@adcp/sdk 6.5.0 → 6.7.0

package/dist/lib/signing/agent-resolver/strict-json.js

@@ -0,0 +1,219 @@
+"use strict";
+/**
+ * Strict JSON parser for the brand_json_url discovery chain. Two hardening
+ * passes the spec mandates that the platform `JSON.parse` does not provide:
+ *
+ *   1. **Duplicate-key rejection.** `JSON.parse('{"a":1,"a":2}')` silently
+ *      keeps the last value. The brand_json_url verifier algorithm
+ *      (security.mdx step 4) requires duplicate-key detection because the
+ *      same trust-root document MUST NOT parse to two different shapes
+ *      across verifiers — that is the parser-differential vector that
+ *      step 14 of the verifier checklist closes on the request body, and
+ *      the same closure applies on the brand.json bootstrap fetch.
+ *
+ *   2. **Prototype-pollution rejection.** Backed by `secure-json-parse` —
+ *      `__proto__` and `constructor` keys raise rather than mutating the
+ *      prototype chain.
+ *
+ * Body cap is enforced by the caller (the SSRF fetch wrapper). This module
+ * works against an already-bounded UTF-8 string. Errors are typed so the
+ * resolver can surface `request_signature_brand_json_malformed` directly.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StrictJsonError = void 0;
+exports.parseStrictJson = parseStrictJson;
+const secure_json_parse_1 = __importDefault(require("secure-json-parse"));
+class StrictJsonError extends Error {
+    code;
+    detail;
+    constructor(code, message, detail = {}) {
+        super(message);
+        this.name = 'StrictJsonError';
+        this.code = code;
+        this.detail = detail;
+    }
+}
+exports.StrictJsonError = StrictJsonError;
+/**
+ * Parse JSON text under the strict rules above. Returns the parsed value on
+ * success; throws `StrictJsonError` on any reject path.
+ *
+ * Implementation: first scan the source for duplicate keys at any object
+ * scope, then hand the source to `secure-json-parse` for prototype-property
+ * rejection and the actual structural parse. Two passes is fine for the
+ * 256 KiB brand.json budget — both are linear, the constant factor is small,
+ * and we never trust the tokenizer to produce the value (it's only a guard).
+ */
+function parseStrictJson(text) {
+    rejectDuplicateKeys(text);
+    try {
+        return secure_json_parse_1.default.parse(text, null, { protoAction: 'error', constructorAction: 'error' });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes('forbidden prototype property')) {
+            throw new StrictJsonError('forbidden_prototype_property', message);
+        }
+        throw new StrictJsonError('invalid_json', message);
+    }
+}
+/**
+ * Walk the source character-by-character and reject when any object scope
+ * declares the same key twice. Comments are not legal JSON, so a `//` or
+ * `/*` inside a string is fine and outside a string would already be a
+ * parse error (caught downstream). This routine only needs to track:
+ *   - whether we are inside a string (with escape handling),
+ *   - the stack of open object scopes (each owning a `Set<string>`),
+ *   - whether the next quoted-string at object scope is the key half of
+ *     a key-value pair.
+ */
+function rejectDuplicateKeys(text) {
+    const stack = [];
+    /** True when at an object scope and the next string token is a key. */
+    let expectingKey = false;
+    let i = 0;
+    const len = text.length;
+    while (i < len) {
+        const ch = text[i];
+        if (ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') {
+            i++;
+            continue;
+        }
+        if (ch === '{') {
+            stack.push({ kind: 'object', keys: new Set() });
+            expectingKey = true;
+            i++;
+            continue;
+        }
+        if (ch === '}') {
+            stack.pop();
+            expectingKey = false;
+            i++;
+            continue;
+        }
+        if (ch === '[') {
+            stack.push({ kind: 'array' });
+            expectingKey = false;
+            i++;
+            continue;
+        }
+        if (ch === ']') {
+            stack.pop();
+            expectingKey = false;
+            i++;
+            continue;
+        }
+        if (ch === ',') {
+            const top = stack[stack.length - 1];
+            expectingKey = top?.kind === 'object';
+            i++;
+            continue;
+        }
+        if (ch === ':') {
+            expectingKey = false;
+            i++;
+            continue;
+        }
+        if (ch === '"') {
+            const { value, end } = readString(text, i);
+            if (expectingKey) {
+                const top = stack[stack.length - 1];
+                if (top?.kind === 'object') {
+                    if (top.keys.has(value)) {
+                        throw new StrictJsonError('duplicate_key', `Duplicate key "${value}" at offset ${i}`, {
+                            offset: i,
+                            key: value,
+                        });
+                    }
+                    top.keys.add(value);
+                }
+            }
+            i = end;
+            continue;
+        }
+        // Any other character is part of a primitive (number, true/false/null);
+        // skip until we hit whitespace, structural punctuation, or end of input.
+        while (i < len) {
+            const c = text[i];
+            if (c === ',' || c === '}' || c === ']' || c === ' ' || c === '\t' || c === '\n' || c === '\r')
+                break;
+            i++;
+        }
+    }
+}
+function readString(text, start) {
+    // text[start] is the opening quote.
+    let i = start + 1;
+    let out = '';
+    const len = text.length;
+    while (i < len) {
+        const ch = text[i];
+        if (ch === '"') {
+            return { value: out, end: i + 1 };
+        }
+        // RFC 8259 §7: unescaped control characters (U+0000–U+001F) are forbidden
+        // inside JSON strings. The platform `JSON.parse` would reject them; the
+        // tokenizer must reject them too so its accepted dialect tracks JSON's
+        // (otherwise an attacker who can inject a literal control char into a
+        // brand.json key smuggles a key that the tokenizer dedupes but the
+        // parser rejects, decoupling our two passes).
+        if (ch.charCodeAt(0) < 0x20) {
+            throw new StrictJsonError('invalid_json', `Unescaped control character at offset ${i} (RFC 8259 §7)`, {
+                offset: i,
+            });
+        }
+        if (ch === '\\') {
+            const next = text[i + 1];
+            if (next === undefined) {
+                throw new StrictJsonError('invalid_json', `Unterminated escape at offset ${i}`, { offset: i });
+            }
+            if (next === '"' || next === '\\' || next === '/') {
+                out += next;
+                i += 2;
+                continue;
+            }
+            if (next === 'b') {
+                out += '\b';
+                i += 2;
+                continue;
+            }
+            if (next === 'f') {
+                out += '\f';
+                i += 2;
+                continue;
+            }
+            if (next === 'n') {
+                out += '\n';
+                i += 2;
+                continue;
+            }
+            if (next === 'r') {
+                out += '\r';
+                i += 2;
+                continue;
+            }
+            if (next === 't') {
+                out += '\t';
+                i += 2;
+                continue;
+            }
+            if (next === 'u') {
+                const hex = text.slice(i + 2, i + 6);
+                if (hex.length !== 4 || /[^0-9a-fA-F]/.test(hex)) {
+                    throw new StrictJsonError('invalid_json', `Invalid unicode escape at offset ${i}`, { offset: i });
+                }
+                out += String.fromCharCode(parseInt(hex, 16));
+                i += 6;
+                continue;
+            }
+            throw new StrictJsonError('invalid_json', `Invalid escape \\${next} at offset ${i}`, { offset: i });
+        }
+        out += ch;
+        i++;
+    }
+    throw new StrictJsonError('invalid_json', `Unterminated string starting at offset ${start}`, { offset: start });
+}
+//# sourceMappingURL=strict-json.js.map

package/dist/lib/signing/agent-resolver/strict-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strict-json.js","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/strict-json.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;AA2BH,0CAWC;AApCD,0EAAoC;AAIpC,MAAa,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAsB;IAC1B,MAAM,CAAoC;IACnD,YAAY,IAAyB,EAAE,OAAe,EAAE,SAA4C,EAAE;QACpG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AATD,0CASC;AAED;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,IAAY;IAC1C,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,2BAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,mBAAmB,CAAC,IAAY;IAEvC,MAAM,KAAK,GAAY,EAAE,CAAC;IAC1B,uEAAuE;IACvE,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IAExB,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC5D,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC,CAAC;YACxD,YAAY,GAAG,IAAI,CAAC;YACpB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,YAAY,GAAG,KAAK,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9B,YAAY,GAAG,KAAK,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,CAAC,GAAG,EAAE,CAAC;YACZ,YAAY,GAAG,KAAK,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACpC,YAAY,GAAG,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC;YACtC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,YAAY,GAAG,KAAK,CAAC;YACrB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3C,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACpC,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACxB,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,kBAAkB,KAAK,eAAe,CAAC,EAAE,EAAE;4BACpF,MAAM,EAAE,CAAC;4BACT,GAAG,EAAE,KAAK;yBACX,CAAC,CAAC;oBACL,CAAC;oBACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,CAAC,GAAG,GAAG,CAAC;YACR,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;gBAAE,MAAM;YACtG,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,oCAAoC;IACpC,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,8CAA8C;QAC9C,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,yCAAyC,CAAC,gBAAgB,EAAE;gBACpG,MAAM,EAAE,CAAC;aACV,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,iCAAiC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAClD,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,oCAAoC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;gBACpG,CAAC;gBACD,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9C,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,oBAAoB,IAAI,cAAc,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACN,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,0CAA0C,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAClH,CAAC"}

package/dist/lib/signing/capability-priming.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-priming.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/capability-priming.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D;;;;GAIG;AACH,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAErD,KAAK,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAyFpE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,mBAAmB,EACnC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,gBAAgB,CAAC,CAoC3B"}
+{"version":3,"file":"capability-priming.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/capability-priming.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI3D;;;;GAIG;AACH,eAAO,MAAM,aAAa,0BAA0B,CAAC;AAErD,KAAK,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAoCpE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,mBAAmB,EACnC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,gBAAgB,CAAC,CAoC3B"}

package/dist/lib/signing/capability-priming.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CAPABILITY_OP = void 0;
 exports.ensureCapabilityLoaded = ensureCapabilityLoaded;
+const protocol_response_1 = require("./protocol-response");
 /**
  * Op name used to fetch the seller's capability advertisement. The signing
  * wrapper short-circuits on this op so the priming request itself is never
@@ -18,7 +19,7 @@ exports.CAPABILITY_OP = 'get_adcp_capabilities';
  *   - Already-unwrapped payload — returned as-is.
  */
 function extractCapability(response) {
-    const payload = unwrapResponse(response);
+    const payload = (0, protocol_response_1.unwrapProtocolResponse)(response);
     if (!payload || typeof payload !== 'object')
         return { requestSigning: undefined, adcpVersion: undefined };
     const body = payload;
@@ -28,60 +29,6 @@ function extractCapability(response) {
     const adcpVersion = versions && versions.length > 0 && typeof versions[0] === 'number' ? versions[0] : undefined;
     return { requestSigning, adcpVersion };
 }
-function unwrapResponse(response) {
-    if (!response || typeof response !== 'object')
-        return response;
-    const r = response;
-    // MCP CallToolResult — structuredContent wins when present.
-    if (r.structuredContent && typeof r.structuredContent === 'object')
-        return r.structuredContent;
-    // MCP CallToolResult — content[].text parsed as JSON.
-    const content = r.content;
-    if (Array.isArray(content)) {
-        for (const chunk of content) {
-            if (chunk && typeof chunk === 'object' && typeof chunk.text === 'string') {
-                try {
-                    return JSON.parse(chunk.text);
-                }
-                catch {
-                    // non-JSON text chunk — keep looking
-                }
-            }
-        }
-    }
-    // A2A JSON-RPC response — .result is the Task or Message.
-    const result = r.result;
-    if (result && typeof result === 'object') {
-        // A2A Task: artifacts[0].parts[0].data carries the AdCP payload.
-        const artifacts = result.artifacts;
-        if (Array.isArray(artifacts)) {
-            for (const artifact of artifacts) {
-                const parts = artifact.parts;
-                const data = findFirstDataPart(parts);
-                if (data)
-                    return data;
-            }
-        }
-        // A2A Message: parts[0].data directly on the result.
-        const parts = result.parts;
-        const data = findFirstDataPart(parts);
-        if (data)
-            return data;
-    }
-    return response;
-}
-function findFirstDataPart(parts) {
-    if (!Array.isArray(parts))
-        return undefined;
-    for (const part of parts) {
-        if (part && typeof part === 'object') {
-            const p = part;
-            if (p.kind === 'data' && p.data && typeof p.data === 'object')
-                return p.data;
-        }
-    }
-    return undefined;
-}
 /**
  * Refresh window applied to a negative-cache entry written after a failed
  * discovery call. 60s is short enough that a transient seller outage

package/dist/lib/signing/capability-priming.js.map

@@ -1 +1 @@
-{"version":3,"file":"capability-priming.js","sourceRoot":"","sources":["../../../src/lib/signing/capability-priming.ts"],"names":[],"mappings":";;;AAsHA,wDAwCC;AAzJD;;;;GAIG;AACU,QAAA,aAAa,GAAG,uBAAuB,CAAC;AAIrD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,QAAiB;IAI1C,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAE1G,MAAM,IAAI,GAAG,OAAkC,CAAC;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,eAAiD,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAgD,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAE,IAAK,CAAC,cAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,WAAW,GACf,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3G,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,cAAc,CAAC,QAAiB;IACvC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/D,MAAM,CAAC,GAAG,QAAmC,CAAC;IAE9C,4DAA4D;IAC5D,IAAI,CAAC,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,iBAAiB,CAAC;IAE/F,sDAAsD;IACtD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAa,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClF,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAE,KAAa,CAAC,IAAI,CAAC,CAAC;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACP,qCAAqC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,iEAAiE;QACjE,MAAM,SAAS,GAAI,MAAkC,CAAC,SAAS,CAAC;QAChE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAI,QAAgC,CAAC,KAAK,CAAC;gBACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QACD,qDAAqD;QACrD,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAC;QACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAA0C,CAAC;YACrD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,sBAAsB,CAC1C,MAAmB,EACnB,cAAmC,EACnC,QAAkB;IAElB,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1D,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAC;SACzB,IAAI,CAAC,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAqB;YAC9B,cAAc;YACd,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACzC,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAqB;YAC9B,cAAc,EAAE,SAAS;YACzB,WAAW,EAAE,SAAS;YACtB,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,GAAG,GAAG,0BAA0B;SAC1C,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"capability-priming.js","sourceRoot":"","sources":["../../../src/lib/signing/capability-priming.ts"],"names":[],"mappings":";;;AAkEA,wDAwCC;AAvGD,2DAA6D;AAG7D;;;;GAIG;AACU,QAAA,aAAa,GAAG,uBAAuB,CAAC;AAIrD;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,QAAiB;IAI1C,MAAM,OAAO,GAAG,IAAA,0CAAsB,EAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAE1G,MAAM,IAAI,GAAG,OAAkC,CAAC;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,eAAiD,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAgD,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAE,IAAK,CAAC,cAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,WAAW,GACf,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3G,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC;;;;;;;;;;;;;;;;GAgBG;AACI,KAAK,UAAU,sBAAsB,CAC1C,MAAmB,EACnB,cAAmC,EACnC,QAAkB;IAElB,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1D,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAC;SACzB,IAAI,CAAC,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAqB;YAC9B,cAAc;YACd,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACzC,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAqB;YAC9B,cAAc,EAAE,SAAS;YACzB,WAAW,EAAE,SAAS;YACtB,SAAS,EAAE,GAAG;YACd,OAAO,EAAE,GAAG,GAAG,0BAA0B;SAC1C,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,OAAO,CAAC,GAAG,EAAE;QACZ,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEL,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/signing/protocol-response.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Unwrap the AdCP payload from a protocol-level response. Both the
+ * capability-priming flow and the agent-URL-bootstrap discovery chain need
+ * to peel a `get_adcp_capabilities` response back to its plain-object body
+ * regardless of which transport delivered it:
+ *
+ *   - MCP `CallToolResult` — `structuredContent` wins when present;
+ *     otherwise the first `content[].text` chunk is parsed as JSON.
+ *   - A2A JSON-RPC `SendMessageResponse` — `result` is a `Task` (with
+ *     `artifacts[].parts[].data`) or a `Message` (with `parts[].data`).
+ *   - Already-unwrapped payload — returned as-is.
+ *
+ * Lives in its own module so the two callers (`capability-priming` and
+ * `agent-resolver`) share one source of truth instead of forking the
+ * envelope walk.
+ */
+export declare function unwrapProtocolResponse(response: unknown): unknown;
+//# sourceMappingURL=protocol-response.d.ts.map

package/dist/lib/signing/protocol-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-response.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/protocol-response.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAmCjE"}

package/dist/lib/signing/protocol-response.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * Unwrap the AdCP payload from a protocol-level response. Both the
+ * capability-priming flow and the agent-URL-bootstrap discovery chain need
+ * to peel a `get_adcp_capabilities` response back to its plain-object body
+ * regardless of which transport delivered it:
+ *
+ *   - MCP `CallToolResult` — `structuredContent` wins when present;
+ *     otherwise the first `content[].text` chunk is parsed as JSON.
+ *   - A2A JSON-RPC `SendMessageResponse` — `result` is a `Task` (with
+ *     `artifacts[].parts[].data`) or a `Message` (with `parts[].data`).
+ *   - Already-unwrapped payload — returned as-is.
+ *
+ * Lives in its own module so the two callers (`capability-priming` and
+ * `agent-resolver`) share one source of truth instead of forking the
+ * envelope walk.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unwrapProtocolResponse = unwrapProtocolResponse;
+function unwrapProtocolResponse(response) {
+    if (!response || typeof response !== 'object')
+        return response;
+    const r = response;
+    if (r.structuredContent && typeof r.structuredContent === 'object')
+        return r.structuredContent;
+    const content = r.content;
+    if (Array.isArray(content)) {
+        for (const chunk of content) {
+            if (chunk && typeof chunk === 'object' && typeof chunk.text === 'string') {
+                try {
+                    return JSON.parse(chunk.text);
+                }
+                catch {
+                    // non-JSON text chunk — keep looking
+                }
+            }
+        }
+    }
+    const result = r.result;
+    if (result && typeof result === 'object') {
+        const artifacts = result.artifacts;
+        if (Array.isArray(artifacts)) {
+            for (const artifact of artifacts) {
+                const parts = artifact.parts;
+                const data = findFirstDataPart(parts);
+                if (data)
+                    return data;
+            }
+        }
+        const parts = result.parts;
+        const data = findFirstDataPart(parts);
+        if (data)
+            return data;
+    }
+    return response;
+}
+function findFirstDataPart(parts) {
+    if (!Array.isArray(parts))
+        return undefined;
+    for (const part of parts) {
+        if (part && typeof part === 'object') {
+            const p = part;
+            if (p.kind === 'data' && p.data && typeof p.data === 'object')
+                return p.data;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=protocol-response.js.map

package/dist/lib/signing/protocol-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-response.js","sourceRoot":"","sources":["../../../src/lib/signing/protocol-response.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAEH,wDAmCC;AAnCD,SAAgB,sBAAsB,CAAC,QAAiB;IACtD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/D,MAAM,CAAC,GAAG,QAAmC,CAAC;IAE9C,IAAI,CAAC,CAAC,iBAAiB,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,iBAAiB,CAAC;IAE/F,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjG,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAE,KAA0B,CAAC,IAAI,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,qCAAqC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,SAAS,GAAI,MAAkC,CAAC,SAAS,CAAC;QAChE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAI,QAAgC,CAAC,KAAK,CAAC;gBACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC;YACxB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAC;QACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAA0C,CAAC;YACrD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/signing/server.d.ts

@@ -24,4 +24,5 @@ export { ALLOWED_ALGS, CLOCK_SKEW_TOLERANCE_SECONDS, MANDATORY_COMPONENTS, MAX_S
 export { verifyRequestSignature, type VerifyRequestOptions } from './verifier';
 export { createWebhookVerifier, verifyWebhookSignature, WEBHOOK_MANDATORY_COMPONENTS, WEBHOOK_SIGNING_TAG, type CreateWebhookVerifierOptions, type VerifyWebhookOptions, type VerifyWebhookResult, } from './webhook-verifier';
 export { createExpressVerifier, type ExpressLike, type ExpressMiddlewareOptions } from './middleware';
+export { resolveAgent, getAgentJwks, createAgentJwksSet, AgentResolverError, attackerInfluencedFields, ATTACKER_INFLUENCED, readBrandJsonUrl, readIdentityPosture, type AgentResolution, type AgentProtocol, type AgentResolverErrorCode, type AgentResolverErrorDetail, type AgentEntry, type AgentJwksResult, type CapabilitiesWithBrandJsonUrl, type CreateAgentJwksSetOptions, type FetchCapabilitiesFn, type GetAgentJwksOptions, type IdentityKeyOriginPurpose, type IdentityKeyOrigins, type IdentityPosture, type ResolveAgentOptions, type TraceStep, } from './agent-resolver';
 //# sourceMappingURL=server.d.ts.map

package/dist/lib/signing/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,GAC/B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,GAChC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChH,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,KAAK,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EACL,YAAY,EACZ,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC5B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,sBAAsB,EAAE,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,qBAAqB,EACrB,KAAK,yBAAyB,GAC/B,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,GAChC,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAChH,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,KAAK,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC5F,OAAO,EACL,YAAY,EACZ,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC5B,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,sBAAsB,EAAE,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,EACnB,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACtG,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,EAC9B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,SAAS,GACf,MAAM,kBAAkB,CAAC"}

package/dist/lib/signing/server.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createExpressVerifier = exports.WEBHOOK_SIGNING_TAG = exports.WEBHOOK_MANDATORY_COMPONENTS = exports.verifyWebhookSignature = exports.createWebhookVerifier = exports.verifyRequestSignature = exports.REQUEST_SIGNING_TAG = exports.MAX_SIGNATURE_WINDOW_SECONDS = exports.MANDATORY_COMPONENTS = exports.CLOCK_SKEW_TOLERANCE_SECONDS = exports.ALLOWED_ALGS = exports.HttpsRevocationStore = exports.InMemoryRevocationStore = exports.sweepExpiredReplays = exports.getReplayStoreMigration = exports.REPLAY_CACHE_MIGRATION = exports.PostgresReplayStore = exports.InMemoryReplayStore = exports.parseSignatureInput = exports.parseSignature = exports.BrandJsonResolverError = exports.BrandJsonJwksResolver = exports.HttpsJwksResolver = exports.StaticJwksResolver = exports.WebhookSignatureError = exports.RequestSignatureError = exports.verifySignature = exports.jwkToPublicKey = exports.parseContentDigest = exports.contentDigestMatches = exports.computeContentDigest = exports.getHeaderValue = exports.formatSignatureParams = exports.canonicalTargetUri = exports.canonicalMethod = exports.canonicalAuthority = exports.buildSignatureBase = void 0;
+exports.readIdentityPosture = exports.readBrandJsonUrl = exports.ATTACKER_INFLUENCED = exports.attackerInfluencedFields = exports.AgentResolverError = exports.createAgentJwksSet = exports.getAgentJwks = exports.resolveAgent = exports.createExpressVerifier = exports.WEBHOOK_SIGNING_TAG = exports.WEBHOOK_MANDATORY_COMPONENTS = exports.verifyWebhookSignature = exports.createWebhookVerifier = exports.verifyRequestSignature = exports.REQUEST_SIGNING_TAG = exports.MAX_SIGNATURE_WINDOW_SECONDS = exports.MANDATORY_COMPONENTS = exports.CLOCK_SKEW_TOLERANCE_SECONDS = exports.ALLOWED_ALGS = exports.HttpsRevocationStore = exports.InMemoryRevocationStore = exports.sweepExpiredReplays = exports.getReplayStoreMigration = exports.REPLAY_CACHE_MIGRATION = exports.PostgresReplayStore = exports.InMemoryReplayStore = exports.parseSignatureInput = exports.parseSignature = exports.BrandJsonResolverError = exports.BrandJsonJwksResolver = exports.HttpsJwksResolver = exports.StaticJwksResolver = exports.WebhookSignatureError = exports.RequestSignatureError = exports.verifySignature = exports.jwkToPublicKey = exports.parseContentDigest = exports.contentDigestMatches = exports.computeContentDigest = exports.getHeaderValue = exports.formatSignatureParams = exports.canonicalTargetUri = exports.canonicalMethod = exports.canonicalAuthority = exports.buildSignatureBase = void 0;
 /**
  * Server-side signing surface: what a seller running an AdCP agent needs to
  * verify inbound RFC 9421 signatures — verifier pipeline, Express-shaped
@@ -64,4 +64,13 @@ Object.defineProperty(exports, "WEBHOOK_MANDATORY_COMPONENTS", { enumerable: tru
 Object.defineProperty(exports, "WEBHOOK_SIGNING_TAG", { enumerable: true, get: function () { return webhook_verifier_1.WEBHOOK_SIGNING_TAG; } });
 var middleware_1 = require("./middleware");
 Object.defineProperty(exports, "createExpressVerifier", { enumerable: true, get: function () { return middleware_1.createExpressVerifier; } });
+var agent_resolver_1 = require("./agent-resolver");
+Object.defineProperty(exports, "resolveAgent", { enumerable: true, get: function () { return agent_resolver_1.resolveAgent; } });
+Object.defineProperty(exports, "getAgentJwks", { enumerable: true, get: function () { return agent_resolver_1.getAgentJwks; } });
+Object.defineProperty(exports, "createAgentJwksSet", { enumerable: true, get: function () { return agent_resolver_1.createAgentJwksSet; } });
+Object.defineProperty(exports, "AgentResolverError", { enumerable: true, get: function () { return agent_resolver_1.AgentResolverError; } });
+Object.defineProperty(exports, "attackerInfluencedFields", { enumerable: true, get: function () { return agent_resolver_1.attackerInfluencedFields; } });
+Object.defineProperty(exports, "ATTACKER_INFLUENCED", { enumerable: true, get: function () { return agent_resolver_1.ATTACKER_INFLUENCED; } });
+Object.defineProperty(exports, "readBrandJsonUrl", { enumerable: true, get: function () { return agent_resolver_1.readBrandJsonUrl; } });
+Object.defineProperty(exports, "readIdentityPosture", { enumerable: true, get: function () { return agent_resolver_1.readIdentityPosture; } });
 //# sourceMappingURL=server.js.map

package/dist/lib/signing/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/lib/signing/server.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,+CASwB;AARtB,kHAAA,kBAAkB,OAAA;AAClB,kHAAA,kBAAkB,OAAA;AAClB,+GAAA,eAAe,OAAA;AACf,kHAAA,kBAAkB,OAAA;AAClB,qHAAA,qBAAqB,OAAA;AACrB,8GAAA,cAAc,OAAA;AAIhB,mDAAkG;AAAzF,sHAAA,oBAAoB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAAE,oHAAA,kBAAkB,OAAA;AACvE,mCAA2D;AAAlD,wGAAA,cAAc,OAAA;AAAE,yGAAA,eAAe,OAAA;AACxC,mCAKkB;AAJhB,+GAAA,qBAAqB,OAAA;AAErB,+GAAA,qBAAqB,OAAA;AAGvB,+BAA+D;AAAtD,0GAAA,kBAAkB,OAAA;AAC3B,2CAAgF;AAAvE,+GAAA,iBAAiB,OAAA;AAC1B,2CAMsB;AALpB,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AAKxB,mCAAgH;AAAvG,wGAAA,cAAc,OAAA;AAAE,6GAAA,mBAAmB,OAAA;AAC5C,mCAKkB;AAJhB,6GAAA,mBAAmB,OAAA;AAKrB,iEAOiC;AAN/B,4HAAA,mBAAmB,OAAA;AACnB,+HAAA,sBAAsB,OAAA;AACtB,gIAAA,uBAAuB,OAAA;AACvB,4HAAA,mBAAmB,OAAA;AAIrB,2CAA6E;AAApE,qHAAA,uBAAuB,OAAA;AAChC,uDAA4F;AAAnF,wHAAA,oBAAoB,OAAA;AAC7B,iCAYiB;AAXf,qGAAA,YAAY,OAAA;AACZ,qHAAA,4BAA4B,OAAA;AAC5B,6GAAA,oBAAoB,OAAA;AACpB,qHAAA,4BAA4B,OAAA;AAC5B,4GAAA,mBAAmB,OAAA;AAQrB,uCAA+E;AAAtE,kHAAA,sBAAsB,OAAA;AAC/B,uDAQ4B;AAP1B,yHAAA,qBAAqB,OAAA;AACrB,0HAAA,sBAAsB,OAAA;AACtB,gIAAA,4BAA4B,OAAA;AAC5B,uHAAA,mBAAmB,OAAA;AAKrB,2CAAsG;AAA7F,mHAAA,qBAAqB,OAAA"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/lib/signing/server.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,+CASwB;AARtB,kHAAA,kBAAkB,OAAA;AAClB,kHAAA,kBAAkB,OAAA;AAClB,+GAAA,eAAe,OAAA;AACf,kHAAA,kBAAkB,OAAA;AAClB,qHAAA,qBAAqB,OAAA;AACrB,8GAAA,cAAc,OAAA;AAIhB,mDAAkG;AAAzF,sHAAA,oBAAoB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAAE,oHAAA,kBAAkB,OAAA;AACvE,mCAA2D;AAAlD,wGAAA,cAAc,OAAA;AAAE,yGAAA,eAAe,OAAA;AACxC,mCAKkB;AAJhB,+GAAA,qBAAqB,OAAA;AAErB,+GAAA,qBAAqB,OAAA;AAGvB,+BAA+D;AAAtD,0GAAA,kBAAkB,OAAA;AAC3B,2CAAgF;AAAvE,+GAAA,iBAAiB,OAAA;AAC1B,2CAMsB;AALpB,mHAAA,qBAAqB,OAAA;AACrB,oHAAA,sBAAsB,OAAA;AAKxB,mCAAgH;AAAvG,wGAAA,cAAc,OAAA;AAAE,6GAAA,mBAAmB,OAAA;AAC5C,mCAKkB;AAJhB,6GAAA,mBAAmB,OAAA;AAKrB,iEAOiC;AAN/B,4HAAA,mBAAmB,OAAA;AACnB,+HAAA,sBAAsB,OAAA;AACtB,gIAAA,uBAAuB,OAAA;AACvB,4HAAA,mBAAmB,OAAA;AAIrB,2CAA6E;AAApE,qHAAA,uBAAuB,OAAA;AAChC,uDAA4F;AAAnF,wHAAA,oBAAoB,OAAA;AAC7B,iCAYiB;AAXf,qGAAA,YAAY,OAAA;AACZ,qHAAA,4BAA4B,OAAA;AAC5B,6GAAA,oBAAoB,OAAA;AACpB,qHAAA,4BAA4B,OAAA;AAC5B,4GAAA,mBAAmB,OAAA;AAQrB,uCAA+E;AAAtE,kHAAA,sBAAsB,OAAA;AAC/B,uDAQ4B;AAP1B,yHAAA,qBAAqB,OAAA;AACrB,0HAAA,sBAAsB,OAAA;AACtB,gIAAA,4BAA4B,OAAA;AAC5B,uHAAA,mBAAmB,OAAA;AAKrB,2CAAsG;AAA7F,mHAAA,qBAAqB,OAAA;AAC9B,mDAwB0B;AAvBxB,8GAAA,YAAY,OAAA;AACZ,8GAAA,YAAY,OAAA;AACZ,oHAAA,kBAAkB,OAAA;AAClB,oHAAA,kBAAkB,OAAA;AAClB,0HAAA,wBAAwB,OAAA;AACxB,qHAAA,mBAAmB,OAAA;AACnB,kHAAA,gBAAgB,OAAA;AAChB,qHAAA,mBAAmB,OAAA"}

package/dist/lib/signing/testing.d.ts

@@ -1,5 +1,6 @@
 import type { SigningProvider } from './provider';
 import type { SignerKey } from './signer';
+import type { AdcpUse } from './jwks-helpers';
 import type { AdcpJsonWebKey, AdcpSignAlg } from './types';
 /**
  * Environment variable that lets operators acknowledge an in-memory signer
@@ -42,4 +43,67 @@ export declare class InMemorySigningProvider implements SigningProvider {
  * without rewriting key-load logic.
  */
 export declare function signerKeyToProvider(key: SignerKey): SigningProvider;
+export interface EphemeralEd25519Key {
+    /** The `kid` embedded in both JWKs. */
+    kid: string;
+    /**
+     * AdCP wire-format algorithm identifier — pass directly to
+     * `InMemorySigningProvider({ algorithm })`. Always `'ed25519'` today;
+     * typed as `AdcpSignAlg` so callers don't hardcode a string literal.
+     */
+    algorithm: AdcpSignAlg;
+    /** Public JWK — publish at `/.well-known/jwks.json` or pass to JWKS discovery. */
+    publicKey: AdcpJsonWebKey;
+    /**
+     * Private JWK with `d` scalar. Pass to
+     * `new InMemorySigningProvider({ keyid, algorithm, privateKey })`.
+     * Never publish this value.
+     */
+    privateKey: AdcpJsonWebKey;
+}
+export interface MintEphemeralEd25519KeyOptions {
+    /**
+     * Stable key ID embedded in both JWKs. Defaults to a random UUID so each
+     * call produces a unique kid. Pass a stable value for deterministic IDs
+     * across test restarts — the `keyid` passed to `InMemorySigningProvider`
+     * must match the `kid` in the published public JWK.
+     */
+    kid?: string;
+    /**
+     * AdCP purpose binding tagged on both JWKs.
+     * - `'webhook-signing'` (default) — outbound webhook callbacks.
+     * - `'request-signing'` — buyer-to-seller signed requests (AdCP step 8).
+     *
+     * For production request-signing keys use `pemToAdcpJwk()` or a KMS-backed
+     * `SigningProvider` instead.
+     */
+    adcp_use?: AdcpUse;
+}
+/**
+ * Mint an ephemeral Ed25519 keypair as `AdcpJsonWebKey` pairs, ready for
+ * dev/test signing.
+ *
+ * Handles the Node `KeyObject.export({ format: 'jwk' })` → `AdcpJsonWebKey`
+ * reshape: Node's `JsonWebKey` has `kty?: string` (optional), while
+ * `AdcpJsonWebKey` requires `kty: string`. Without this helper, callers must
+ * write a manual spread + non-null assertion on every key-generation site —
+ * easy to typo on the most critical JWK field.
+ *
+ * Both JWKs are tagged with the correct AdCP fields:
+ * - `alg: 'EdDSA'` — JOSE algorithm name required by AdCP verifiers (step 8).
+ * - `use: 'sig'` — RFC 7517 §4.2 intent hint.
+ * - `adcp_use` — AdCP purpose binding; enforced at step 8. Defaults to
+ *   `'webhook-signing'`; pass `'request-signing'` for buyer-to-seller keys.
+ * - `key_ops`: `['verify']` on `publicKey`, `['sign']` on `privateKey`.
+ *
+ * Usage with {@link InMemorySigningProvider}:
+ * ```ts
+ * import { mintEphemeralEd25519Key, InMemorySigningProvider } from '@adcp/sdk/signing/testing';
+ *
+ * const { kid, algorithm, privateKey, publicKey } = await mintEphemeralEd25519Key();
+ * const provider = new InMemorySigningProvider({ keyid: kid, algorithm, privateKey });
+ * // Publish publicKey in your /.well-known/jwks.json `keys` array.
+ * ```
+ */
+export declare function mintEphemeralEd25519Key(opts?: MintEphemeralEd25519KeyOptions): Promise<EphemeralEd25519Key>;
 //# sourceMappingURL=testing.d.ts.map

package/dist/lib/signing/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/testing.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AAExE,MAAM,WAAW,8BAA8B;IAC7C,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,SAAS,EAAE,WAAW,CAAC;IACvB,4CAA4C;IAC5C,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;gBAEhC,OAAO,EAAE,8BAA8B;IAgC7C,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAQrD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,GAAG,eAAe,CAMnE"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/testing.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AAExE,MAAM,WAAW,8BAA8B;IAC7C,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,SAAS,EAAE,WAAW,CAAC;IACvB,4CAA4C;IAC5C,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;gBAEhC,OAAO,EAAE,8BAA8B;IAgC7C,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAQrD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,GAAG,eAAe,CAMnE;AAED,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,EAAE,WAAW,CAAC;IACvB,kFAAkF;IAClF,SAAS,EAAE,cAAc,CAAC;IAC1B;;;;OAIG;IACH,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE,8BAA8B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoCjH"}