@adcp/sdk 8.1.0-beta.13 → 8.1.0-beta.14

package/dist/lib/signing/signer.d.ts

@@ -1,4 +1,4 @@
-import { type RequestLike, type ResponseLike, type SignatureParams } from './canonicalize';
+import { type RequestLike, type SignatureParams } from './canonicalize';
 import type { AdcpUse } from './jwks-helpers';
 import { type AdcpJsonWebKey, type AdcpSignAlg } from './types';
 export interface SignerKey {
@@ -8,7 +8,6 @@ export interface SignerKey {
      * Private JWK. MUST carry `adcp_use` matching the helper being called:
      * - `signRequest` requires `adcp_use: 'request-signing'`
      * - `signWebhook` requires `adcp_use: 'webhook-signing'`
-     * - `signResponse` requires `adcp_use: 'response-signing'`
      *
      * Mismatched or missing `adcp_use` throws at the signer with the same
      * error code the verifier raises at step 8 — failure surfaces at
@@ -47,12 +46,12 @@ type Rfc9421AdcpUse = Exclude<AdcpUse, 'governance-signing'>;
  * is skipped — preserves backward compat with adapters that pre-date the
  * `SigningProvider.adcpUse` field. Adapter authors who want signer-side
  * defense-in-depth set `adcpUse` on their provider; the async helpers
- * (`signRequestAsync` / `signWebhookAsync` / `signResponseAsync`) then
- * enforce the binding parallel to the sync path.
+ * (`signRequestAsync` / `signWebhookAsync`) then enforce the binding
+ * parallel to the sync path.
  */
 declare function assertProviderPurpose(provider: {
     readonly keyid: string;
-    readonly adcpUse?: AdcpUse;
+    readonly adcpUse?: string;
 }, expected: Rfc9421AdcpUse): void;
 export { assertProviderPurpose };
 export interface SignRequestOptions {
@@ -154,110 +153,4 @@ export declare function prepareWebhookSignature(request: RequestLike, identity:
  * conformant webhooks should use this instead of hand-rolling signatures.
  */
 export declare function signWebhook(request: RequestLike, key: SignerKey, options?: SignWebhookOptions): SignedRequest;
-export interface SignResponseOptions {
-    /**
-     * Cover a `Content-Digest` of the response body. Defaults to `true` when
-     * the response has a body.
-     *
-     * **Asymmetric with `signRequest`.** Request signing defaults to opt-in
-     * (`coverContentDigest: true` required to cover); response signing
-     * defaults to opt-out because an unbound body is the most common
-     * cross-purpose footgun for response signing — without a body digest,
-     * an attacker that can swap the payload but preserve headers can pass
-     * the signature check. The asymmetry is deliberate; callers that want
-     * to omit (e.g. when an upstream proxy computes the digest) pass
-     * `false` explicitly.
-     */
-    coverContentDigest?: boolean;
-    /**
-     * Additional derived/header components to cover beyond
-     * {@link RESPONSE_MANDATORY_COMPONENTS}. The defaults already include
-     * `@status`, `@authority`, and `@target-uri`. Use this for `@method`
-     * (uncommon for responses — request method is usually implicit) or for
-     * custom headers (`x-content-type-options`, etc.).
-     */
-    additionalComponents?: ReadonlyArray<string>;
-    label?: string;
-    windowSeconds?: number;
-    now?: () => number;
-    nonce?: string;
-    /**
-     * Override the signature tag. Defaults to `adcp/response-signing/v1`.
-     * Exposed so test suites can pin a wrong tag to exercise receiver
-     * rejection paths without mutating the signed headers post-hoc.
-     */
-    tag?: string;
-}
-export interface SignedResponse {
-    status: number;
-    headers: Record<string, string>;
-    signatureBase: string;
-    params: SignatureParams;
-}
-/**
- * Result of canonicalizing a response for signing — everything `signResponse`
- * and `signResponseAsync` produce up to (but not including) the call into
- * the signer/provider.
- */
-export interface PreparedResponseSignature {
-    status: number;
-    components: string[];
-    params: SignatureParams;
-    /**
-     * Outbound response headers including `Content-Digest` when covered, but
-     * not yet including `Signature-Input` / `Signature` — those are appended
-     * by {@link finalizeResponseSignature}.
-     */
-    headers: Record<string, string>;
-    /** Canonical signature base bytes (UTF-8). Pass to the signer/provider. */
-    base: string;
-    label: string;
-}
-/**
- * Canonicalize a response for RFC 9421 response-signing (§2.2.9). Pure
- * (no I/O); shared between sync `signResponse` and async `signResponseAsync`
- * so canonicalization can't drift between them. Covers
- * {@link RESPONSE_MANDATORY_COMPONENTS} by default; adds `content-type` +
- * `content-digest` automatically when the response carries a body. Callers
- * can extend the covered set via
- * {@link SignResponseOptions.additionalComponents}.
- *
- * **No purpose-binding gate** — same caveat as
- * {@link prepareRequestSignature}. The convenience helper `signResponse`
- * runs `assertKeyPurpose` before calling this.
- */
-export declare function prepareResponseSignature(response: ResponseLike, identity: SignatureIdentity, options?: SignResponseOptions): PreparedResponseSignature;
-/**
- * Attach `Signature` / `Signature-Input` headers given the bytes returned
- * by the signer/provider. Mirrors {@link finalizeRequestSignature} but
- * returns a {@link SignedResponse} that carries the response status alongside
- * the stamped headers so the caller can hand the whole object back to its
- * HTTP layer.
- */
-export declare function finalizeResponseSignature(prepared: PreparedResponseSignature, signature: Uint8Array): SignedResponse;
-/**
- * Sign an outbound response under the RFC 9421 response-signing profile
- * (`tag=adcp/response-signing/v1`). Covers `@status` and `@authority` by
- * default, plus `content-type` + `content-digest` when a body is present.
- * Servers emitting signed responses (e.g. seller agents whose clients
- * verify `get_products` payloads before parsing) should use this instead
- * of hand-rolling signatures.
- *
- * Returns headers as a plain `Record<string, string>` for direct use with
- * Express (`res.set(signed.headers)`). For Fetch / Node `Response` (where
- * the headers object is immutable on construction), spread into the
- * `Headers` constructor or `setHeader` loop:
- *
- * ```ts
- * // Express
- * res.status(signed.status).set(signed.headers).send(body);
- *
- * // Fetch / Workers / Node 20+ Response
- * return new Response(body, { status: signed.status, headers: signed.headers });
- *
- * // Node `http.ServerResponse`
- * res.writeHead(signed.status, signed.headers).end(body);
- * ```
- */
-export declare function signResponse(response: ResponseLike, key: SignerKey, options?: SignResponseOptions): SignedResponse;
 //# sourceMappingURL=signer.d.ts.map

package/dist/lib/signing/signer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/signer.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,SAAS,CAAC;AAGjB,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,SAAS,GAAG,mBAAmB,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;GAOG;AACH,KAAK,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAM7D;;;;;;;;;;GAUG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAChE,QAAQ,EAAE,cAAc,GACvB,IAAI,CAGN;AA0BD,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,eAAe,CAAC;IACxB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,wBAAwB,CA8B1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB,EAAE,SAAS,EAAE,UAAU,GAAG,aAAa,CAMjH;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,GAAE,kBAAuB,GAAG,aAAa,CAKjH;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,wBAAwB,CAuB1B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,GAAE,kBAAuB,GAAG,aAAa,CAKjH;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,eAAe,CAAC;IACxB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,mBAAwB,GAChC,yBAAyB,CAmC3B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,yBAAyB,EAAE,SAAS,EAAE,UAAU,GAAG,cAAc,CAMpH;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE,SAAS,EACd,OAAO,GAAE,mBAAwB,GAChC,cAAc,CAKhB"}
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/signer.ts"],"names":[],"mappings":"AACA,OAAO,EAA6C,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGnH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,SAAS,CAAC;AAGjB,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,SAAS,GAAG,mBAAmB,CAAC;IACrC;;;;;;;;;;OAUG;IACH,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;GAOG;AACH,KAAK,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAM7D;;;;;;;;;;GAUG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/D,QAAQ,EAAE,cAAc,GACvB,IAAI,CAGN;AAwBD,OAAO,EAAE,qBAAqB,EAAE,CAAC;AAEjC,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,WAAW,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,eAAe,CAAC;IACxB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,wBAAwB,CA8B1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,wBAAwB,EAAE,SAAS,EAAE,UAAU,GAAG,aAAa,CAMjH;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,GAAE,kBAAuB,GAAG,aAAa,CAKjH;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,wBAAwB,CAuB1B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,GAAE,kBAAuB,GAAG,aAAa,CAKjH"}

package/dist/lib/signing/signer.js

@@ -6,9 +6,6 @@ exports.finalizeRequestSignature = finalizeRequestSignature;
 exports.signRequest = signRequest;
 exports.prepareWebhookSignature = prepareWebhookSignature;
 exports.signWebhook = signWebhook;
-exports.prepareResponseSignature = prepareResponseSignature;
-exports.finalizeResponseSignature = finalizeResponseSignature;
-exports.signResponse = signResponse;
 const crypto_1 = require("crypto");
 const canonicalize_1 = require("./canonicalize");
 const content_digest_1 = require("./content-digest");
@@ -26,8 +23,8 @@ function assertKeyPurpose(key, expected) {
  * is skipped — preserves backward compat with adapters that pre-date the
  * `SigningProvider.adcpUse` field. Adapter authors who want signer-side
  * defense-in-depth set `adcpUse` on their provider; the async helpers
- * (`signRequestAsync` / `signWebhookAsync` / `signResponseAsync`) then
- * enforce the binding parallel to the sync path.
+ * (`signRequestAsync` / `signWebhookAsync`) then enforce the binding
+ * parallel to the sync path.
  */
 function assertProviderPurpose(provider, expected) {
     if (provider.adcpUse === undefined)
@@ -45,8 +42,6 @@ function throwIfPurposeMismatch(keyid, actual, expected) {
             throw new errors_1.RequestSignatureError('request_signature_key_purpose_invalid', 8, message);
         case 'webhook-signing':
             throw new errors_1.WebhookSignatureError('webhook_signature_key_purpose_invalid', 8, message);
-        case 'response-signing':
-            throw new errors_1.ResponseSignatureError('response_signature_key_purpose_invalid', 8, message);
         default: {
             // Compile-time exhaustiveness: a future widening of `Rfc9421AdcpUse`
             // (typically because `AdcpUse` grew an RFC-9421 member) must add a
@@ -166,97 +161,6 @@ function signWebhook(request, key, options = {}) {
     const signature = produceSignature(key, Buffer.from(prepared.base, 'utf8'));
     return finalizeRequestSignature(prepared, signature);
 }
-/**
- * Canonicalize a response for RFC 9421 response-signing (§2.2.9). Pure
- * (no I/O); shared between sync `signResponse` and async `signResponseAsync`
- * so canonicalization can't drift between them. Covers
- * {@link RESPONSE_MANDATORY_COMPONENTS} by default; adds `content-type` +
- * `content-digest` automatically when the response carries a body. Callers
- * can extend the covered set via
- * {@link SignResponseOptions.additionalComponents}.
- *
- * **No purpose-binding gate** — same caveat as
- * {@link prepareRequestSignature}. The convenience helper `signResponse`
- * runs `assertKeyPurpose` before calling this.
- */
-function prepareResponseSignature(response, identity, options = {}) {
-    const now = options.now ? options.now() : Math.floor(Date.now() / 1000);
-    const windowSeconds = Math.min(options.windowSeconds ?? 300, types_1.MAX_SIGNATURE_WINDOW_SECONDS);
-    const nonce = options.nonce ?? base64UrlRandom(16);
-    const label = options.label ?? 'sig1';
-    const hasBody = (response.body ?? '').length > 0;
-    const coverDigest = (options.coverContentDigest ?? true) && hasBody;
-    const headers = { ...flattenHeaders(response.headers) };
-    if (coverDigest) {
-        headers['Content-Digest'] = (0, content_digest_1.computeContentDigest)(response.body ?? '');
-    }
-    const components = [...types_1.RESPONSE_MANDATORY_COMPONENTS];
-    if (hasBody)
-        components.push('content-type');
-    if (coverDigest)
-        components.push('content-digest');
-    if (options.additionalComponents) {
-        for (const c of options.additionalComponents) {
-            if (!components.includes(c))
-                components.push(c);
-        }
-    }
-    const params = {
-        created: now,
-        expires: now + windowSeconds,
-        nonce,
-        keyid: identity.keyid,
-        alg: identity.alg,
-        tag: options.tag ?? types_1.RESPONSE_SIGNING_TAG,
-    };
-    const normalizedResponse = { ...response, headers };
-    const base = (0, canonicalize_1.buildResponseSignatureBase)(components, normalizedResponse, params);
-    return { status: response.status, components, params, headers, base, label };
-}
-/**
- * Attach `Signature` / `Signature-Input` headers given the bytes returned
- * by the signer/provider. Mirrors {@link finalizeRequestSignature} but
- * returns a {@link SignedResponse} that carries the response status alongside
- * the stamped headers so the caller can hand the whole object back to its
- * HTTP layer.
- */
-function finalizeResponseSignature(prepared, signature) {
-    const headers = { ...prepared.headers };
-    const sigB64 = Buffer.from(signature).toString('base64url');
-    headers['Signature-Input'] = `${prepared.label}=${(0, canonicalize_1.formatSignatureParams)(prepared.components, prepared.params)}`;
-    headers['Signature'] = `${prepared.label}=:${sigB64}:`;
-    return { status: prepared.status, headers, signatureBase: prepared.base, params: prepared.params };
-}
-/**
- * Sign an outbound response under the RFC 9421 response-signing profile
- * (`tag=adcp/response-signing/v1`). Covers `@status` and `@authority` by
- * default, plus `content-type` + `content-digest` when a body is present.
- * Servers emitting signed responses (e.g. seller agents whose clients
- * verify `get_products` payloads before parsing) should use this instead
- * of hand-rolling signatures.
- *
- * Returns headers as a plain `Record<string, string>` for direct use with
- * Express (`res.set(signed.headers)`). For Fetch / Node `Response` (where
- * the headers object is immutable on construction), spread into the
- * `Headers` constructor or `setHeader` loop:
- *
- * ```ts
- * // Express
- * res.status(signed.status).set(signed.headers).send(body);
- *
- * // Fetch / Workers / Node 20+ Response
- * return new Response(body, { status: signed.status, headers: signed.headers });
- *
- * // Node `http.ServerResponse`
- * res.writeHead(signed.status, signed.headers).end(body);
- * ```
- */
-function signResponse(response, key, options = {}) {
-    assertKeyPurpose(key, 'response-signing');
-    const prepared = prepareResponseSignature(response, { keyid: key.keyid, alg: key.alg }, options);
-    const signature = produceSignature(key, Buffer.from(prepared.base, 'utf8'));
-    return finalizeResponseSignature(prepared, signature);
-}
 function produceSignature(key, data) {
     const privateKey = (0, crypto_1.createPrivateKey)({
         key: key.privateKey,

package/dist/lib/signing/signer.js.map

@@ -1 +1 @@
-{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../../src/lib/signing/signer.ts"],"names":[],"mappings":";;AA8GS,sDAAqB;AA4D9B,0DAkCC;AAYD,4DAMC;AAED,kCAKC;AA0BD,0DA2BC;AASD,kCAKC;AA6ED,4DAuCC;AASD,8DAMC;AA0BD,oCASC;AA9cD,mCAA0F;AAC1F,iDAOwB;AACxB,qDAAwD;AACxD,qCAAgG;AAEhG,mCAQiB;AACjB,yDAAuF;AA0CvF,SAAS,gBAAgB,CAAC,GAAc,EAAE,QAAwB;IAChE,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAC5B,QAAgE,EAChE,QAAwB;IAExB,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO;IAC3C,sBAAsB,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,MAA0B,EAAE,QAAwB;IACjG,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO;IAChC,MAAM,OAAO,GACX,gBAAgB,KAAK,kBAAkB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,GAAG,GAAG;QAC5F,4BAA4B,QAAQ,6BAA6B,QAAQ,QAAQ;QACjF,6BAA6B,QAAQ,+DAA+D,CAAC;IACvG,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,iBAAiB;YACpB,MAAM,IAAI,8BAAqB,CAAC,uCAAuC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,KAAK,iBAAiB;YACpB,MAAM,IAAI,8BAAqB,CAAC,uCAAuC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,KAAK,kBAAkB;YACrB,MAAM,IAAI,+BAAsB,CAAC,wCAAwC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,CAAC;YACR,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,WAAW,GAAU,QAAQ,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,WAAW,GAAG,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;AACH,CAAC;AAgDD;;;;;;;;;;;;;GAaG;AACH,SAAgB,uBAAuB,CACrC,OAAoB,EACpB,QAA2B,EAC3B,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,EAAE,oCAA4B,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,CAAC;IACnE,MAAM,OAAO,GAA2B,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAA,qCAAoB,EAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,4BAAoB,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,WAAW;QAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAoB;QAC9B,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,GAAG,GAAG,aAAa;QAC5B,KAAK;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,EAAE,2BAAmB;KACzB,CAAC;IAEF,MAAM,iBAAiB,GAAgB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAA,iCAAkB,EAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,wBAAwB,CAAC,QAAkC,EAAE,SAAqB;IAChG,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO,CAAC,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC,KAAK,IAAI,IAAA,oCAAqB,EAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAChH,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,QAAQ,CAAC,KAAK,KAAK,MAAM,GAAG,CAAC;IACvD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,SAAgB,WAAW,CAAC,OAAoB,EAAE,GAAc,EAAE,UAA8B,EAAE;IAChG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,OAAO,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAeD;;;;;;;;;;GAUG;AACH,SAAgB,uBAAuB,CACrC,OAAoB,EACpB,QAA2B,EAC3B,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,EAAE,oCAA4B,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IAEtC,MAAM,OAAO,GAA2B,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAA,qCAAoB,EAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,CAAC,GAAG,+CAA4B,CAAC,CAAC;IACrD,MAAM,MAAM,GAAoB;QAC9B,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,GAAG,GAAG,aAAa;QAC5B,KAAK;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,sCAAmB;KACxC,CAAC;IAEF,MAAM,iBAAiB,GAAgB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAA,iCAAkB,EAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,OAAoB,EAAE,GAAc,EAAE,UAA8B,EAAE;IAChG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,OAAO,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAgED;;;;;;;;;;;;GAYG;AACH,SAAgB,wBAAwB,CACtC,QAAsB,EACtB,QAA2B,EAC3B,UAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,EAAE,oCAA4B,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,OAAO,CAAC;IAEpE,MAAM,OAAO,GAA2B,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IAChF,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAA,qCAAoB,EAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,qCAA6B,CAAC,CAAC;IACtD,IAAI,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,WAAW;QAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC7C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAoB;QAC9B,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,GAAG,GAAG,aAAa;QAC5B,KAAK;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,4BAAoB;KACzC,CAAC;IAEF,MAAM,kBAAkB,GAAiB,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC;IAClE,MAAM,IAAI,GAAG,IAAA,yCAA0B,EAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAEhF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,QAAmC,EAAE,SAAqB;IAClG,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO,CAAC,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC,KAAK,IAAI,IAAA,oCAAqB,EAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAChH,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,QAAQ,CAAC,KAAK,KAAK,MAAM,GAAG,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AACrG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,YAAY,CAC1B,QAAsB,EACtB,GAAc,EACd,UAA+B,EAAE;IAEjC,gBAAgB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,OAAO,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAc,EAAE,IAAY;IACpD,MAAM,UAAU,GAAG,IAAA,yBAAgB,EAAC;QAClC,GAAG,EAAE,GAAG,CAAC,UAAwB;QACjC,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,UAAU,CAAC,IAAA,aAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,IAAA,aAAQ,EAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CAAC,OAAsD;IAC5E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,wEAAwE;QACxE,4EAA4E;QAC5E,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAA,oBAAW,EAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChH,CAAC"}
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../../src/lib/signing/signer.ts"],"names":[],"mappings":";;AAkGS,sDAAqB;AA4D9B,0DAkCC;AAYD,4DAMC;AAED,kCAKC;AA0BD,0DA2BC;AASD,kCAKC;AA5RD,mCAA0F;AAC1F,iDAAmH;AACnH,qDAAwD;AACxD,qCAAwE;AAExE,mCAMiB;AACjB,yDAAuF;AAyCvF,SAAS,gBAAgB,CAAC,GAAc,EAAE,QAAwB;IAChE,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,qBAAqB,CAC5B,QAA+D,EAC/D,QAAwB;IAExB,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO;IAC3C,sBAAsB,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,MAA0B,EAAE,QAAwB;IACjG,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO;IAChC,MAAM,OAAO,GACX,gBAAgB,KAAK,kBAAkB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,GAAG,GAAG;QAC5F,4BAA4B,QAAQ,6BAA6B,QAAQ,QAAQ;QACjF,6BAA6B,QAAQ,+DAA+D,CAAC;IACvG,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,iBAAiB;YACpB,MAAM,IAAI,8BAAqB,CAAC,uCAAuC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,KAAK,iBAAiB;YACpB,MAAM,IAAI,8BAAqB,CAAC,uCAAuC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC,CAAC;YACR,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,WAAW,GAAU,QAAQ,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,WAAW,GAAG,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;AACH,CAAC;AAgDD;;;;;;;;;;;;;GAaG;AACH,SAAgB,uBAAuB,CACrC,OAAoB,EACpB,QAA2B,EAC3B,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,EAAE,oCAA4B,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAG,OAAO,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,CAAC;IACnE,MAAM,OAAO,GAA2B,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAA,qCAAoB,EAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,4BAAoB,CAAC,CAAC;IAC7C,IAAI,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,WAAW;QAAE,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAoB;QAC9B,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,GAAG,GAAG,aAAa;QAC5B,KAAK;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,EAAE,2BAAmB;KACzB,CAAC;IAEF,MAAM,iBAAiB,GAAgB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAA,iCAAkB,EAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,wBAAwB,CAAC,QAAkC,EAAE,SAAqB;IAChG,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO,CAAC,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC,KAAK,IAAI,IAAA,oCAAqB,EAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAChH,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,QAAQ,CAAC,KAAK,KAAK,MAAM,GAAG,CAAC;IACvD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED,SAAgB,WAAW,CAAC,OAAoB,EAAE,GAAc,EAAE,UAA8B,EAAE;IAChG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,OAAO,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAeD;;;;;;;;;;GAUG;AACH,SAAgB,uBAAuB,CACrC,OAAoB,EACpB,QAA2B,EAC3B,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,GAAG,EAAE,oCAA4B,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IAEtC,MAAM,OAAO,GAA2B,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAA,qCAAoB,EAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,CAAC,GAAG,+CAA4B,CAAC,CAAC;IACrD,MAAM,MAAM,GAAoB;QAC9B,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,GAAG,GAAG,aAAa;QAC5B,KAAK;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,sCAAmB;KACxC,CAAC;IAEF,MAAM,iBAAiB,GAAgB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAA,iCAAkB,EAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;IAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,OAAoB,EAAE,GAAc,EAAE,UAA8B,EAAE;IAChG,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,OAAO,wBAAwB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAc,EAAE,IAAY;IACpD,MAAM,UAAU,GAAG,IAAA,yBAAgB,EAAC;QAClC,GAAG,EAAE,GAAG,CAAC,UAAwB;QACjC,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,UAAU,CAAC,IAAA,aAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,IAAA,aAAQ,EAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CAAC,OAAsD;IAC5E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,wEAAwE;QACxE,4EAA4E;QAC5E,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,OAAO,IAAA,oBAAW,EAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChH,CAAC"}

package/dist/lib/signing/testing.d.ts

@@ -1,6 +1,6 @@
 import type { SigningProvider } from './provider';
 import type { SignerKey } from './signer';
-import type { AdcpUse } from './jwks-helpers';
+import { type AdcpUse } from './jwks-helpers';
 import type { AdcpJsonWebKey, AdcpSignAlg } from './types';
 /**
  * Environment variable that lets operators acknowledge an in-memory signer
@@ -18,13 +18,13 @@ export interface InMemorySigningProviderOptions {
     privateKey: AdcpJsonWebKey;
     /**
      * Optional purpose binding. When supplied, the async signing helpers
-     * (`signRequestAsync` / `signWebhookAsync` / `signResponseAsync`) refuse
-     * to sign with a mismatched purpose — same defense-in-depth gate the
-     * sync path's `SignerKey.privateKey.adcp_use` provides. Defaults to the
-     * value carried on `privateKey.adcp_use` when present, so adapters
-     * minted via `pemToAdcpJwk({ adcp_use: ... })` get the binding for free.
+     * (`signRequestAsync` / `signWebhookAsync`) refuse to sign with a
+     * mismatched purpose — same defense-in-depth gate the sync path's
+     * `SignerKey.privateKey.adcp_use` provides. Defaults to the value carried
+     * on `privateKey.adcp_use` when present, so adapters minted via
+     * `pemToAdcpJwk({ adcp_use: ... })` get the binding for free.
      */
-    adcpUse?: AdcpUse;
+    adcpUse?: string;
 }
 /**
  * Reference {@link SigningProvider} that holds the private JWK in process
@@ -41,7 +41,7 @@ export declare class InMemorySigningProvider implements SigningProvider {
     readonly keyid: string;
     readonly algorithm: AdcpSignAlg;
     readonly fingerprint: string;
-    readonly adcpUse?: AdcpUse;
+    readonly adcpUse?: string;
     private readonly privateKey;
     constructor(options: InMemorySigningProviderOptions);
     sign(payload: Uint8Array): Promise<Uint8Array>;
@@ -82,8 +82,8 @@ export interface MintEphemeralEd25519KeyOptions {
     /**
      * AdCP purpose binding tagged on both JWKs. Accepts every member of
      * {@link AdcpUse} — see that type for the canonical list (currently
-     * `'webhook-signing'`, `'request-signing'`, `'response-signing'`,
-     * `'governance-signing'`). Defaults to `'webhook-signing'`.
+     * `'webhook-signing'`, `'request-signing'`, and `'governance-signing'`).
+     * Defaults to `'webhook-signing'`.
      *
      * For production request-signing keys use `pemToAdcpJwk()` or a KMS-backed
      * `SigningProvider` instead.

package/dist/lib/signing/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/testing.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AAYxE,MAAM,WAAW,8BAA8B;IAC7C,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,SAAS,EAAE,WAAW,CAAC;IACvB,4CAA4C;IAC5C,UAAU,EAAE,cAAc,CAAC;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;gBAEhC,OAAO,EAAE,8BAA8B;IAoC7C,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAQrD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,GAAG,eAAe,CAMnE;AAED,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,EAAE,WAAW,CAAC;IACvB,kFAAkF;IAClF,SAAS,EAAE,cAAc,CAAC;IAC1B;;;;OAIG;IACH,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE,8BAA8B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoCjH"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/testing.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AAExE,MAAM,WAAW,8BAA8B;IAC7C,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,SAAS,EAAE,WAAW,CAAC;IACvB,4CAA4C;IAC5C,UAAU,EAAE,cAAc,CAAC;IAC3B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;gBAEhC,OAAO,EAAE,8BAA8B;IAoC7C,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAQrD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,GAAG,eAAe,CAMnE;AAED,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,EAAE,WAAW,CAAC;IACvB,kFAAkF;IAClF,SAAS,EAAE,cAAc,CAAC;IAC1B;;;;OAIG;IACH,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,CAAC,EAAE,8BAA8B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqCjH"}

package/dist/lib/signing/testing.js

@@ -37,6 +37,7 @@ exports.InMemorySigningProvider = exports.ALLOW_IN_MEMORY_SIGNER_ENV = void 0;
 exports.signerKeyToProvider = signerKeyToProvider;
 exports.mintEphemeralEd25519Key = mintEphemeralEd25519Key;
 const node_crypto_1 = require("node:crypto");
+const jwks_helpers_1 = require("./jwks-helpers");
 /**
  * Environment variable that lets operators acknowledge an in-memory signer
  * is intentional in a `NODE_ENV=production` deployment (CI runs with
@@ -44,15 +45,6 @@ const node_crypto_1 = require("node:crypto");
  * production-time guard.
  */
 exports.ALLOW_IN_MEMORY_SIGNER_ENV = 'ADCP_ALLOW_IN_MEMORY_SIGNER';
-const ADCP_USE_VALUES = new Set([
-    'request-signing',
-    'webhook-signing',
-    'response-signing',
-    'governance-signing',
-]);
-function isAdcpUse(value) {
-    return typeof value === 'string' && ADCP_USE_VALUES.has(value);
-}
 /**
  * Reference {@link SigningProvider} that holds the private JWK in process
  * memory. Useful for unit tests, conformance vectors, and local development.
@@ -88,10 +80,10 @@ class InMemorySigningProvider {
         this.keyid = options.keyid;
         this.algorithm = options.algorithm;
         this.privateKey = options.privateKey;
-        // Prefer explicit `adcpUse` option; fall back to the JWK's `adcp_use`
-        // metadata so keys minted via `pemToAdcpJwk` get the binding for free.
+        // Prefer explicit `adcpUse` option; fall back to raw JWK metadata so
+        // retired/unknown purposes still fail closed at the async signer gate.
         const jwkUse = options.privateKey.adcp_use;
-        this.adcpUse = options.adcpUse ?? (isAdcpUse(jwkUse) ? jwkUse : undefined);
+        this.adcpUse = options.adcpUse ?? (typeof jwkUse === 'string' ? jwkUse : undefined);
         // Mirrors the historical `privateKeyFingerprint` derivation — same input,
         // same 64-bit cache disambiguator, so behavior carries over for callers
         // who switch from the inline `request_signing` shape to a provider while
@@ -153,9 +145,10 @@ function signerKeyToProvider(key) {
  * ```
  */
 async function mintEphemeralEd25519Key(opts) {
-    const { generateKeyPair, exportJWK } = await Promise.resolve().then(() => __importStar(require('jose')));
     const resolvedKid = opts?.kid ?? (0, node_crypto_1.randomUUID)();
     const adcpUse = opts?.adcp_use ?? 'webhook-signing';
+    (0, jwks_helpers_1.assertAdcpUse)(adcpUse, 'mintEphemeralEd25519Key');
+    const { generateKeyPair, exportJWK } = await Promise.resolve().then(() => __importStar(require('jose')));
     const { publicKey: pubKeyObj, privateKey: privKeyObj } = await generateKeyPair('EdDSA', {
         crv: 'Ed25519',
         extractable: true,

package/dist/lib/signing/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../../src/lib/signing/testing.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgHA,kDAMC;AAmED,0DAoCC;AA7ND,6CAA0G;AAM1G;;;;;GAKG;AACU,QAAA,0BAA0B,GAAG,6BAA6B,CAAC;AAExE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAU;IACvC,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;CACrB,CAAC,CAAC;AACH,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAgB,CAAC,CAAC;AAC5E,CAAC;AAoBD;;;;;;;;;;GAUG;AACH,MAAa,uBAAuB;IACzB,KAAK,CAAS;IACd,SAAS,CAAc;IACvB,WAAW,CAAS;IACpB,OAAO,CAAW;IACV,UAAU,CAAiB;IAE5C,YAAY,OAAuC;QACjD,+DAA+D;QAC/D,gEAAgE;QAChE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,WAAW;QACX,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,YAAY,CAAC;QAC1E,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kCAA0B,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,sDAAsD,kCAA0B,qBAAqB;gBACnG,iFAAiF,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,2EAA2E,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,iCAAiC;QACjC,IAAI,CAAC,WAAW,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;aACpC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAW,CAAC;aACtC,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAmB;QAC5B,MAAM,UAAU,GAAG,IAAA,8BAAgB,EAAC,EAAE,GAAG,EAAE,IAAI,CAAC,UAAwB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,UAAU,CAAC,IAAA,kBAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,IAAA,kBAAQ,EAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;CACF;AAnDD,0DAmDC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,GAAc;IAChD,OAAO,IAAI,uBAAuB,CAAC;QACjC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,GAAG;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC,CAAC;AACL,CAAC;AAyCD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACI,KAAK,UAAU,uBAAuB,CAAC,IAAqC;IACjF,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,wDAAa,MAAM,GAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,IAAA,wBAAU,GAAE,CAAC;IAC9C,MAAM,OAAO,GAAY,IAAI,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IAC7D,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE;QACtF,GAAG,EAAE,SAAS;QACd,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAE3F,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC3G,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAE7G,MAAM,SAAS,GAAmB;QAChC,GAAI,MAAkC;QACtC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;QACV,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,CAAC,QAAQ,CAAC;KACpB,CAAC;IAEF,MAAM,UAAU,GAAmB;QACjC,GAAI,OAAmC;QACvC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;QACV,QAAQ,EAAE,OAAO;QACjB,4EAA4E;QAC5E,qFAAqF;QACrF,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../../../src/lib/signing/testing.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsGA,kDAMC;AAmED,0DAqCC;AApND,6CAA0G;AAG1G,iDAA6D;AAG7D;;;;;GAKG;AACU,QAAA,0BAA0B,GAAG,6BAA6B,CAAC;AAoBxE;;;;;;;;;;GAUG;AACH,MAAa,uBAAuB;IACzB,KAAK,CAAS;IACd,SAAS,CAAc;IACvB,WAAW,CAAS;IACpB,OAAO,CAAU;IACT,UAAU,CAAiB;IAE5C,YAAY,OAAuC;QACjD,+DAA+D;QAC/D,gEAAgE;QAChE,oEAAoE;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,WAAW;QACX,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,YAAY,CAAC;QAC1E,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kCAA0B,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,sDAAsD,kCAA0B,qBAAqB;gBACnG,iFAAiF,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,2EAA2E,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,qEAAqE;QACrE,uEAAuE;QACvE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,iCAAiC;QACjC,IAAI,CAAC,WAAW,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;aACpC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAW,CAAC;aACtC,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAmB;QAC5B,MAAM,UAAU,GAAG,IAAA,8BAAgB,EAAC,EAAE,GAAG,EAAE,IAAI,CAAC,UAAwB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,UAAU,CAAC,IAAA,kBAAQ,EAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,IAAA,kBAAQ,EAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;CACF;AAnDD,0DAmDC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,GAAc;IAChD,OAAO,IAAI,uBAAuB,CAAC;QACjC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,GAAG;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC,CAAC;AACL,CAAC;AAyCD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACI,KAAK,UAAU,uBAAuB,CAAC,IAAqC;IACjF,MAAM,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,IAAA,wBAAU,GAAE,CAAC;IAC9C,MAAM,OAAO,GAAY,IAAI,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IAC7D,IAAA,4BAAa,EAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAClD,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,wDAAa,MAAM,GAAC,CAAC;IAC5D,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE;QACtF,GAAG,EAAE,SAAS;QACd,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAE3F,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC3G,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAE7G,MAAM,SAAS,GAAmB;QAChC,GAAI,MAAkC;QACtC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;QACV,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,CAAC,QAAQ,CAAC;KACpB,CAAC;IAEF,MAAM,UAAU,GAAmB;QACjC,GAAI,OAAmC;QACvC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;QACV,QAAQ,EAAE,OAAO;QACjB,4EAA4E;QAC5E,qFAAqF;QACrF,OAAO,EAAE,CAAC,MAAM,CAAC;KAClB,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3E,CAAC"}

package/dist/lib/signing/types.d.ts

@@ -84,16 +84,6 @@ export type VerifyResult = ({
     verified_at: number;
 };
 export declare const REQUEST_SIGNING_TAG = "adcp/request-signing/v1";
-/**
- * Tag value for the AdCP response-signing profile (RFC 9421 §2.2.9).
- *
- * Signer ships in #1823; verifier (`verifyResponseSignature`) ships in
- * #1826. The wire format is now exercised both directions inside this SDK
- * via round-trip tests. The `v1` suffix gives a clean break path if cross-
- * SDK interop testing later surfaces an incompat — any breaking change
- * ships as `v2` and verifiers reject `v1`.
- */
-export declare const RESPONSE_SIGNING_TAG = "adcp/response-signing/v1";
 export declare const ALLOWED_ALGS: Set<string>;
 /**
  * Wire-format algorithm identifier — the string that appears in
@@ -103,30 +93,4 @@ export type AdcpSignAlg = 'ed25519' | 'ecdsa-p256-sha256';
 export declare const MAX_SIGNATURE_WINDOW_SECONDS = 300;
 export declare const CLOCK_SKEW_TOLERANCE_SECONDS = 60;
 export declare const MANDATORY_COMPONENTS: ReadonlyArray<string>;
-/**
- * Minimum derived components covered by a response signature under the AdCP
- * response-signing profile (RFC 9421 §2.2.9).
- *
- * - `@status` — binds the signature to the response status code.
- * - `@authority` — binds it to the request origin the response was emitted
- *   for (so a compromised origin can't cross-sign for a sibling tenant on
- *   the same fleet).
- * - `@target-uri` — binds the signature to the specific request path + query,
- *   preventing a multi-tenant seller from emitting interchangeable signatures
- *   across endpoints sharing the same authority. Matches RFC 9421 §B.2.5
- *   examples for response signing.
- *
- * `content-type` + `content-digest` are added at signing time when the
- * response carries a body — `content-digest` is opt-out via
- * `coverContentDigest: false` because an unbound body is the most common
- * cross-purpose footgun for response signing. Callers can extend the
- * covered set further via `SignResponseOptions.additionalComponents`
- * (e.g. `@method`, custom headers).
- *
- * Signer ships in #1823; verifier (`verifyResponseSignature`) ships in
- * #1826. The wire format is now exercised both directions inside this SDK
- * via round-trip tests. The `v1` tag suffix gives a clean break path if
- * cross-SDK interop testing later surfaces an incompat.
- */
-export declare const RESPONSE_MANDATORY_COMPONENTS: ReadonlyArray<string>;
 //# sourceMappingURL=types.d.ts.map

package/dist/lib/signing/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEtE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,+CAA+C;IAC/C,CAAC,CAAC,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG,cAAc,CAAC,GAAG;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnH,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAC7D;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAC/D,eAAO,MAAM,YAAY,aAA4C,CAAC;AACtE;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAC1D,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAA4C,CAAC;AACpG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAAa,CAAC,MAAM,CAA4C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/signing/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEtE,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,OAAO,CAAC;IACnB,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;OAIG;IACH,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,+CAA+C;IAC/C,CAAC,CAAC,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG,cAAc,CAAC,GAAG;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnH,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAC7D,eAAO,MAAM,YAAY,aAA4C,CAAC;AACtE;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,mBAAmB,CAAC;AAC1D,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAA4C,CAAC"}

package/dist/lib/signing/types.js

@@ -1,45 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RESPONSE_MANDATORY_COMPONENTS = exports.MANDATORY_COMPONENTS = exports.CLOCK_SKEW_TOLERANCE_SECONDS = exports.MAX_SIGNATURE_WINDOW_SECONDS = exports.ALLOWED_ALGS = exports.RESPONSE_SIGNING_TAG = exports.REQUEST_SIGNING_TAG = void 0;
+exports.MANDATORY_COMPONENTS = exports.CLOCK_SKEW_TOLERANCE_SECONDS = exports.MAX_SIGNATURE_WINDOW_SECONDS = exports.ALLOWED_ALGS = exports.REQUEST_SIGNING_TAG = void 0;
 exports.REQUEST_SIGNING_TAG = 'adcp/request-signing/v1';
-/**
- * Tag value for the AdCP response-signing profile (RFC 9421 §2.2.9).
- *
- * Signer ships in #1823; verifier (`verifyResponseSignature`) ships in
- * #1826. The wire format is now exercised both directions inside this SDK
- * via round-trip tests. The `v1` suffix gives a clean break path if cross-
- * SDK interop testing later surfaces an incompat — any breaking change
- * ships as `v2` and verifiers reject `v1`.
- */
-exports.RESPONSE_SIGNING_TAG = 'adcp/response-signing/v1';
 exports.ALLOWED_ALGS = new Set(['ed25519', 'ecdsa-p256-sha256']);
 exports.MAX_SIGNATURE_WINDOW_SECONDS = 300;
 exports.CLOCK_SKEW_TOLERANCE_SECONDS = 60;
 exports.MANDATORY_COMPONENTS = ['@method', '@target-uri', '@authority'];
-/**
- * Minimum derived components covered by a response signature under the AdCP
- * response-signing profile (RFC 9421 §2.2.9).
- *
- * - `@status` — binds the signature to the response status code.
- * - `@authority` — binds it to the request origin the response was emitted
- *   for (so a compromised origin can't cross-sign for a sibling tenant on
- *   the same fleet).
- * - `@target-uri` — binds the signature to the specific request path + query,
- *   preventing a multi-tenant seller from emitting interchangeable signatures
- *   across endpoints sharing the same authority. Matches RFC 9421 §B.2.5
- *   examples for response signing.
- *
- * `content-type` + `content-digest` are added at signing time when the
- * response carries a body — `content-digest` is opt-out via
- * `coverContentDigest: false` because an unbound body is the most common
- * cross-purpose footgun for response signing. Callers can extend the
- * covered set further via `SignResponseOptions.additionalComponents`
- * (e.g. `@method`, custom headers).
- *
- * Signer ships in #1823; verifier (`verifyResponseSignature`) ships in
- * #1826. The wire format is now exercised both directions inside this SDK
- * via round-trip tests. The `v1` tag suffix gives a clean break path if
- * cross-SDK interop testing later surfaces an incompat.
- */
-exports.RESPONSE_MANDATORY_COMPONENTS = ['@status', '@authority', '@target-uri'];
 //# sourceMappingURL=types.js.map

package/dist/lib/signing/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/signing/types.ts"],"names":[],"mappings":";;;AAsFa,QAAA,mBAAmB,GAAG,yBAAyB,CAAC;AAC7D;;;;;;;;GAQG;AACU,QAAA,oBAAoB,GAAG,0BAA0B,CAAC;AAClD,QAAA,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAMzD,QAAA,4BAA4B,GAAG,GAAG,CAAC;AACnC,QAAA,4BAA4B,GAAG,EAAE,CAAC;AAClC,QAAA,oBAAoB,GAA0B,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AACpG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACU,QAAA,6BAA6B,GAA0B,CAAC,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/signing/types.ts"],"names":[],"mappings":";;;AAsFa,QAAA,mBAAmB,GAAG,yBAAyB,CAAC;AAChD,QAAA,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAMzD,QAAA,4BAA4B,GAAG,GAAG,CAAC;AACnC,QAAA,4BAA4B,GAAG,EAAE,CAAC;AAClC,QAAA,oBAAoB,GAA0B,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC"}

package/dist/lib/testing/agent-tester.d.ts

@@ -22,6 +22,7 @@
  * ```
  */
 export type { TestScenario, TestOptions, TestStepResult, AgentProfile, TestResult, SuiteResult, TaskResult, Logger, } from './types';
+export type { TestClient } from './client';
 export { setAgentTesterLogger, getLogger, createTestClient, runStep } from './client';
 export { formatTestResults, formatTestResultsJSON, formatTestResultsSummary } from './formatter';
 import type { TestScenario, TestOptions, TestResult } from './types';

package/dist/lib/testing/agent-tester.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-tester.d.ts","sourceRoot":"","sources":["../../../src/lib/testing/agent-tester.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,YAAY,EACV,YAAY,EACZ,WAAW,EACX,cAAc,EACd,YAAY,EACZ,UAAU,EACV,WAAW,EACX,UAAU,EACV,MAAM,GACP,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGtF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AA0DjG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAgC,MAAM,SAAS,CAAC;AAGnG;;GAEG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,YAAY,EACtB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAyWrB;AAGD,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EAEvB,2BAA2B,EAC3B,8BAA8B,EAC9B,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAElB,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,EAEpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EAExB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EAEnB,kBAAkB,EAClB,0BAA0B,EAC1B,UAAU,EACV,gBAAgB,GACjB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"agent-tester.d.ts","sourceRoot":"","sources":["../../../src/lib/testing/agent-tester.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,YAAY,EACV,YAAY,EACZ,WAAW,EACX,cAAc,EACd,YAAY,EACZ,UAAU,EACV,WAAW,EACX,UAAU,EACV,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAGtF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AA0DjG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAgC,MAAM,SAAS,CAAC;AAGnG;;GAEG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,YAAY,EACtB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAyWrB;AAGD,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EAEvB,2BAA2B,EAC3B,8BAA8B,EAC9B,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,gCAAgC,EAChC,8BAA8B,EAC9B,2BAA2B,EAC3B,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,0BAA0B,EAC1B,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAElB,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,EAEpB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EAExB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EAEnB,kBAAkB,EAClB,0BAA0B,EAC1B,UAAU,EACV,gBAAgB,GACjB,MAAM,aAAa,CAAC"}