@adcp/sdk 8.1.0-beta.13 → 8.1.0-beta.14

package/dist/lib/upstream-recorder/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const IDENTIFIER_DIGEST_LIMIT = 64;
+//# sourceMappingURL=constants.d.ts.map

package/dist/lib/upstream-recorder/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/lib/upstream-recorder/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,KAAK,CAAC"}

package/dist/lib/upstream-recorder/constants.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTIFIER_DIGEST_LIMIT = void 0;
+exports.IDENTIFIER_DIGEST_LIMIT = 64;
+//# sourceMappingURL=constants.js.map

package/dist/lib/upstream-recorder/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/lib/upstream-recorder/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,uBAAuB,GAAG,EAAE,CAAC"}

package/dist/lib/upstream-recorder/index.d.ts

@@ -32,26 +32,36 @@
  * });
  *
  * // 3. In your `comply_test_controller` handler for scenario:
- * //    `query_upstream_traffic`, return the recorder's query result
- * //    verbatim:
+ * //    `query_upstream_traffic`, project the recorder's query result
+ * //    onto the controller response shape:
  * function handleQueryUpstreamTraffic(req, principal) {
- *   const { items, total, truncated, since_timestamp } = recorder.query({
- *     principal,
- *     sinceTimestamp: req.params.since_timestamp,
- *     endpointPattern: req.params.endpoint_pattern,
- *     limit: req.params.limit,
- *   });
- *   return { success: true, recorded_calls: items, total_count: total, truncated, since_timestamp };
+ *   return toQueryUpstreamTrafficResponse(
+ *     recorder.query({
+ *       principal,
+ *       sinceTimestamp: req.params.since_timestamp,
+ *       endpointPattern: req.params.endpoint_pattern,
+ *       limit: req.params.limit,
+ *       attestationMode: req.params.attestation_mode,
+ *       identifierValueDigests: req.params.identifier_value_digests,
+ *     })
+ *   );
  * }
  * ```
  *
+ * Digest-mode queries canonicalize JSON payloads before hashing. If a
+ * recorded JSON payload cannot be canonicalized (for example because it
+ * exceeds the recorder's depth cap), `query()` omits that entry and emits
+ * `digest_canonicalization_failed` through `onError` rather than returning a
+ * non-canonical digest.
+ *
  * Production builds with `enabled: false` get a no-op recorder — every
  * method is a pass-through / empty-result, zero per-call overhead.
  *
  * Companion to issue adcp-client#1290; runner-side consumer is
  * `@adcp/sdk`'s storyboard runner (PR adcp-client#1289).
  */
-export { createUpstreamRecorder, toQueryUpstreamTrafficResponse } from './recorder';
+export { PayloadDigestError, computePayloadDigestSha256, createUpstreamRecorder, toQueryUpstreamTrafficResponse, } from './recorder';
+export type { PayloadDigestOptions } from './recorder';
 export { UpstreamRecorderScopeError } from './types';
 export type { PurposeClassifier, QueryUpstreamTrafficResponse, RecordInput, RecordedCall, UpstreamRecorder, UpstreamRecorderDebugInfo, UpstreamRecorderErrorEvent, UpstreamRecorderOptions, UpstreamRecorderQueryParams, UpstreamRecorderQueryResult, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/upstream-recorder/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/upstream-recorder/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,sBAAsB,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AACrD,YAAY,EACV,iBAAiB,EACjB,4BAA4B,EAC5B,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/upstream-recorder/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAEH,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AACrD,YAAY,EACV,iBAAiB,EACjB,4BAA4B,EAC5B,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,SAAS,CAAC"}

package/dist/lib/upstream-recorder/index.js

@@ -33,19 +33,28 @@
  * });
  *
  * // 3. In your `comply_test_controller` handler for scenario:
- * //    `query_upstream_traffic`, return the recorder's query result
- * //    verbatim:
+ * //    `query_upstream_traffic`, project the recorder's query result
+ * //    onto the controller response shape:
  * function handleQueryUpstreamTraffic(req, principal) {
- *   const { items, total, truncated, since_timestamp } = recorder.query({
- *     principal,
- *     sinceTimestamp: req.params.since_timestamp,
- *     endpointPattern: req.params.endpoint_pattern,
- *     limit: req.params.limit,
- *   });
- *   return { success: true, recorded_calls: items, total_count: total, truncated, since_timestamp };
+ *   return toQueryUpstreamTrafficResponse(
+ *     recorder.query({
+ *       principal,
+ *       sinceTimestamp: req.params.since_timestamp,
+ *       endpointPattern: req.params.endpoint_pattern,
+ *       limit: req.params.limit,
+ *       attestationMode: req.params.attestation_mode,
+ *       identifierValueDigests: req.params.identifier_value_digests,
+ *     })
+ *   );
  * }
  * ```
  *
+ * Digest-mode queries canonicalize JSON payloads before hashing. If a
+ * recorded JSON payload cannot be canonicalized (for example because it
+ * exceeds the recorder's depth cap), `query()` omits that entry and emits
+ * `digest_canonicalization_failed` through `onError` rather than returning a
+ * non-canonical digest.
+ *
  * Production builds with `enabled: false` get a no-op recorder — every
  * method is a pass-through / empty-result, zero per-call overhead.
  *
@@ -53,8 +62,10 @@
  * `@adcp/sdk`'s storyboard runner (PR adcp-client#1289).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpstreamRecorderScopeError = exports.toQueryUpstreamTrafficResponse = exports.createUpstreamRecorder = void 0;
+exports.UpstreamRecorderScopeError = exports.toQueryUpstreamTrafficResponse = exports.createUpstreamRecorder = exports.computePayloadDigestSha256 = exports.PayloadDigestError = void 0;
 var recorder_1 = require("./recorder");
+Object.defineProperty(exports, "PayloadDigestError", { enumerable: true, get: function () { return recorder_1.PayloadDigestError; } });
+Object.defineProperty(exports, "computePayloadDigestSha256", { enumerable: true, get: function () { return recorder_1.computePayloadDigestSha256; } });
 Object.defineProperty(exports, "createUpstreamRecorder", { enumerable: true, get: function () { return recorder_1.createUpstreamRecorder; } });
 Object.defineProperty(exports, "toQueryUpstreamTrafficResponse", { enumerable: true, get: function () { return recorder_1.toQueryUpstreamTrafficResponse; } });
 var types_1 = require("./types");

package/dist/lib/upstream-recorder/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/upstream-recorder/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;;;AAEH,uCAAoF;AAA3E,kHAAA,sBAAsB,OAAA;AAAE,0HAAA,8BAA8B,OAAA;AAC/D,iCAAqD;AAA5C,mHAAA,0BAA0B,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/upstream-recorder/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;;;AAEH,uCAKoB;AAJlB,8GAAA,kBAAkB,OAAA;AAClB,sHAAA,0BAA0B,OAAA;AAC1B,kHAAA,sBAAsB,OAAA;AACtB,0HAAA,8BAA8B,OAAA;AAGhC,iCAAqD;AAA5C,mHAAA,0BAA0B,OAAA"}

package/dist/lib/upstream-recorder/recorder.d.ts

@@ -3,12 +3,77 @@
  * surface and `./README` (file header on `index.ts`) for the why.
  */
 import { type QueryUpstreamTrafficResponse, type UpstreamRecorder, type UpstreamRecorderOptions, type UpstreamRecorderQueryResult } from './types';
+export declare class PayloadDigestError extends Error {
+    cause: unknown;
+    constructor(message: string, cause?: unknown);
+}
 /**
  * Build the recorder. Producer-side companion to the
  * `runner-output-contract.yaml` v2.0.0 `upstream_traffic` storyboard
  * check (spec PR adcontextprotocol/adcp#3816).
  */
 export declare function createUpstreamRecorder(options?: UpstreamRecorderOptions): UpstreamRecorder;
+/**
+ * Compute the `RecordedCall.payload_digest_sha256` value. By default this
+ * applies the same body snapshot normalization, payload normalization, and
+ * canonical secret-key redaction used by the recorder before hashing; pass a
+ * custom redaction pattern and `maxPayloadBytes` when your recorder uses matching
+ * options:
+ *
+ * - `createUpstreamRecorder({ redactPattern })` → `computePayloadDigestSha256(..., { redactPattern })`
+ * - `createUpstreamRecorder({ maxPayloadBytes })` → `computePayloadDigestSha256(..., { maxPayloadBytes })`
+ *
+ * Prefer `{ prenormalized: true }` only when the payload has already been
+ * normalized/redacted exactly as the recorder would store it; legacy `false`
+ * remains accepted as the same prenormalized sentinel. The prenormalized path
+ * skips redaction, so the helper rejects secret-shaped keys whose values are
+ * not already the literal `"[redacted]"` marker or an explicit null
+ * placeholder. For form-encoded bodies, duplicate secret-shaped keys are also
+ * rejected because last-wins maps cannot prove that every original value was
+ * inspected before hashing.
+ *
+ * JSON content is serialized with RFC 8785 JCS before hashing. When
+ * `contentType` is JSON-shaped and `payload` is a string, the helper parses
+ * it first so semantically equivalent JSON strings and objects hash to the
+ * same value. On the normalizing path, an unparseable JSON-shaped string is
+ * treated as the emitted body bytes and hashed verbatim after best-effort
+ * redaction. On the prenormalized path, malformed JSON strings throw because
+ * their secret-key structure cannot be proven safe. Unsupported JSON values
+ * and payloads deeper than the recorder's depth cap throw rather than
+ * producing a non-canonical digest.
+ *
+ * The returned digest is lowercase hex, matching the 3.1
+ * `query_upstream_traffic` wire contract.
+ */
+export declare function computePayloadDigestSha256(payload: unknown, contentType?: string, options?: PayloadDigestOptions): string;
+/**
+ * @deprecated Pass `{ redactPattern: /.../ }` instead of the bare `RegExp`
+ * form. The legacy form remains accepted for this major.
+ */
+export declare function computePayloadDigestSha256(payload: unknown, contentType: string | undefined, options: RegExp): string;
+/**
+ * @deprecated Pass `{ prenormalized: true }` instead of `false`. The legacy
+ * form remains accepted for this major.
+ */
+export declare function computePayloadDigestSha256(payload: unknown, contentType: string | undefined, options: false): string;
+export type PayloadDigestOptions = {
+    /**
+     * Custom redaction pattern. Passing `false` is accepted only with
+     * `prenormalized: true`; otherwise it would silently bypass redaction.
+     */
+    redactPattern?: RegExp | false;
+    /**
+     * Match `createUpstreamRecorder({ maxPayloadBytes })` when computing
+     * digests outside the recorder.
+     */
+    maxPayloadBytes?: number;
+    /**
+     * Set only for payloads that have already been normalized and redacted.
+     * The helper skips redaction but still scans secret-shaped keys, rejects
+     * malformed JSON strings, and rejects duplicate secret-shaped form keys.
+     */
+    prenormalized?: boolean;
+};
 /**
  * Project a `recorder.query()` result onto the spec wire shape returned
  * by `comply_test_controller`'s `query_upstream_traffic` scenario

package/dist/lib/upstream-recorder/recorder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../../src/lib/upstream-recorder/recorder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAEL,KAAK,4BAA4B,EAGjC,KAAK,gBAAgB,EAGrB,KAAK,uBAAuB,EAE5B,KAAK,2BAA2B,EACjC,MAAM,SAAS,CAAC;AAoCjB;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,uBAA4B,GAAG,gBAAgB,CAiU9F;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,2BAA2B,GAAG,4BAA4B,CAQhH"}
+{"version":3,"file":"recorder.d.ts","sourceRoot":"","sources":["../../../src/lib/upstream-recorder/recorder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAcH,OAAO,EAEL,KAAK,4BAA4B,EAIjC,KAAK,gBAAgB,EAGrB,KAAK,uBAAuB,EAE5B,KAAK,2BAA2B,EACjC,MAAM,SAAS,CAAC;AAiBjB,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,KAAK,EAAE,OAAO,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAK7C;AA6BD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,uBAA4B,GAAG,gBAAgB,CAkT9F;AAqJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,MAAM,CAAC;AACV;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;AACvH;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,CAAC;AAqDtH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC/B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAqKF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,2BAA2B,GAAG,4BAA4B,CAQhH"}