@fora-protocol/sdk 1.0.3

package/sdk/ts/core/sign-request.d.ts

@@ -0,0 +1,83 @@
+export declare const COVERED_COMPONENTS: readonly ["@method", "@target-uri", "content-digest", "authorization", "signature-agent"];
+/** Inputs for signRequest. All fields required; signatureAgent is "" to pin its absence. */
+export interface SignRequestOptions {
+    method: string;
+    url: string;
+    body: Uint8Array<ArrayBuffer>;
+    authorization: string;
+    signatureAgent: string;
+    keyid: string;
+    created: number;
+    expires: number;
+}
+/**
+ * The RFC 9421 artifacts a signed request carries, plus the covered base bytes.
+ *
+ * EVERY covered header is here, at the value that entered the base — the two whose value
+ * may be empty included. A verifier rebuilds the base from the request it received, so a
+ * covered value bound but never sent is not bound at all; the oracle's signer reaches the
+ * same place by mutating the request it was handed (helpers.SignRequest), which is why it
+ * has no such field to omit. See docs/design-history.md, "A covered header the peer never
+ * receives is not bound".
+ */
+export interface SignedRequest {
+    contentDigest: string;
+    signatureInput: string;
+    signature: string;
+    signatureBase: string;
+    /** Echoed from the input so a caller attaching what this returns sends what was
+     * signed. Empty is a value, not an absence. */
+    authorization: string;
+    /** The signer's WBA directory, echoed for the same reason. Empty is the
+     * static-bootstrap case and is still carried. */
+    signatureAgent: string;
+}
+export declare function contentDigest(body: Uint8Array<ArrayBuffer>): Promise<string>;
+export interface ChainLink {
+    token: string;
+    value: string;
+}
+/** The covered request field values a 5-component FORA signature base is built over. */
+export interface RequestBaseFields {
+    method: string;
+    url: string;
+    digestHeader: string;
+    authorization: string;
+    signatureAgent: string;
+}
+/**
+ * The RFC 9421 signature base over the FORA 5-component covered set: one
+ * `"name": value` line per component, joined by "\n", terminated by
+ * `"@signature-params": <sigParams>` with NO trailing newline. Empty
+ * authorization/signature-agent still render (name + ": " + "") — the trailing
+ * space is part of the covered bytes and must never be trimmed. Exported and
+ * shared with the verify sibling (core/verify-request.ts) so sign and verify
+ * reconstruct byte-identical bases; `sigParams` is the VERBATIM inner-list +
+ * params tail (the signer's own on sign, the wire's on verify).
+ */
+export declare function buildRequestSignatureBase(fields: RequestBaseFields, sigParams: string, chainLink?: ChainLink): string;
+/**
+ * signRequest signs opts over the FORA 5-component covered set with privKey and
+ * returns the RFC 9421 Content-Digest, Signature-Input, and Signature header
+ * values plus the exact signature base the signature covers. The Signature is
+ * `sig1=:<STANDARD-base64(sig)>:` (NOT b64url — do not unify with the thumbprint
+ * encoding); Signature-Input is `sig1=` + the same inner the base carries.
+ */
+export declare function signRequest(privKey: CryptoKey, opts: SignRequestOptions): Promise<SignedRequest>;
+/** A request's prior signature state — the Signature-Input / Signature header
+ * values already on the request (both "" for an unsigned request). */
+export interface PriorSignatures {
+    signatureInput: string;
+    signature: string;
+}
+/**
+ * appendSignature chains sig(N+1) onto `prev` WITHOUT disturbing existing members
+ * (forwarding chain), the TS port of Go helpers.AppendSignature. It finds
+ * the next label sig(N+1) and predecessor sigN, binds the FORA base plus a
+ * `"signature";key="sigN"` link whose value is `:<std-base64(decoded predecessor
+ * sig bytes)>:` (re-encoded canonically, NOT a wire splice), Ed25519-signs, and
+ * returns the APPENDED Signature-Input / Signature strings. Appending to an
+ * unsigned request (empty prev) produces a sig1 byte-for-byte identical to
+ * signRequest — single-sig is the N=1 case.
+ */
+export declare function appendSignature(privKey: CryptoKey, prev: PriorSignatures, opts: SignRequestOptions): Promise<SignedRequest>;

package/sdk/ts/core/sign-request.js

@@ -0,0 +1,146 @@
+// sdk/ts outbound RFC 9421 request signer over the full 5-component FORA covered
+// set (@method @target-uri content-digest authorization signature-agent) — the
+// TS sibling of Go helpers.SignRequest and Python httpsig.sign_request. It signs
+// byte-identical to the shared Go oracle so a request signed in TS verifies
+// unchanged at any Go/Python broker/exchange.
+//
+// This is the 5-component sibling of core/sign.ts::signInbound (the 2-component
+// GET PoP). It does NOT reuse pop.ts::signatureBase (hardcoded to 2 components);
+// it renders its own base, mirroring Python fora_sdk/httpsig.py::sign_request.
+//
+// created/expires are INJECTED unix seconds (L1-pure, no wall clock).
+// authorization + signature-agent are ALWAYS bound — an empty string still
+// renders (with the load-bearing trailing space), so a later token/directory
+// injection cannot piggy-back the signature. Values pass through verbatim: the
+// caller supplies an absolute @target-uri; the signer never normalizes it.
+import { opaqueUrl } from "../src/opaque-url.js";
+import { maxSigLabelN, signatureBytesByLabel, } from "./multisig-parse.js";
+import { stdBase64 } from "./sign.js";
+// The FORA request covered set: exactly these five, in this order. No conditional
+// biscuit component — it is bound only when an entitlement header is present,
+// which this signer's inputs never carry. Exported so the verify sibling
+// (core/verify-request.ts) enforces the SAME required set without duplicating it.
+export const COVERED_COMPONENTS = [
+    "@method",
+    "@target-uri",
+    "content-digest",
+    "authorization",
+    "signature-agent",
+];
+// RFC 9530 Content-Digest header value: `sha-256=:<STANDARD-base64(SHA-256)>:`.
+// Exported so the verify sibling recomputes the digest over the exact body bytes
+// and compares against the covered Content-Digest header byte-for-byte.
+export async function contentDigest(body) {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", body));
+    return `sha-256=:${stdBase64(digest)}:`;
+}
+// The @signature-params inner list: the covered components then keyid/alg/
+// created/expires, RFC 9421 order — byte-identical to Go signatureInputInner. An
+// optional chain-link token appends as the final covered component (sigN, N>1),
+// defaulting absent so the single-sig (N=1) inner list stays byte-identical.
+function signatureParams(keyid, created, expires, chainLinkToken) {
+    const tokens = COVERED_COMPONENTS.map((c) => `"${c}"`);
+    if (chainLinkToken !== undefined)
+        tokens.push(chainLinkToken);
+    const covered = tokens.join(" ");
+    return `(${covered});keyid="${keyid}";alg="ed25519";created=${created};expires=${expires}`;
+}
+/**
+ * The RFC 9421 signature base over the FORA 5-component covered set: one
+ * `"name": value` line per component, joined by "\n", terminated by
+ * `"@signature-params": <sigParams>` with NO trailing newline. Empty
+ * authorization/signature-agent still render (name + ": " + "") — the trailing
+ * space is part of the covered bytes and must never be trimmed. Exported and
+ * shared with the verify sibling (core/verify-request.ts) so sign and verify
+ * reconstruct byte-identical bases; `sigParams` is the VERBATIM inner-list +
+ * params tail (the signer's own on sign, the wire's on verify).
+ */
+export function buildRequestSignatureBase(fields, sigParams, chainLink) {
+    const lines = [
+        `"@method": ${fields.method.toUpperCase()}`,
+        `"@target-uri": ${opaqueUrl(fields.url)}`,
+        `"content-digest": ${fields.digestHeader}`,
+        `"authorization": ${fields.authorization}`,
+        `"signature-agent": ${fields.signatureAgent}`,
+    ];
+    // The chain-link line is the LAST covered component BEFORE @signature-params
+    // (Go buildSignatureBase renders params.Covered in order, chain link last).
+    if (chainLink !== undefined) {
+        lines.push(`${chainLink.token}: ${chainLink.value}`);
+    }
+    lines.push(`"@signature-params": ${sigParams}`);
+    return lines.join("\n");
+}
+/**
+ * signRequest signs opts over the FORA 5-component covered set with privKey and
+ * returns the RFC 9421 Content-Digest, Signature-Input, and Signature header
+ * values plus the exact signature base the signature covers. The Signature is
+ * `sig1=:<STANDARD-base64(sig)>:` (NOT b64url — do not unify with the thumbprint
+ * encoding); Signature-Input is `sig1=` + the same inner the base carries.
+ */
+export async function signRequest(privKey, opts) {
+    const digestHeader = await contentDigest(opts.body);
+    const sigParams = signatureParams(opts.keyid, opts.created, opts.expires);
+    const base = buildRequestSignatureBase({
+        method: opts.method,
+        url: opts.url,
+        digestHeader,
+        authorization: opts.authorization,
+        signatureAgent: opts.signatureAgent,
+    }, sigParams);
+    const sig = await crypto.subtle.sign("Ed25519", privKey, new TextEncoder().encode(base));
+    return {
+        contentDigest: digestHeader,
+        signatureInput: `sig1=${sigParams}`,
+        signature: `sig1=:${stdBase64(new Uint8Array(sig))}:`,
+        signatureBase: base,
+        authorization: opts.authorization,
+        signatureAgent: opts.signatureAgent,
+    };
+}
+/**
+ * appendSignature chains sig(N+1) onto `prev` WITHOUT disturbing existing members
+ * (forwarding chain), the TS port of Go helpers.AppendSignature. It finds
+ * the next label sig(N+1) and predecessor sigN, binds the FORA base plus a
+ * `"signature";key="sigN"` link whose value is `:<std-base64(decoded predecessor
+ * sig bytes)>:` (re-encoded canonically, NOT a wire splice), Ed25519-signs, and
+ * returns the APPENDED Signature-Input / Signature strings. Appending to an
+ * unsigned request (empty prev) produces a sig1 byte-for-byte identical to
+ * signRequest — single-sig is the N=1 case.
+ */
+export async function appendSignature(privKey, prev, opts) {
+    const digestHeader = await contentDigest(opts.body);
+    const hasPrev = prev.signatureInput !== "";
+    const prevN = hasPrev ? maxSigLabelN(prev.signatureInput) : 0;
+    const label = `sig${prevN + 1}`;
+    let chainLink;
+    let chainLinkToken;
+    if (prevN > 0) {
+        const prevLabel = `sig${prevN}`;
+        const prevBytes = signatureBytesByLabel(prev.signature)[prevLabel];
+        if (!prevBytes) {
+            throw new Error(`appendSignature: predecessor ${prevLabel} not in Signature`);
+        }
+        chainLinkToken = `"signature";key="${prevLabel}"`;
+        chainLink = { token: chainLinkToken, value: `:${stdBase64(prevBytes)}:` };
+    }
+    const sigParams = signatureParams(opts.keyid, opts.created, opts.expires, chainLinkToken);
+    const base = buildRequestSignatureBase({
+        method: opts.method,
+        url: opts.url,
+        digestHeader,
+        authorization: opts.authorization,
+        signatureAgent: opts.signatureAgent,
+    }, sigParams, chainLink);
+    const sig = await crypto.subtle.sign("Ed25519", privKey, new TextEncoder().encode(base));
+    const memberInput = `${label}=${sigParams}`;
+    const memberSig = `${label}=:${stdBase64(new Uint8Array(sig))}:`;
+    return {
+        contentDigest: digestHeader,
+        signatureInput: hasPrev ? `${prev.signatureInput}, ${memberInput}` : memberInput,
+        signature: prev.signature !== "" ? `${prev.signature}, ${memberSig}` : memberSig,
+        signatureBase: base,
+        authorization: opts.authorization,
+        signatureAgent: opts.signatureAgent,
+    };
+}

package/sdk/ts/core/sign.d.ts

@@ -0,0 +1,31 @@
+import { type Window } from "./window.ts";
+/**
+ * Ed25519 sign primitive: (privateKey, message) -> signature. Injected so a
+ * non-WebCrypto runtime can supply its own without changing the byte contract.
+ * Defaults to WebCrypto crypto.subtle over a CryptoKey.
+ */
+export type Ed25519SignFn = (message: Uint8Array) => Promise<Uint8Array>;
+/** Options for signInbound — the created/expires window + an injectable clock. */
+export interface SignInboundOptions {
+    now?: () => number;
+    ttlSec?: number;
+    /**
+     * An injectable signature Window sourcing (created, expires). Defaults to a
+     * clockWindow over `now`/`ttlSec` (both floored to integer seconds). Supply a
+     * monotonicWindow to keep back-to-back signatures' expires cutoffs unique.
+     */
+    window?: Window;
+}
+/**
+ * signInbound produces a genuinely RFC 9421 GET-PoP-signed inbound Request over
+ * @method + @target-uri, bound to the agent keypair's RFC 7638 thumbprint (keyid =
+ * agent_id). It is the sign side the Hono server-verify binding accepts; it returns
+ * a NEW Request carrying the X-FORA-Agent-Key, Signature-Input, and Signature
+ * headers (the Fetch Request is immutable — we clone + set headers, never mutate).
+ *
+ * The covered set is exactly ("@method" "@target-uri"), matching the L1 pop
+ * verifier's coversExactly, and the signature base is the L1 signatureBase byte
+ * contract, so the produced request verifies through verifyAgentBinding unchanged.
+ */
+export declare function signInbound(kp: CryptoKeyPair, url: string, opts?: SignInboundOptions): Promise<Request>;
+export declare function stdBase64(bytes: Uint8Array): string;

package/sdk/ts/core/sign.js

@@ -0,0 +1,82 @@
+// sdk/ts/core sign seam — the client/inbound sign face over the WHATWG Fetch
+// Request, mirror of the Go RoundTripper sign face (transport.go) but adapted to
+// the IMMUTABLE Fetch Request: it returns a NEW signed Request (headers set on a
+// clone), never mutating in place. It signs the RFC 9421 covered components over
+// the EXACT request (for a GET PoP: @method + @target-uri), reusing the L1
+// signatureBase byte contract so the signed bytes are byte-identical to what the
+// L1 pop verifier reconstructs.
+//
+// ZERO framework import (no hono, no connect-es) — only WebCrypto + the L1
+// helpers. The Hono binding (sdk/ts/hono) composes this seam; this seam composes
+// nothing above the web standard.
+import { encodeBase64Url } from "../src/base64url.js";
+import { opaqueUrl } from "../src/opaque-url.js";
+import { AGENT_KEY_HEADER, signatureBase } from "../src/pop.js";
+import { thumbprint } from "../src/thumbprint.js";
+import { clockWindow } from "./window.js";
+// A default signing window (seconds) for the GET PoP created/expires params.
+const DEFAULT_POP_TTL_SEC = 600;
+/**
+ * signInbound produces a genuinely RFC 9421 GET-PoP-signed inbound Request over
+ * @method + @target-uri, bound to the agent keypair's RFC 7638 thumbprint (keyid =
+ * agent_id). It is the sign side the Hono server-verify binding accepts; it returns
+ * a NEW Request carrying the X-FORA-Agent-Key, Signature-Input, and Signature
+ * headers (the Fetch Request is immutable — we clone + set headers, never mutate).
+ *
+ * The covered set is exactly ("@method" "@target-uri"), matching the L1 pop
+ * verifier's coversExactly, and the signature base is the L1 signatureBase byte
+ * contract, so the produced request verifies through verifyAgentBinding unchanged.
+ */
+export async function signInbound(kp, url, opts = {}) {
+    const rawPub = new Uint8Array(await crypto.subtle.exportKey("raw", kp.publicKey));
+    const agentId = await thumbprint(rawPub);
+    // Source (created, expires) from the injected Window, defaulting to a
+    // clockWindow over now (ms → seconds) and ttlSec. clockWindow floors to
+    // integer seconds, so the @signature-params bytes stay byte-identical to the
+    // historical inline `Math.floor(now()/1000)` mint.
+    const ttlSec = opts.ttlSec ?? DEFAULT_POP_TTL_SEC;
+    const window = opts.window ??
+        clockWindow(() => (opts.now?.() ?? Date.now()) / 1000, ttlSec);
+    const [created, expires] = window();
+    // The @signature-params inner list the verifier rebuilds verbatim: covered
+    // components then keyid/alg/created/expires, RFC 9421 order.
+    const rawParams = `("@method" "@target-uri");keyid="${agentId}";alg="ed25519";created=${created};expires=${expires}`;
+    // Coerce a URL-like input (a Fastly Compute request URL object) to its opaque
+    // string form ONCE at the boundary, so the signed @target-uri and the emitted
+    // Request carry the same verbatim bytes. No-op for string callers.
+    const target = opaqueUrl(url);
+    // The signature base is line-delimited and `target` is written into it
+    // verbatim, so a control byte would add or split a component line and the bytes
+    // signed here would stop describing the request a verifier reconstructs.
+    // Refused rather than escaped, mirroring the Go signer. Checked AFTER the
+    // coercion above so it inspects the bytes that actually get signed — and before
+    // `new Request(target, …)` below, which would otherwise throw an opaque
+    // TypeError instead of naming the reason.
+    // Scanned over the UTF-8 BYTES, not the code points, so the reported offset is
+    // the same number Go's strings.IndexFunc reports for the same input. Which
+    // inputs are refused is unaffected — a control byte is always a single UTF-8
+    // byte — but an unlabelled index under identical wording meant three units.
+    const badAt = new TextEncoder()
+        .encode(target)
+        .findIndex((b) => b < 0x20 || b === 0x7f);
+    if (badAt !== -1) {
+        throw new TypeError(`target URI carries a control byte at byte ${badAt}`);
+    }
+    const base = signatureBase("GET", target, rawParams);
+    const sig = await crypto.subtle.sign("Ed25519", kp.privateKey, new TextEncoder().encode(base));
+    const sigStd = stdBase64(new Uint8Array(sig));
+    const headers = new Headers();
+    headers.set(AGENT_KEY_HEADER, encodeBase64Url(rawPub));
+    headers.set("signature-input", `sig1=${rawParams}`);
+    headers.set("signature", `sig1=:${sigStd}:`);
+    return new Request(target, { method: "GET", headers });
+}
+// stdBase64 encodes bytes as standard (padded) base64 — the RFC 9421 Signature
+// header byte-string encoding the L1 parseSignature decodes. Exported so the
+// 5-component request signer (core/sign-request.ts) shares the exact encoder.
+export function stdBase64(bytes) {
+    let bin = "";
+    for (let i = 0; i < bytes.length; i += 1)
+        bin += String.fromCharCode(bytes[i]);
+    return btoa(bin);
+}

package/sdk/ts/core/signing-transport.d.ts

@@ -0,0 +1,75 @@
+import { type PriorSignatures } from "./sign-request.ts";
+import { type Window } from "./window.ts";
+/** Inputs for signOutbound — the transport-neutral header core. */
+export interface SignOutboundOptions {
+    privKey: CryptoKey;
+    keyid: string;
+    method: string;
+    url: string;
+    body: Uint8Array<ArrayBuffer>;
+    authorization: string;
+    signatureAgent: string;
+    window?: Window;
+    appendOnly?: boolean;
+    prior?: PriorSignatures;
+}
+/** The RFC 9421 header set (plus the untouched body) a signed request carries. */
+export interface SignedOutbound {
+    headers: Record<string, string>;
+    body: Uint8Array<ArrayBuffer>;
+}
+/**
+ * signOutbound computes the RFC 9421 Content-Digest / Signature-Input / Signature
+ * headers for one outbound request and returns them with the body untouched — the
+ * transport-neutral core (Python SignedOutbound sibling). It orchestrates the
+ * parity-locked primitives: appendSignature when appendOnly is set OR a prior
+ * Signature is present (forwarding chain), signRequest otherwise.
+ *
+ * It returns EVERY covered header at the value that entered the signature base, empty
+ * values included — see the emit below for why. The keys are LOWERCASE, which is the
+ * spelling the corpus records and Python emits, and is what lets a merge over a caller's
+ * own headers replace rather than duplicate.
+ */
+export declare function signOutbound(o: SignOutboundOptions): Promise<SignedOutbound>;
+/** The WHATWG-fetch-shaped outbound request the transport inspects / forwards. */
+export interface OutboundInit {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: Uint8Array<ArrayBuffer>;
+}
+/** The seam createSigningTransport wraps: a WHATWG-fetch-shaped send(url, init). */
+export type OutboundSend<R> = (url: string, init: OutboundInit) => Promise<R>;
+/** What a sign predicate inspects to decide whether a request is signed. */
+export interface OutboundRequest {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body: Uint8Array<ArrayBuffer> | undefined;
+}
+/**
+ * Options for createSigningTransport — an idiomatic TS options object, one field per
+ * Go WithX (transport.go:47-96). window replaces the default freshness window;
+ * appendOnly forces the relay append branch; signatureAgent supplies the covered
+ * directory value stamped SET-IF-ABSENT; predicate gates which requests are signed
+ * (default: sign every bodied request).
+ */
+export interface SigningTransportOptions {
+    privKey: CryptoKey;
+    keyid: string;
+    window?: Window;
+    appendOnly?: boolean;
+    signatureAgent?: string;
+    predicate?: (req: OutboundRequest) => boolean;
+}
+/**
+ * createSigningTransport wraps a WHATWG-fetch-shaped send and returns a send with the
+ * same shape that auto-signs each outbound request: it buffers the body, computes
+ * the RFC 9421 headers via signOutbound, merges them, and forwards the SAME body
+ * bytes to the wrapped send. A request with no body — or one the predicate
+ * excludes — passes through UNSIGNED (there is nothing to bind a Content-Digest
+ * to); that is not an error. A request already carrying a Signature is CHAINED
+ * onto (appendSignature), never replaced. Naming stays family-consistent with the
+ * newXResolver siblings; the whole-surface newX -> create rename is a separate,
+ * broader change, not this module's concern.
+ */
+export declare function createSigningTransport<R>(send: OutboundSend<R>, opts: SigningTransportOptions): OutboundSend<R>;

package/sdk/ts/core/signing-transport.js

@@ -0,0 +1,172 @@
+// sdk/ts outbound auto-sign transport — the TS sibling of Go
+// core.NewSigningTransport (sdk/go/core/transport.go) and Python
+// SigningTransport / SignedOutbound (sdk/python/fora_sdk/signing_transport.py).
+//
+// Core Invariant: this module is a pure ORCHESTRATION of the already
+// byte-parity-locked primitives signRequest / appendSignature (core/sign-request.ts)
+// and clockWindow / monotonicWindow (core/window.ts). It stamps EVERY covered header
+// at the value that entered the signature base — Content-Digest / Signature-Input /
+// Signature, and the Authorization / Signature-Agent whose values may be empty —
+// byte-identical to the shared Go/Python oracle, forwards the request body UNMODIFIED,
+// and adds NO new crypto and NO new signature-base rendering.
+//
+// Two faces, mirroring Python's transport-neutral shape (the cleaner fit for TS's
+// multi-runtime edge, which has no Go http.RoundTripper):
+//   - signOutbound(...): the transport-NEUTRAL header core (Python SignedOutbound
+//     sibling) — computes the RFC 9421 headers for one request and returns them
+//     with the untouched body. Wraps no client.
+//   - createSigningTransport(send, opts): wraps a WHATWG-fetch-shaped outbound seam
+//     send(url, init) — buffers the body, computes headers via signOutbound, and
+//     forwards the SAME body bytes to send.
+//
+// Signature-Agent is SET-IF-ABSENT (mirror Go transport.go:143-145, NOT Python's
+// always-stamp): TS carries the relay/append chain, where an upstream sig1 already
+// covers its own Signature-Agent value and must never be overwritten.
+import { SignatureAgentHeader } from "../src/wire.js";
+import { appendSignature, signRequest, } from "./sign-request.js";
+import { clockWindow } from "./window.js";
+// The DEFAULT freshness window: clock-derived created + a 5-minute TTL, matching
+// Go's `signWindow = 5 * time.Minute` (transport.go:18) — NOT Python's 600s. The
+// clock reads seconds (Date.now()/1000); clockWindow floors to Go's .Unix().
+const DEFAULT_WINDOW_TTL_SEC = 300;
+function defaultWindow() {
+    return clockWindow(() => Date.now() / 1000, DEFAULT_WINDOW_TTL_SEC);
+}
+// Case-insensitive header lookup over a plain header record. Incoming requests may
+// spell header names in any case; the covered values (authorization, prior
+// Signature state, Signature-Agent) must be read regardless of casing.
+function getHeader(headers, name) {
+    const lower = name.toLowerCase();
+    for (const k of Object.keys(headers)) {
+        if (k.toLowerCase() === lower)
+            return headers[k];
+    }
+    return undefined;
+}
+/**
+ * mergeSigned overlays the signed headers onto the caller's, REPLACING any the caller
+ * spelled in a different case rather than letting both survive.
+ *
+ * A plain spread would not: header names are case-insensitive on the wire, JS object keys
+ * are not, so a caller's `Authorization` and a signed `authorization` become two field
+ * lines. getHeader above already reads case-insensitively; this is the write side
+ * agreeing with it. See docs/design-history.md, "A covered header the peer never receives
+ * is not bound".
+ */
+function mergeSigned(callerHeaders, signedHeaders) {
+    const claimed = new Set(Object.keys(signedHeaders).map((k) => k.toLowerCase()));
+    const merged = {};
+    for (const [name, value] of Object.entries(callerHeaders)) {
+        if (!claimed.has(name.toLowerCase()))
+            merged[name] = value;
+    }
+    return { ...merged, ...signedHeaders };
+}
+/**
+ * signOutbound computes the RFC 9421 Content-Digest / Signature-Input / Signature
+ * headers for one outbound request and returns them with the body untouched — the
+ * transport-neutral core (Python SignedOutbound sibling). It orchestrates the
+ * parity-locked primitives: appendSignature when appendOnly is set OR a prior
+ * Signature is present (forwarding chain), signRequest otherwise.
+ *
+ * It returns EVERY covered header at the value that entered the signature base, empty
+ * values included — see the emit below for why. The keys are LOWERCASE, which is the
+ * spelling the corpus records and Python emits, and is what lets a merge over a caller's
+ * own headers replace rather than duplicate.
+ */
+export async function signOutbound(o) {
+    const [created, expires] = (o.window ?? defaultWindow())();
+    const signOpts = {
+        method: o.method,
+        url: o.url,
+        body: o.body,
+        authorization: o.authorization,
+        signatureAgent: o.signatureAgent,
+        keyid: o.keyid,
+        created,
+        expires,
+    };
+    const prior = o.prior ?? { signatureInput: "", signature: "" };
+    const chained = (o.appendOnly ?? false) || prior.signature !== "";
+    const signed = chained
+        ? await appendSignature(o.privKey, prior, signOpts)
+        : await signRequest(o.privKey, signOpts);
+    // EVERY covered header is emitted, at exactly the value that entered the signature
+    // base — empty values included. A verifier rebuilds the base from the request it
+    // received, so a value bound but never sent is not bound at all: it reads the covered
+    // names off signature-input, finds nothing on the wire under one of them, and refuses.
+    // Measured: the covered set binds authorization and signature-agent unconditionally,
+    // and a request carrying neither is answered `header "authorization" missing from
+    // request` by every conformant verifier — so the ports agreed byte-for-byte with the
+    // oracle on what they signed and could not complete a single call.
+    //
+    // EVERY covered header, at exactly the value that entered the signature base — empty
+    // values included. See docs/design-history.md, "A covered header the peer never
+    // receives is not bound", for why binding one without sending it is not binding it,
+    // and why the emitted key is LOWERCASE (a signed key spelled differently from the
+    // caller's survives the merge beside it, putting the name on the wire twice).
+    //
+    // Taken straight off `signed`, never re-read from `o`: the primitive echoes what it
+    // bound, so there is one place the emitted value can come from and no way for the two
+    // to drift.
+    const headers = {
+        "content-digest": signed.contentDigest,
+        "signature-input": signed.signatureInput,
+        signature: signed.signature,
+        authorization: signed.authorization,
+        [SignatureAgentHeader.toLowerCase()]: signed.signatureAgent,
+    };
+    return { headers, body: o.body };
+}
+/**
+ * createSigningTransport wraps a WHATWG-fetch-shaped send and returns a send with the
+ * same shape that auto-signs each outbound request: it buffers the body, computes
+ * the RFC 9421 headers via signOutbound, merges them, and forwards the SAME body
+ * bytes to the wrapped send. A request with no body — or one the predicate
+ * excludes — passes through UNSIGNED (there is nothing to bind a Content-Digest
+ * to); that is not an error. A request already carrying a Signature is CHAINED
+ * onto (appendSignature), never replaced. Naming stays family-consistent with the
+ * newXResolver siblings; the whole-surface newX -> create rename is a separate,
+ * broader change, not this module's concern.
+ */
+export function createSigningTransport(send, opts) {
+    const window = opts.window ?? defaultWindow();
+    return async (url, init) => {
+        const body = init.body;
+        const method = init.method ?? "GET";
+        const headers = init.headers ?? {};
+        // No body / predicate-excluded: pass through UNSIGNED, body untouched.
+        const excluded = opts.predicate !== undefined &&
+            !opts.predicate({ url, method, headers, body });
+        if (body === undefined || excluded) {
+            return send(url, init);
+        }
+        // Signature-Agent SET-IF-ABSENT: the incoming header (an upstream sig1's
+        // covered directory) wins; otherwise the transport stamps its own.
+        const existingAgent = getHeader(headers, SignatureAgentHeader);
+        const signatureAgent = existingAgent ?? opts.signatureAgent ?? "";
+        const prior = {
+            signatureInput: getHeader(headers, "signature-input") ?? "",
+            signature: getHeader(headers, "signature") ?? "",
+        };
+        const signed = await signOutbound({
+            privKey: opts.privKey,
+            keyid: opts.keyid,
+            method,
+            url,
+            body,
+            authorization: getHeader(headers, "authorization") ?? "",
+            signatureAgent,
+            window,
+            appendOnly: opts.appendOnly ?? false,
+            prior,
+        });
+        // Forward the SAME body bytes (body integrity — buffer for the digest
+        // but never consume/replace the payload; Go resets req.Body + GetBody).
+        return send(url, {
+            ...init,
+            headers: mergeSigned(headers, signed.headers),
+            body,
+        });
+    };
+}