wb-auth 0.1.1 → 0.2.0

package/README.md

@@ -1,8 +1,65 @@
-# wbauth (TypeScript)
+# wb-auth — Web Bot Auth for TypeScript
+
+[![npm](https://img.shields.io/npm/v/wb-auth?style=flat-square&color=111111&label=npm)](https://www.npmjs.com/package/wb-auth)
+
+Ed25519 [RFC 9421](https://www.rfc-editor.org/rfc/rfc9421) request signing with the IETF
+Web Bot Auth profile. Byte-identical to the Python SDK (`pip install wbauth`).
 
 ```bash
-npm install wbauth   # Phase 5 — not yet published
+npm install wb-auth
+```
+
+Node ≥ 20. Ships ESM (`import`) and CommonJS (`require`) builds with types.
+
+## Sign `fetch`
+
+```ts
+import { Identity, createSignedFetch } from "wb-auth";
+
+const identity = await Identity.loadOrGenerate("~/.config/wbauth/key.pem", {
+  signatureAgentUrl: "https://agent.example.com/.well-known/http-message-signatures-directory",
+  userAgent: "ExampleAgent/1.0 (+https://agent.example.com)",
+});
+
+const signedFetch = createSignedFetch(identity);
+await signedFetch("https://example.com/articles/42");
+```
+
+- POST/PUT/PATCH bodies get a `Content-Digest` (RFC 9530) that is covered by the signature.
+- Retries are safe: stale `Signature*` headers are replaced, never merged.
+- `signal`, `redirect`, `credentials`, … from a `Request` input are preserved.
+
+## Sign a Playwright page
+
+```ts
+import { chromium } from "playwright";
+import { Identity, applyTo } from "wb-auth";
+
+const page = await (await chromium.launch()).newPage();
+// Only sign requests to the sites you target — third parties never see your identity.
+await applyTo(page, identity, { hosts: ["example.com", "*.example.com"] });
+await page.goto("https://example.com");
+```
+
+## Low-level
+
+```ts
+import { sign } from "wb-auth";
+
+const headers: Record<string, string> = {};
+await sign({ method: "GET", url: "https://example.com/", headers, body: null }, identity);
+// headers now has Signature, Signature-Input, Signature-Agent
 ```
 
-Phase 1: stub package — only used as the cross-language vector check oracle.
-Phase 4: full SDK with createSignedFetch + Playwright applyTo.
+`sign()` throws if a POST/PUT/PATCH body has no `Content-Digest` header
+(use `createSignedFetch`/`applyTo`, which add it automatically).
+
+## Keys
+
+`Identity.loadOrGenerate(path, opts)` creates an Ed25519 key with mode `0600`
+and refuses to load keys readable by others. `identity.exportJwks()` returns
+the public JWKS to publish; `identity.rotate()` keeps the previous key in the
+JWKS during the overlap window.
+
+See the [repository README](../README.md) for the policy inspector (Python),
+CLI and the hosted JWKS directory.

package/dist/{index.mjs → index.cjs}

@@ -1,5 +1,36 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_KEY_PATH: () => DEFAULT_KEY_PATH,
+  Identity: () => Identity,
+  VERSION: () => VERSION,
+  applyTo: () => applyTo,
+  createSignedFetch: () => createSignedFetch,
+  sign: () => sign
+});
+module.exports = __toCommonJS(index_exports);
+
 // src/signer.ts
-import { signatureHeaders } from "web-bot-auth";
+var import_web_bot_auth = require("web-bot-auth");
 var DEFAULT_LABEL = "sig1";
 var DEFAULT_EXPIRES_SECONDS = 60;
 var DIGEST_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
@@ -10,20 +41,41 @@ function componentsFor(method, hasBody) {
   }
   return base;
 }
+var RESIGN_HEADERS = ["signature", "signature-input", "signature-agent"];
+function hasHeader(headers, name) {
+  const n = name.toLowerCase();
+  return Object.keys(headers).some((k) => k.toLowerCase() === n);
+}
+function removeHeaders(headers, names) {
+  for (const k of Object.keys(headers)) {
+    if (names.includes(k.toLowerCase())) delete headers[k];
+  }
+}
 async function sign(request, identity, opts = {}) {
   if (!identity.signatureAgentUrl.startsWith("https://")) {
     throw new Error(
       `signatureAgentUrl must be https://, got: ${identity.signatureAgentUrl}`
     );
   }
+  const expiresAfterSeconds = opts.expiresAfterSeconds ?? DEFAULT_EXPIRES_SECONDS;
+  if (!Number.isFinite(expiresAfterSeconds) || expiresAfterSeconds <= 0) {
+    throw new RangeError(
+      `expiresAfterSeconds must be a positive number, got: ${expiresAfterSeconds}`
+    );
+  }
+  removeHeaders(request.headers, RESIGN_HEADERS);
   const signatureAgentHeader = `"${identity.signatureAgentUrl}"`;
   request.headers["Signature-Agent"] = signatureAgentHeader;
   const created = opts.created ?? /* @__PURE__ */ new Date();
-  const expiresAfterSeconds = opts.expiresAfterSeconds ?? DEFAULT_EXPIRES_SECONDS;
   const expires = new Date(created.getTime() + expiresAfterSeconds * 1e3);
   const label = opts.label ?? DEFAULT_LABEL;
-  const hasBody = request.body !== null && request.body !== void 0;
+  const hasBody = request.body !== null && request.body !== void 0 && request.body.byteLength > 0;
   const components = componentsFor(request.method, hasBody);
+  if (components.includes("content-digest") && !hasHeader(request.headers, "content-digest")) {
+    throw new Error(
+      'Covered header field "content-digest" not found in the message. Call ensureContentDigest() or use createSignedFetch()/applyTo(), which add it automatically.'
+    );
+  }
   const headers = new Headers();
   for (const [k, v] of Object.entries(request.headers)) headers.set(k, v);
   const init = { method: request.method, headers };
@@ -36,7 +88,7 @@ async function sign(request, identity, opts = {}) {
     components,
     ...opts.nonce !== void 0 ? { nonce: opts.nonce } : {}
   };
-  const result = await signatureHeaders(req, identity._signer(), params);
+  const result = await (0, import_web_bot_auth.signatureHeaders)(req, identity._signer(), params);
   request.headers.Signature = result.Signature;
   request.headers["Signature-Input"] = result["Signature-Input"];
   return {
@@ -47,20 +99,46 @@ async function sign(request, identity, opts = {}) {
 }
 
 // src/adapters/_utils.ts
-import { createHash } from "crypto";
+var import_node_crypto = require("crypto");
 var DIGEST_METHODS2 = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
+var LIBRARY_DEFAULT_UA = /^(node|undici|node-fetch)(\/|$)/i;
+function findHeader(headers, name) {
+  const n = name.toLowerCase();
+  return Object.keys(headers).find((k) => k.toLowerCase() === n);
+}
 function ensureContentDigest(method, headers, body) {
   if (!body || body.byteLength === 0) return;
   if (!DIGEST_METHODS2.has(method.toUpperCase())) return;
-  if (Object.keys(headers).some((k) => k.toLowerCase() === "content-digest")) {
+  if (findHeader(headers, "content-digest")) return;
+  const b64 = (0, import_node_crypto.createHash)("sha256").update(body).digest("base64");
+  headers["Content-Digest"] = `sha-256=:${b64}:`;
+}
+function applyUserAgent(headers, userAgent) {
+  if (!userAgent) return;
+  const key = findHeader(headers, "user-agent");
+  if (key === void 0) {
+    headers["User-Agent"] = userAgent;
     return;
   }
-  const b64 = createHash("sha256").update(body).digest("base64");
-  headers["Content-Digest"] = `sha-256=:${b64}:`;
+  if (LIBRARY_DEFAULT_UA.test(headers[key] ?? "")) {
+    delete headers[key];
+    headers["User-Agent"] = userAgent;
+  }
+}
+function hostMatches(hostname, allow) {
+  const h = hostname.toLowerCase().replace(/\.$/, "");
+  return allow.some((raw) => {
+    const a = raw.toLowerCase().replace(/\.$/, "");
+    if (a.startsWith("*.")) {
+      const base = a.slice(2);
+      return h === base || h.endsWith(`.${base}`);
+    }
+    return h === a;
+  });
 }
 
 // src/adapters/fetch.ts
-function createSignedFetch(identity) {
+function createSignedFetch(identity, options = {}) {
   return async function signedFetch(input, init = {}) {
     const req = new Request(input, init);
     const method = req.method;
@@ -76,52 +154,68 @@ function createSignedFetch(identity) {
     });
     ensureContentDigest(method, headers, body);
     await sign({ method, url, headers, body }, identity);
-    if (identity.userAgent && !Object.keys(headers).some((k) => k.toLowerCase() === "user-agent")) {
-      headers["User-Agent"] = identity.userAgent;
-    }
-    return fetch(url, {
+    applyUserAgent(headers, identity.userAgent);
+    const outInit = {
       ...init,
       method,
       headers,
-      body: body ?? void 0
-    });
+      // Uint8Array is a valid BodyInit at runtime; DOM typings disagree.
+      body: body ?? void 0,
+      signal: init.signal ?? req.signal,
+      redirect: init.redirect ?? req.redirect,
+      credentials: init.credentials ?? req.credentials,
+      cache: init.cache ?? req.cache,
+      keepalive: init.keepalive ?? req.keepalive
+    };
+    const integrity = init.integrity ?? req.integrity;
+    if (integrity) outInit.integrity = integrity;
+    const referrerPolicy = init.referrerPolicy ?? req.referrerPolicy;
+    if (referrerPolicy) outInit.referrerPolicy = referrerPolicy;
+    const doFetch = options.fetch ?? globalThis.fetch;
+    return doFetch(url, outInit);
   };
 }
 
 // src/adapters/playwright.ts
-async function applyTo(page, identity) {
-  await page.route("**/*", async (route, request) => {
+async function applyTo(page, identity, options = {}) {
+  const pattern = options.pattern ?? "**/*";
+  const decide = (raw) => {
+    let u;
+    try {
+      u = new URL(raw);
+    } catch {
+      return false;
+    }
+    if (u.protocol !== "https:" && u.protocol !== "http:") return false;
+    if (options.shouldSign) return options.shouldSign(u);
+    if (options.hosts) return hostMatches(u.hostname, options.hosts);
+    return true;
+  };
+  await page.route(pattern, async (route, request) => {
+    const url = request.url();
+    if (!decide(url)) {
+      const r = route;
+      await (r.fallback ? r.fallback() : route.continue());
+      return;
+    }
     const headers = await request.allHeaders();
     const postData = request.postDataBuffer();
     const body = postData ? new Uint8Array(postData) : null;
     ensureContentDigest(request.method(), headers, body);
-    await sign(
-      { method: request.method(), url: request.url(), headers, body },
-      identity
-    );
-    if (identity.userAgent && !Object.keys(headers).some((k) => k.toLowerCase() === "user-agent")) {
-      headers["User-Agent"] = identity.userAgent;
-    }
+    await sign({ method: request.method(), url, headers, body }, identity);
+    applyUserAgent(headers, identity.userAgent);
     await route.continue({ headers });
   });
 }
 
 // src/identity.ts
-import { createPrivateKey, generateKeyPairSync } from "crypto";
-import {
-  closeSync,
-  existsSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  statSync,
-  writeFileSync
-} from "fs";
-import { homedir } from "os";
-import { dirname, resolve } from "path";
-import { signerFromJWK } from "web-bot-auth/crypto";
-var DEFAULT_KEY_PATH = resolve(
-  homedir(),
+var import_node_crypto2 = require("crypto");
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var import_crypto = require("web-bot-auth/crypto");
+var DEFAULT_KEY_PATH = (0, import_node_path.resolve)(
+  (0, import_node_os.homedir)(),
   ".config",
   "wbauth",
   "key.pem"
@@ -191,7 +285,7 @@ var Identity = class _Identity {
    */
   static async loadOrGenerate(path = DEFAULT_KEY_PATH, opts) {
     const resolved = expandUser(path);
-    const pair = existsSync(resolved) ? await loadKeypair(resolved) : await generateKeypairTo(resolved);
+    const pair = (0, import_node_fs.existsSync)(resolved) ? await loadKeypair(resolved) : await generateKeypairTo(resolved);
     return new _Identity(pair, opts);
   }
   /**
@@ -199,9 +293,9 @@ var Identity = class _Identity {
    * For tests + Cloudflare debug smoke checks. NEVER use in production.
    * Does NOT write any file to disk.
    */
-  static async fromTestKey(signatureAgentUrl) {
+  static async fromTestKey(signatureAgentUrl, opts = {}) {
     const pair = await keyPairFromJwk(TEST_KEY_JWK);
-    return new _Identity(pair, { signatureAgentUrl });
+    return new _Identity(pair, { ...opts, signatureAgentUrl });
   }
   // ---------- Redaction guarantees (IDENT-08) ----------
   toString() {
@@ -213,10 +307,10 @@ var Identity = class _Identity {
   }
 };
 function expandUser(path) {
-  return resolve(path.startsWith("~") ? path.replace(/^~/, homedir()) : path);
+  return (0, import_node_path.resolve)(path.startsWith("~") ? path.replace(/^~/, (0, import_node_os.homedir)()) : path);
 }
 async function keyPairFromJwk(privateJwk) {
-  const signer = await signerFromJWK(privateJwk);
+  const signer = await (0, import_crypto.signerFromJWK)(privateJwk);
   const kid = signer.keyid;
   const publicJwk = {
     kty: privateJwk.kty,
@@ -228,7 +322,7 @@ async function keyPairFromJwk(privateJwk) {
 }
 async function loadKeypair(path) {
   if (process.platform !== "win32") {
-    const mode = statSync(path).mode & 511;
+    const mode = (0, import_node_fs.statSync)(path).mode & 511;
     if ((mode & 63) !== 0) {
       throw new Error(
         `Key file ${path} has mode 0o${mode.toString(8)}; expected 0o600. Fix: chmod 600 ${path}`
@@ -239,38 +333,40 @@ async function loadKeypair(path) {
       `Windows detected \u2014 file permissions on ${path} cannot be enforced via POSIX mode. Use NTFS ACLs or store the key in a per-user secrets vault.`
     );
   }
-  const pem = readFileSync(path, "utf8");
-  const jwk = createPrivateKey(pem).export({ format: "jwk" });
+  const pem = (0, import_node_fs.readFileSync)(path, "utf8");
+  const jwk = (0, import_node_crypto2.createPrivateKey)(pem).export({ format: "jwk" });
   if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519") {
     throw new TypeError(`Expected Ed25519, got kty=${jwk.kty}, crv=${jwk.crv}`);
   }
   return keyPairFromJwk(jwk);
 }
 async function generateKeypairTo(path) {
-  const dir = dirname(path);
-  mkdirSync(dir, { recursive: true });
-  if (existsSync(path)) {
+  const dir = (0, import_node_path.dirname)(path);
+  (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+  if ((0, import_node_fs.existsSync)(path)) {
     throw new Error(`Key already exists at ${path}; refuse overwrite`);
   }
-  const { privateKey } = generateKeyPairSync("ed25519");
+  const { privateKey } = (0, import_node_crypto2.generateKeyPairSync)("ed25519");
   const pem = privateKey.export({ format: "pem", type: "pkcs8" });
-  const fd = openSync(path, "wx", 384);
+  const fd = (0, import_node_fs.openSync)(path, "wx", 384);
   try {
-    writeFileSync(fd, pem);
+    (0, import_node_fs.writeFileSync)(fd, pem);
   } finally {
-    closeSync(fd);
+    (0, import_node_fs.closeSync)(fd);
   }
   const jwk = privateKey.export({ format: "jwk" });
   return keyPairFromJwk(jwk);
 }
 
 // src/index.ts
-var VERSION = "0.1.0";
-export {
+var VERSION = "0.2.0";
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
   DEFAULT_KEY_PATH,
   Identity,
   VERSION,
   applyTo,
   createSignedFetch,
   sign
-};
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/signer.ts","../src/adapters/_utils.ts","../src/adapters/fetch.ts","../src/adapters/playwright.ts","../src/identity.ts"],"sourcesContent":["/**\n * wbauth: Web Bot Auth (RFC 9421) TypeScript SDK — Phase 4 public surface.\n *\n * Per CONTEXT D-74: flat root exports. Subpath exports (`wb-auth/adapters`)\n * are a v1.x optimization, not required for Phase 4.\n *\n * Quickstart:\n *   import { Identity, createSignedFetch } from \"wb-auth\";\n *   const id = await Identity.loadOrGenerate(\"./key.pem\", {\n *     signatureAgentUrl: \"https://example.com/.well-known/.../<kid>\",\n *   });\n *   const sf = createSignedFetch(id);\n *   const res = await sf(\"https://api.example.com/data\");\n */\n\nexport type { SignedFetchOptions } from \"./adapters/fetch.js\";\nexport { createSignedFetch } from \"./adapters/fetch.js\";\nexport type { ApplyToOptions } from \"./adapters/playwright.js\";\nexport { applyTo } from \"./adapters/playwright.js\";\nexport type { IdentityOptions, KeyPair } from \"./identity.js\";\nexport { DEFAULT_KEY_PATH, Identity } from \"./identity.js\";\nexport type { NormalizedRequest } from \"./normalized-request.js\";\nexport type { SignatureHeaders, SignOptions } from \"./signer.js\";\nexport { sign } from \"./signer.js\";\n\nexport const VERSION = \"0.2.0\";\n","/**\n * Pure-function signer for Web Bot Auth (RFC 9421).\n *\n * Mirrors python/src/wbauth/signer.py — same defaults (Ed25519, tag=\n * \"web-bot-auth\", expires=created+60s, covered components [\"@authority\",\n * \"signature-agent\"] + \"content-digest\" for bodies).\n *\n * The function delegates all RFC 9421 mechanics (signing-base canonicalization,\n * structured-field encoding, Ed25519 signing) to `web-bot-auth` 0.1.3's\n * `signatureHeaders`. We only own the Web Bot Auth profile glue: pre-setting\n * Signature-Agent (Pitfall 6), picking covered components, defaulting expires.\n */\nimport { type SignatureParams, signatureHeaders } from \"web-bot-auth\";\nimport type { Identity } from \"./identity.js\";\nimport type { NormalizedRequest } from \"./normalized-request.js\";\n\n// ---------- Module constants (HARD-CODED — typos = silent verifier reject) ----------\n\n/** IETF Web Bot Auth profile mandate. NEVER change. Pitfall 6. */\nconst WEB_BOT_AUTH_TAG = \"web-bot-auth\";\n/** Canonical Signature label. Most verifier examples assume \"sig1\". */\nconst DEFAULT_LABEL = \"sig1\";\n/** Default expires window. 60s leaves NTP-skew + network-latency headroom. */\nconst DEFAULT_EXPIRES_SECONDS = 60;\n/** Methods that may carry a body and therefore want content-digest covered. */\nconst DIGEST_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\"]);\n// WEB_BOT_AUTH_TAG is enforced internally by web-bot-auth's signatureHeaders;\n// we keep the constant for greppability of the profile invariant.\nvoid WEB_BOT_AUTH_TAG;\n\n// ---------- Public types ----------\n\nexport interface SignatureHeaders {\n\tsignature: string;\n\tsignatureInput: string;\n\tsignatureAgent: string;\n}\n\nexport interface SignOptions {\n\t/** Signing timestamp. Defaults to `new Date()`. Override for vector reproducibility. */\n\tcreated?: Date;\n\t/** Validity window in seconds. Defaults to 60. */\n\texpiresAfterSeconds?: number;\n\t/** Anti-replay nonce. Defaults to web-bot-auth's `generateNonce()` (64-byte b64). */\n\tnonce?: string;\n\t/** Signature label (the `sig1=` prefix). Defaults to \"sig1\". */\n\tlabel?: string;\n}\n\n// ---------- Components selector (mirror Python `_components_for`) ----------\n\nfunction componentsFor(method: string, hasBody: boolean): string[] {\n\tconst base = [\"@authority\", \"signature-agent\"];\n\tif (hasBody && DIGEST_METHODS.has(method.toUpperCase())) {\n\t\tbase.push(\"content-digest\");\n\t}\n\treturn base;\n}\n\n/** Headers regenerated on every sign() call. */\nconst RESIGN_HEADERS = [\"signature\", \"signature-input\", \"signature-agent\"];\n\nfunction hasHeader(headers: Record<string, string>, name: string): boolean {\n\tconst n = name.toLowerCase();\n\treturn Object.keys(headers).some((k) => k.toLowerCase() === n);\n}\n\nfunction removeHeaders(headers: Record<string, string>, names: string[]): void {\n\tfor (const k of Object.keys(headers)) {\n\t\tif (names.includes(k.toLowerCase())) delete headers[k];\n\t}\n}\n\n// ---------- Public API ----------\n\n/**\n * Sign a NormalizedRequest with the Web Bot Auth profile.\n *\n * Mutates `request.headers` in place: writes Signature-Agent BEFORE building\n * the signing base (Pitfall 6 — without pre-set, web-bot-auth defaults to\n * `[\"@authority\"]` only and silently breaks byte-equality with the Python\n * signer). After signatureHeaders returns, also writes Signature and\n * Signature-Input back into `request.headers`.\n *\n * @returns the same three values as a typed dataclass for callers that prefer\n * a return value over header inspection.\n */\nexport async function sign(\n\trequest: NormalizedRequest,\n\tidentity: Identity,\n\topts: SignOptions = {},\n): Promise<SignatureHeaders> {\n\t// 1. Defensive https:// check — Identity ctor enforces it too, but a future\n\t// bypassed ctor would otherwise leak http://. Pitfall 1.\n\tif (!identity.signatureAgentUrl.startsWith(\"https://\")) {\n\t\tthrow new Error(\n\t\t\t`signatureAgentUrl must be https://, got: ${identity.signatureAgentUrl}`,\n\t\t);\n\t}\n\n\t// 2. Validate options up-front (parity with Python signer).\n\tconst expiresAfterSeconds =\n\t\topts.expiresAfterSeconds ?? DEFAULT_EXPIRES_SECONDS;\n\tif (!Number.isFinite(expiresAfterSeconds) || expiresAfterSeconds <= 0) {\n\t\tthrow new RangeError(\n\t\t\t`expiresAfterSeconds must be a positive number, got: ${expiresAfterSeconds}`,\n\t\t);\n\t}\n\n\t// 3. Drop stale signature headers in ANY casing. A retried / redirected\n\t// request still carries the previous hop's values; leaving them in place\n\t// produces merged `sig1=..., sig1=...` headers that every verifier rejects.\n\tremoveHeaders(request.headers, RESIGN_HEADERS);\n\n\t// 4. Set Signature-Agent header (RFC 8941 string in double quotes).\n\t// CRITICAL: must be set BEFORE signatureHeaders inspects the message,\n\t// otherwise web-bot-auth picks REQUEST_COMPONENTS_WITHOUT_SIGNATURE_AGENT.\n\tconst signatureAgentHeader = `\"${identity.signatureAgentUrl}\"`;\n\trequest.headers[\"Signature-Agent\"] = signatureAgentHeader;\n\n\t// 5. Defaults.\n\tconst created = opts.created ?? new Date();\n\tconst expires = new Date(created.getTime() + expiresAfterSeconds * 1000);\n\tconst label = opts.label ?? DEFAULT_LABEL;\n\n\t// 6. Components based on body presence.\n\tconst hasBody =\n\t\trequest.body !== null &&\n\t\trequest.body !== undefined &&\n\t\trequest.body.byteLength > 0;\n\tconst components = componentsFor(request.method, hasBody);\n\tif (\n\t\tcomponents.includes(\"content-digest\") &&\n\t\t!hasHeader(request.headers, \"content-digest\")\n\t) {\n\t\t// Python raises here too. Signing a missing header would yield a\n\t\t// signature that no verifier can ever validate.\n\t\tthrow new Error(\n\t\t\t'Covered header field \"content-digest\" not found in the message. ' +\n\t\t\t\t\"Call ensureContentDigest() or use createSignedFetch()/applyTo(), which add it automatically.\",\n\t\t);\n\t}\n\n\t// 7. Build a Web `Request` for web-bot-auth's `signatureHeaders`.\n\tconst headers = new Headers();\n\tfor (const [k, v] of Object.entries(request.headers)) headers.set(k, v);\n\tconst init: RequestInit = { method: request.method, headers };\n\t// Cast: Uint8Array is a valid BodyInit at runtime (web fetch spec) but DOM\n\t// typing wants ArrayBufferView/string/Blob etc. The cast is safe.\n\tif (hasBody) init.body = request.body as unknown as BodyInit;\n\tconst req = new Request(request.url, init);\n\n\t// 8. Delegate to web-bot-auth. The signer is the active key's pre-resolved\n\t// Signer (cached in Identity at construction time).\n\tconst params: SignatureParams = {\n\t\tcreated,\n\t\texpires,\n\t\tkey: label,\n\t\tcomponents,\n\t\t...(opts.nonce !== undefined ? { nonce: opts.nonce } : {}),\n\t};\n\tconst result = await signatureHeaders(req, identity._signer(), params);\n\n\t// 9. Mutate request.headers (mirror Python signer behavior).\n\trequest.headers.Signature = result.Signature;\n\trequest.headers[\"Signature-Input\"] = result[\"Signature-Input\"];\n\n\treturn {\n\t\tsignature: result.Signature,\n\t\tsignatureInput: result[\"Signature-Input\"],\n\t\tsignatureAgent: signatureAgentHeader,\n\t};\n}\n","/**\n * Shared adapter helpers (internal — not part of the public surface).\n *\n * Mirror python/src/wbauth/adapters/_utils.py. The signer auto-includes\n * `content-digest` in covered components for POST/PUT/PATCH with a body;\n * adapters call ensureContentDigest() before sign() so that precondition\n * is met. RFC 9530 sha-256 in structured-fields form (`sha-256=:<b64>:`).\n */\nimport { createHash } from \"node:crypto\";\n\nconst DIGEST_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\"]);\n\n/** Default UAs injected by HTTP stacks; an Identity UA should replace them. */\nconst LIBRARY_DEFAULT_UA = /^(node|undici|node-fetch)(\\/|$)/i;\n\nfunction findHeader(\n\theaders: Record<string, string>,\n\tname: string,\n): string | undefined {\n\tconst n = name.toLowerCase();\n\treturn Object.keys(headers).find((k) => k.toLowerCase() === n);\n}\n\n/**\n * Mutate `headers` in place to add Content-Digest when warranted. No-op if:\n * - body is null/empty,\n * - method is not POST/PUT/PATCH,\n * - the request already carries a Content-Digest header (case-insensitive).\n */\nexport function ensureContentDigest(\n\tmethod: string,\n\theaders: Record<string, string>,\n\tbody: Uint8Array | null,\n): void {\n\tif (!body || body.byteLength === 0) return;\n\tif (!DIGEST_METHODS.has(method.toUpperCase())) return;\n\tif (findHeader(headers, \"content-digest\")) return;\n\tconst b64 = createHash(\"sha256\").update(body).digest(\"base64\");\n\theaders[\"Content-Digest\"] = `sha-256=:${b64}:`;\n}\n\n/**\n * Apply the Identity's User-Agent unless the caller explicitly set a\n * non-library UA. Library defaults (node, undici) are replaced.\n */\nexport function applyUserAgent(\n\theaders: Record<string, string>,\n\tuserAgent: string | undefined,\n): void {\n\tif (!userAgent) return;\n\tconst key = findHeader(headers, \"user-agent\");\n\tif (key === undefined) {\n\t\theaders[\"User-Agent\"] = userAgent;\n\t\treturn;\n\t}\n\tif (LIBRARY_DEFAULT_UA.test(headers[key] ?? \"\")) {\n\t\tdelete headers[key];\n\t\theaders[\"User-Agent\"] = userAgent;\n\t}\n}\n\n/**\n * Host allow-list matcher. Entries are exact hostnames (`api.example.com`)\n * or wildcard subdomains (`*.example.com`, which also matches `example.com`).\n */\nexport function hostMatches(\n\thostname: string,\n\tallow: readonly string[],\n): boolean {\n\tconst h = hostname.toLowerCase().replace(/\\.$/, \"\");\n\treturn allow.some((raw) => {\n\t\tconst a = raw.toLowerCase().replace(/\\.$/, \"\");\n\t\tif (a.startsWith(\"*.\")) {\n\t\t\tconst base = a.slice(2);\n\t\t\treturn h === base || h.endsWith(`.${base}`);\n\t\t}\n\t\treturn h === a;\n\t});\n}\n","/**\n * createSignedFetch — drop-in `fetch` wrapper that signs every outgoing request.\n *\n * Mirrors python/src/wbauth/adapters/httpx_auth.py. Stateless: closure over\n * `identity` only. Returns a function whose signature matches `typeof fetch`,\n * so user code can swap `fetch` for `signedFetch` without other changes.\n *\n * - Request-object inputs keep their `signal`, `redirect`, `credentials`,\n *   `cache`, `keepalive`, `integrity` and `referrerPolicy`.\n * - Re-sending an already signed request (retry wrappers) produces exactly one\n *   fresh signature — stale Signature* headers are replaced, never merged.\n *\n * v1 limitation: streaming bodies are buffered (`req.clone().arrayBuffer()`)\n * so Content-Digest can be computed.\n */\n\nimport type { Identity } from \"../identity.js\";\nimport { sign } from \"../signer.js\";\nimport { applyUserAgent, ensureContentDigest } from \"./_utils.js\";\n\nexport interface SignedFetchOptions {\n\t/** Underlying fetch implementation. Defaults to `globalThis.fetch` at call time. */\n\tfetch?: typeof fetch;\n}\n\nexport function createSignedFetch(\n\tidentity: Identity,\n\toptions: SignedFetchOptions = {},\n): typeof fetch {\n\treturn async function signedFetch(\n\t\tinput: RequestInfo | URL,\n\t\tinit: RequestInit = {},\n\t): Promise<Response> {\n\t\tconst req = new Request(input, init);\n\t\tconst method = req.method;\n\t\tconst url = req.url;\n\n\t\t// Read body once — Request consumes its body stream; clone first.\n\t\tlet body: Uint8Array | null = null;\n\t\tif (req.body) {\n\t\t\tconst buf = await req.clone().arrayBuffer();\n\t\t\tbody = buf.byteLength > 0 ? new Uint8Array(buf) : null;\n\t\t}\n\n\t\t// Mutable header dict (Headers already lower-cases + de-duplicates).\n\t\tconst headers: Record<string, string> = {};\n\t\treq.headers.forEach((value, key) => {\n\t\t\theaders[key] = value;\n\t\t});\n\n\t\t// Auto-Content-Digest BEFORE sign() (signer precondition for POST/PUT/PATCH + body).\n\t\tensureContentDigest(method, headers, body);\n\n\t\t// Sign — replaces stale Signature* headers, then writes fresh ones.\n\t\tawait sign({ method, url, headers, body }, identity);\n\t\tapplyUserAgent(headers, identity.userAgent);\n\n\t\tconst outInit: RequestInit = {\n\t\t\t...init,\n\t\t\tmethod,\n\t\t\theaders,\n\t\t\t// Uint8Array is a valid BodyInit at runtime; DOM typings disagree.\n\t\t\tbody: (body ?? undefined) as BodyInit | undefined,\n\t\t\tsignal: init.signal ?? req.signal,\n\t\t\tredirect: init.redirect ?? req.redirect,\n\t\t\tcredentials: init.credentials ?? req.credentials,\n\t\t\tcache: init.cache ?? req.cache,\n\t\t\tkeepalive: init.keepalive ?? req.keepalive,\n\t\t};\n\t\tconst integrity = init.integrity ?? req.integrity;\n\t\tif (integrity) outInit.integrity = integrity;\n\t\tconst referrerPolicy = init.referrerPolicy ?? req.referrerPolicy;\n\t\tif (referrerPolicy) outInit.referrerPolicy = referrerPolicy;\n\n\t\tconst doFetch = options.fetch ?? globalThis.fetch;\n\t\treturn doFetch(url, outInit);\n\t};\n}\n","/**\n * applyTo — sign every matching request a Playwright page sends.\n *\n * Mirrors python/src/wbauth/adapters/playwright.py.\n *\n * Privacy: by default every http(s) request is signed, including third-party\n * analytics/CDN hosts, which reveals your agent identity to them. Pass\n * `hosts` to restrict signing to the sites you actually target:\n *\n *   await applyTo(page, identity, { hosts: [\"example.com\", \"*.example.org\"] });\n *\n * Non-http(s) requests (data:, blob:, chrome-extension:) are never signed.\n * Note: Playwright disables the HTTP cache while a route is active.\n */\nimport type { Page, Request as PWRequest, Route } from \"playwright\";\nimport type { Identity } from \"../identity.js\";\nimport { sign } from \"../signer.js\";\nimport { applyUserAgent, ensureContentDigest, hostMatches } from \"./_utils.js\";\n\nexport interface ApplyToOptions {\n\t/** Only sign requests to these hosts (`example.com`, `*.example.com`). */\n\thosts?: readonly string[];\n\t/** Custom predicate; takes precedence over `hosts`. */\n\tshouldSign?: (url: URL) => boolean;\n\t/** Route pattern passed to `page.route`. Default `\"**\\/*\"`. */\n\tpattern?: string;\n}\n\nexport async function applyTo(\n\tpage: Page,\n\tidentity: Identity,\n\toptions: ApplyToOptions = {},\n): Promise<void> {\n\tconst pattern = options.pattern ?? \"**/*\";\n\tconst decide = (raw: string): boolean => {\n\t\tlet u: URL;\n\t\ttry {\n\t\t\tu = new URL(raw);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t\tif (u.protocol !== \"https:\" && u.protocol !== \"http:\") return false;\n\t\tif (options.shouldSign) return options.shouldSign(u);\n\t\tif (options.hosts) return hostMatches(u.hostname, options.hosts);\n\t\treturn true;\n\t};\n\n\tawait page.route(pattern, async (route: Route, request: PWRequest) => {\n\t\tconst url = request.url();\n\t\tif (!decide(url)) {\n\t\t\tconst r = route as Route & { fallback?: () => Promise<void> };\n\t\t\tawait (r.fallback ? r.fallback() : route.continue());\n\t\t\treturn;\n\t\t}\n\t\tconst headers = await request.allHeaders();\n\t\tconst postData = request.postDataBuffer();\n\t\tconst body = postData ? new Uint8Array(postData) : null;\n\t\tensureContentDigest(request.method(), headers, body);\n\t\tawait sign({ method: request.method(), url, headers, body }, identity);\n\t\tapplyUserAgent(headers, identity.userAgent);\n\t\tawait route.continue({ headers });\n\t});\n}\n","/**\n * Identity, KeyPair, and key-file helpers for the wbauth TypeScript SDK.\n *\n * Mirrors python/src/wbauth/identity.py — same on-disk format (PKCS8\n * NoEncryption PEM at 0o600), same kid (RFC 7638 JWK thumbprint), same\n * multi-key rotation semantics (active + retiring), same REDACTED repr\n * (IDENT-08).\n *\n * Cross-language guarantee (D-60): the PEM file Python writes via\n * `Ed25519PrivateKey.private_bytes(PEM, PKCS8, NoEncryption)` is byte-equal\n * to what Node's `crypto.generateKeyPairSync('ed25519').privateKey.export({\n * format: 'pem', type: 'pkcs8' })` writes. Both runtimes can load each\n * other's keyfile and produce the same kid + signatures.\n *\n * Key implementation choice (Pitfall 1): PEM→JWK is done via Node 20+\n * stdlib `node:crypto.createPrivateKey(pem).export({format:'jwk'})`. We do\n * NOT use `jose` or any third-party JOSE library — the stdlib output is\n * verified byte-identical to what Python's cryptography library produces\n * for the same PKCS8 PEM (RESEARCH §2.2 live verification 2026-05-10).\n */\n\nimport { createPrivateKey, generateKeyPairSync } from \"node:crypto\";\nimport {\n\tcloseSync,\n\texistsSync,\n\tmkdirSync,\n\topenSync,\n\treadFileSync,\n\tstatSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, resolve } from \"node:path\";\nimport type { Signer } from \"http-message-sig\";\nimport { signerFromJWK } from \"web-bot-auth/crypto\";\n\n// ---------- Module constants ----------\n\n/** Default path for the active signing key. Matches Python DEFAULT_KEY_PATH. */\nexport const DEFAULT_KEY_PATH = resolve(\n\thomedir(),\n\t\".config\",\n\t\"wbauth\",\n\t\"key.pem\",\n);\n\n/**\n * RFC 9421 Appendix B.1.4 publicly-known test key — NEVER use in production.\n * The private \"d\" component is published in the RFC and known to everyone.\n * `Identity.fromTestKey()` returns an Identity using these bytes.\n */\nconst TEST_KEY_JWK: JsonWebKey = {\n\tkty: \"OKP\",\n\tcrv: \"Ed25519\",\n\td: \"n4Ni-HpISpVObnQMW0wOhCKROaIKqKtW_2ZYb2p9KcU\",\n\tx: \"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs\",\n};\n\n// ---------- Public types ----------\n\nexport interface IdentityOptions {\n\t/** Stable HTTPS URL where this agent's JWKS is published. Must start with `https://`. */\n\tsignatureAgentUrl: string;\n\t/** Optional User-Agent string adapters inject when caller did not supply one. */\n\tuserAgent?: string;\n}\n\nexport interface KeyPair {\n\t/** Private JWK (includes \"d\") — used to mint the signer. Never logged. */\n\tprivateJwk: JsonWebKey;\n\t/** Public JWK ({kty, crv, x, kid}) — what exportJwks returns per key. */\n\tpublicJwk: JsonWebKey & { kid: string };\n\t/** RFC 7638 base64url-no-pad thumbprint of the public key. */\n\tkid: string;\n\t/** Pre-resolved web-bot-auth Signer (caches the imported CryptoKey). */\n\tsigner: Signer;\n}\n\n// ---------- Identity class ----------\n\nexport class Identity {\n\tprivate _active: KeyPair;\n\tprivate _retiring: KeyPair | null;\n\treadonly signatureAgentUrl: string;\n\treadonly userAgent: string | undefined;\n\n\tprivate constructor(\n\t\tactive: KeyPair,\n\t\topts: IdentityOptions,\n\t\tretiring: KeyPair | null = null,\n\t) {\n\t\tif (!opts.signatureAgentUrl.startsWith(\"https://\")) {\n\t\t\tthrow new Error(\n\t\t\t\t`signatureAgentUrl must be https://, got: ${opts.signatureAgentUrl}`,\n\t\t\t);\n\t\t}\n\t\tthis._active = active;\n\t\tthis._retiring = retiring;\n\t\tthis.signatureAgentUrl = opts.signatureAgentUrl;\n\t\tthis.userAgent = opts.userAgent;\n\t}\n\n\t// ---------- Public read-only API ----------\n\n\t/** The active key's kid (used as `keyid=` param in Signature-Input). */\n\tget kid(): string {\n\t\treturn this._active.kid;\n\t}\n\n\t/** Module-internal: returns the resolved Signer for sign() to use. */\n\t_signer(): Signer {\n\t\treturn this._active.signer;\n\t}\n\n\t/**\n\t * Export the public JWKS document.\n\t *\n\t * Returns `{keys: [active_jwk]}` if no retiring key is held, or\n\t * `{keys: [active_jwk, retiring_jwk]}` after a rotation. Active is always\n\t * first. Verifiers select by `kid`. Mirror of Python `export_jwks`.\n\t */\n\texportJwks(): { keys: Array<JsonWebKey & { kid: string }> } {\n\t\tconst keys: Array<JsonWebKey & { kid: string }> = [this._active.publicJwk];\n\t\tif (this._retiring) keys.push(this._retiring.publicJwk);\n\t\treturn { keys };\n\t}\n\n\t/**\n\t * IDENT-07: generate a new active key, demote current to retiring.\n\t *\n\t * Returns a NEW Identity (immutable update — the old Identity is unchanged).\n\t * Any previously-retiring key is dropped (only one overlap window).\n\t */\n\tasync rotate(newPath: string = DEFAULT_KEY_PATH): Promise<Identity> {\n\t\tconst newPair = await generateKeypairTo(expandUser(newPath));\n\t\treturn new Identity(\n\t\t\tnewPair,\n\t\t\t{ signatureAgentUrl: this.signatureAgentUrl, userAgent: this.userAgent },\n\t\t\tthis._active,\n\t\t);\n\t}\n\n\t// ---------- Constructors ----------\n\n\t/**\n\t * Primary entry point. Loads `path` if it exists, generates a fresh key\n\t * there otherwise. The on-disk file is PKCS8 NoEncryption PEM at 0o600,\n\t * byte-equal to what Python's `Identity.load_or_generate` writes (D-60).\n\t */\n\tstatic async loadOrGenerate(\n\t\tpath: string = DEFAULT_KEY_PATH,\n\t\topts: IdentityOptions,\n\t): Promise<Identity> {\n\t\tconst resolved = expandUser(path);\n\t\tconst pair = existsSync(resolved)\n\t\t\t? await loadKeypair(resolved)\n\t\t\t: await generateKeypairTo(resolved);\n\t\treturn new Identity(pair, opts);\n\t}\n\n\t/**\n\t * Construct from the RFC 9421 Appendix B.1.4 publicly-known test key.\n\t * For tests + Cloudflare debug smoke checks. NEVER use in production.\n\t * Does NOT write any file to disk.\n\t */\n\tstatic async fromTestKey(\n\t\tsignatureAgentUrl: string,\n\t\topts: Omit<IdentityOptions, \"signatureAgentUrl\"> = {},\n\t): Promise<Identity> {\n\t\tconst pair = await keyPairFromJwk(TEST_KEY_JWK);\n\t\treturn new Identity(pair, { ...opts, signatureAgentUrl });\n\t}\n\n\t// ---------- Redaction guarantees (IDENT-08) ----------\n\n\ttoString(): string {\n\t\treturn `<Identity REDACTED kid='${this.kid}' sig_agent='${this.signatureAgentUrl}'>`;\n\t}\n\n\t/** util.inspect / console.log render the same REDACTED form (IDENT-08). */\n\t[Symbol.for(\"nodejs.util.inspect.custom\")](): string {\n\t\treturn this.toString();\n\t}\n}\n\n// ---------- Helpers (module-private) ----------\n\nfunction expandUser(path: string): string {\n\treturn resolve(path.startsWith(\"~\") ? path.replace(/^~/, homedir()) : path);\n}\n\nasync function keyPairFromJwk(privateJwk: JsonWebKey): Promise<KeyPair> {\n\tconst signer = await signerFromJWK(privateJwk);\n\t// signerFromJWK pre-computes the kid (RFC 7638 thumbprint) into signer.keyid.\n\t// Reuse it instead of calling jwkToKeyID separately (avoids the 3-arg helper).\n\tconst kid = signer.keyid;\n\tconst publicJwk: JsonWebKey & { kid: string } = {\n\t\tkty: privateJwk.kty,\n\t\tcrv: privateJwk.crv,\n\t\tx: privateJwk.x,\n\t\tkid,\n\t};\n\treturn { privateJwk, publicJwk, kid, signer };\n}\n\nasync function loadKeypair(path: string): Promise<KeyPair> {\n\t// POSIX permission check (mirror Python — refuse wider-than-0o600).\n\t// Pitfall 8: Windows lacks POSIX mode bits → emit warning, do not enforce.\n\tif (process.platform !== \"win32\") {\n\t\tconst mode = statSync(path).mode & 0o777;\n\t\tif ((mode & 0o077) !== 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Key file ${path} has mode 0o${mode.toString(8)}; expected 0o600. Fix: chmod 600 ${path}`,\n\t\t\t);\n\t\t}\n\t} else {\n\t\tprocess.emitWarning(\n\t\t\t`Windows detected — file permissions on ${path} cannot be enforced via POSIX mode. Use NTFS ACLs or store the key in a per-user secrets vault.`,\n\t\t);\n\t}\n\tconst pem = readFileSync(path, \"utf8\");\n\tconst jwk = createPrivateKey(pem).export({ format: \"jwk\" }) as JsonWebKey;\n\tif (jwk.kty !== \"OKP\" || jwk.crv !== \"Ed25519\") {\n\t\tthrow new TypeError(`Expected Ed25519, got kty=${jwk.kty}, crv=${jwk.crv}`);\n\t}\n\treturn keyPairFromJwk(jwk);\n}\n\nasync function generateKeypairTo(path: string): Promise<KeyPair> {\n\tconst dir = dirname(path);\n\tmkdirSync(dir, { recursive: true });\n\tif (existsSync(path)) {\n\t\t// Belt + suspenders: O_EXCL would catch this too, but raising here gives\n\t\t// a cleaner error than the low-level EEXIST.\n\t\tthrow new Error(`Key already exists at ${path}; refuse overwrite`);\n\t}\n\tconst { privateKey } = generateKeyPairSync(\"ed25519\");\n\tconst pem = privateKey.export({ format: \"pem\", type: \"pkcs8\" }) as string;\n\t// Race-free 0o600 creation: openSync with \"wx\" = O_WRONLY|O_CREAT|O_EXCL.\n\t// Mirrors Python `os.open(path, O_WRONLY|O_CREAT|O_EXCL, 0o600)`.\n\tconst fd = openSync(path, \"wx\", 0o600);\n\ttry {\n\t\twriteFileSync(fd, pem);\n\t} finally {\n\t\tcloseSync(fd);\n\t}\n\tconst jwk = privateKey.export({ format: \"jwk\" }) as JsonWebKey;\n\treturn keyPairFromJwk(jwk);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACYA,0BAAuD;AASvD,IAAM,gBAAgB;AAEtB,IAAM,0BAA0B;AAEhC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AA0BvD,SAAS,cAAc,QAAgB,SAA4B;AAClE,QAAM,OAAO,CAAC,cAAc,iBAAiB;AAC7C,MAAI,WAAW,eAAe,IAAI,OAAO,YAAY,CAAC,GAAG;AACxD,SAAK,KAAK,gBAAgB;AAAA,EAC3B;AACA,SAAO;AACR;AAGA,IAAM,iBAAiB,CAAC,aAAa,mBAAmB,iBAAiB;AAEzE,SAAS,UAAU,SAAiC,MAAuB;AAC1E,QAAM,IAAI,KAAK,YAAY;AAC3B,SAAO,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,CAAC;AAC9D;AAEA,SAAS,cAAc,SAAiC,OAAuB;AAC9E,aAAW,KAAK,OAAO,KAAK,OAAO,GAAG;AACrC,QAAI,MAAM,SAAS,EAAE,YAAY,CAAC,EAAG,QAAO,QAAQ,CAAC;AAAA,EACtD;AACD;AAgBA,eAAsB,KACrB,SACA,UACA,OAAoB,CAAC,GACO;AAG5B,MAAI,CAAC,SAAS,kBAAkB,WAAW,UAAU,GAAG;AACvD,UAAM,IAAI;AAAA,MACT,4CAA4C,SAAS,iBAAiB;AAAA,IACvE;AAAA,EACD;AAGA,QAAM,sBACL,KAAK,uBAAuB;AAC7B,MAAI,CAAC,OAAO,SAAS,mBAAmB,KAAK,uBAAuB,GAAG;AACtE,UAAM,IAAI;AAAA,MACT,uDAAuD,mBAAmB;AAAA,IAC3E;AAAA,EACD;AAKA,gBAAc,QAAQ,SAAS,cAAc;AAK7C,QAAM,uBAAuB,IAAI,SAAS,iBAAiB;AAC3D,UAAQ,QAAQ,iBAAiB,IAAI;AAGrC,QAAM,UAAU,KAAK,WAAW,oBAAI,KAAK;AACzC,QAAM,UAAU,IAAI,KAAK,QAAQ,QAAQ,IAAI,sBAAsB,GAAI;AACvE,QAAM,QAAQ,KAAK,SAAS;AAG5B,QAAM,UACL,QAAQ,SAAS,QACjB,QAAQ,SAAS,UACjB,QAAQ,KAAK,aAAa;AAC3B,QAAM,aAAa,cAAc,QAAQ,QAAQ,OAAO;AACxD,MACC,WAAW,SAAS,gBAAgB,KACpC,CAAC,UAAU,QAAQ,SAAS,gBAAgB,GAC3C;AAGD,UAAM,IAAI;AAAA,MACT;AAAA,IAED;AAAA,EACD;AAGA,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,OAAO,EAAG,SAAQ,IAAI,GAAG,CAAC;AACtE,QAAM,OAAoB,EAAE,QAAQ,QAAQ,QAAQ,QAAQ;AAG5D,MAAI,QAAS,MAAK,OAAO,QAAQ;AACjC,QAAM,MAAM,IAAI,QAAQ,QAAQ,KAAK,IAAI;AAIzC,QAAM,SAA0B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL;AAAA,IACA,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,EACzD;AACA,QAAM,SAAS,UAAM,sCAAiB,KAAK,SAAS,QAAQ,GAAG,MAAM;AAGrE,UAAQ,QAAQ,YAAY,OAAO;AACnC,UAAQ,QAAQ,iBAAiB,IAAI,OAAO,iBAAiB;AAE7D,SAAO;AAAA,IACN,WAAW,OAAO;AAAA,IAClB,gBAAgB,OAAO,iBAAiB;AAAA,IACxC,gBAAgB;AAAA,EACjB;AACD;;;ACpKA,yBAA2B;AAE3B,IAAMA,kBAAiB,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AAGvD,IAAM,qBAAqB;AAE3B,SAAS,WACR,SACA,MACqB;AACrB,QAAM,IAAI,KAAK,YAAY;AAC3B,SAAO,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,CAAC;AAC9D;AAQO,SAAS,oBACf,QACA,SACA,MACO;AACP,MAAI,CAAC,QAAQ,KAAK,eAAe,EAAG;AACpC,MAAI,CAACA,gBAAe,IAAI,OAAO,YAAY,CAAC,EAAG;AAC/C,MAAI,WAAW,SAAS,gBAAgB,EAAG;AAC3C,QAAM,UAAM,+BAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,QAAQ;AAC7D,UAAQ,gBAAgB,IAAI,YAAY,GAAG;AAC5C;AAMO,SAAS,eACf,SACA,WACO;AACP,MAAI,CAAC,UAAW;AAChB,QAAM,MAAM,WAAW,SAAS,YAAY;AAC5C,MAAI,QAAQ,QAAW;AACtB,YAAQ,YAAY,IAAI;AACxB;AAAA,EACD;AACA,MAAI,mBAAmB,KAAK,QAAQ,GAAG,KAAK,EAAE,GAAG;AAChD,WAAO,QAAQ,GAAG;AAClB,YAAQ,YAAY,IAAI;AAAA,EACzB;AACD;AAMO,SAAS,YACf,UACA,OACU;AACV,QAAM,IAAI,SAAS,YAAY,EAAE,QAAQ,OAAO,EAAE;AAClD,SAAO,MAAM,KAAK,CAAC,QAAQ;AAC1B,UAAM,IAAI,IAAI,YAAY,EAAE,QAAQ,OAAO,EAAE;AAC7C,QAAI,EAAE,WAAW,IAAI,GAAG;AACvB,YAAM,OAAO,EAAE,MAAM,CAAC;AACtB,aAAO,MAAM,QAAQ,EAAE,SAAS,IAAI,IAAI,EAAE;AAAA,IAC3C;AACA,WAAO,MAAM;AAAA,EACd,CAAC;AACF;;;ACrDO,SAAS,kBACf,UACA,UAA8B,CAAC,GAChB;AACf,SAAO,eAAe,YACrB,OACA,OAAoB,CAAC,GACD;AACpB,UAAM,MAAM,IAAI,QAAQ,OAAO,IAAI;AACnC,UAAM,SAAS,IAAI;AACnB,UAAM,MAAM,IAAI;AAGhB,QAAI,OAA0B;AAC9B,QAAI,IAAI,MAAM;AACb,YAAM,MAAM,MAAM,IAAI,MAAM,EAAE,YAAY;AAC1C,aAAO,IAAI,aAAa,IAAI,IAAI,WAAW,GAAG,IAAI;AAAA,IACnD;AAGA,UAAM,UAAkC,CAAC;AACzC,QAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACnC,cAAQ,GAAG,IAAI;AAAA,IAChB,CAAC;AAGD,wBAAoB,QAAQ,SAAS,IAAI;AAGzC,UAAM,KAAK,EAAE,QAAQ,KAAK,SAAS,KAAK,GAAG,QAAQ;AACnD,mBAAe,SAAS,SAAS,SAAS;AAE1C,UAAM,UAAuB;AAAA,MAC5B,GAAG;AAAA,MACH;AAAA,MACA;AAAA;AAAA,MAEA,MAAO,QAAQ;AAAA,MACf,QAAQ,KAAK,UAAU,IAAI;AAAA,MAC3B,UAAU,KAAK,YAAY,IAAI;AAAA,MAC/B,aAAa,KAAK,eAAe,IAAI;AAAA,MACrC,OAAO,KAAK,SAAS,IAAI;AAAA,MACzB,WAAW,KAAK,aAAa,IAAI;AAAA,IAClC;AACA,UAAM,YAAY,KAAK,aAAa,IAAI;AACxC,QAAI,UAAW,SAAQ,YAAY;AACnC,UAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAClD,QAAI,eAAgB,SAAQ,iBAAiB;AAE7C,UAAM,UAAU,QAAQ,SAAS,WAAW;AAC5C,WAAO,QAAQ,KAAK,OAAO;AAAA,EAC5B;AACD;;;ACjDA,eAAsB,QACrB,MACA,UACA,UAA0B,CAAC,GACX;AAChB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,SAAS,CAAC,QAAyB;AACxC,QAAI;AACJ,QAAI;AACH,UAAI,IAAI,IAAI,GAAG;AAAA,IAChB,QAAQ;AACP,aAAO;AAAA,IACR;AACA,QAAI,EAAE,aAAa,YAAY,EAAE,aAAa,QAAS,QAAO;AAC9D,QAAI,QAAQ,WAAY,QAAO,QAAQ,WAAW,CAAC;AACnD,QAAI,QAAQ,MAAO,QAAO,YAAY,EAAE,UAAU,QAAQ,KAAK;AAC/D,WAAO;AAAA,EACR;AAEA,QAAM,KAAK,MAAM,SAAS,OAAO,OAAc,YAAuB;AACrE,UAAM,MAAM,QAAQ,IAAI;AACxB,QAAI,CAAC,OAAO,GAAG,GAAG;AACjB,YAAM,IAAI;AACV,aAAO,EAAE,WAAW,EAAE,SAAS,IAAI,MAAM,SAAS;AAClD;AAAA,IACD;AACA,UAAM,UAAU,MAAM,QAAQ,WAAW;AACzC,UAAM,WAAW,QAAQ,eAAe;AACxC,UAAM,OAAO,WAAW,IAAI,WAAW,QAAQ,IAAI;AACnD,wBAAoB,QAAQ,OAAO,GAAG,SAAS,IAAI;AACnD,UAAM,KAAK,EAAE,QAAQ,QAAQ,OAAO,GAAG,KAAK,SAAS,KAAK,GAAG,QAAQ;AACrE,mBAAe,SAAS,SAAS,SAAS;AAC1C,UAAM,MAAM,SAAS,EAAE,QAAQ,CAAC;AAAA,EACjC,CAAC;AACF;;;ACzCA,IAAAC,sBAAsD;AACtD,qBAQO;AACP,qBAAwB;AACxB,uBAAiC;AAEjC,oBAA8B;AAKvB,IAAM,uBAAmB;AAAA,MAC/B,wBAAQ;AAAA,EACR;AAAA,EACA;AAAA,EACA;AACD;AAOA,IAAM,eAA2B;AAAA,EAChC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,GAAG;AAAA,EACH,GAAG;AACJ;AAwBO,IAAM,WAAN,MAAM,UAAS;AAAA,EACb;AAAA,EACA;AAAA,EACC;AAAA,EACA;AAAA,EAED,YACP,QACA,MACA,WAA2B,MAC1B;AACD,QAAI,CAAC,KAAK,kBAAkB,WAAW,UAAU,GAAG;AACnD,YAAM,IAAI;AAAA,QACT,4CAA4C,KAAK,iBAAiB;AAAA,MACnE;AAAA,IACD;AACA,SAAK,UAAU;AACf,SAAK,YAAY;AACjB,SAAK,oBAAoB,KAAK;AAC9B,SAAK,YAAY,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA,EAKA,IAAI,MAAc;AACjB,WAAO,KAAK,QAAQ;AAAA,EACrB;AAAA;AAAA,EAGA,UAAkB;AACjB,WAAO,KAAK,QAAQ;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAA4D;AAC3D,UAAM,OAA4C,CAAC,KAAK,QAAQ,SAAS;AACzE,QAAI,KAAK,UAAW,MAAK,KAAK,KAAK,UAAU,SAAS;AACtD,WAAO,EAAE,KAAK;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,UAAkB,kBAAqC;AACnE,UAAM,UAAU,MAAM,kBAAkB,WAAW,OAAO,CAAC;AAC3D,WAAO,IAAI;AAAA,MACV;AAAA,MACA,EAAE,mBAAmB,KAAK,mBAAmB,WAAW,KAAK,UAAU;AAAA,MACvE,KAAK;AAAA,IACN;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAa,eACZ,OAAe,kBACf,MACoB;AACpB,UAAM,WAAW,WAAW,IAAI;AAChC,UAAM,WAAO,2BAAW,QAAQ,IAC7B,MAAM,YAAY,QAAQ,IAC1B,MAAM,kBAAkB,QAAQ;AACnC,WAAO,IAAI,UAAS,MAAM,IAAI;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,YACZ,mBACA,OAAmD,CAAC,GAChC;AACpB,UAAM,OAAO,MAAM,eAAe,YAAY;AAC9C,WAAO,IAAI,UAAS,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC;AAAA,EACzD;AAAA;AAAA,EAIA,WAAmB;AAClB,WAAO,2BAA2B,KAAK,GAAG,gBAAgB,KAAK,iBAAiB;AAAA,EACjF;AAAA;AAAA,EAGA,CAAC,uBAAO,IAAI,4BAA4B,CAAC,IAAY;AACpD,WAAO,KAAK,SAAS;AAAA,EACtB;AACD;AAIA,SAAS,WAAW,MAAsB;AACzC,aAAO,0BAAQ,KAAK,WAAW,GAAG,IAAI,KAAK,QAAQ,UAAM,wBAAQ,CAAC,IAAI,IAAI;AAC3E;AAEA,eAAe,eAAe,YAA0C;AACvE,QAAM,SAAS,UAAM,6BAAc,UAAU;AAG7C,QAAM,MAAM,OAAO;AACnB,QAAM,YAA0C;AAAA,IAC/C,KAAK,WAAW;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB,GAAG,WAAW;AAAA,IACd;AAAA,EACD;AACA,SAAO,EAAE,YAAY,WAAW,KAAK,OAAO;AAC7C;AAEA,eAAe,YAAY,MAAgC;AAG1D,MAAI,QAAQ,aAAa,SAAS;AACjC,UAAM,WAAO,yBAAS,IAAI,EAAE,OAAO;AACnC,SAAK,OAAO,QAAW,GAAG;AACzB,YAAM,IAAI;AAAA,QACT,YAAY,IAAI,eAAe,KAAK,SAAS,CAAC,CAAC,oCAAoC,IAAI;AAAA,MACxF;AAAA,IACD;AAAA,EACD,OAAO;AACN,YAAQ;AAAA,MACP,+CAA0C,IAAI;AAAA,IAC/C;AAAA,EACD;AACA,QAAM,UAAM,6BAAa,MAAM,MAAM;AACrC,QAAM,UAAM,sCAAiB,GAAG,EAAE,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC1D,MAAI,IAAI,QAAQ,SAAS,IAAI,QAAQ,WAAW;AAC/C,UAAM,IAAI,UAAU,6BAA6B,IAAI,GAAG,SAAS,IAAI,GAAG,EAAE;AAAA,EAC3E;AACA,SAAO,eAAe,GAAG;AAC1B;AAEA,eAAe,kBAAkB,MAAgC;AAChE,QAAM,UAAM,0BAAQ,IAAI;AACxB,gCAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,UAAI,2BAAW,IAAI,GAAG;AAGrB,UAAM,IAAI,MAAM,yBAAyB,IAAI,oBAAoB;AAAA,EAClE;AACA,QAAM,EAAE,WAAW,QAAI,yCAAoB,SAAS;AACpD,QAAM,MAAM,WAAW,OAAO,EAAE,QAAQ,OAAO,MAAM,QAAQ,CAAC;AAG9D,QAAM,SAAK,yBAAS,MAAM,MAAM,GAAK;AACrC,MAAI;AACH,sCAAc,IAAI,GAAG;AAAA,EACtB,UAAE;AACD,kCAAU,EAAE;AAAA,EACb;AACA,QAAM,MAAM,WAAW,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC/C,SAAO,eAAe,GAAG;AAC1B;;;AL/NO,IAAM,UAAU;","names":["DIGEST_METHODS","import_node_crypto"]}

package/dist/index.d.cts

@@ -60,7 +60,9 @@ declare class Identity {
      * first. Verifiers select by `kid`. Mirror of Python `export_jwks`.
      */
     exportJwks(): {
-        keys: JsonWebKey[];
+        keys: Array<JsonWebKey & {
+            kid: string;
+        }>;
     };
     /**
      * IDENT-07: generate a new active key, demote current to retiring.
@@ -80,7 +82,7 @@ declare class Identity {
      * For tests + Cloudflare debug smoke checks. NEVER use in production.
      * Does NOT write any file to disk.
      */
-    static fromTestKey(signatureAgentUrl: string): Promise<Identity>;
+    static fromTestKey(signatureAgentUrl: string, opts?: Omit<IdentityOptions, "signatureAgentUrl">): Promise<Identity>;
     toString(): string;
 }
 
@@ -91,32 +93,45 @@ declare class Identity {
  * `identity` only. Returns a function whose signature matches `typeof fetch`,
  * so user code can swap `fetch` for `signedFetch` without other changes.
  *
- * v1 limitation (Pitfall 4): streaming bodies are NOT supported. The adapter
- * reads the full body via `req.clone().arrayBuffer()` to compute Content-Digest.
+ * - Request-object inputs keep their `signal`, `redirect`, `credentials`,
+ *   `cache`, `keepalive`, `integrity` and `referrerPolicy`.
+ * - Re-sending an already signed request (retry wrappers) produces exactly one
+ *   fresh signature — stale Signature* headers are replaced, never merged.
+ *
+ * v1 limitation: streaming bodies are buffered (`req.clone().arrayBuffer()`)
+ * so Content-Digest can be computed.
  */
 
-declare function createSignedFetch(identity: Identity): typeof fetch;
+interface SignedFetchOptions {
+    /** Underlying fetch implementation. Defaults to `globalThis.fetch` at call time. */
+    fetch?: typeof fetch;
+}
+declare function createSignedFetch(identity: Identity, options?: SignedFetchOptions): typeof fetch;
 
 /**
- * applyTo — Playwright async helper for Web Bot Auth (ADAPT-05).
+ * applyTo — sign every matching request a Playwright page sends.
  *
- * Mirrors python/src/wbauth/adapters/playwright.py. Registers a route
- * handler that intercepts every outgoing request, signs it via wbauth.sign(),
- * and continues with the signed headers.
+ * Mirrors python/src/wbauth/adapters/playwright.py.
  *
- * Pitfall 3: Call applyTo(page, identity) BEFORE the first page.goto()/click
- * that should produce signed requests. page.route must be registered before
- * navigation begins, or the navigation request leaves the browser unsigned.
+ * Privacy: by default every http(s) request is signed, including third-party
+ * analytics/CDN hosts, which reveals your agent identity to them. Pass
+ * `hosts` to restrict signing to the sites you actually target:
  *
- * Pitfall (iframe coverage): page.route('**\/*', handler) covers all
- * sub-frame requests by default. If the target site uses Service Workers,
- * set serviceWorkers="block" on the BrowserContext (Playwright option).
+ *   await applyTo(page, identity, { hosts: ["example.com", "*.example.org"] });
  *
- * Note: `playwright` is a peerDependency (optional). End users only install
- * it if they actually use this adapter — fetch-only consumers pay zero cost.
+ * Non-http(s) requests (data:, blob:, chrome-extension:) are never signed.
+ * Note: Playwright disables the HTTP cache while a route is active.
  */
 
-declare function applyTo(page: Page, identity: Identity): Promise<void>;
+interface ApplyToOptions {
+    /** Only sign requests to these hosts (`example.com`, `*.example.com`). */
+    hosts?: readonly string[];
+    /** Custom predicate; takes precedence over `hosts`. */
+    shouldSign?: (url: URL) => boolean;
+    /** Route pattern passed to `page.route`. Default `"**\/*"`. */
+    pattern?: string;
+}
+declare function applyTo(page: Page, identity: Identity, options?: ApplyToOptions): Promise<void>;
 
 /**
  * NormalizedRequest — the structural input to wbauth.sign().
@@ -172,11 +187,11 @@ declare function sign(request: NormalizedRequest, identity: Identity, opts?: Sig
 /**
  * wbauth: Web Bot Auth (RFC 9421) TypeScript SDK — Phase 4 public surface.
  *
- * Per CONTEXT D-74: flat root exports. Subpath exports (`wbauth/adapters`)
+ * Per CONTEXT D-74: flat root exports. Subpath exports (`wb-auth/adapters`)
  * are a v1.x optimization, not required for Phase 4.
  *
  * Quickstart:
- *   import { Identity, createSignedFetch } from "wbauth";
+ *   import { Identity, createSignedFetch } from "wb-auth";
  *   const id = await Identity.loadOrGenerate("./key.pem", {
  *     signatureAgentUrl: "https://example.com/.well-known/.../<kid>",
  *   });
@@ -184,6 +199,6 @@ declare function sign(request: NormalizedRequest, identity: Identity, opts?: Sig
  *   const res = await sf("https://api.example.com/data");
  */
 
-declare const VERSION = "0.1.0";
+declare const VERSION = "0.2.0";
 
-export { DEFAULT_KEY_PATH, Identity, type IdentityOptions, type KeyPair, type NormalizedRequest, type SignOptions, type SignatureHeaders, VERSION, applyTo, createSignedFetch, sign };
+export { type ApplyToOptions, DEFAULT_KEY_PATH, Identity, type IdentityOptions, type KeyPair, type NormalizedRequest, type SignOptions, type SignatureHeaders, type SignedFetchOptions, VERSION, applyTo, createSignedFetch, sign };

package/dist/index.d.ts

@@ -60,7 +60,9 @@ declare class Identity {
      * first. Verifiers select by `kid`. Mirror of Python `export_jwks`.
      */
     exportJwks(): {
-        keys: JsonWebKey[];
+        keys: Array<JsonWebKey & {
+            kid: string;
+        }>;
     };
     /**
      * IDENT-07: generate a new active key, demote current to retiring.
@@ -80,7 +82,7 @@ declare class Identity {
      * For tests + Cloudflare debug smoke checks. NEVER use in production.
      * Does NOT write any file to disk.
      */
-    static fromTestKey(signatureAgentUrl: string): Promise<Identity>;
+    static fromTestKey(signatureAgentUrl: string, opts?: Omit<IdentityOptions, "signatureAgentUrl">): Promise<Identity>;
     toString(): string;
 }
 
@@ -91,32 +93,45 @@ declare class Identity {
  * `identity` only. Returns a function whose signature matches `typeof fetch`,
  * so user code can swap `fetch` for `signedFetch` without other changes.
  *
- * v1 limitation (Pitfall 4): streaming bodies are NOT supported. The adapter
- * reads the full body via `req.clone().arrayBuffer()` to compute Content-Digest.
+ * - Request-object inputs keep their `signal`, `redirect`, `credentials`,
+ *   `cache`, `keepalive`, `integrity` and `referrerPolicy`.
+ * - Re-sending an already signed request (retry wrappers) produces exactly one
+ *   fresh signature — stale Signature* headers are replaced, never merged.
+ *
+ * v1 limitation: streaming bodies are buffered (`req.clone().arrayBuffer()`)
+ * so Content-Digest can be computed.
  */
 
-declare function createSignedFetch(identity: Identity): typeof fetch;
+interface SignedFetchOptions {
+    /** Underlying fetch implementation. Defaults to `globalThis.fetch` at call time. */
+    fetch?: typeof fetch;
+}
+declare function createSignedFetch(identity: Identity, options?: SignedFetchOptions): typeof fetch;
 
 /**
- * applyTo — Playwright async helper for Web Bot Auth (ADAPT-05).
+ * applyTo — sign every matching request a Playwright page sends.
  *
- * Mirrors python/src/wbauth/adapters/playwright.py. Registers a route
- * handler that intercepts every outgoing request, signs it via wbauth.sign(),
- * and continues with the signed headers.
+ * Mirrors python/src/wbauth/adapters/playwright.py.
  *
- * Pitfall 3: Call applyTo(page, identity) BEFORE the first page.goto()/click
- * that should produce signed requests. page.route must be registered before
- * navigation begins, or the navigation request leaves the browser unsigned.
+ * Privacy: by default every http(s) request is signed, including third-party
+ * analytics/CDN hosts, which reveals your agent identity to them. Pass
+ * `hosts` to restrict signing to the sites you actually target:
  *
- * Pitfall (iframe coverage): page.route('**\/*', handler) covers all
- * sub-frame requests by default. If the target site uses Service Workers,
- * set serviceWorkers="block" on the BrowserContext (Playwright option).
+ *   await applyTo(page, identity, { hosts: ["example.com", "*.example.org"] });
  *
- * Note: `playwright` is a peerDependency (optional). End users only install
- * it if they actually use this adapter — fetch-only consumers pay zero cost.
+ * Non-http(s) requests (data:, blob:, chrome-extension:) are never signed.
+ * Note: Playwright disables the HTTP cache while a route is active.
  */
 
-declare function applyTo(page: Page, identity: Identity): Promise<void>;
+interface ApplyToOptions {
+    /** Only sign requests to these hosts (`example.com`, `*.example.com`). */
+    hosts?: readonly string[];
+    /** Custom predicate; takes precedence over `hosts`. */
+    shouldSign?: (url: URL) => boolean;
+    /** Route pattern passed to `page.route`. Default `"**\/*"`. */
+    pattern?: string;
+}
+declare function applyTo(page: Page, identity: Identity, options?: ApplyToOptions): Promise<void>;
 
 /**
  * NormalizedRequest — the structural input to wbauth.sign().
@@ -172,11 +187,11 @@ declare function sign(request: NormalizedRequest, identity: Identity, opts?: Sig
 /**
  * wbauth: Web Bot Auth (RFC 9421) TypeScript SDK — Phase 4 public surface.
  *
- * Per CONTEXT D-74: flat root exports. Subpath exports (`wbauth/adapters`)
+ * Per CONTEXT D-74: flat root exports. Subpath exports (`wb-auth/adapters`)
  * are a v1.x optimization, not required for Phase 4.
  *
  * Quickstart:
- *   import { Identity, createSignedFetch } from "wbauth";
+ *   import { Identity, createSignedFetch } from "wb-auth";
  *   const id = await Identity.loadOrGenerate("./key.pem", {
  *     signatureAgentUrl: "https://example.com/.well-known/.../<kid>",
  *   });
@@ -184,6 +199,6 @@ declare function sign(request: NormalizedRequest, identity: Identity, opts?: Sig
  *   const res = await sf("https://api.example.com/data");
  */
 
-declare const VERSION = "0.1.0";
+declare const VERSION = "0.2.0";
 
-export { DEFAULT_KEY_PATH, Identity, type IdentityOptions, type KeyPair, type NormalizedRequest, type SignOptions, type SignatureHeaders, VERSION, applyTo, createSignedFetch, sign };
+export { type ApplyToOptions, DEFAULT_KEY_PATH, Identity, type IdentityOptions, type KeyPair, type NormalizedRequest, type SignOptions, type SignatureHeaders, type SignedFetchOptions, VERSION, applyTo, createSignedFetch, sign };

package/dist/index.js

@@ -1,36 +1,5 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  DEFAULT_KEY_PATH: () => DEFAULT_KEY_PATH,
-  Identity: () => Identity,
-  VERSION: () => VERSION,
-  applyTo: () => applyTo,
-  createSignedFetch: () => createSignedFetch,
-  sign: () => sign
-});
-module.exports = __toCommonJS(index_exports);
-
 // src/signer.ts
-var import_web_bot_auth = require("web-bot-auth");
+import { signatureHeaders } from "web-bot-auth";
 var DEFAULT_LABEL = "sig1";
 var DEFAULT_EXPIRES_SECONDS = 60;
 var DIGEST_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
@@ -41,20 +10,41 @@ function componentsFor(method, hasBody) {
   }
   return base;
 }
+var RESIGN_HEADERS = ["signature", "signature-input", "signature-agent"];
+function hasHeader(headers, name) {
+  const n = name.toLowerCase();
+  return Object.keys(headers).some((k) => k.toLowerCase() === n);
+}
+function removeHeaders(headers, names) {
+  for (const k of Object.keys(headers)) {
+    if (names.includes(k.toLowerCase())) delete headers[k];
+  }
+}
 async function sign(request, identity, opts = {}) {
   if (!identity.signatureAgentUrl.startsWith("https://")) {
     throw new Error(
       `signatureAgentUrl must be https://, got: ${identity.signatureAgentUrl}`
     );
   }
+  const expiresAfterSeconds = opts.expiresAfterSeconds ?? DEFAULT_EXPIRES_SECONDS;
+  if (!Number.isFinite(expiresAfterSeconds) || expiresAfterSeconds <= 0) {
+    throw new RangeError(
+      `expiresAfterSeconds must be a positive number, got: ${expiresAfterSeconds}`
+    );
+  }
+  removeHeaders(request.headers, RESIGN_HEADERS);
   const signatureAgentHeader = `"${identity.signatureAgentUrl}"`;
   request.headers["Signature-Agent"] = signatureAgentHeader;
   const created = opts.created ?? /* @__PURE__ */ new Date();
-  const expiresAfterSeconds = opts.expiresAfterSeconds ?? DEFAULT_EXPIRES_SECONDS;
   const expires = new Date(created.getTime() + expiresAfterSeconds * 1e3);
   const label = opts.label ?? DEFAULT_LABEL;
-  const hasBody = request.body !== null && request.body !== void 0;
+  const hasBody = request.body !== null && request.body !== void 0 && request.body.byteLength > 0;
   const components = componentsFor(request.method, hasBody);
+  if (components.includes("content-digest") && !hasHeader(request.headers, "content-digest")) {
+    throw new Error(
+      'Covered header field "content-digest" not found in the message. Call ensureContentDigest() or use createSignedFetch()/applyTo(), which add it automatically.'
+    );
+  }
   const headers = new Headers();
   for (const [k, v] of Object.entries(request.headers)) headers.set(k, v);
   const init = { method: request.method, headers };
@@ -67,7 +57,7 @@ async function sign(request, identity, opts = {}) {
     components,
     ...opts.nonce !== void 0 ? { nonce: opts.nonce } : {}
   };
-  const result = await (0, import_web_bot_auth.signatureHeaders)(req, identity._signer(), params);
+  const result = await signatureHeaders(req, identity._signer(), params);
   request.headers.Signature = result.Signature;
   request.headers["Signature-Input"] = result["Signature-Input"];
   return {
@@ -78,20 +68,46 @@ async function sign(request, identity, opts = {}) {
 }
 
 // src/adapters/_utils.ts
-var import_node_crypto = require("crypto");
+import { createHash } from "crypto";
 var DIGEST_METHODS2 = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH"]);
+var LIBRARY_DEFAULT_UA = /^(node|undici|node-fetch)(\/|$)/i;
+function findHeader(headers, name) {
+  const n = name.toLowerCase();
+  return Object.keys(headers).find((k) => k.toLowerCase() === n);
+}
 function ensureContentDigest(method, headers, body) {
   if (!body || body.byteLength === 0) return;
   if (!DIGEST_METHODS2.has(method.toUpperCase())) return;
-  if (Object.keys(headers).some((k) => k.toLowerCase() === "content-digest")) {
+  if (findHeader(headers, "content-digest")) return;
+  const b64 = createHash("sha256").update(body).digest("base64");
+  headers["Content-Digest"] = `sha-256=:${b64}:`;
+}
+function applyUserAgent(headers, userAgent) {
+  if (!userAgent) return;
+  const key = findHeader(headers, "user-agent");
+  if (key === void 0) {
+    headers["User-Agent"] = userAgent;
     return;
   }
-  const b64 = (0, import_node_crypto.createHash)("sha256").update(body).digest("base64");
-  headers["Content-Digest"] = `sha-256=:${b64}:`;
+  if (LIBRARY_DEFAULT_UA.test(headers[key] ?? "")) {
+    delete headers[key];
+    headers["User-Agent"] = userAgent;
+  }
+}
+function hostMatches(hostname, allow) {
+  const h = hostname.toLowerCase().replace(/\.$/, "");
+  return allow.some((raw) => {
+    const a = raw.toLowerCase().replace(/\.$/, "");
+    if (a.startsWith("*.")) {
+      const base = a.slice(2);
+      return h === base || h.endsWith(`.${base}`);
+    }
+    return h === a;
+  });
 }
 
 // src/adapters/fetch.ts
-function createSignedFetch(identity) {
+function createSignedFetch(identity, options = {}) {
   return async function signedFetch(input, init = {}) {
     const req = new Request(input, init);
     const method = req.method;
@@ -107,44 +123,76 @@ function createSignedFetch(identity) {
     });
     ensureContentDigest(method, headers, body);
     await sign({ method, url, headers, body }, identity);
-    if (identity.userAgent && !Object.keys(headers).some((k) => k.toLowerCase() === "user-agent")) {
-      headers["User-Agent"] = identity.userAgent;
-    }
-    return fetch(url, {
+    applyUserAgent(headers, identity.userAgent);
+    const outInit = {
       ...init,
       method,
       headers,
-      body: body ?? void 0
-    });
+      // Uint8Array is a valid BodyInit at runtime; DOM typings disagree.
+      body: body ?? void 0,
+      signal: init.signal ?? req.signal,
+      redirect: init.redirect ?? req.redirect,
+      credentials: init.credentials ?? req.credentials,
+      cache: init.cache ?? req.cache,
+      keepalive: init.keepalive ?? req.keepalive
+    };
+    const integrity = init.integrity ?? req.integrity;
+    if (integrity) outInit.integrity = integrity;
+    const referrerPolicy = init.referrerPolicy ?? req.referrerPolicy;
+    if (referrerPolicy) outInit.referrerPolicy = referrerPolicy;
+    const doFetch = options.fetch ?? globalThis.fetch;
+    return doFetch(url, outInit);
   };
 }
 
 // src/adapters/playwright.ts
-async function applyTo(page, identity) {
-  await page.route("**/*", async (route, request) => {
+async function applyTo(page, identity, options = {}) {
+  const pattern = options.pattern ?? "**/*";
+  const decide = (raw) => {
+    let u;
+    try {
+      u = new URL(raw);
+    } catch {
+      return false;
+    }
+    if (u.protocol !== "https:" && u.protocol !== "http:") return false;
+    if (options.shouldSign) return options.shouldSign(u);
+    if (options.hosts) return hostMatches(u.hostname, options.hosts);
+    return true;
+  };
+  await page.route(pattern, async (route, request) => {
+    const url = request.url();
+    if (!decide(url)) {
+      const r = route;
+      await (r.fallback ? r.fallback() : route.continue());
+      return;
+    }
     const headers = await request.allHeaders();
     const postData = request.postDataBuffer();
     const body = postData ? new Uint8Array(postData) : null;
     ensureContentDigest(request.method(), headers, body);
-    await sign(
-      { method: request.method(), url: request.url(), headers, body },
-      identity
-    );
-    if (identity.userAgent && !Object.keys(headers).some((k) => k.toLowerCase() === "user-agent")) {
-      headers["User-Agent"] = identity.userAgent;
-    }
+    await sign({ method: request.method(), url, headers, body }, identity);
+    applyUserAgent(headers, identity.userAgent);
     await route.continue({ headers });
   });
 }
 
 // src/identity.ts
-var import_node_crypto2 = require("crypto");
-var import_node_fs = require("fs");
-var import_node_os = require("os");
-var import_node_path = require("path");
-var import_crypto = require("web-bot-auth/crypto");
-var DEFAULT_KEY_PATH = (0, import_node_path.resolve)(
-  (0, import_node_os.homedir)(),
+import { createPrivateKey, generateKeyPairSync } from "crypto";
+import {
+  closeSync,
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  statSync,
+  writeFileSync
+} from "fs";
+import { homedir } from "os";
+import { dirname, resolve } from "path";
+import { signerFromJWK } from "web-bot-auth/crypto";
+var DEFAULT_KEY_PATH = resolve(
+  homedir(),
   ".config",
   "wbauth",
   "key.pem"
@@ -214,7 +262,7 @@ var Identity = class _Identity {
    */
   static async loadOrGenerate(path = DEFAULT_KEY_PATH, opts) {
     const resolved = expandUser(path);
-    const pair = (0, import_node_fs.existsSync)(resolved) ? await loadKeypair(resolved) : await generateKeypairTo(resolved);
+    const pair = existsSync(resolved) ? await loadKeypair(resolved) : await generateKeypairTo(resolved);
     return new _Identity(pair, opts);
   }
   /**
@@ -222,9 +270,9 @@ var Identity = class _Identity {
    * For tests + Cloudflare debug smoke checks. NEVER use in production.
    * Does NOT write any file to disk.
    */
-  static async fromTestKey(signatureAgentUrl) {
+  static async fromTestKey(signatureAgentUrl, opts = {}) {
     const pair = await keyPairFromJwk(TEST_KEY_JWK);
-    return new _Identity(pair, { signatureAgentUrl });
+    return new _Identity(pair, { ...opts, signatureAgentUrl });
   }
   // ---------- Redaction guarantees (IDENT-08) ----------
   toString() {
@@ -236,10 +284,10 @@ var Identity = class _Identity {
   }
 };
 function expandUser(path) {
-  return (0, import_node_path.resolve)(path.startsWith("~") ? path.replace(/^~/, (0, import_node_os.homedir)()) : path);
+  return resolve(path.startsWith("~") ? path.replace(/^~/, homedir()) : path);
 }
 async function keyPairFromJwk(privateJwk) {
-  const signer = await (0, import_crypto.signerFromJWK)(privateJwk);
+  const signer = await signerFromJWK(privateJwk);
   const kid = signer.keyid;
   const publicJwk = {
     kty: privateJwk.kty,
@@ -251,7 +299,7 @@ async function keyPairFromJwk(privateJwk) {
 }
 async function loadKeypair(path) {
   if (process.platform !== "win32") {
-    const mode = (0, import_node_fs.statSync)(path).mode & 511;
+    const mode = statSync(path).mode & 511;
     if ((mode & 63) !== 0) {
       throw new Error(
         `Key file ${path} has mode 0o${mode.toString(8)}; expected 0o600. Fix: chmod 600 ${path}`
@@ -262,39 +310,39 @@ async function loadKeypair(path) {
       `Windows detected \u2014 file permissions on ${path} cannot be enforced via POSIX mode. Use NTFS ACLs or store the key in a per-user secrets vault.`
     );
   }
-  const pem = (0, import_node_fs.readFileSync)(path, "utf8");
-  const jwk = (0, import_node_crypto2.createPrivateKey)(pem).export({ format: "jwk" });
+  const pem = readFileSync(path, "utf8");
+  const jwk = createPrivateKey(pem).export({ format: "jwk" });
   if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519") {
     throw new TypeError(`Expected Ed25519, got kty=${jwk.kty}, crv=${jwk.crv}`);
   }
   return keyPairFromJwk(jwk);
 }
 async function generateKeypairTo(path) {
-  const dir = (0, import_node_path.dirname)(path);
-  (0, import_node_fs.mkdirSync)(dir, { recursive: true });
-  if ((0, import_node_fs.existsSync)(path)) {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true });
+  if (existsSync(path)) {
     throw new Error(`Key already exists at ${path}; refuse overwrite`);
   }
-  const { privateKey } = (0, import_node_crypto2.generateKeyPairSync)("ed25519");
+  const { privateKey } = generateKeyPairSync("ed25519");
   const pem = privateKey.export({ format: "pem", type: "pkcs8" });
-  const fd = (0, import_node_fs.openSync)(path, "wx", 384);
+  const fd = openSync(path, "wx", 384);
   try {
-    (0, import_node_fs.writeFileSync)(fd, pem);
+    writeFileSync(fd, pem);
   } finally {
-    (0, import_node_fs.closeSync)(fd);
+    closeSync(fd);
   }
   const jwk = privateKey.export({ format: "jwk" });
   return keyPairFromJwk(jwk);
 }
 
 // src/index.ts
-var VERSION = "0.1.0";
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+var VERSION = "0.2.0";
+export {
   DEFAULT_KEY_PATH,
   Identity,
   VERSION,
   applyTo,
   createSignedFetch,
   sign
-});
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/signer.ts","../src/adapters/_utils.ts","../src/adapters/fetch.ts","../src/adapters/playwright.ts","../src/identity.ts","../src/index.ts"],"sourcesContent":["/**\n * Pure-function signer for Web Bot Auth (RFC 9421).\n *\n * Mirrors python/src/wbauth/signer.py — same defaults (Ed25519, tag=\n * \"web-bot-auth\", expires=created+60s, covered components [\"@authority\",\n * \"signature-agent\"] + \"content-digest\" for bodies).\n *\n * The function delegates all RFC 9421 mechanics (signing-base canonicalization,\n * structured-field encoding, Ed25519 signing) to `web-bot-auth` 0.1.3's\n * `signatureHeaders`. We only own the Web Bot Auth profile glue: pre-setting\n * Signature-Agent (Pitfall 6), picking covered components, defaulting expires.\n */\nimport { type SignatureParams, signatureHeaders } from \"web-bot-auth\";\nimport type { Identity } from \"./identity.js\";\nimport type { NormalizedRequest } from \"./normalized-request.js\";\n\n// ---------- Module constants (HARD-CODED — typos = silent verifier reject) ----------\n\n/** IETF Web Bot Auth profile mandate. NEVER change. Pitfall 6. */\nconst WEB_BOT_AUTH_TAG = \"web-bot-auth\";\n/** Canonical Signature label. Most verifier examples assume \"sig1\". */\nconst DEFAULT_LABEL = \"sig1\";\n/** Default expires window. 60s leaves NTP-skew + network-latency headroom. */\nconst DEFAULT_EXPIRES_SECONDS = 60;\n/** Methods that may carry a body and therefore want content-digest covered. */\nconst DIGEST_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\"]);\n// WEB_BOT_AUTH_TAG is enforced internally by web-bot-auth's signatureHeaders;\n// we keep the constant for greppability of the profile invariant.\nvoid WEB_BOT_AUTH_TAG;\n\n// ---------- Public types ----------\n\nexport interface SignatureHeaders {\n\tsignature: string;\n\tsignatureInput: string;\n\tsignatureAgent: string;\n}\n\nexport interface SignOptions {\n\t/** Signing timestamp. Defaults to `new Date()`. Override for vector reproducibility. */\n\tcreated?: Date;\n\t/** Validity window in seconds. Defaults to 60. */\n\texpiresAfterSeconds?: number;\n\t/** Anti-replay nonce. Defaults to web-bot-auth's `generateNonce()` (64-byte b64). */\n\tnonce?: string;\n\t/** Signature label (the `sig1=` prefix). Defaults to \"sig1\". */\n\tlabel?: string;\n}\n\n// ---------- Components selector (mirror Python `_components_for`) ----------\n\nfunction componentsFor(method: string, hasBody: boolean): string[] {\n\tconst base = [\"@authority\", \"signature-agent\"];\n\tif (hasBody && DIGEST_METHODS.has(method.toUpperCase())) {\n\t\tbase.push(\"content-digest\");\n\t}\n\treturn base;\n}\n\n/** Headers regenerated on every sign() call. */\nconst RESIGN_HEADERS = [\"signature\", \"signature-input\", \"signature-agent\"];\n\nfunction hasHeader(headers: Record<string, string>, name: string): boolean {\n\tconst n = name.toLowerCase();\n\treturn Object.keys(headers).some((k) => k.toLowerCase() === n);\n}\n\nfunction removeHeaders(headers: Record<string, string>, names: string[]): void {\n\tfor (const k of Object.keys(headers)) {\n\t\tif (names.includes(k.toLowerCase())) delete headers[k];\n\t}\n}\n\n// ---------- Public API ----------\n\n/**\n * Sign a NormalizedRequest with the Web Bot Auth profile.\n *\n * Mutates `request.headers` in place: writes Signature-Agent BEFORE building\n * the signing base (Pitfall 6 — without pre-set, web-bot-auth defaults to\n * `[\"@authority\"]` only and silently breaks byte-equality with the Python\n * signer). After signatureHeaders returns, also writes Signature and\n * Signature-Input back into `request.headers`.\n *\n * @returns the same three values as a typed dataclass for callers that prefer\n * a return value over header inspection.\n */\nexport async function sign(\n\trequest: NormalizedRequest,\n\tidentity: Identity,\n\topts: SignOptions = {},\n): Promise<SignatureHeaders> {\n\t// 1. Defensive https:// check — Identity ctor enforces it too, but a future\n\t// bypassed ctor would otherwise leak http://. Pitfall 1.\n\tif (!identity.signatureAgentUrl.startsWith(\"https://\")) {\n\t\tthrow new Error(\n\t\t\t`signatureAgentUrl must be https://, got: ${identity.signatureAgentUrl}`,\n\t\t);\n\t}\n\n\t// 2. Validate options up-front (parity with Python signer).\n\tconst expiresAfterSeconds =\n\t\topts.expiresAfterSeconds ?? DEFAULT_EXPIRES_SECONDS;\n\tif (!Number.isFinite(expiresAfterSeconds) || expiresAfterSeconds <= 0) {\n\t\tthrow new RangeError(\n\t\t\t`expiresAfterSeconds must be a positive number, got: ${expiresAfterSeconds}`,\n\t\t);\n\t}\n\n\t// 3. Drop stale signature headers in ANY casing. A retried / redirected\n\t// request still carries the previous hop's values; leaving them in place\n\t// produces merged `sig1=..., sig1=...` headers that every verifier rejects.\n\tremoveHeaders(request.headers, RESIGN_HEADERS);\n\n\t// 4. Set Signature-Agent header (RFC 8941 string in double quotes).\n\t// CRITICAL: must be set BEFORE signatureHeaders inspects the message,\n\t// otherwise web-bot-auth picks REQUEST_COMPONENTS_WITHOUT_SIGNATURE_AGENT.\n\tconst signatureAgentHeader = `\"${identity.signatureAgentUrl}\"`;\n\trequest.headers[\"Signature-Agent\"] = signatureAgentHeader;\n\n\t// 5. Defaults.\n\tconst created = opts.created ?? new Date();\n\tconst expires = new Date(created.getTime() + expiresAfterSeconds * 1000);\n\tconst label = opts.label ?? DEFAULT_LABEL;\n\n\t// 6. Components based on body presence.\n\tconst hasBody =\n\t\trequest.body !== null &&\n\t\trequest.body !== undefined &&\n\t\trequest.body.byteLength > 0;\n\tconst components = componentsFor(request.method, hasBody);\n\tif (\n\t\tcomponents.includes(\"content-digest\") &&\n\t\t!hasHeader(request.headers, \"content-digest\")\n\t) {\n\t\t// Python raises here too. Signing a missing header would yield a\n\t\t// signature that no verifier can ever validate.\n\t\tthrow new Error(\n\t\t\t'Covered header field \"content-digest\" not found in the message. ' +\n\t\t\t\t\"Call ensureContentDigest() or use createSignedFetch()/applyTo(), which add it automatically.\",\n\t\t);\n\t}\n\n\t// 7. Build a Web `Request` for web-bot-auth's `signatureHeaders`.\n\tconst headers = new Headers();\n\tfor (const [k, v] of Object.entries(request.headers)) headers.set(k, v);\n\tconst init: RequestInit = { method: request.method, headers };\n\t// Cast: Uint8Array is a valid BodyInit at runtime (web fetch spec) but DOM\n\t// typing wants ArrayBufferView/string/Blob etc. The cast is safe.\n\tif (hasBody) init.body = request.body as unknown as BodyInit;\n\tconst req = new Request(request.url, init);\n\n\t// 8. Delegate to web-bot-auth. The signer is the active key's pre-resolved\n\t// Signer (cached in Identity at construction time).\n\tconst params: SignatureParams = {\n\t\tcreated,\n\t\texpires,\n\t\tkey: label,\n\t\tcomponents,\n\t\t...(opts.nonce !== undefined ? { nonce: opts.nonce } : {}),\n\t};\n\tconst result = await signatureHeaders(req, identity._signer(), params);\n\n\t// 9. Mutate request.headers (mirror Python signer behavior).\n\trequest.headers.Signature = result.Signature;\n\trequest.headers[\"Signature-Input\"] = result[\"Signature-Input\"];\n\n\treturn {\n\t\tsignature: result.Signature,\n\t\tsignatureInput: result[\"Signature-Input\"],\n\t\tsignatureAgent: signatureAgentHeader,\n\t};\n}\n","/**\n * Shared adapter helpers (internal — not part of the public surface).\n *\n * Mirror python/src/wbauth/adapters/_utils.py. The signer auto-includes\n * `content-digest` in covered components for POST/PUT/PATCH with a body;\n * adapters call ensureContentDigest() before sign() so that precondition\n * is met. RFC 9530 sha-256 in structured-fields form (`sha-256=:<b64>:`).\n */\nimport { createHash } from \"node:crypto\";\n\nconst DIGEST_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\"]);\n\n/** Default UAs injected by HTTP stacks; an Identity UA should replace them. */\nconst LIBRARY_DEFAULT_UA = /^(node|undici|node-fetch)(\\/|$)/i;\n\nfunction findHeader(\n\theaders: Record<string, string>,\n\tname: string,\n): string | undefined {\n\tconst n = name.toLowerCase();\n\treturn Object.keys(headers).find((k) => k.toLowerCase() === n);\n}\n\n/**\n * Mutate `headers` in place to add Content-Digest when warranted. No-op if:\n * - body is null/empty,\n * - method is not POST/PUT/PATCH,\n * - the request already carries a Content-Digest header (case-insensitive).\n */\nexport function ensureContentDigest(\n\tmethod: string,\n\theaders: Record<string, string>,\n\tbody: Uint8Array | null,\n): void {\n\tif (!body || body.byteLength === 0) return;\n\tif (!DIGEST_METHODS.has(method.toUpperCase())) return;\n\tif (findHeader(headers, \"content-digest\")) return;\n\tconst b64 = createHash(\"sha256\").update(body).digest(\"base64\");\n\theaders[\"Content-Digest\"] = `sha-256=:${b64}:`;\n}\n\n/**\n * Apply the Identity's User-Agent unless the caller explicitly set a\n * non-library UA. Library defaults (node, undici) are replaced.\n */\nexport function applyUserAgent(\n\theaders: Record<string, string>,\n\tuserAgent: string | undefined,\n): void {\n\tif (!userAgent) return;\n\tconst key = findHeader(headers, \"user-agent\");\n\tif (key === undefined) {\n\t\theaders[\"User-Agent\"] = userAgent;\n\t\treturn;\n\t}\n\tif (LIBRARY_DEFAULT_UA.test(headers[key] ?? \"\")) {\n\t\tdelete headers[key];\n\t\theaders[\"User-Agent\"] = userAgent;\n\t}\n}\n\n/**\n * Host allow-list matcher. Entries are exact hostnames (`api.example.com`)\n * or wildcard subdomains (`*.example.com`, which also matches `example.com`).\n */\nexport function hostMatches(\n\thostname: string,\n\tallow: readonly string[],\n): boolean {\n\tconst h = hostname.toLowerCase().replace(/\\.$/, \"\");\n\treturn allow.some((raw) => {\n\t\tconst a = raw.toLowerCase().replace(/\\.$/, \"\");\n\t\tif (a.startsWith(\"*.\")) {\n\t\t\tconst base = a.slice(2);\n\t\t\treturn h === base || h.endsWith(`.${base}`);\n\t\t}\n\t\treturn h === a;\n\t});\n}\n","/**\n * createSignedFetch — drop-in `fetch` wrapper that signs every outgoing request.\n *\n * Mirrors python/src/wbauth/adapters/httpx_auth.py. Stateless: closure over\n * `identity` only. Returns a function whose signature matches `typeof fetch`,\n * so user code can swap `fetch` for `signedFetch` without other changes.\n *\n * - Request-object inputs keep their `signal`, `redirect`, `credentials`,\n *   `cache`, `keepalive`, `integrity` and `referrerPolicy`.\n * - Re-sending an already signed request (retry wrappers) produces exactly one\n *   fresh signature — stale Signature* headers are replaced, never merged.\n *\n * v1 limitation: streaming bodies are buffered (`req.clone().arrayBuffer()`)\n * so Content-Digest can be computed.\n */\n\nimport type { Identity } from \"../identity.js\";\nimport { sign } from \"../signer.js\";\nimport { applyUserAgent, ensureContentDigest } from \"./_utils.js\";\n\nexport interface SignedFetchOptions {\n\t/** Underlying fetch implementation. Defaults to `globalThis.fetch` at call time. */\n\tfetch?: typeof fetch;\n}\n\nexport function createSignedFetch(\n\tidentity: Identity,\n\toptions: SignedFetchOptions = {},\n): typeof fetch {\n\treturn async function signedFetch(\n\t\tinput: RequestInfo | URL,\n\t\tinit: RequestInit = {},\n\t): Promise<Response> {\n\t\tconst req = new Request(input, init);\n\t\tconst method = req.method;\n\t\tconst url = req.url;\n\n\t\t// Read body once — Request consumes its body stream; clone first.\n\t\tlet body: Uint8Array | null = null;\n\t\tif (req.body) {\n\t\t\tconst buf = await req.clone().arrayBuffer();\n\t\t\tbody = buf.byteLength > 0 ? new Uint8Array(buf) : null;\n\t\t}\n\n\t\t// Mutable header dict (Headers already lower-cases + de-duplicates).\n\t\tconst headers: Record<string, string> = {};\n\t\treq.headers.forEach((value, key) => {\n\t\t\theaders[key] = value;\n\t\t});\n\n\t\t// Auto-Content-Digest BEFORE sign() (signer precondition for POST/PUT/PATCH + body).\n\t\tensureContentDigest(method, headers, body);\n\n\t\t// Sign — replaces stale Signature* headers, then writes fresh ones.\n\t\tawait sign({ method, url, headers, body }, identity);\n\t\tapplyUserAgent(headers, identity.userAgent);\n\n\t\tconst outInit: RequestInit = {\n\t\t\t...init,\n\t\t\tmethod,\n\t\t\theaders,\n\t\t\t// Uint8Array is a valid BodyInit at runtime; DOM typings disagree.\n\t\t\tbody: (body ?? undefined) as BodyInit | undefined,\n\t\t\tsignal: init.signal ?? req.signal,\n\t\t\tredirect: init.redirect ?? req.redirect,\n\t\t\tcredentials: init.credentials ?? req.credentials,\n\t\t\tcache: init.cache ?? req.cache,\n\t\t\tkeepalive: init.keepalive ?? req.keepalive,\n\t\t};\n\t\tconst integrity = init.integrity ?? req.integrity;\n\t\tif (integrity) outInit.integrity = integrity;\n\t\tconst referrerPolicy = init.referrerPolicy ?? req.referrerPolicy;\n\t\tif (referrerPolicy) outInit.referrerPolicy = referrerPolicy;\n\n\t\tconst doFetch = options.fetch ?? globalThis.fetch;\n\t\treturn doFetch(url, outInit);\n\t};\n}\n","/**\n * applyTo — sign every matching request a Playwright page sends.\n *\n * Mirrors python/src/wbauth/adapters/playwright.py.\n *\n * Privacy: by default every http(s) request is signed, including third-party\n * analytics/CDN hosts, which reveals your agent identity to them. Pass\n * `hosts` to restrict signing to the sites you actually target:\n *\n *   await applyTo(page, identity, { hosts: [\"example.com\", \"*.example.org\"] });\n *\n * Non-http(s) requests (data:, blob:, chrome-extension:) are never signed.\n * Note: Playwright disables the HTTP cache while a route is active.\n */\nimport type { Page, Request as PWRequest, Route } from \"playwright\";\nimport type { Identity } from \"../identity.js\";\nimport { sign } from \"../signer.js\";\nimport { applyUserAgent, ensureContentDigest, hostMatches } from \"./_utils.js\";\n\nexport interface ApplyToOptions {\n\t/** Only sign requests to these hosts (`example.com`, `*.example.com`). */\n\thosts?: readonly string[];\n\t/** Custom predicate; takes precedence over `hosts`. */\n\tshouldSign?: (url: URL) => boolean;\n\t/** Route pattern passed to `page.route`. Default `\"**\\/*\"`. */\n\tpattern?: string;\n}\n\nexport async function applyTo(\n\tpage: Page,\n\tidentity: Identity,\n\toptions: ApplyToOptions = {},\n): Promise<void> {\n\tconst pattern = options.pattern ?? \"**/*\";\n\tconst decide = (raw: string): boolean => {\n\t\tlet u: URL;\n\t\ttry {\n\t\t\tu = new URL(raw);\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t\tif (u.protocol !== \"https:\" && u.protocol !== \"http:\") return false;\n\t\tif (options.shouldSign) return options.shouldSign(u);\n\t\tif (options.hosts) return hostMatches(u.hostname, options.hosts);\n\t\treturn true;\n\t};\n\n\tawait page.route(pattern, async (route: Route, request: PWRequest) => {\n\t\tconst url = request.url();\n\t\tif (!decide(url)) {\n\t\t\tconst r = route as Route & { fallback?: () => Promise<void> };\n\t\t\tawait (r.fallback ? r.fallback() : route.continue());\n\t\t\treturn;\n\t\t}\n\t\tconst headers = await request.allHeaders();\n\t\tconst postData = request.postDataBuffer();\n\t\tconst body = postData ? new Uint8Array(postData) : null;\n\t\tensureContentDigest(request.method(), headers, body);\n\t\tawait sign({ method: request.method(), url, headers, body }, identity);\n\t\tapplyUserAgent(headers, identity.userAgent);\n\t\tawait route.continue({ headers });\n\t});\n}\n","/**\n * Identity, KeyPair, and key-file helpers for the wbauth TypeScript SDK.\n *\n * Mirrors python/src/wbauth/identity.py — same on-disk format (PKCS8\n * NoEncryption PEM at 0o600), same kid (RFC 7638 JWK thumbprint), same\n * multi-key rotation semantics (active + retiring), same REDACTED repr\n * (IDENT-08).\n *\n * Cross-language guarantee (D-60): the PEM file Python writes via\n * `Ed25519PrivateKey.private_bytes(PEM, PKCS8, NoEncryption)` is byte-equal\n * to what Node's `crypto.generateKeyPairSync('ed25519').privateKey.export({\n * format: 'pem', type: 'pkcs8' })` writes. Both runtimes can load each\n * other's keyfile and produce the same kid + signatures.\n *\n * Key implementation choice (Pitfall 1): PEM→JWK is done via Node 20+\n * stdlib `node:crypto.createPrivateKey(pem).export({format:'jwk'})`. We do\n * NOT use `jose` or any third-party JOSE library — the stdlib output is\n * verified byte-identical to what Python's cryptography library produces\n * for the same PKCS8 PEM (RESEARCH §2.2 live verification 2026-05-10).\n */\n\nimport { createPrivateKey, generateKeyPairSync } from \"node:crypto\";\nimport {\n\tcloseSync,\n\texistsSync,\n\tmkdirSync,\n\topenSync,\n\treadFileSync,\n\tstatSync,\n\twriteFileSync,\n} from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, resolve } from \"node:path\";\nimport type { Signer } from \"http-message-sig\";\nimport { signerFromJWK } from \"web-bot-auth/crypto\";\n\n// ---------- Module constants ----------\n\n/** Default path for the active signing key. Matches Python DEFAULT_KEY_PATH. */\nexport const DEFAULT_KEY_PATH = resolve(\n\thomedir(),\n\t\".config\",\n\t\"wbauth\",\n\t\"key.pem\",\n);\n\n/**\n * RFC 9421 Appendix B.1.4 publicly-known test key — NEVER use in production.\n * The private \"d\" component is published in the RFC and known to everyone.\n * `Identity.fromTestKey()` returns an Identity using these bytes.\n */\nconst TEST_KEY_JWK: JsonWebKey = {\n\tkty: \"OKP\",\n\tcrv: \"Ed25519\",\n\td: \"n4Ni-HpISpVObnQMW0wOhCKROaIKqKtW_2ZYb2p9KcU\",\n\tx: \"JrQLj5P_89iXES9-vFgrIy29clF9CC_oPPsw3c5D0bs\",\n};\n\n// ---------- Public types ----------\n\nexport interface IdentityOptions {\n\t/** Stable HTTPS URL where this agent's JWKS is published. Must start with `https://`. */\n\tsignatureAgentUrl: string;\n\t/** Optional User-Agent string adapters inject when caller did not supply one. */\n\tuserAgent?: string;\n}\n\nexport interface KeyPair {\n\t/** Private JWK (includes \"d\") — used to mint the signer. Never logged. */\n\tprivateJwk: JsonWebKey;\n\t/** Public JWK ({kty, crv, x, kid}) — what exportJwks returns per key. */\n\tpublicJwk: JsonWebKey & { kid: string };\n\t/** RFC 7638 base64url-no-pad thumbprint of the public key. */\n\tkid: string;\n\t/** Pre-resolved web-bot-auth Signer (caches the imported CryptoKey). */\n\tsigner: Signer;\n}\n\n// ---------- Identity class ----------\n\nexport class Identity {\n\tprivate _active: KeyPair;\n\tprivate _retiring: KeyPair | null;\n\treadonly signatureAgentUrl: string;\n\treadonly userAgent: string | undefined;\n\n\tprivate constructor(\n\t\tactive: KeyPair,\n\t\topts: IdentityOptions,\n\t\tretiring: KeyPair | null = null,\n\t) {\n\t\tif (!opts.signatureAgentUrl.startsWith(\"https://\")) {\n\t\t\tthrow new Error(\n\t\t\t\t`signatureAgentUrl must be https://, got: ${opts.signatureAgentUrl}`,\n\t\t\t);\n\t\t}\n\t\tthis._active = active;\n\t\tthis._retiring = retiring;\n\t\tthis.signatureAgentUrl = opts.signatureAgentUrl;\n\t\tthis.userAgent = opts.userAgent;\n\t}\n\n\t// ---------- Public read-only API ----------\n\n\t/** The active key's kid (used as `keyid=` param in Signature-Input). */\n\tget kid(): string {\n\t\treturn this._active.kid;\n\t}\n\n\t/** Module-internal: returns the resolved Signer for sign() to use. */\n\t_signer(): Signer {\n\t\treturn this._active.signer;\n\t}\n\n\t/**\n\t * Export the public JWKS document.\n\t *\n\t * Returns `{keys: [active_jwk]}` if no retiring key is held, or\n\t * `{keys: [active_jwk, retiring_jwk]}` after a rotation. Active is always\n\t * first. Verifiers select by `kid`. Mirror of Python `export_jwks`.\n\t */\n\texportJwks(): { keys: Array<JsonWebKey & { kid: string }> } {\n\t\tconst keys: Array<JsonWebKey & { kid: string }> = [this._active.publicJwk];\n\t\tif (this._retiring) keys.push(this._retiring.publicJwk);\n\t\treturn { keys };\n\t}\n\n\t/**\n\t * IDENT-07: generate a new active key, demote current to retiring.\n\t *\n\t * Returns a NEW Identity (immutable update — the old Identity is unchanged).\n\t * Any previously-retiring key is dropped (only one overlap window).\n\t */\n\tasync rotate(newPath: string = DEFAULT_KEY_PATH): Promise<Identity> {\n\t\tconst newPair = await generateKeypairTo(expandUser(newPath));\n\t\treturn new Identity(\n\t\t\tnewPair,\n\t\t\t{ signatureAgentUrl: this.signatureAgentUrl, userAgent: this.userAgent },\n\t\t\tthis._active,\n\t\t);\n\t}\n\n\t// ---------- Constructors ----------\n\n\t/**\n\t * Primary entry point. Loads `path` if it exists, generates a fresh key\n\t * there otherwise. The on-disk file is PKCS8 NoEncryption PEM at 0o600,\n\t * byte-equal to what Python's `Identity.load_or_generate` writes (D-60).\n\t */\n\tstatic async loadOrGenerate(\n\t\tpath: string = DEFAULT_KEY_PATH,\n\t\topts: IdentityOptions,\n\t): Promise<Identity> {\n\t\tconst resolved = expandUser(path);\n\t\tconst pair = existsSync(resolved)\n\t\t\t? await loadKeypair(resolved)\n\t\t\t: await generateKeypairTo(resolved);\n\t\treturn new Identity(pair, opts);\n\t}\n\n\t/**\n\t * Construct from the RFC 9421 Appendix B.1.4 publicly-known test key.\n\t * For tests + Cloudflare debug smoke checks. NEVER use in production.\n\t * Does NOT write any file to disk.\n\t */\n\tstatic async fromTestKey(\n\t\tsignatureAgentUrl: string,\n\t\topts: Omit<IdentityOptions, \"signatureAgentUrl\"> = {},\n\t): Promise<Identity> {\n\t\tconst pair = await keyPairFromJwk(TEST_KEY_JWK);\n\t\treturn new Identity(pair, { ...opts, signatureAgentUrl });\n\t}\n\n\t// ---------- Redaction guarantees (IDENT-08) ----------\n\n\ttoString(): string {\n\t\treturn `<Identity REDACTED kid='${this.kid}' sig_agent='${this.signatureAgentUrl}'>`;\n\t}\n\n\t/** util.inspect / console.log render the same REDACTED form (IDENT-08). */\n\t[Symbol.for(\"nodejs.util.inspect.custom\")](): string {\n\t\treturn this.toString();\n\t}\n}\n\n// ---------- Helpers (module-private) ----------\n\nfunction expandUser(path: string): string {\n\treturn resolve(path.startsWith(\"~\") ? path.replace(/^~/, homedir()) : path);\n}\n\nasync function keyPairFromJwk(privateJwk: JsonWebKey): Promise<KeyPair> {\n\tconst signer = await signerFromJWK(privateJwk);\n\t// signerFromJWK pre-computes the kid (RFC 7638 thumbprint) into signer.keyid.\n\t// Reuse it instead of calling jwkToKeyID separately (avoids the 3-arg helper).\n\tconst kid = signer.keyid;\n\tconst publicJwk: JsonWebKey & { kid: string } = {\n\t\tkty: privateJwk.kty,\n\t\tcrv: privateJwk.crv,\n\t\tx: privateJwk.x,\n\t\tkid,\n\t};\n\treturn { privateJwk, publicJwk, kid, signer };\n}\n\nasync function loadKeypair(path: string): Promise<KeyPair> {\n\t// POSIX permission check (mirror Python — refuse wider-than-0o600).\n\t// Pitfall 8: Windows lacks POSIX mode bits → emit warning, do not enforce.\n\tif (process.platform !== \"win32\") {\n\t\tconst mode = statSync(path).mode & 0o777;\n\t\tif ((mode & 0o077) !== 0) {\n\t\t\tthrow new Error(\n\t\t\t\t`Key file ${path} has mode 0o${mode.toString(8)}; expected 0o600. Fix: chmod 600 ${path}`,\n\t\t\t);\n\t\t}\n\t} else {\n\t\tprocess.emitWarning(\n\t\t\t`Windows detected — file permissions on ${path} cannot be enforced via POSIX mode. Use NTFS ACLs or store the key in a per-user secrets vault.`,\n\t\t);\n\t}\n\tconst pem = readFileSync(path, \"utf8\");\n\tconst jwk = createPrivateKey(pem).export({ format: \"jwk\" }) as JsonWebKey;\n\tif (jwk.kty !== \"OKP\" || jwk.crv !== \"Ed25519\") {\n\t\tthrow new TypeError(`Expected Ed25519, got kty=${jwk.kty}, crv=${jwk.crv}`);\n\t}\n\treturn keyPairFromJwk(jwk);\n}\n\nasync function generateKeypairTo(path: string): Promise<KeyPair> {\n\tconst dir = dirname(path);\n\tmkdirSync(dir, { recursive: true });\n\tif (existsSync(path)) {\n\t\t// Belt + suspenders: O_EXCL would catch this too, but raising here gives\n\t\t// a cleaner error than the low-level EEXIST.\n\t\tthrow new Error(`Key already exists at ${path}; refuse overwrite`);\n\t}\n\tconst { privateKey } = generateKeyPairSync(\"ed25519\");\n\tconst pem = privateKey.export({ format: \"pem\", type: \"pkcs8\" }) as string;\n\t// Race-free 0o600 creation: openSync with \"wx\" = O_WRONLY|O_CREAT|O_EXCL.\n\t// Mirrors Python `os.open(path, O_WRONLY|O_CREAT|O_EXCL, 0o600)`.\n\tconst fd = openSync(path, \"wx\", 0o600);\n\ttry {\n\t\twriteFileSync(fd, pem);\n\t} finally {\n\t\tcloseSync(fd);\n\t}\n\tconst jwk = privateKey.export({ format: \"jwk\" }) as JsonWebKey;\n\treturn keyPairFromJwk(jwk);\n}\n","/**\n * wbauth: Web Bot Auth (RFC 9421) TypeScript SDK — Phase 4 public surface.\n *\n * Per CONTEXT D-74: flat root exports. Subpath exports (`wb-auth/adapters`)\n * are a v1.x optimization, not required for Phase 4.\n *\n * Quickstart:\n *   import { Identity, createSignedFetch } from \"wb-auth\";\n *   const id = await Identity.loadOrGenerate(\"./key.pem\", {\n *     signatureAgentUrl: \"https://example.com/.well-known/.../<kid>\",\n *   });\n *   const sf = createSignedFetch(id);\n *   const res = await sf(\"https://api.example.com/data\");\n */\n\nexport type { SignedFetchOptions } from \"./adapters/fetch.js\";\nexport { createSignedFetch } from \"./adapters/fetch.js\";\nexport type { ApplyToOptions } from \"./adapters/playwright.js\";\nexport { applyTo } from \"./adapters/playwright.js\";\nexport type { IdentityOptions, KeyPair } from \"./identity.js\";\nexport { DEFAULT_KEY_PATH, Identity } from \"./identity.js\";\nexport type { NormalizedRequest } from \"./normalized-request.js\";\nexport type { SignatureHeaders, SignOptions } from \"./signer.js\";\nexport { sign } from \"./signer.js\";\n\nexport const VERSION = \"0.2.0\";\n"],"mappings":";AAYA,SAA+B,wBAAwB;AASvD,IAAM,gBAAgB;AAEtB,IAAM,0BAA0B;AAEhC,IAAM,iBAAiB,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AA0BvD,SAAS,cAAc,QAAgB,SAA4B;AAClE,QAAM,OAAO,CAAC,cAAc,iBAAiB;AAC7C,MAAI,WAAW,eAAe,IAAI,OAAO,YAAY,CAAC,GAAG;AACxD,SAAK,KAAK,gBAAgB;AAAA,EAC3B;AACA,SAAO;AACR;AAGA,IAAM,iBAAiB,CAAC,aAAa,mBAAmB,iBAAiB;AAEzE,SAAS,UAAU,SAAiC,MAAuB;AAC1E,QAAM,IAAI,KAAK,YAAY;AAC3B,SAAO,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,CAAC;AAC9D;AAEA,SAAS,cAAc,SAAiC,OAAuB;AAC9E,aAAW,KAAK,OAAO,KAAK,OAAO,GAAG;AACrC,QAAI,MAAM,SAAS,EAAE,YAAY,CAAC,EAAG,QAAO,QAAQ,CAAC;AAAA,EACtD;AACD;AAgBA,eAAsB,KACrB,SACA,UACA,OAAoB,CAAC,GACO;AAG5B,MAAI,CAAC,SAAS,kBAAkB,WAAW,UAAU,GAAG;AACvD,UAAM,IAAI;AAAA,MACT,4CAA4C,SAAS,iBAAiB;AAAA,IACvE;AAAA,EACD;AAGA,QAAM,sBACL,KAAK,uBAAuB;AAC7B,MAAI,CAAC,OAAO,SAAS,mBAAmB,KAAK,uBAAuB,GAAG;AACtE,UAAM,IAAI;AAAA,MACT,uDAAuD,mBAAmB;AAAA,IAC3E;AAAA,EACD;AAKA,gBAAc,QAAQ,SAAS,cAAc;AAK7C,QAAM,uBAAuB,IAAI,SAAS,iBAAiB;AAC3D,UAAQ,QAAQ,iBAAiB,IAAI;AAGrC,QAAM,UAAU,KAAK,WAAW,oBAAI,KAAK;AACzC,QAAM,UAAU,IAAI,KAAK,QAAQ,QAAQ,IAAI,sBAAsB,GAAI;AACvE,QAAM,QAAQ,KAAK,SAAS;AAG5B,QAAM,UACL,QAAQ,SAAS,QACjB,QAAQ,SAAS,UACjB,QAAQ,KAAK,aAAa;AAC3B,QAAM,aAAa,cAAc,QAAQ,QAAQ,OAAO;AACxD,MACC,WAAW,SAAS,gBAAgB,KACpC,CAAC,UAAU,QAAQ,SAAS,gBAAgB,GAC3C;AAGD,UAAM,IAAI;AAAA,MACT;AAAA,IAED;AAAA,EACD;AAGA,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,OAAO,EAAG,SAAQ,IAAI,GAAG,CAAC;AACtE,QAAM,OAAoB,EAAE,QAAQ,QAAQ,QAAQ,QAAQ;AAG5D,MAAI,QAAS,MAAK,OAAO,QAAQ;AACjC,QAAM,MAAM,IAAI,QAAQ,QAAQ,KAAK,IAAI;AAIzC,QAAM,SAA0B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,KAAK;AAAA,IACL;AAAA,IACA,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,EACzD;AACA,QAAM,SAAS,MAAM,iBAAiB,KAAK,SAAS,QAAQ,GAAG,MAAM;AAGrE,UAAQ,QAAQ,YAAY,OAAO;AACnC,UAAQ,QAAQ,iBAAiB,IAAI,OAAO,iBAAiB;AAE7D,SAAO;AAAA,IACN,WAAW,OAAO;AAAA,IAClB,gBAAgB,OAAO,iBAAiB;AAAA,IACxC,gBAAgB;AAAA,EACjB;AACD;;;ACpKA,SAAS,kBAAkB;AAE3B,IAAMA,kBAAiB,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AAGvD,IAAM,qBAAqB;AAE3B,SAAS,WACR,SACA,MACqB;AACrB,QAAM,IAAI,KAAK,YAAY;AAC3B,SAAO,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,MAAM,CAAC;AAC9D;AAQO,SAAS,oBACf,QACA,SACA,MACO;AACP,MAAI,CAAC,QAAQ,KAAK,eAAe,EAAG;AACpC,MAAI,CAACA,gBAAe,IAAI,OAAO,YAAY,CAAC,EAAG;AAC/C,MAAI,WAAW,SAAS,gBAAgB,EAAG;AAC3C,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,QAAQ;AAC7D,UAAQ,gBAAgB,IAAI,YAAY,GAAG;AAC5C;AAMO,SAAS,eACf,SACA,WACO;AACP,MAAI,CAAC,UAAW;AAChB,QAAM,MAAM,WAAW,SAAS,YAAY;AAC5C,MAAI,QAAQ,QAAW;AACtB,YAAQ,YAAY,IAAI;AACxB;AAAA,EACD;AACA,MAAI,mBAAmB,KAAK,QAAQ,GAAG,KAAK,EAAE,GAAG;AAChD,WAAO,QAAQ,GAAG;AAClB,YAAQ,YAAY,IAAI;AAAA,EACzB;AACD;AAMO,SAAS,YACf,UACA,OACU;AACV,QAAM,IAAI,SAAS,YAAY,EAAE,QAAQ,OAAO,EAAE;AAClD,SAAO,MAAM,KAAK,CAAC,QAAQ;AAC1B,UAAM,IAAI,IAAI,YAAY,EAAE,QAAQ,OAAO,EAAE;AAC7C,QAAI,EAAE,WAAW,IAAI,GAAG;AACvB,YAAM,OAAO,EAAE,MAAM,CAAC;AACtB,aAAO,MAAM,QAAQ,EAAE,SAAS,IAAI,IAAI,EAAE;AAAA,IAC3C;AACA,WAAO,MAAM;AAAA,EACd,CAAC;AACF;;;ACrDO,SAAS,kBACf,UACA,UAA8B,CAAC,GAChB;AACf,SAAO,eAAe,YACrB,OACA,OAAoB,CAAC,GACD;AACpB,UAAM,MAAM,IAAI,QAAQ,OAAO,IAAI;AACnC,UAAM,SAAS,IAAI;AACnB,UAAM,MAAM,IAAI;AAGhB,QAAI,OAA0B;AAC9B,QAAI,IAAI,MAAM;AACb,YAAM,MAAM,MAAM,IAAI,MAAM,EAAE,YAAY;AAC1C,aAAO,IAAI,aAAa,IAAI,IAAI,WAAW,GAAG,IAAI;AAAA,IACnD;AAGA,UAAM,UAAkC,CAAC;AACzC,QAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACnC,cAAQ,GAAG,IAAI;AAAA,IAChB,CAAC;AAGD,wBAAoB,QAAQ,SAAS,IAAI;AAGzC,UAAM,KAAK,EAAE,QAAQ,KAAK,SAAS,KAAK,GAAG,QAAQ;AACnD,mBAAe,SAAS,SAAS,SAAS;AAE1C,UAAM,UAAuB;AAAA,MAC5B,GAAG;AAAA,MACH;AAAA,MACA;AAAA;AAAA,MAEA,MAAO,QAAQ;AAAA,MACf,QAAQ,KAAK,UAAU,IAAI;AAAA,MAC3B,UAAU,KAAK,YAAY,IAAI;AAAA,MAC/B,aAAa,KAAK,eAAe,IAAI;AAAA,MACrC,OAAO,KAAK,SAAS,IAAI;AAAA,MACzB,WAAW,KAAK,aAAa,IAAI;AAAA,IAClC;AACA,UAAM,YAAY,KAAK,aAAa,IAAI;AACxC,QAAI,UAAW,SAAQ,YAAY;AACnC,UAAM,iBAAiB,KAAK,kBAAkB,IAAI;AAClD,QAAI,eAAgB,SAAQ,iBAAiB;AAE7C,UAAM,UAAU,QAAQ,SAAS,WAAW;AAC5C,WAAO,QAAQ,KAAK,OAAO;AAAA,EAC5B;AACD;;;ACjDA,eAAsB,QACrB,MACA,UACA,UAA0B,CAAC,GACX;AAChB,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,SAAS,CAAC,QAAyB;AACxC,QAAI;AACJ,QAAI;AACH,UAAI,IAAI,IAAI,GAAG;AAAA,IAChB,QAAQ;AACP,aAAO;AAAA,IACR;AACA,QAAI,EAAE,aAAa,YAAY,EAAE,aAAa,QAAS,QAAO;AAC9D,QAAI,QAAQ,WAAY,QAAO,QAAQ,WAAW,CAAC;AACnD,QAAI,QAAQ,MAAO,QAAO,YAAY,EAAE,UAAU,QAAQ,KAAK;AAC/D,WAAO;AAAA,EACR;AAEA,QAAM,KAAK,MAAM,SAAS,OAAO,OAAc,YAAuB;AACrE,UAAM,MAAM,QAAQ,IAAI;AACxB,QAAI,CAAC,OAAO,GAAG,GAAG;AACjB,YAAM,IAAI;AACV,aAAO,EAAE,WAAW,EAAE,SAAS,IAAI,MAAM,SAAS;AAClD;AAAA,IACD;AACA,UAAM,UAAU,MAAM,QAAQ,WAAW;AACzC,UAAM,WAAW,QAAQ,eAAe;AACxC,UAAM,OAAO,WAAW,IAAI,WAAW,QAAQ,IAAI;AACnD,wBAAoB,QAAQ,OAAO,GAAG,SAAS,IAAI;AACnD,UAAM,KAAK,EAAE,QAAQ,QAAQ,OAAO,GAAG,KAAK,SAAS,KAAK,GAAG,QAAQ;AACrE,mBAAe,SAAS,SAAS,SAAS;AAC1C,UAAM,MAAM,SAAS,EAAE,QAAQ,CAAC;AAAA,EACjC,CAAC;AACF;;;ACzCA,SAAS,kBAAkB,2BAA2B;AACtD;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACM;AACP,SAAS,eAAe;AACxB,SAAS,SAAS,eAAe;AAEjC,SAAS,qBAAqB;AAKvB,IAAM,mBAAmB;AAAA,EAC/B,QAAQ;AAAA,EACR;AAAA,EACA;AAAA,EACA;AACD;AAOA,IAAM,eAA2B;AAAA,EAChC,KAAK;AAAA,EACL,KAAK;AAAA,EACL,GAAG;AAAA,EACH,GAAG;AACJ;AAwBO,IAAM,WAAN,MAAM,UAAS;AAAA,EACb;AAAA,EACA;AAAA,EACC;AAAA,EACA;AAAA,EAED,YACP,QACA,MACA,WAA2B,MAC1B;AACD,QAAI,CAAC,KAAK,kBAAkB,WAAW,UAAU,GAAG;AACnD,YAAM,IAAI;AAAA,QACT,4CAA4C,KAAK,iBAAiB;AAAA,MACnE;AAAA,IACD;AACA,SAAK,UAAU;AACf,SAAK,YAAY;AACjB,SAAK,oBAAoB,KAAK;AAC9B,SAAK,YAAY,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA,EAKA,IAAI,MAAc;AACjB,WAAO,KAAK,QAAQ;AAAA,EACrB;AAAA;AAAA,EAGA,UAAkB;AACjB,WAAO,KAAK,QAAQ;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAA4D;AAC3D,UAAM,OAA4C,CAAC,KAAK,QAAQ,SAAS;AACzE,QAAI,KAAK,UAAW,MAAK,KAAK,KAAK,UAAU,SAAS;AACtD,WAAO,EAAE,KAAK;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,UAAkB,kBAAqC;AACnE,UAAM,UAAU,MAAM,kBAAkB,WAAW,OAAO,CAAC;AAC3D,WAAO,IAAI;AAAA,MACV;AAAA,MACA,EAAE,mBAAmB,KAAK,mBAAmB,WAAW,KAAK,UAAU;AAAA,MACvE,KAAK;AAAA,IACN;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,aAAa,eACZ,OAAe,kBACf,MACoB;AACpB,UAAM,WAAW,WAAW,IAAI;AAChC,UAAM,OAAO,WAAW,QAAQ,IAC7B,MAAM,YAAY,QAAQ,IAC1B,MAAM,kBAAkB,QAAQ;AACnC,WAAO,IAAI,UAAS,MAAM,IAAI;AAAA,EAC/B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,YACZ,mBACA,OAAmD,CAAC,GAChC;AACpB,UAAM,OAAO,MAAM,eAAe,YAAY;AAC9C,WAAO,IAAI,UAAS,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC;AAAA,EACzD;AAAA;AAAA,EAIA,WAAmB;AAClB,WAAO,2BAA2B,KAAK,GAAG,gBAAgB,KAAK,iBAAiB;AAAA,EACjF;AAAA;AAAA,EAGA,CAAC,uBAAO,IAAI,4BAA4B,CAAC,IAAY;AACpD,WAAO,KAAK,SAAS;AAAA,EACtB;AACD;AAIA,SAAS,WAAW,MAAsB;AACzC,SAAO,QAAQ,KAAK,WAAW,GAAG,IAAI,KAAK,QAAQ,MAAM,QAAQ,CAAC,IAAI,IAAI;AAC3E;AAEA,eAAe,eAAe,YAA0C;AACvE,QAAM,SAAS,MAAM,cAAc,UAAU;AAG7C,QAAM,MAAM,OAAO;AACnB,QAAM,YAA0C;AAAA,IAC/C,KAAK,WAAW;AAAA,IAChB,KAAK,WAAW;AAAA,IAChB,GAAG,WAAW;AAAA,IACd;AAAA,EACD;AACA,SAAO,EAAE,YAAY,WAAW,KAAK,OAAO;AAC7C;AAEA,eAAe,YAAY,MAAgC;AAG1D,MAAI,QAAQ,aAAa,SAAS;AACjC,UAAM,OAAO,SAAS,IAAI,EAAE,OAAO;AACnC,SAAK,OAAO,QAAW,GAAG;AACzB,YAAM,IAAI;AAAA,QACT,YAAY,IAAI,eAAe,KAAK,SAAS,CAAC,CAAC,oCAAoC,IAAI;AAAA,MACxF;AAAA,IACD;AAAA,EACD,OAAO;AACN,YAAQ;AAAA,MACP,+CAA0C,IAAI;AAAA,IAC/C;AAAA,EACD;AACA,QAAM,MAAM,aAAa,MAAM,MAAM;AACrC,QAAM,MAAM,iBAAiB,GAAG,EAAE,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC1D,MAAI,IAAI,QAAQ,SAAS,IAAI,QAAQ,WAAW;AAC/C,UAAM,IAAI,UAAU,6BAA6B,IAAI,GAAG,SAAS,IAAI,GAAG,EAAE;AAAA,EAC3E;AACA,SAAO,eAAe,GAAG;AAC1B;AAEA,eAAe,kBAAkB,MAAgC;AAChE,QAAM,MAAM,QAAQ,IAAI;AACxB,YAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,MAAI,WAAW,IAAI,GAAG;AAGrB,UAAM,IAAI,MAAM,yBAAyB,IAAI,oBAAoB;AAAA,EAClE;AACA,QAAM,EAAE,WAAW,IAAI,oBAAoB,SAAS;AACpD,QAAM,MAAM,WAAW,OAAO,EAAE,QAAQ,OAAO,MAAM,QAAQ,CAAC;AAG9D,QAAM,KAAK,SAAS,MAAM,MAAM,GAAK;AACrC,MAAI;AACH,kBAAc,IAAI,GAAG;AAAA,EACtB,UAAE;AACD,cAAU,EAAE;AAAA,EACb;AACA,QAAM,MAAM,WAAW,OAAO,EAAE,QAAQ,MAAM,CAAC;AAC/C,SAAO,eAAe,GAAG;AAC1B;;;AC/NO,IAAM,UAAU;","names":["DIGEST_METHODS"]}

package/package.json

@@ -1,45 +1,77 @@
 {
-  "name": "wb-auth",
-  "version": "0.1.1",
-  "description": "Web Bot Auth (RFC 9421) TypeScript SDK",
-  "type": "module",
-  "main": "./dist/index.js",
-  "module": "./dist/index.mjs",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs",
-      "require": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist"
-  ],
-  "license": "Apache-2.0",
-  "dependencies": {
-    "http-message-sig": "^0.2.0",
-    "web-bot-auth": "^0.1.3"
-  },
-  "devDependencies": {
-    "@biomejs/biome": "^2",
-    "@types/node": "^20",
-    "playwright": "^1.59",
-    "tsup": "^8",
-    "typescript": "^6",
-    "vitest": "^4"
-  },
-  "peerDependencies": {
-    "playwright": "^1"
-  },
-  "peerDependenciesMeta": {
-    "playwright": {
-      "optional": true
-    }
-  },
-  "scripts": {
-    "build": "tsup",
-    "test": "vitest run",
-    "lint": "biome check ."
-  }
-}
+	"name": "wb-auth",
+	"version": "0.2.0",
+	"description": "Web Bot Auth (RFC 9421) TypeScript SDK \u2014 signed identity for AI agents and crawlers",
+	"type": "module",
+	"main": "./dist/index.cjs",
+	"module": "./dist/index.js",
+	"types": "./dist/index.d.ts",
+	"exports": {
+		".": {
+			"import": {
+				"types": "./dist/index.d.ts",
+				"default": "./dist/index.js"
+			},
+			"require": {
+				"types": "./dist/index.d.cts",
+				"default": "./dist/index.cjs"
+			}
+		},
+		"./package.json": "./package.json"
+	},
+	"files": [
+		"dist"
+	],
+	"sideEffects": false,
+	"license": "Apache-2.0",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/MrKoriy/wbauth.git",
+		"directory": "typescript"
+	},
+	"homepage": "https://github.com/MrKoriy/wbauth#readme",
+	"bugs": "https://github.com/MrKoriy/wbauth/issues",
+	"keywords": [
+		"web-bot-auth",
+		"rfc9421",
+		"http-message-signatures",
+		"ed25519",
+		"ai-agents",
+		"crawler",
+		"playwright"
+	],
+	"engines": {
+		"node": ">=20"
+	},
+	"publishConfig": {
+		"access": "public",
+		"provenance": true
+	},
+	"scripts": {
+		"build": "tsup",
+		"test": "vitest run",
+		"lint": "biome check .",
+		"prepublishOnly": "npm run build",
+		"typecheck": "tsc --noEmit -p ."
+	},
+	"dependencies": {
+		"http-message-sig": "^0.2.0",
+		"web-bot-auth": "^0.1.3"
+	},
+	"devDependencies": {
+		"@biomejs/biome": "^2",
+		"@types/node": "^20",
+		"playwright": "^1.59",
+		"tsup": "^8",
+		"typescript": "^6",
+		"vitest": "^4"
+	},
+	"peerDependencies": {
+		"playwright": "^1"
+	},
+	"peerDependenciesMeta": {
+		"playwright": {
+			"optional": true
+		}
+	}
+}