feat(signing): default stores + upstream, add createAgentSignedFetch preset

[bokelley]

Summary

Four ergonomic upgrades to the RFC 9421 signing surface. All backwards compatible — existing callers that pass explicit stores or an upstream fetch are unaffected. Lands on top of #916 (mcpToolNameResolver).

• verifySignatureAsAuthenticator — defaults replayStore and revocationStore to fresh InMemoryReplayStore / InMemoryRevocationStore instances when omitted. The defaults are constructed once at authenticator wire-up so replay detection actually works across requests on a single instance. Wire explicit stores for multi-replica deployments where replay state must be shared.

• createExpressVerifier — gets the same defaults, symmetric with verifySignatureAsAuthenticator. Previously the serve() path could omit both stores while the raw-Express path required them — same underlying verifier, asymmetric ergonomics. Now both shapes behave identically on omission.

• buildAgentSigningFetch — defaults upstream to globalThis.fetch when omitted. Throws a clear TypeError if globalThis.fetch isn't available at wire-up, rather than binding undefined and failing cryptically on first request.

• createAgentSignedFetch(options) — new single-seller buyer preset. Bundles buildAgentSigningFetch with a CapabilityCache lookup keyed by the target seller's agent_uri, so adapter authors write one call instead of wiring the cache and capability accessor by hand:

  // fetch.ts
  import { createAgentSignedFetch } from '@adcp/client/signing';
  
  export const signedFetch = createAgentSignedFetch({
    signing: {
      kid: 'my-agent-2026',
      alg: 'ed25519',
      private_key: JSON.parse(process.env.ADCP_PRIV_KEY!),
      agent_url: 'https://agent.example.com',
    },
    sellerAgentUri: 'https://seller.example.com',
  });

  Multi-seller buyers still use buildAgentSigningFetch directly with a URL-dispatching getCapability.

Motivation

Follow-up from the PR #914 signing-guide review — ported to the spec repo at adcp#3064. Ben asked for "base tooling setup as defaults with override capability" plus an init() entrypoint that configures a shared signedFetch importable anywhere.

Module-level init() would regress host-aware multi-agent serve() (5.16) — one process running N agents with N signing keys can't use a singleton. This PR takes the defaults-with-override half directly and ships the "import once, use anywhere" ergonomic via a factory preset instead of a singleton. The usage pattern Ben wants works identically — module-level export const signedFetch = createAgentSignedFetch({...}) — but stays multi-tenant-safe, testable, and consistent with every other SDK config surface (createAdcpServer, serve, createSigningFetch, createExpressVerifier).

Once this merges, the adcp#3064 signing guide can drop the explicit new InMemoryReplayStore() / new InMemoryRevocationStore() lines from its Step 4 createExpressVerifier and requireAuthenticatedOrSigned examples, and the Step 3 capability-aware fetch example can collapse into a single createAgentSignedFetch({ signing, sellerAgentUri }) call.

Test plan

• New tests: test/lib/signing-defaults-and-preset.test.js — 12/12 pass
  • 3 for verifySignatureAsAuthenticator default stores (accepts valid signature, default replay store rejects replays, separate authenticator instances get isolated stores)
  • 3 for createExpressVerifier default stores (accepts valid signature, default replay store rejects replays with 401 WWW-Authenticate: Signature, separate middleware instances get isolated stores)
  • 2 for buildAgentSigningFetch default upstream (falls back to globalThis.fetch, throws TypeError when globalThis.fetch is unavailable)
  • 4 for createAgentSignedFetch preset (returns FetchLike, cold-cache no-sign, required_for sign, default cache wiring)
• Regression: existing auth-signature-compose.test.js + webhook-signing-vectors.test.js + storyboard-webhook-signature.test.js + request-signing-runner-integration.test.js + request-signing-e2e.test.js still green (84/84)
• npm run build clean
• tsc --noEmit clean (pre-push)

🤖 Generated with Claude Code