Webhook verifier should default replay store to in-memory (parity with request-signing)

[bokelley]

Follow-up from #917 and the cross-SDK ergonomics work in adcp-client-python#272 / adcp-go#88.

`#917` defaulted `replayStore` and `revocationStore` on `verifySignatureAsAuthenticator` and `createExpressVerifier` — the request-signing surface. The webhook profile (`verifyWebhookSignature` in `@adcp/client/signing/server`) has a symmetric replay-store dependency and the same regression class applies: omitting the store silently disables webhook-replay dedup.

Compliance vector `compliance/cache/3.0.0/test-vectors/webhook-signing/negative/016-replayed-nonce.json` is identical in shape to the request-signing version.

Proposal:

• Default `replayStore` to a fresh `InMemoryReplayStore` on `verifyWebhookSignature` (or whatever the equivalent option bag is named).
• Mirror the same security-by-default story across TS / Python / Go webhook verifiers — symmetric to the request-signing work that just shipped.
• Add a regression test that confirms a replayed webhook gets rejected when the caller didn't pass an explicit store.

cc @benminer (this came out of adcp#3064 review)

[bokelley]

Triage

Classification: feature request (security-by-default ergonomics)
Bucket(s): library (src/lib/signing/)
Status: drafting-pr

What the experts said:

• security-reviewer: confirmed the initial "make stores optional on verifyWebhookSignature" approach is a blocker — per-call defaulting silently defeats replay detection; factory pattern with closure-scope stores is the correct fix
• code-reviewer: non-breaking additive change; approved with nits addressed (JSDoc strength, test fixture safety guard)

My take: createWebhookVerifier factory mirrors createExpressVerifier exactly — stores instantiated once at creation time, shared across all requests via closure. Draft PR #928 covers the factory, its options type, exports, and a regression test that proves replay is rejected when no explicit store is passed.

Drafting PR: add createWebhookVerifier(options) factory to @adcp/client/signing/server, symmetric with createExpressVerifier, with a regression test for the no-explicit-store replay case.

---

Triaged by Claude Code. Session: https://claude.ai/code/session_01UWbckodGXcJVoH1Z1VpLjv

---

Generated by Claude Code