@aamp/protocol 1.1.3 → 1.1.4

package/dist/publisher.d.ts

@@ -1,8 +1,4 @@
-/**
- * Layer 2: Publisher Middleware
- * Used by content owners to enforce policy, log access, and filter bots.
- */
-import { AccessPolicy, ContentOrigin, EvaluationResult, UnauthenticatedStrategy, IdentityCache } from './types';
+import { AccessPolicy, ContentOrigin, EvaluationResult, IdentityCache, UnauthenticatedStrategy } from './types';
 export declare class AAMPPublisher {
     private policy;
     private keyPair;

package/dist/publisher.js

@@ -5,9 +5,9 @@ exports.AAMPPublisher = void 0;
  * Layer 2: Publisher Middleware
  * Used by content owners to enforce policy, log access, and filter bots.
  */
-const types_1 = require("./types");
-const crypto_1 = require("./crypto");
 const constants_1 = require("./constants");
+const crypto_1 = require("./crypto");
+const types_1 = require("./types");
 /**
  * Default In-Memory Cache (Fallback only)
  * NOT recommended for high-traffic Serverless production.
@@ -218,7 +218,9 @@ class AAMPPublisher {
     }
     async verifyDnsBinding(domain, requestKeySpki) {
         try {
-            const url = `https://${domain}${constants_1.WELL_KNOWN_AGENT_PATH}`;
+            // Allow HTTP for localhost testing
+            const protocol = (domain.includes('localhost') || domain.match(/:\d+$/)) ? 'http' : 'https';
+            const url = `${protocol}://${domain}${constants_1.WELL_KNOWN_AGENT_PATH}`;
             // In production, we need a short timeout to prevent hanging
             const controller = new AbortController();
             const timeoutId = setTimeout(() => controller.abort(), 1500); // 1.5s max for DNS check
@@ -234,7 +236,8 @@ class AAMPPublisher {
         }
     }
     isDomain(s) {
-        return /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);
+        // Basic regex, allows localhost with ports
+        return /^[a-zA-Z0-9.-]+(:\d+)?$/.test(s) || /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);
     }
     async generateResponseHeaders(origin) {
         if (!this.keyPair)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aamp/protocol",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "TypeScript reference implementation of AAMP v1.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/publisher.ts

@@ -2,9 +2,9 @@
  * Layer 2: Publisher Middleware
  * Used by content owners to enforce policy, log access, and filter bots.
  */
-import { AccessPolicy, AccessPurpose, SignedAccessRequest, ContentOrigin, FeedbackSignal, AgentIdentityManifest, EvaluationResult, UnauthenticatedStrategy, IdentityCache } from './types';
-import { verifySignature, signData, exportPublicKey } from './crypto';
-import { MAX_CLOCK_SKEW_MS, HEADERS, WELL_KNOWN_AGENT_PATH } from './constants';
+import { HEADERS, MAX_CLOCK_SKEW_MS, WELL_KNOWN_AGENT_PATH } from './constants';
+import { exportPublicKey, signData, verifySignature } from './crypto';
+import { AccessPolicy, AccessPurpose, AgentIdentityManifest, ContentOrigin, EvaluationResult, IdentityCache, SignedAccessRequest, UnauthenticatedStrategy } from './types';
 
 interface VerificationResult {
   allowed: boolean;
@@ -273,7 +273,10 @@ export class AAMPPublisher {
 
   private async verifyDnsBinding(domain: string, requestKeySpki: string): Promise<boolean> {
     try {
-      const url = `https://${domain}${WELL_KNOWN_AGENT_PATH}`;
+      // Allow HTTP for localhost testing
+      const protocol = (domain.includes('localhost') || domain.match(/:\d+$/)) ? 'http' : 'https';
+      const url = `${protocol}://${domain}${WELL_KNOWN_AGENT_PATH}`;
+      
       // In production, we need a short timeout to prevent hanging
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), 1500); // 1.5s max for DNS check
@@ -288,7 +291,8 @@ export class AAMPPublisher {
   }
 
   private isDomain(s: string): boolean {
-    return /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);
+    // Basic regex, allows localhost with ports
+    return /^[a-zA-Z0-9.-]+(:\d+)?$/.test(s) || /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);
   }
 
   async generateResponseHeaders(origin: ContentOrigin): Promise<Record<string, string>> {