@aamp/protocol 1.1.7 → 1.1.9

package/dist/publisher.d.ts

@@ -33,6 +33,11 @@ export declare class AAMPPublisher {
     private checkPolicyStrict;
     private verifyRequestLogic;
     private verifyDnsBinding;
+    /**
+     * NEW: Verify a Broker-Issued Token (JWT)
+     * Checks if the request contains a valid "Visa" from the Broker.
+     */
+    private verifyBrokerCred;
     private isDomain;
     generateResponseHeaders(origin: ContentOrigin): Promise<Record<string, string>>;
     /**

package/dist/publisher.js

@@ -6,6 +6,7 @@ import { HEADERS, MAX_CLOCK_SKEW_MS, WELL_KNOWN_AGENT_PATH } from './constants.j
 import { exportPublicKey, signData, verifySignature } from './crypto.js';
 import { AccessPurpose } from './types.js';
 import { verifyJwt } from './proof.js';
+import { jwtVerify, createRemoteJWKSet } from 'jose';
 /**
  * Default In-Memory Cache (Fallback only)
  * NOT recommended for high-traffic Serverless production.
@@ -186,6 +187,19 @@ export class AAMPPublisher {
         if (requestHeader.purpose === AccessPurpose.CRAWL_TRAINING && !this.policy.allowTraining) {
             return { allowed: false, status: 403, reason: 'POLICY_DENIED: Training not allowed.', visitorType: 'VERIFIED_AGENT' };
         }
+        // 2. BROKER CHECK (New v1.1)
+        if (this.policy.monetization?.brokerUrl) {
+            const brokerUrl = this.policy.monetization.brokerUrl;
+            if (!paymentCredential) {
+                return { allowed: false, status: 402, reason: "PAYMENT_REQUIRED: Missing Broker Credential", visitorType: 'UNIDENTIFIED_BOT' };
+            }
+            const isValid = await this.verifyBrokerCred(paymentCredential, brokerUrl);
+            if (!isValid) {
+                return { allowed: false, status: 403, reason: "PAYMENT_DENIED: Invalid Broker Token", visitorType: 'UNIDENTIFIED_BOT' };
+            }
+            // If valid, we record the "Proof Used" so we can settle later
+            return { allowed: true, status: 200, reason: "AAMP_PAID", visitorType: "VERIFIED_AGENT", proofUsed: `BROKER_JWT:${paymentCredential.slice(0, 10)}...` };
+        }
         if (requestHeader.purpose === AccessPurpose.RAG_RETRIEVAL && !this.policy.allowRAG) {
             return { allowed: false, status: 403, reason: 'POLICY_DENIED: RAG not allowed.', visitorType: 'VERIFIED_AGENT' };
         }
@@ -275,7 +289,7 @@ export class AAMPPublisher {
             return { allowed: false, reason: 'IDENTITY_FAIL: DNS Binding could not be verified.', identityVerified: false };
         }
         // Return verified status so handleAgentStrict can proceed to Policy Check
-        return { allowed: true, reason: 'OK', identityVerified: true };
+        return { allowed: true, reason: 'OK', identityVerified: identityVerified };
     }
     async verifyDnsBinding(domain, requestKeySpki) {
         try {
@@ -312,6 +326,27 @@ export class AAMPPublisher {
             return false;
         }
     }
+    /**
+     * NEW: Verify a Broker-Issued Token (JWT)
+     * Checks if the request contains a valid "Visa" from the Broker.
+     */
+    async verifyBrokerCred(credential, brokerUrl) {
+        try {
+            // 1. Fetch Broker's Public Keys (JWKS)
+            const JWKS = createRemoteJWKSet(new URL(`${brokerUrl}/.well-known/jwks.json`));
+            // 2. Verify the Token Signature
+            const { payload } = await jwtVerify(credential, JWKS, {
+                issuer: brokerUrl, // Ensure it came from THE Broker
+                clockTolerance: 5 // Allow 5s clock skew
+            });
+            console.log(`[BROKER] 💰 Valid Payment Token from ${payload.iss} for amount ${payload.amount}`);
+            return true;
+        }
+        catch (e) {
+            console.warn(`[BROKER] ❌ Invalid Token:`, e.message);
+            return false;
+        }
+    }
     isDomain(s) {
         // Basic regex, allows localhost with ports
         return /^[a-zA-Z0-9.-]+(:\d+)?$/.test(s) || /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);

package/dist/types.d.ts

@@ -49,6 +49,7 @@ export interface MonetizationConfig {
         jwksUrl: string;
         issuer: string;
     };
+    brokerUrl?: string;
     paymentConfig?: {
         jwksUrl: string;
         issuer: string;

package/package.json

@@ -1,15 +1,22 @@
 {
   "name": "@aamp/protocol",
-  "version": "1.1.7",
+  "version": "1.1.9",
   "description": "TypeScript reference implementation of AAMP v1.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js",
+    "./dist/nextjs": "./dist/nextjs.js",
+    "./dist/agent": "./dist/agent.js",
+    "./dist/types": "./dist/types.js"
+  },
   "type": "module",
   "scripts": {
     "build": "tsc",
     "test": "node --loader ts-node/esm test/handshake.spec.ts"
   },
   "repository": {
+    "license": "Apache-2.0",
     "type": "git",
     "url": "https://github.com/aamp-protocol/aamp.git"
   },

package/src/publisher.ts

@@ -6,6 +6,7 @@ import { HEADERS, MAX_CLOCK_SKEW_MS, WELL_KNOWN_AGENT_PATH } from './constants.j
 import { exportPublicKey, signData, verifySignature } from './crypto.js';
 import { AccessPolicy, AccessPurpose, AgentIdentityManifest, ContentOrigin, EvaluationResult, IdentityCache, SignedAccessRequest, UnauthenticatedStrategy } from './types.js';
 import { verifyJwt } from './proof.js';
+import { jwtVerify, createRemoteJWKSet } from 'jose';
 
 interface VerificationResult {
   allowed: boolean;
@@ -248,6 +249,24 @@ export class AAMPPublisher {
     if (requestHeader.purpose === AccessPurpose.CRAWL_TRAINING && !this.policy.allowTraining) {
       return { allowed: false, status: 403, reason: 'POLICY_DENIED: Training not allowed.', visitorType: 'VERIFIED_AGENT' };
     }
+
+    // 2. BROKER CHECK (New v1.1)
+    if (this.policy.monetization?.brokerUrl) {
+      const brokerUrl = this.policy.monetization.brokerUrl;
+
+      if (!paymentCredential) {
+        return { allowed: false, status: 402, reason: "PAYMENT_REQUIRED: Missing Broker Credential", visitorType: 'UNIDENTIFIED_BOT' };
+      }
+
+      const isValid = await this.verifyBrokerCred(paymentCredential, brokerUrl);
+
+      if (!isValid) {
+        return { allowed: false, status: 403, reason: "PAYMENT_DENIED: Invalid Broker Token", visitorType: 'UNIDENTIFIED_BOT' };
+      }
+
+      // If valid, we record the "Proof Used" so we can settle later
+      return { allowed: true, status: 200, reason: "AAMP_PAID", visitorType: "VERIFIED_AGENT", proofUsed: `BROKER_JWT:${paymentCredential.slice(0, 10)}...` };
+    }
     if (requestHeader.purpose === AccessPurpose.RAG_RETRIEVAL && !this.policy.allowRAG) {
       return { allowed: false, status: 403, reason: 'POLICY_DENIED: RAG not allowed.', visitorType: 'VERIFIED_AGENT' };
     }
@@ -352,7 +371,7 @@ export class AAMPPublisher {
     }
 
     // Return verified status so handleAgentStrict can proceed to Policy Check
-    return { allowed: true, reason: 'OK', identityVerified: true };
+    return { allowed: true, reason: 'OK', identityVerified: identityVerified };
   }
 
   private async verifyDnsBinding(domain: string, requestKeySpki: string): Promise<boolean> {
@@ -398,6 +417,30 @@ export class AAMPPublisher {
     }
   }
 
+  /**
+   * NEW: Verify a Broker-Issued Token (JWT)
+   * Checks if the request contains a valid "Visa" from the Broker.
+   */
+  private async verifyBrokerCred(credential: string, brokerUrl: string): Promise<boolean> {
+    try {
+      // 1. Fetch Broker's Public Keys (JWKS)
+      const JWKS = createRemoteJWKSet(new URL(`${brokerUrl}/.well-known/jwks.json`));
+
+      // 2. Verify the Token Signature
+      const { payload } = await jwtVerify(credential, JWKS, {
+        issuer: brokerUrl, // Ensure it came from THE Broker
+        clockTolerance: 5  // Allow 5s clock skew
+      });
+
+      console.log(`[BROKER] 💰 Valid Payment Token from ${payload.iss} for amount ${payload.amount}`);
+      return true;
+
+    } catch (e: any) {
+      console.warn(`[BROKER] ❌ Invalid Token:`, e.message);
+      return false;
+    }
+  }
+
   private isDomain(s: string): boolean {
     // Basic regex, allows localhost with ports
     return /^[a-zA-Z0-9.-]+(:\d+)?$/.test(s) || /^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(s);

package/src/types.ts

@@ -62,7 +62,11 @@ export interface MonetizationConfig {
     issuer: string;    // e.g. "https://accounts.google.com"
   };
 
-  // Method 3: Payment Credentials (Unified JWT)
+  // Method 3: Broker Integration (NEW)
+  // For third-party clearing houses (AdSense for Data)
+  brokerUrl?: string; // e.g. "https://broker.aamp.network"
+
+  // Method 4: Payment Credentials (Unified JWT)
   // Verifies "x-aamp-credential" for Broker or Direct payments.
   paymentConfig?: {
     jwksUrl: string;   // e.g. "https://my-site.com/.well-known/jwks.json"