@adcp/sdk 14.0.0-rc.39 → 14.0.0-rc.40

package/dist/lib/supply-path/validation.js

@@ -0,0 +1,152 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var validation_exports = {};
+__export(validation_exports, {
+  agentIdentity: () => agentIdentity,
+  assertRegistrySupplyPathResult: () => assertRegistrySupplyPathResult,
+  domain: () => domain,
+  record: () => record,
+  records: () => records,
+  strings: () => strings,
+  validateSupplyPathRequest: () => validateSupplyPathRequest
+});
+module.exports = __toCommonJS(validation_exports);
+var import_node_net = require("node:net");
+var import_resolve_agent_properties = require('../discovery/resolve-agent-properties.js');
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function records(value) {
+  return Array.isArray(value) ? value.filter(record) : [];
+}
+function strings(value) {
+  return Array.isArray(value) && value.length > 0 && value.every((v) => typeof v === "string" && v.trim().length > 0);
+}
+function domain(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.toLowerCase().replace(/\.$/, "");
+  if (normalized.length > 253 || (0, import_node_net.isIP)(normalized) || !normalized.includes(".")) return null;
+  return normalized.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) ? normalized : null;
+}
+function agentIdentity(value) {
+  if (typeof value !== "string" || /[\s\x00-\x1f\x7f]/.test(value)) return null;
+  const canonical = (0, import_resolve_agent_properties.canonicalizeAgentUrl)(value);
+  return canonical?.startsWith("https://") ? canonical : null;
+}
+function validateSupplyPathRequest(input) {
+  if (!record(input)) throw new TypeError("Supply-path request must be an object");
+  const owner = domain(input.owner_domain);
+  const host = domain(input.host_domain);
+  if (!owner || !host) throw new TypeError("owner_domain and host_domain must be DNS publisher domains");
+  if (!agentIdentity(input.agent_url)) throw new TypeError("agent_url must be an HTTPS URL without credentials");
+  if (input.collection_id !== void 0 && (typeof input.collection_id !== "string" || !input.collection_id.trim() || input.collection_id.length > 256)) {
+    throw new TypeError("collection_id must be a non-empty string of at most 256 characters");
+  }
+  return {
+    owner_domain: owner,
+    host_domain: host,
+    agent_url: input.agent_url,
+    ...input.collection_id !== void 0 ? { collection_id: input.collection_id } : {}
+  };
+}
+function assertRegistrySupplyPathResult(value, request) {
+  const fail = (invariant) => {
+    throw new TypeError(
+      `Invalid registry supply-path response: ${invariant}; verification cannot be accepted, check the registry response contract`
+    );
+  };
+  if (!record(value)) return fail("response must be an object");
+  if (value.semantics_version !== "1")
+    throw new TypeError("Invalid registry supply-path response: semantics_version 1 required; upgrade the registry");
+  if (!record(value.legs) || !record(value.sources)) return fail("legs and sources must be objects");
+  if (!["verified_owner_sold", "host_delegated", "owner_attested", "unverified"].includes(String(value.state)))
+    return fail("state is not recognized");
+  if (domain(value.owner_domain) !== request.owner_domain || domain(value.host_domain) !== request.host_domain || agentIdentity(value.agent_url) !== agentIdentity(request.agent_url) || value.collection_id !== request.collection_id)
+    return fail("request identity does not match the submitted owner, host, agent, and collection");
+  if (typeof value.checked_at !== "string" || !Number.isFinite(Date.parse(value.checked_at)) || typeof value.sources.cached !== "boolean")
+    return fail("checked_at or sources.cached provenance is malformed");
+  for (const key of ["owner_adagents_url", "host_adagents_url"]) {
+    if (typeof value.sources[key] !== "string") return fail(`sources.${key} must be an HTTPS URL`);
+    try {
+      const url = new URL(value.sources[key]);
+      if (url.protocol !== "https:" || url.username || url.password)
+        return fail(`sources.${key} must be an HTTPS URL without credentials`);
+    } catch {
+      return fail(`sources.${key} must be a valid URL`);
+    }
+  }
+  for (const key of ["owner_fetched_at", "host_fetched_at"]) {
+    const timestamp = value.sources[key];
+    if (timestamp !== null && (typeof timestamp !== "string" || !Number.isFinite(Date.parse(timestamp))))
+      return fail(`sources.${key} must be null or a valid timestamp`);
+  }
+  for (const key of ["owner_resolved_url", "host_resolved_url"]) {
+    const location = value.sources[key];
+    if (location === null) continue;
+    if (typeof location !== "string" || location.length > 8192)
+      return fail(`sources.${key} must be null or a bounded HTTPS URL`);
+    try {
+      const parsed = new URL(location);
+      if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash || parsed.port && parsed.port !== "443")
+        return fail(`sources.${key} must be an HTTPS URL without credentials, fragments, or nonstandard ports`);
+    } catch {
+      return fail(`sources.${key} must be a valid URL`);
+    }
+  }
+  const legNames = [
+    "owner_collection_declared",
+    "owner_distribution_carriage",
+    "owner_agent_declared",
+    "host_authorization",
+    "inventory_partner_domain"
+  ];
+  for (const key of legNames) {
+    const leg = value.legs[key];
+    if (!record(leg) || typeof leg.ok !== "boolean" || leg.detail !== void 0 && typeof leg.detail !== "string")
+      return fail(`legs.${key} is malformed`);
+    if (leg.ok ? leg.failure !== void 0 : typeof leg.failure !== "string" || !leg.failure.length)
+      return fail(`legs.${key} has an inconsistent ok/failure pair`);
+    for (const ids of ["property_ids_matched", "property_ids_unmatched"]) {
+      if (leg[ids] !== void 0 && (!Array.isArray(leg[ids]) || !leg[ids].every((id) => typeof id === "string")))
+        return fail(`legs.${key}.${ids} must contain only string property IDs`);
+    }
+  }
+  const ok = (key) => value.legs[key]?.ok === true;
+  if (ok("owner_collection_declared")) {
+    if (typeof value.resolved_collection_id !== "string" || !value.resolved_collection_id.trim() || value.resolved_collection_id.length > 256 || request.collection_id !== void 0 && value.resolved_collection_id !== request.collection_id)
+      return fail("resolved_collection_id is missing, malformed, or inconsistent with the request");
+  } else if (value.resolved_collection_id !== void 0)
+    return fail("resolved_collection_id requires a successful owner collection leg");
+  if (value.state === "verified_owner_sold" && !(ok("owner_collection_declared") && ok("owner_distribution_carriage") && ok("host_authorization")))
+    return fail("verified_owner_sold is inconsistent with its required successful legs");
+  if (value.state === "host_delegated" && !(ok("owner_collection_declared") && ok("owner_agent_declared") && ok("inventory_partner_domain")))
+    return fail("host_delegated is inconsistent with its required successful legs");
+  if (value.state === "owner_attested" && !ok("owner_collection_declared"))
+    return fail("owner_attested requires a successful owner collection leg");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  agentIdentity,
+  assertRegistrySupplyPathResult,
+  domain,
+  record,
+  records,
+  strings,
+  validateSupplyPathRequest
+});

package/dist/lib/supply-path/validation.mjs

@@ -0,0 +1,122 @@
+import { isIP } from "node:net";
+import { canonicalizeAgentUrl } from "../discovery/resolve-agent-properties.mjs";
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function records(value) {
+  return Array.isArray(value) ? value.filter(record) : [];
+}
+function strings(value) {
+  return Array.isArray(value) && value.length > 0 && value.every((v) => typeof v === "string" && v.trim().length > 0);
+}
+function domain(value) {
+  if (typeof value !== "string") return null;
+  const normalized = value.toLowerCase().replace(/\.$/, "");
+  if (normalized.length > 253 || isIP(normalized) || !normalized.includes(".")) return null;
+  return normalized.split(".").every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)) ? normalized : null;
+}
+function agentIdentity(value) {
+  if (typeof value !== "string" || /[\s\x00-\x1f\x7f]/.test(value)) return null;
+  const canonical = canonicalizeAgentUrl(value);
+  return canonical?.startsWith("https://") ? canonical : null;
+}
+function validateSupplyPathRequest(input) {
+  if (!record(input)) throw new TypeError("Supply-path request must be an object");
+  const owner = domain(input.owner_domain);
+  const host = domain(input.host_domain);
+  if (!owner || !host) throw new TypeError("owner_domain and host_domain must be DNS publisher domains");
+  if (!agentIdentity(input.agent_url)) throw new TypeError("agent_url must be an HTTPS URL without credentials");
+  if (input.collection_id !== void 0 && (typeof input.collection_id !== "string" || !input.collection_id.trim() || input.collection_id.length > 256)) {
+    throw new TypeError("collection_id must be a non-empty string of at most 256 characters");
+  }
+  return {
+    owner_domain: owner,
+    host_domain: host,
+    agent_url: input.agent_url,
+    ...input.collection_id !== void 0 ? { collection_id: input.collection_id } : {}
+  };
+}
+function assertRegistrySupplyPathResult(value, request) {
+  const fail = (invariant) => {
+    throw new TypeError(
+      `Invalid registry supply-path response: ${invariant}; verification cannot be accepted, check the registry response contract`
+    );
+  };
+  if (!record(value)) return fail("response must be an object");
+  if (value.semantics_version !== "1")
+    throw new TypeError("Invalid registry supply-path response: semantics_version 1 required; upgrade the registry");
+  if (!record(value.legs) || !record(value.sources)) return fail("legs and sources must be objects");
+  if (!["verified_owner_sold", "host_delegated", "owner_attested", "unverified"].includes(String(value.state)))
+    return fail("state is not recognized");
+  if (domain(value.owner_domain) !== request.owner_domain || domain(value.host_domain) !== request.host_domain || agentIdentity(value.agent_url) !== agentIdentity(request.agent_url) || value.collection_id !== request.collection_id)
+    return fail("request identity does not match the submitted owner, host, agent, and collection");
+  if (typeof value.checked_at !== "string" || !Number.isFinite(Date.parse(value.checked_at)) || typeof value.sources.cached !== "boolean")
+    return fail("checked_at or sources.cached provenance is malformed");
+  for (const key of ["owner_adagents_url", "host_adagents_url"]) {
+    if (typeof value.sources[key] !== "string") return fail(`sources.${key} must be an HTTPS URL`);
+    try {
+      const url = new URL(value.sources[key]);
+      if (url.protocol !== "https:" || url.username || url.password)
+        return fail(`sources.${key} must be an HTTPS URL without credentials`);
+    } catch {
+      return fail(`sources.${key} must be a valid URL`);
+    }
+  }
+  for (const key of ["owner_fetched_at", "host_fetched_at"]) {
+    const timestamp = value.sources[key];
+    if (timestamp !== null && (typeof timestamp !== "string" || !Number.isFinite(Date.parse(timestamp))))
+      return fail(`sources.${key} must be null or a valid timestamp`);
+  }
+  for (const key of ["owner_resolved_url", "host_resolved_url"]) {
+    const location = value.sources[key];
+    if (location === null) continue;
+    if (typeof location !== "string" || location.length > 8192)
+      return fail(`sources.${key} must be null or a bounded HTTPS URL`);
+    try {
+      const parsed = new URL(location);
+      if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash || parsed.port && parsed.port !== "443")
+        return fail(`sources.${key} must be an HTTPS URL without credentials, fragments, or nonstandard ports`);
+    } catch {
+      return fail(`sources.${key} must be a valid URL`);
+    }
+  }
+  const legNames = [
+    "owner_collection_declared",
+    "owner_distribution_carriage",
+    "owner_agent_declared",
+    "host_authorization",
+    "inventory_partner_domain"
+  ];
+  for (const key of legNames) {
+    const leg = value.legs[key];
+    if (!record(leg) || typeof leg.ok !== "boolean" || leg.detail !== void 0 && typeof leg.detail !== "string")
+      return fail(`legs.${key} is malformed`);
+    if (leg.ok ? leg.failure !== void 0 : typeof leg.failure !== "string" || !leg.failure.length)
+      return fail(`legs.${key} has an inconsistent ok/failure pair`);
+    for (const ids of ["property_ids_matched", "property_ids_unmatched"]) {
+      if (leg[ids] !== void 0 && (!Array.isArray(leg[ids]) || !leg[ids].every((id) => typeof id === "string")))
+        return fail(`legs.${key}.${ids} must contain only string property IDs`);
+    }
+  }
+  const ok = (key) => value.legs[key]?.ok === true;
+  if (ok("owner_collection_declared")) {
+    if (typeof value.resolved_collection_id !== "string" || !value.resolved_collection_id.trim() || value.resolved_collection_id.length > 256 || request.collection_id !== void 0 && value.resolved_collection_id !== request.collection_id)
+      return fail("resolved_collection_id is missing, malformed, or inconsistent with the request");
+  } else if (value.resolved_collection_id !== void 0)
+    return fail("resolved_collection_id requires a successful owner collection leg");
+  if (value.state === "verified_owner_sold" && !(ok("owner_collection_declared") && ok("owner_distribution_carriage") && ok("host_authorization")))
+    return fail("verified_owner_sold is inconsistent with its required successful legs");
+  if (value.state === "host_delegated" && !(ok("owner_collection_declared") && ok("owner_agent_declared") && ok("inventory_partner_domain")))
+    return fail("host_delegated is inconsistent with its required successful legs");
+  if (value.state === "owner_attested" && !ok("owner_collection_declared"))
+    return fail("owner_attested requires a successful owner collection leg");
+}
+export {
+  agentIdentity,
+  assertRegistrySupplyPathResult,
+  domain,
+  record,
+  records,
+  strings,
+  validateSupplyPathRequest
+};

package/dist/lib/supply-path/verify.d.mts

@@ -0,0 +1,25 @@
+import { SupplyPathEvidenceSession } from './fetch-evidence.mjs';
+import type { SupplyPathRequest, VerifySupplyPathOptions, RegistrySupplyPathOptions, AuthoritativeSupplyPathOptions, RegistrySupplyPathResult, AuthoritativeSupplyPathResult } from './types.mjs';
+/**
+ * Verify one owner/host/agent path. Authoritative mode (the default) fetches
+ * live publisher evidence; registry mode validates a remote cached verdict.
+ * Invalid evidence rejects or returns a fail-closed verdict—it is never
+ * converted into synthetic authorization.
+ *
+ * @example
+ * ```ts
+ * const verdict = await verifySupplyPath({
+ *   owner_domain: 'owner.example',
+ *   host_domain: 'host.example',
+ *   agent_url: 'https://sales.example',
+ *   collection_id: 'news',
+ * });
+ * ```
+ *
+ * @see docs/guides/SUPPLY-PATH-VERIFICATION.md
+ */
+export declare function verifySupplyPath(request: SupplyPathRequest, options: RegistrySupplyPathOptions): Promise<RegistrySupplyPathResult>;
+export declare function verifySupplyPath(request: SupplyPathRequest, options?: AuthoritativeSupplyPathOptions): Promise<AuthoritativeSupplyPathResult>;
+export declare function verifySupplyPath(request: SupplyPathRequest, options: VerifySupplyPathOptions): Promise<RegistrySupplyPathResult | AuthoritativeSupplyPathResult>;
+/** Internal batch entrypoint; callers cannot supply evidence through the public API. */
+export declare function verifyAuthoritativeSupplyPath(normalized: SupplyPathRequest, options: AuthoritativeSupplyPathOptions, session: SupplyPathEvidenceSession): Promise<AuthoritativeSupplyPathResult>;

package/dist/lib/supply-path/verify.d.ts

@@ -0,0 +1,25 @@
+import { SupplyPathEvidenceSession } from './fetch-evidence';
+import type { SupplyPathRequest, VerifySupplyPathOptions, RegistrySupplyPathOptions, AuthoritativeSupplyPathOptions, RegistrySupplyPathResult, AuthoritativeSupplyPathResult } from './types';
+/**
+ * Verify one owner/host/agent path. Authoritative mode (the default) fetches
+ * live publisher evidence; registry mode validates a remote cached verdict.
+ * Invalid evidence rejects or returns a fail-closed verdict—it is never
+ * converted into synthetic authorization.
+ *
+ * @example
+ * ```ts
+ * const verdict = await verifySupplyPath({
+ *   owner_domain: 'owner.example',
+ *   host_domain: 'host.example',
+ *   agent_url: 'https://sales.example',
+ *   collection_id: 'news',
+ * });
+ * ```
+ *
+ * @see docs/guides/SUPPLY-PATH-VERIFICATION.md
+ */
+export declare function verifySupplyPath(request: SupplyPathRequest, options: RegistrySupplyPathOptions): Promise<RegistrySupplyPathResult>;
+export declare function verifySupplyPath(request: SupplyPathRequest, options?: AuthoritativeSupplyPathOptions): Promise<AuthoritativeSupplyPathResult>;
+export declare function verifySupplyPath(request: SupplyPathRequest, options: VerifySupplyPathOptions): Promise<RegistrySupplyPathResult | AuthoritativeSupplyPathResult>;
+/** Internal batch entrypoint; callers cannot supply evidence through the public API. */
+export declare function verifyAuthoritativeSupplyPath(normalized: SupplyPathRequest, options: AuthoritativeSupplyPathOptions, session: SupplyPathEvidenceSession): Promise<AuthoritativeSupplyPathResult>;

package/dist/lib/supply-path/verify.js

@@ -0,0 +1,218 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var verify_exports = {};
+__export(verify_exports, {
+  verifyAuthoritativeSupplyPath: () => verifyAuthoritativeSupplyPath,
+  verifySupplyPath: () => verifySupplyPath
+});
+module.exports = __toCommonJS(verify_exports);
+var import_abort = require('../protocols/abort.js');
+var import_publisher_property_selector = require('../discovery/publisher-property-selector.js');
+var import_validation = require('./validation.js');
+var import_registry = require('../registry/index.js');
+var import_fetch_evidence = require('./fetch-evidence.js');
+var import_evaluate = require('./evaluate.js');
+var import_validation2 = require('./validation.js');
+const MAX_PROPERTY_SCOPE_VALUES = 32768;
+const MAX_PROPERTY_SELECTOR_EXPANSIONS = 4096;
+async function verifySupplyPath(request, options = { source: "authoritative" }) {
+  const normalized = (0, import_validation2.validateSupplyPathRequest)(request);
+  if (options.source === "registry") {
+    const result = await (options.registry ?? new import_registry.RegistryClient()).verifySupplyPath(normalized);
+    (0, import_validation2.assertRegistrySupplyPathResult)(result, normalized);
+    return result;
+  }
+  if (options.source !== "authoritative") throw new TypeError("source must be registry or authoritative");
+  const session = new import_fetch_evidence.SupplyPathEvidenceSession(options);
+  try {
+    return await (0, import_abort.withAbortSignal)(
+      [session.signal],
+      void 0,
+      () => verifyAuthoritativeSupplyPath(normalized, options, session)
+    );
+  } finally {
+    session.close();
+  }
+}
+async function verifyAuthoritativeSupplyPath(normalized, options, session) {
+  if (options.propertySelectors !== void 0) {
+    if (!Array.isArray(options.propertySelectors) || !options.propertySelectors.length)
+      throw new TypeError("propertySelectors must be non-empty");
+    if (options.propertySelectors.length > 1024)
+      throw new TypeError("propertySelectors exceed the evaluation work limit");
+    for (const raw of options.propertySelectors) {
+      if (!(0, import_evaluate.isUnqualifiedPropertySelector)(raw)) throw new TypeError("Unsupported product property selector fields");
+      if (!(0, import_evaluate.hasValidPropertySelectorPredicate)(raw))
+        throw new TypeError("Product property selector predicate conflicts with selection_type");
+    }
+  }
+  const [ownerManifest, hostManifest] = await Promise.all([
+    session.adagents(normalized.owner_domain),
+    session.adagents(normalized.host_domain)
+  ]);
+  const input = {
+    ownerDomain: normalized.owner_domain,
+    hostDomain: normalized.host_domain,
+    agentUrl: normalized.agent_url,
+    collectionId: normalized.collection_id,
+    ownerManifest,
+    hostManifest,
+    requireExplicitOwnerPublisherDomain: session.crossOriginAuthorities.has(normalized.owner_domain),
+    requireExplicitHostPublisherDomain: session.crossOriginAuthorities.has(normalized.host_domain),
+    hostInventoryPartnerDomains: null,
+    hostInventoryPartnerDomainsByFile: void 0,
+    heldRevocations: {
+      owner: session.revocations.get(normalized.owner_domain)?.map((r) => r.publisher_domain),
+      host: session.revocations.get(normalized.host_domain)?.map((r) => r.publisher_domain)
+    }
+  };
+  const scopedInput = input;
+  let selectorLimitExceeded = false;
+  if (options.propertySelectors !== void 0) {
+    const ids = /* @__PURE__ */ new Set();
+    const rawProperties = hostManifest?.properties;
+    if (Array.isArray(rawProperties) && rawProperties.length > 1024) selectorLimitExceeded = true;
+    const properties = selectorLimitExceeded ? [] : (0, import_validation.records)(rawProperties).filter(
+      (p) => p.publisher_domain === void 0 && !input.requireExplicitHostPublisherDomain || (0, import_validation.domain)(p.publisher_domain) === normalized.host_domain
+    );
+    let unresolved = false;
+    let scopeValues = properties.length;
+    const availableTags = /* @__PURE__ */ new Set();
+    for (const property of properties) {
+      session.assertActive();
+      if (property.tags === void 0) continue;
+      if (!Array.isArray(property.tags) || property.tags.length > 1024 || property.tags.some((tag) => typeof tag !== "string" || !tag.trim())) {
+        selectorLimitExceeded = true;
+        continue;
+      }
+      scopeValues += property.tags.length;
+      if (scopeValues > MAX_PROPERTY_SCOPE_VALUES) {
+        selectorLimitExceeded = true;
+        break;
+      }
+      for (const tag of property.tags) {
+        if (tag.length > 8192) selectorLimitExceeded = true;
+        availableTags.add(tag);
+      }
+    }
+    const selectors = [];
+    for (const raw of options.propertySelectors) {
+      session.assertActive();
+      if (selectorLimitExceeded) continue;
+      const selector = (0, import_publisher_property_selector.parsePublisherPropertySelector)(raw);
+      const expansionCount = "publisher_domains" in selector ? selector.publisher_domains.length : 1;
+      if (selectors.length + expansionCount > MAX_PROPERTY_SELECTOR_EXPANSIONS) {
+        selectorLimitExceeded = true;
+        continue;
+      }
+      const expanded = (0, import_publisher_property_selector.expandPublisherPropertySelector)(selector);
+      selectors.push(...expanded);
+    }
+    const selectedTags = /* @__PURE__ */ new Set();
+    let selectAll = false;
+    for (const single of selectors) {
+      session.assertActive();
+      scopeValues += 1;
+      if (scopeValues > MAX_PROPERTY_SCOPE_VALUES) selectorLimitExceeded = true;
+      if (!selectorLimitExceeded) {
+        if ((0, import_validation.domain)(single.publisher_domain) !== normalized.host_domain)
+          throw new TypeError("propertySelectors must name host_domain");
+        if (single.selection_type === "by_id") {
+          if (!(0, import_validation.strings)(single.property_ids)) throw new TypeError("Invalid product property IDs");
+          scopeValues += single.property_ids.length;
+          if (single.property_ids.length > 1024 || single.property_ids.some((id) => id.length > 8192))
+            selectorLimitExceeded = true;
+          for (const id of single.property_ids) ids.add(id);
+        } else {
+          if (single.selection_type === "by_tag" && !(0, import_validation.strings)(single.property_tags))
+            throw new TypeError("Invalid product property tags");
+          if (single.selection_type === "all") {
+            selectAll = true;
+            if (!properties.length) unresolved = true;
+          } else {
+            scopeValues += single.property_tags.length;
+            if (single.property_tags.length > 1024 || single.property_tags.some((tag) => tag.length > 8192))
+              selectorLimitExceeded = true;
+            let matched = false;
+            for (const tag of single.property_tags) {
+              if (!availableTags.has(tag)) continue;
+              matched = true;
+              selectedTags.add(tag);
+            }
+            if (!matched) unresolved = true;
+          }
+        }
+      }
+    }
+    if (scopeValues > MAX_PROPERTY_SCOPE_VALUES) selectorLimitExceeded = true;
+    if (!selectorLimitExceeded && (selectAll || selectedTags.size)) {
+      for (const property of properties) {
+        session.assertActive();
+        const selected = selectAll || Array.isArray(property.tags) && property.tags.some((tag) => selectedTags.has(tag));
+        if (!selected) continue;
+        if (typeof property.property_id !== "string" || !property.property_id.length) unresolved = true;
+        else ids.add(property.property_id);
+      }
+    }
+    scopedInput.requiredHostPropertyIds = selectorLimitExceeded || unresolved ? [] : [...ids];
+  }
+  session.assertActive();
+  let verdict = selectorLimitExceeded ? (0, import_evaluate.evaluationLimitVerdict)() : (0, import_evaluate.evaluateSupplyPath)(scopedInput);
+  session.assertActive();
+  if (!verdict.legs.host_authorization.ok && verdict.legs.host_authorization.failure !== "evaluation_limit_exceeded") {
+    const policy = (0, import_evaluate.supplyPathAdsTxtPolicy)(scopedInput);
+    const responses = await Promise.all(
+      policy.files.map((kind) => session.read(normalized.host_domain, kind, `https://${normalized.host_domain}/${kind}`))
+    );
+    input.hostInventoryPartnerDomainsByFile = Object.fromEntries(
+      policy.files.map((file, index) => [
+        file,
+        responses[index] ? (0, import_evaluate.parseInventoryPartnerDomains)(new TextDecoder().decode(responses[index].body)) : null
+      ])
+    );
+    session.assertActive();
+    verdict = (0, import_evaluate.evaluateSupplyPath)(scopedInput);
+    session.assertActive();
+  } else if (verdict.legs.host_authorization.ok) {
+    verdict = (0, import_evaluate.evaluateSupplyPath)({ ...scopedInput, inventoryPartnerDomainEvaluated: false });
+    session.assertActive();
+  }
+  session.assertActive();
+  return {
+    ...verdict,
+    ...normalized,
+    source: "authoritative",
+    ...options.propertySelectors ? { property_selectors: options.propertySelectors } : {},
+    sources: {
+      owner_adagents_url: `https://${normalized.owner_domain}/.well-known/adagents.json`,
+      host_adagents_url: `https://${normalized.host_domain}/.well-known/adagents.json`,
+      cached: false,
+      held_revocations: [...session.revocations].filter(([authority]) => authority === normalized.owner_domain || authority === normalized.host_domain).map(([authority, entries]) => ({ authority, entries })),
+      evidence: session.evidence.filter(
+        (e) => e.publisher_domain === normalized.owner_domain || e.publisher_domain === normalized.host_domain
+      )
+    },
+    checked_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  verifyAuthoritativeSupplyPath,
+  verifySupplyPath
+});