@adcp/sdk 14.0.0 → 14.2.0

package/dist/lib/protocols/signedRequestRejection.mjs

@@ -0,0 +1,189 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
+import { AuthenticationRequiredError } from "../errors/index.mjs";
+import { RequestSigningErrorCodeMetadata } from "../types/enums.generated.mjs";
+import { parseWWWAuthenticate } from "../auth/oauth/diagnostics.mjs";
+import { redactSensitiveJsonOrText, sanitizeTransportHeaders, sanitizeTransportUrl } from "./transportDiagnostics.mjs";
+import { recordRawResponseCapture } from "./rawResponseCapture.mjs";
+const CAPTURE_BYTES = 16 * 1024;
+const EXCERPT_LENGTH = 2048;
+const CAPTURE_TIMEOUT_MS = 1e3;
+const PUBLIC_HEADERS = /* @__PURE__ */ new Set([
+  "accept",
+  "content-type",
+  "content-length",
+  "user-agent",
+  "host",
+  "a2a-version",
+  "a2a-extensions",
+  "adcp-version",
+  "mcp-protocol-version",
+  "mcp-session-id",
+  "traceparent",
+  "tracestate",
+  "signature",
+  "signature-input",
+  "content-digest"
+]);
+function wrapFetchWithSignedRequestRejection(upstream, agentUrl) {
+  return async (input, init) => {
+    const startedAt = Date.now();
+    const response = await upstream(input, init);
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : void 0));
+    if (response.status !== 401 || !headers.has("signature")) return response;
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    const parsed = parseWWWAuthenticate(response.headers.get("www-authenticate"));
+    if (parsed && parsed.scheme !== "signature") return response;
+    const knownCode = parsed?.scheme === "signature" && parsed.error && Object.prototype.hasOwnProperty.call(RequestSigningErrorCodeMetadata, parsed.error);
+    const challenge = parsed ? { scheme: parsed.scheme.slice(0, 64), ...knownCode && { error: parsed.error } } : void 0;
+    const secrets = getHeaderSecrets(headers);
+    const captured = await captureBody(response, secrets, init?.signal);
+    const captureHeaders = sanitizeTransportHeaders(response.headers);
+    for (const key of Object.keys(captureHeaders)) {
+      captureHeaders[key] = redactReflected(captureHeaders[key], secrets);
+    }
+    if (parsed) captureHeaders["www-authenticate"] = knownCode ? `Signature error="${parsed.error}"` : "Signature";
+    recordRawResponseCapture(input, init, response, captured?.body ?? "", captured?.truncated ?? true, startedAt, {
+      url: sanitizeTransportUrl(url),
+      headers: captureHeaders
+    });
+    const body = captured?.body;
+    let excerpt = body;
+    if (body && body.length > EXCERPT_LENGTH) {
+      let end = EXCERPT_LENGTH - 1;
+      if (/[\uD800-\uDBFF]/.test(body[end - 1])) end--;
+      excerpt = body.slice(0, end) + "\u2026";
+    }
+    throw new AuthenticationRequiredError(sanitizeTransportUrl(agentUrl ?? url), void 0, void 0, challenge, {
+      status: response.status,
+      responseBody: excerpt
+    });
+  };
+}
+function getSignedRequestRejection(error) {
+  const seen = /* @__PURE__ */ new Set();
+  while (error && typeof error === "object" && !seen.has(error)) {
+    seen.add(error);
+    if (error instanceof AuthenticationRequiredError && error.requestSigned) return error;
+    error = error.cause;
+  }
+  return void 0;
+}
+function getHeaderSecrets(headers) {
+  const secrets = [];
+  headers.forEach((value, name) => {
+    if (value && !PUBLIC_HEADERS.has(name)) {
+      secrets.push(value);
+      if (/^(authorization|proxy-authorization)$/i.test(name)) {
+        const credential = value.replace(/^\S+\s+/, "");
+        if (credential) secrets.push(credential);
+      }
+    }
+  });
+  return secrets;
+}
+function redactReflected(value, secrets) {
+  const mask = new Uint8Array(value.length);
+  for (const secret of secrets) {
+    for (let from = 0; from < value.length; ) {
+      const at = value.indexOf(secret, from);
+      if (at < 0) break;
+      mask.fill(1, at, at + secret.length);
+      from = at + 1;
+    }
+  }
+  let out = "";
+  let cursor = 0;
+  for (let at = 0; at < value.length; ) {
+    if (!mask[at]) {
+      at++;
+      continue;
+    }
+    out += value.slice(cursor, at) + "[redacted]";
+    while (at < value.length && mask[at]) at++;
+    cursor = at;
+  }
+  return out + value.slice(cursor);
+}
+async function captureBody(response, secrets, signal) {
+  if (!response.body) return void 0;
+  const reader = response.body.getReader();
+  let timer;
+  let cancelled = false;
+  const cancel = () => {
+    cancelled = true;
+    void reader.cancel().catch(() => {
+    });
+  };
+  signal?.addEventListener("abort", cancel, { once: true });
+  if (signal?.aborted) cancel();
+  try {
+    return await Promise.race([
+      (async () => {
+        const chunks = [];
+        let bytes = 0;
+        while (true) {
+          const { value, done } = await reader.read();
+          if (done) break;
+          if (bytes + value.byteLength > CAPTURE_BYTES) {
+            return { body: "[seller response exceeds diagnostic capture limit]", truncated: true };
+          }
+          chunks.push(value);
+          bytes += value.byteLength;
+        }
+        if (cancelled) return void 0;
+        let text = Buffer.concat(chunks).toString("utf8");
+        const redact = (value) => redactReflected(value, secrets);
+        if (/^\s*[{["]/.test(text)) {
+          try {
+            const valueRedacted = JSON.stringify(
+              JSON.parse(text, (_key, value) => {
+                if (typeof value === "string") return redact(value);
+                if ((typeof value === "boolean" || value === null) && secrets.includes(String(value)))
+                  return "[redacted]";
+                if (typeof value === "number" && secrets.some((secret) => /^-?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(secret) && Number(secret) === value))
+                  return "[redacted]";
+                return value;
+              })
+            );
+            text = JSON.stringify(
+              JSON.parse(redactSensitiveJsonOrText(valueRedacted), (_key, value) => {
+                if (value && typeof value === "object" && !Array.isArray(value)) {
+                  const out = /* @__PURE__ */ Object.create(null);
+                  for (const key of Object.keys(value)) out[redact(key)] = value[key];
+                  return out;
+                }
+                return value;
+              })
+            );
+          } catch {
+            return { body: "[seller response is not valid diagnostic JSON]", truncated: true };
+          }
+        } else {
+          text = redact(text);
+        }
+        text = redactSensitiveJsonOrText(text).replace(/[\u0000-\u001f\u007f]/g, " ");
+        return { body: text, truncated: false };
+      })(),
+      new Promise((resolve) => {
+        timer = setTimeout(() => {
+          cancel();
+          resolve(void 0);
+        }, CAPTURE_TIMEOUT_MS);
+      })
+    ]);
+  } catch {
+    return void 0;
+  } finally {
+    if (timer) clearTimeout(timer);
+    signal?.removeEventListener("abort", cancel);
+    cancel();
+  }
+}
+export {
+  getSignedRequestRejection,
+  wrapFetchWithSignedRequestRejection
+};

package/dist/lib/protocols/transportDiagnostics.d.mts

@@ -53,4 +53,5 @@ export declare function withTransportDiagnostics<T>(context: TransportActivityCo
 export declare function sanitizeTransportUrl(value: string): string;
 export declare function sanitizeTransportHeaders(headers: HeadersInit | undefined): Record<string, string>;
 export declare function wrapFetchWithTransportDiagnostics(upstream: typeof fetch): typeof fetch;
+export declare function redactSensitiveJsonOrText(text: string): string;
 export {};

package/dist/lib/protocols/transportDiagnostics.d.ts

@@ -53,4 +53,5 @@ export declare function withTransportDiagnostics<T>(context: TransportActivityCo
 export declare function sanitizeTransportUrl(value: string): string;
 export declare function sanitizeTransportHeaders(headers: HeadersInit | undefined): Record<string, string>;
 export declare function wrapFetchWithTransportDiagnostics(upstream: typeof fetch): typeof fetch;
+export declare function redactSensitiveJsonOrText(text: string): string;
 export {};

package/dist/lib/protocols/transportDiagnostics.js

@@ -20,6 +20,7 @@ var transportDiagnostics_exports = {};
 __export(transportDiagnostics_exports, {
   BODY_SNIPPET_TIMEOUT_MS: () => BODY_SNIPPET_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS: () => OBSERVER_FLUSH_TIMEOUT_MS,
+  redactSensitiveJsonOrText: () => redactSensitiveJsonOrText,
   sanitizeTransportHeaders: () => sanitizeTransportHeaders,
   sanitizeTransportUrl: () => sanitizeTransportUrl,
   transportDiagnosticsStorage: () => transportDiagnosticsStorage,
@@ -385,6 +386,7 @@ function fingerprintDiagnosticValue(value) {
 0 && (module.exports = {
   BODY_SNIPPET_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS,
+  redactSensitiveJsonOrText,
   sanitizeTransportHeaders,
   sanitizeTransportUrl,
   transportDiagnosticsStorage,

package/dist/lib/protocols/transportDiagnostics.mjs

@@ -360,6 +360,7 @@ function fingerprintDiagnosticValue(value) {
 export {
   BODY_SNIPPET_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS,
+  redactSensitiveJsonOrText,
   sanitizeTransportHeaders,
   sanitizeTransportUrl,
   transportDiagnosticsStorage,

package/dist/lib/registry/types.generated.d.mts

@@ -1756,11 +1756,11 @@ export interface paths {
         put?: never;
         /**
          * Refresh agent snapshot
-         * @description Re-probe the agent and update its registry health (online, tools_count, response_time_ms), capability snapshot (inferred type, discovered tools), and compliance verdict (storyboard pass/fail counts). Use after fixing your agent so the registry shows fresh data without waiting for the periodic heartbeat (~1h).
+         * @description Re-probe the agent and update its registry health (online, tools_count, response_time_ms), capability snapshot (inferred type, discovered tools), and compliance verdict (storyboard pass/fail counts). Use after fixing your agent so the registry shows fresh data without waiting for the periodic heartbeat.
          *
-         *     **Compliance re-run:** when the caller owns the agent or is an AAO admin and the capability probe succeeds, the full storyboard suite can run for several minutes on capability-rich agents with a fresh test session, and `agent_storyboard_status` is updated. Owner-triggered runs use `triggered_by: 'owner_test'`; admin-triggered support runs use `triggered_by: 'manual'`. Badge fan-out reissues verification badges off the new run. If the compliance call fails (timeout, OAuth wall, internal error), the capability/health portion still returns successfully — `compliance.ran` is `false` with an `error` string.
+         *     **Compliance re-run:** when the caller owns the agent or is an AgenticAdvertising.org admin and the capability probe succeeds, the full storyboard suite runs with a fresh test session. Owner-triggered runs use `triggered_by: 'owner_test'`; admin-triggered support runs use `triggered_by: 'manual'`. Only a complete authoritative run can update public grades or badges.
          *
-         *     **Auth:** owner of the agent, AAO admin, or static `ADMIN_API_KEY`. Human submissions are temporarily fenced with HTTP 503 until durable authorization provenance is supported; static admin API key submissions remain available.
+         *     **Auth:** an authenticated owner or administrator credential is checked at admission and throughout execution. Static admin API keys cannot queue a refresh.
          *
          *     **Rate limits:** 60 seconds per agent URL, 30 requests per user per hour.
          */
@@ -2641,7 +2641,7 @@ export interface components {
             verified?: boolean;
             /** @description Canonical badge roles the agent is AgenticAdvertising.org Verified for (e.g. media-buy, creative). */
             verified_roles?: components["schemas"]["BadgeRole"][];
-            /** @description Active AgenticAdvertising.org Verified AdCP releases for each verified role, keyed by canonical badge role and sorted newest-first (e.g. { media-buy: ['3.1', '3.0'] }). Use this when choosing a version-pinned badge URL. */
+            /** @description Active AgenticAdvertising.org Verified AdCP releases for each verified role, keyed by canonical badge role and sorted newest-first (e.g. { media-buy: ['3.2', '3.1'] }). Use this when choosing a version-pinned badge URL. */
             verified_role_versions?: {
                 [key: string]: string[];
             };
@@ -4164,21 +4164,48 @@ export interface components {
             compliance_opt_out?: boolean;
             /** @description True when monitoring is enabled but badges remain suppressed until a fresh passing full-suite run completes. */
             badge_requalification_required?: boolean;
-            /** @description Current human refresh admission state. Monitoring requeue is a separate scheduler operation and is not a retry or ETA for this endpoint. */
+            /** @description Whether authenticated owners and administrators can queue an agent refresh. */
             refresh_availability?: {
                 available: boolean;
-                /** @description Whether retrying the same human refresh request later is expected to succeed without a platform change. */
-                retryable: boolean;
-                /** @enum {string} */
-                scope: "platform";
-                /** @enum {string} */
-                applies_to: "human_session";
-                /** @enum {string} */
-                code: "refresh_authorization_provenance_required";
-                notice: string;
-                /** @enum {string} */
-                alternative_action: "monitoring_requeue";
-                alternative_description: string;
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 */
+                retryable?: boolean;
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 * @enum {string}
+                 */
+                scope?: "platform";
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 * @enum {string}
+                 */
+                applies_to?: "human_session";
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 * @enum {string}
+                 */
+                code?: "refresh_authorization_provenance_required";
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 */
+                notice?: string;
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 * @enum {string}
+                 */
+                alternative_action?: "monitoring_requeue";
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 */
+                alternative_description?: string;
             };
             tracks?: {
                 [key: string]: string;
@@ -4200,6 +4227,21 @@ export interface components {
             status_changed_at?: string | null;
             storyboards_passing?: number;
             storyboards_total?: number;
+            /** @description Owner/operator-only newest persisted full assessment, including audit-only timeouts. Null for other viewers. This does not change the public verdict. */
+            latest_attempt?: {
+                /** Format: uuid */
+                id: string;
+                tested_at: string;
+                /** @enum {string} */
+                triggered_by: "heartbeat" | "owner_test" | "manual" | "webhook";
+                /** @enum {string} */
+                completeness: "complete" | "timed_out" | "not_completed";
+                is_authoritative: boolean;
+                requested_compliance_target: string | null;
+                storyboards_completed: number | null;
+                storyboards_total: number | null;
+                first_blocker: string | null;
+            } | null;
             /** @description How often the heartbeat re-tests this agent, in hours */
             check_interval_hours?: number;
             /** @description Specialisms the agent declared in get_adcp_capabilities, from the latest run */
@@ -4329,7 +4371,7 @@ export interface components {
         };
         VerificationBadge: {
             role: components["schemas"]["BadgeRole"] & unknown;
-            /** @description AdCP release this badge was issued against, MAJOR.MINOR (e.g. '3.0', '3.1'). Load-bearing for badge identity — pairs with the (agent_url, role, adcp_version) PK. */
+            /** @description AdCP release this badge was issued against, MAJOR.MINOR (e.g. '3.1', '3.2'). Load-bearing for badge identity — pairs with the (agent_url, role, adcp_version) PK. */
             adcp_version: string;
             verified_at: string;
             /** @description Specialisms demonstrably passed (enums/specialism.json). Preview specialisms are excluded from stable badges. */
@@ -9299,7 +9341,7 @@ export interface operations {
                 encodedUrl: string;
                 /** @description Canonical badge role */
                 role: components["schemas"]["BadgeRole"] & unknown;
-                /** @description AdCP release as MAJOR.MINOR (e.g. '3.0', '3.1') */
+                /** @description AdCP release as MAJOR.MINOR (e.g. '3.1', '3.2') */
                 version: string;
             };
             cookie?: never;
@@ -10208,13 +10250,13 @@ export interface operations {
                             run_id?: string;
                             /** @description Fresh test session id used for the compliance run. Useful when matching seller-side logs to the refresh. */
                             test_session_id?: string;
-                            /** @description Requested compliance target before alias resolution, e.g. 3.1, 3.0, 3.1-rc, or 3.1-beta. Present when `ran` is true. */
+                            /** @description Requested compliance target before alias resolution, e.g. 3.2, 3.1, 3.0, 3.2-rc, or 3.2-beta. Present when `ran` is true. */
                             requested_compliance_target?: string;
-                            /** @description Concrete AdCP compliance bundle version used for the run, e.g. 3.0.12 or 3.1.0-beta.7. Present when `ran` is true. */
+                            /** @description Concrete AdCP compliance bundle version used for the run, e.g. 3.2.1, 3.1.24, or 3.2.0-rc.7. Present when `ran` is true. */
                             adcp_version?: string;
                             /** @description True when this run can update public badge state. */
                             badge_eligible?: boolean;
-                            /** @description Public badge versions this run can issue, e.g. ['3.0']. */
+                            /** @description Public badge versions this run can issue, e.g. ['3.2']. */
                             badge_eligible_adcp_versions?: string[];
                             /** @description Aggregate verdict from the run (passing / failing / partial / unknown). Only present when `ran` is true. */
                             overall_status?: string;
@@ -10327,34 +10369,59 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description Refresh queue or authorization unavailable. Human submissions are fenced with refresh_authorization_provenance_required until durable authorization provenance is supported; this response is non-retryable and carries no ETA. Static admin API key submissions remain supported. */
+            /** @description Refresh queue or authorization temporarily unavailable. */
             503: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        /** @enum {string} */
-                        error: "admin_authorization_unavailable";
-                        message: string;
-                    } | {
-                        error: string;
-                        /** @enum {string} */
-                        code: "refresh_authorization_provenance_required";
-                        /** @enum {boolean} */
-                        retryable: false;
-                        /** @enum {string} */
-                        scope: "platform";
-                        /** @enum {string} */
-                        applies_to: "human_session";
-                        /** @enum {string} */
-                        alternative_action: "monitoring_requeue";
-                        alternative_description: string;
+                    "application/json": components["schemas"]["Error"] & {
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         */
+                        message?: string;
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {string}
+                         */
+                        code?: "refresh_authorization_provenance_required";
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {boolean}
+                         */
+                        retryable?: false;
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {string}
+                         */
+                        scope?: "platform";
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {string}
+                         */
+                        applies_to?: "human_session";
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {string}
+                         */
+                        alternative_action?: "monitoring_requeue";
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         */
+                        alternative_description?: string;
                         /**
                          * Format: uri
-                         * @description Issue tracking the restoration of human-initiated refresh
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
                          */
-                        tracking_issue: string;
+                        tracking_issue?: string;
                     };
                 };
             };
@@ -10922,7 +10989,7 @@ export interface operations {
             query?: {
                 /** @description Filter by storyboard category */
                 category?: string;
-                /** @description Compliance target to inspect, e.g. 3.1, 3.0, 3.1-rc, or 3.1-beta */
+                /** @description Compliance target to inspect, e.g. 3.2, 3.1, 3.0, 3.2-rc, or 3.2-beta */
                 compliance_target?: string;
             };
             header?: never;
@@ -10959,7 +11026,7 @@ export interface operations {
     getStoryboard: {
         parameters: {
             query?: {
-                /** @description Compliance target to inspect, e.g. 3.1, 3.0, 3.1-rc, or 3.1-beta */
+                /** @description Compliance target to inspect, e.g. 3.2, 3.1, 3.0, 3.2-rc, or 3.2-beta */
                 compliance_target?: string;
             };
             header?: never;
@@ -11342,7 +11409,7 @@ export interface operations {
     getStoryboardFirstStep: {
         parameters: {
             query?: {
-                /** @description Compliance target to inspect, e.g. 3.1, 3.0, 3.1-rc, or 3.1-beta */
+                /** @description Compliance target to inspect, e.g. 3.2, 3.1, 3.0, 3.2-rc, or 3.2-beta */
                 compliance_target?: string;
             };
             header?: never;