@adcp/sdk 14.0.0 → 14.2.0

package/dist/lib/signing/agent-resolver/resolved-agent-jwks.mjs

@@ -23,10 +23,17 @@ class ResolvedAgentJwksResolver {
   cacheTtlSeconds;
   unknownKidCooldownSeconds;
   resolveAgentFn;
+  canonicalAgentUrl;
+  legacyWebhookFallback;
+  operatorRecord;
+  get resolvedAgentUrl() {
+    return this.canonicalAgentUrl;
+  }
   keys = /* @__PURE__ */ new Map();
   expiresAt = 0;
   operatorAuthorizationValidUntil;
   lastUnknownKidRefresh = Number.NEGATIVE_INFINITY;
+  lastDiscoveryAttemptAt = Number.NEGATIVE_INFINITY;
   inFlight;
   async resolve(keyid) {
     return (await this.resolveWithMetadata(keyid)).jwk;
@@ -35,6 +42,15 @@ class ResolvedAgentJwksResolver {
     const now = this.now();
     let refreshed = false;
     if (now >= this.expiresAt) {
+      if (!this.inFlight && now - this.lastDiscoveryAttemptAt < 30) {
+        const expiredAuthorization = this.operatorAuthorizationValidUntil !== void 0 && now >= this.operatorAuthorizationValidUntil;
+        throw new AgentResolverError(
+          expiredAuthorization ? "request_signature_brand_origin_mismatch" : "request_signature_brand_json_unreachable",
+          "Expired operator mapping cannot be used during the discovery cooldown",
+          { agent_url: this.agentUrl },
+          ["agent_url"]
+        );
+      }
       await this.refresh();
       refreshed = true;
     }
@@ -44,14 +60,22 @@ class ResolvedAgentJwksResolver {
       this.lastUnknownKidRefresh = now;
       return this.resolution(null);
     }
-    if (now - this.lastUnknownKidRefresh < this.unknownKidCooldownSeconds) return this.resolution(null);
+    if (now - Math.max(this.lastUnknownKidRefresh, this.lastDiscoveryAttemptAt) < Math.max(30, this.unknownKidCooldownSeconds))
+      return this.resolution(null);
     await this.refresh();
     this.lastUnknownKidRefresh = now;
     return this.resolution(this.keys.get(keyid) ?? null);
   }
+  async forceRefresh() {
+    this.expiresAt = 0;
+    await this.refresh();
+  }
   resolution(jwk) {
     return {
       jwk,
+      ...this.operatorRecord !== void 0 && { operatorRecord: this.operatorRecord },
+      ...this.legacyWebhookFallback && { legacyWebhookFallback: true },
+      ...this.resolvedAgentUrl !== void 0 && { agentUrl: this.resolvedAgentUrl },
       ...this.operatorAuthorizationValidUntil !== void 0 && {
         operatorAuthorizationValidUntil: this.operatorAuthorizationValidUntil
       }
@@ -59,23 +83,11 @@ class ResolvedAgentJwksResolver {
   }
   async refresh() {
     if (this.inFlight) return this.inFlight;
+    this.lastDiscoveryAttemptAt = this.now();
     this.inFlight = (async () => {
       const resolution = await this.resolveAgentFn(this.agentUrl, {
-        protocol: this.protocol,
-        ...this.options.fetchCapabilities && { fetchCapabilities: this.options.fetchCapabilities },
-        ...this.options.allowPrivateIp !== void 0 && { allowPrivateIp: this.options.allowPrivateIp },
-        ...this.options.bodyCaps && { bodyCaps: this.options.bodyCaps },
-        ...this.options.timeoutMs !== void 0 && { timeoutMs: this.options.timeoutMs },
-        ...this.options.now && { now: this.options.now },
-        ...this.options.requiredOperatorBrand !== void 0 && {
-          requiredOperatorBrand: this.options.requiredOperatorBrand
-        },
-        ...this.options.requiredOperatorScope !== void 0 && {
-          requiredOperatorScope: this.options.requiredOperatorScope
-        },
-        ...this.options.requiredOperatorCountry !== void 0 && {
-          requiredOperatorCountry: this.options.requiredOperatorCountry
-        }
+        ...this.options,
+        protocol: this.protocol
       });
       const refreshedAt = this.now();
       if (resolution.operatorAuthorizationValidUntil !== void 0 && refreshedAt >= resolution.operatorAuthorizationValidUntil) {
@@ -89,13 +101,28 @@ class ResolvedAgentJwksResolver {
       const next = /* @__PURE__ */ new Map();
       for (const candidate of resolution.jwks.keys) {
         if (candidate && typeof candidate === "object" && typeof candidate.kid === "string") {
+          if (next.has(candidate.kid))
+            throw new AgentResolverError(
+              "request_signature_key_unknown",
+              "JWKS has duplicate key identifiers",
+              { agent_url: this.agentUrl },
+              ["agent_url"]
+            );
           next.set(candidate.kid, candidate);
         }
       }
       this.keys = next;
+      this.canonicalAgentUrl = resolution.agentUrl;
+      this.operatorRecord = resolution.brandJson === void 0 ? void 0 : { url: resolution.brandJsonUrl, document: resolution.brandJson };
+      this.legacyWebhookFallback = resolution.legacyWebhookFallback;
       this.operatorAuthorizationValidUntil = resolution.operatorAuthorizationValidUntil;
       this.expiresAt = Math.min(
-        refreshedAt + this.cacheTtlSeconds,
+        refreshedAt + Math.min(
+          this.cacheTtlSeconds,
+          1800,
+          Math.max(30, cacheLifetime(resolution.brandJsonCacheControl)),
+          Math.max(60, cacheLifetime(resolution.jwksCacheControl))
+        ),
         resolution.operatorAuthorizationValidUntil ?? Number.POSITIVE_INFINITY
       );
     })().finally(() => {
@@ -104,6 +131,12 @@ class ResolvedAgentJwksResolver {
     return this.inFlight;
   }
 }
+function cacheLifetime(cacheControl) {
+  if (!cacheControl) return Infinity;
+  if (/\bno-cache\b|\bno-store\b/i.test(cacheControl)) return 0;
+  const match = /(?:^|,)\s*max-age\s*=\s*"?(\d+)/i.exec(cacheControl);
+  return match ? Number(match[1]) : Infinity;
+}
 export {
   ResolvedAgentJwksResolver
 };

package/dist/lib/signing/agent-resolver/select-agent.d.mts

@@ -1,16 +1,5 @@
-/**
- * Step 5 of the brand_json_url discovery algorithm: locate the brand.json
- * `agents[]` entry whose `url` byte-equals the agent URL the verifier is
- * resolving. The byte-equal rule is deliberate (security.mdx §"Discovering
- * an agent's signing keys via `brand_json_url`" step 5) — no canonicalization,
- * because the most common operator misconfiguration is a trailing-slash or
- * scheme mismatch (`https://x.com/mcp` vs `https://x.com/mcp/`), and silently
- * canonicalizing past that hides the bug. The match must be exact.
- *
- * Both flat (`agents[]` at top level) and house-portfolio
- * (`house.agents[]` + `brands[].agents[]`) brand.json shapes are supported,
- * because either may carry the entry that matches the agent URL.
- */
+/** Shared identifier rules, including query escapes (unlike the signing profile's raw query). */
+export declare function canonicalAgentUrl(raw: string): string;
 export type AgentSelectorErrorCode = 'agent_not_in_brand_json' | 'brand_json_ambiguous';
 export interface AgentEntry {
     url: string;
@@ -18,6 +7,12 @@ export interface AgentEntry {
     /** Other fields preserved verbatim — the resolver passes the entry to the caller. */
     [key: string]: unknown;
 }
+export interface AgentSelector {
+    agentType?: string;
+    agentId?: string;
+}
+/** The key source always belongs to the matched entry, never to the artifact. */
+export declare function agentJwksUri(entry: AgentEntry): string;
 export declare class AgentSelectorError extends Error {
     readonly code: AgentSelectorErrorCode;
     readonly detail: {
@@ -40,7 +35,9 @@ export declare class AgentSelectorError extends Error {
  */
 export declare function collectAgentEntries(brandJson: unknown): AgentEntry[];
 /**
- * Find the unique `agents[]` entry whose `url` byte-equals `agentUrl`.
+ * Find the unique canonical match. Portfolio repetitions across collections
+ * count once when their type and canonical JWKS source agree. Duplicates
+ * within one collection remain ambiguous. Type/id only narrow URL matches.
  *
  * - Returns the matched entry on a unique hit.
  * - Throws `AgentSelectorError('agent_not_in_brand_json')` on zero matches.
@@ -50,4 +47,6 @@ export declare function collectAgentEntries(brandJson: unknown): AgentEntry[];
  *   fields. `matched_entries` reflects counterparty-controlled state and is
  *   marked attacker-influenceable in the resolver's error mapping.
  */
-export declare function selectAgentByUrl(brandJson: unknown, agentUrl: string): AgentEntry;
+export declare function selectAgentByUrl(brandJson: unknown, agentUrl: string, selector?: AgentSelector): AgentEntry;
+/** Select a relying party's collection without incorporating sibling brands. */
+export declare function relyingPartyAgentRecord(brandJson: unknown, brandDomain: string): unknown;

package/dist/lib/signing/agent-resolver/select-agent.d.ts

@@ -1,16 +1,5 @@
-/**
- * Step 5 of the brand_json_url discovery algorithm: locate the brand.json
- * `agents[]` entry whose `url` byte-equals the agent URL the verifier is
- * resolving. The byte-equal rule is deliberate (security.mdx §"Discovering
- * an agent's signing keys via `brand_json_url`" step 5) — no canonicalization,
- * because the most common operator misconfiguration is a trailing-slash or
- * scheme mismatch (`https://x.com/mcp` vs `https://x.com/mcp/`), and silently
- * canonicalizing past that hides the bug. The match must be exact.
- *
- * Both flat (`agents[]` at top level) and house-portfolio
- * (`house.agents[]` + `brands[].agents[]`) brand.json shapes are supported,
- * because either may carry the entry that matches the agent URL.
- */
+/** Shared identifier rules, including query escapes (unlike the signing profile's raw query). */
+export declare function canonicalAgentUrl(raw: string): string;
 export type AgentSelectorErrorCode = 'agent_not_in_brand_json' | 'brand_json_ambiguous';
 export interface AgentEntry {
     url: string;
@@ -18,6 +7,12 @@ export interface AgentEntry {
     /** Other fields preserved verbatim — the resolver passes the entry to the caller. */
     [key: string]: unknown;
 }
+export interface AgentSelector {
+    agentType?: string;
+    agentId?: string;
+}
+/** The key source always belongs to the matched entry, never to the artifact. */
+export declare function agentJwksUri(entry: AgentEntry): string;
 export declare class AgentSelectorError extends Error {
     readonly code: AgentSelectorErrorCode;
     readonly detail: {
@@ -40,7 +35,9 @@ export declare class AgentSelectorError extends Error {
  */
 export declare function collectAgentEntries(brandJson: unknown): AgentEntry[];
 /**
- * Find the unique `agents[]` entry whose `url` byte-equals `agentUrl`.
+ * Find the unique canonical match. Portfolio repetitions across collections
+ * count once when their type and canonical JWKS source agree. Duplicates
+ * within one collection remain ambiguous. Type/id only narrow URL matches.
  *
  * - Returns the matched entry on a unique hit.
  * - Throws `AgentSelectorError('agent_not_in_brand_json')` on zero matches.
@@ -50,4 +47,6 @@ export declare function collectAgentEntries(brandJson: unknown): AgentEntry[];
  *   fields. `matched_entries` reflects counterparty-controlled state and is
  *   marked attacker-influenceable in the resolver's error mapping.
  */
-export declare function selectAgentByUrl(brandJson: unknown, agentUrl: string): AgentEntry;
+export declare function selectAgentByUrl(brandJson: unknown, agentUrl: string, selector?: AgentSelector): AgentEntry;
+/** Select a relying party's collection without incorporating sibling brands. */
+export declare function relyingPartyAgentRecord(brandJson: unknown, brandDomain: string): unknown;

package/dist/lib/signing/agent-resolver/select-agent.js

@@ -19,10 +19,34 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var select_agent_exports = {};
 __export(select_agent_exports, {
   AgentSelectorError: () => AgentSelectorError,
+  agentJwksUri: () => agentJwksUri,
+  canonicalAgentUrl: () => canonicalAgentUrl,
   collectAgentEntries: () => collectAgentEntries,
+  relyingPartyAgentRecord: () => relyingPartyAgentRecord,
   selectAgentByUrl: () => selectAgentByUrl
 });
 module.exports = __toCommonJS(select_agent_exports);
+var import_canonicalize = require('../canonicalize.js');
+function canonicalAgentUrl(raw) {
+  const authority = /^[a-z][a-z0-9+.\-]*:\/\/([^/?#]*)/i.exec(raw)?.[1];
+  if (authority) (0, import_canonicalize.rejectNonAsciiHost)(`https://${authority.slice(authority.lastIndexOf("@") + 1)}`);
+  const canonical = (0, import_canonicalize.canonicalTargetUri)(raw, "3.2");
+  if (!/^https?:\/\//.test(canonical)) throw new TypeError("Agent identifier must be an HTTP(S) URL");
+  return canonical.replace(/%([0-9a-f]{2})/gi, (_escape, hex) => {
+    const character = String.fromCharCode(parseInt(hex, 16));
+    return /^[a-z0-9._~-]$/i.test(character) ? character : `%${hex.toUpperCase()}`;
+  });
+}
+function agentJwksUri(entry) {
+  if (entry.jwks_uri !== void 0) {
+    if (typeof entry.jwks_uri !== "string" || !entry.jwks_uri) throw new TypeError("Invalid jwks_uri");
+    const source = new URL(entry.jwks_uri);
+    if (source.username || source.password) throw new TypeError("JWKS URI must not contain userinfo");
+    canonicalAgentUrl(entry.jwks_uri);
+    return entry.jwks_uri;
+  }
+  return `${new URL(canonicalAgentUrl(entry.url)).origin}/.well-known/jwks.json`;
+}
 class AgentSelectorError extends Error {
   code;
   detail;
@@ -34,22 +58,31 @@ class AgentSelectorError extends Error {
   }
 }
 function collectAgentEntries(brandJson) {
+  return agentCollections(brandJson).flat();
+}
+function agentCollections(brandJson) {
   if (!brandJson || typeof brandJson !== "object") return [];
-  const entries = [];
+  const collections = [];
   const obj = brandJson;
-  pushAgentArray(obj.agents, entries);
+  const add = (value) => {
+    const entries = [];
+    pushAgentArray(value, entries);
+    collections.push(entries);
+  };
+  if (obj.agents !== void 0) {
+    add(obj.agents);
+    return collections;
+  }
   const house = obj.house;
   if (house && typeof house === "object") {
-    pushAgentArray(house.agents, entries);
-  }
-  if (Array.isArray(obj.brands)) {
-    for (const brand of obj.brands) {
-      if (brand && typeof brand === "object") {
-        pushAgentArray(brand.agents, entries);
+    add(house.agents);
+    if (Array.isArray(obj.brands)) {
+      for (const brand of obj.brands) {
+        if (brand && typeof brand === "object") add(brand.agents);
       }
     }
   }
-  return entries;
+  return collections;
 }
 function pushAgentArray(value, out) {
   if (!Array.isArray(value)) return;
@@ -62,13 +95,37 @@ function pushAgentArray(value, out) {
     }
   }
 }
-function selectAgentByUrl(brandJson, agentUrl) {
-  const entries = collectAgentEntries(brandJson);
-  const matches = entries.filter((e) => e.url === agentUrl);
+function selectAgentByUrl(brandJson, agentUrl, selector = {}) {
+  const canonicalUrl = canonicalAgentUrl(agentUrl);
+  const matches = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const collection of agentCollections(brandJson)) {
+    const local = collection.filter((e) => {
+      try {
+        return canonicalAgentUrl(e.url) === canonicalUrl && (selector.agentType === void 0 || e.type === selector.agentType) && (selector.agentId === void 0 || e.id === selector.agentId);
+      } catch {
+        return false;
+      }
+    });
+    if (local.length > 1) {
+      throw new AgentSelectorError("brand_json_ambiguous", `Multiple brand.json agent entries match ${agentUrl}`, {
+        agent_url: agentUrl,
+        matched_count: local.length,
+        matched_entries: local
+      });
+    }
+    for (const entry of local) {
+      const source = JSON.stringify([entry.type, canonicalAgentUrl(agentJwksUri(entry))]);
+      if (!seen.has(source)) {
+        seen.add(source);
+        matches.push(entry);
+      }
+    }
+  }
   if (matches.length === 0) {
     throw new AgentSelectorError(
       "agent_not_in_brand_json",
-      `No brand.json agent entry has url byte-equal to ${agentUrl}`,
+      `No brand.json agent entry has canonical URL ${canonicalUrl}`,
       { agent_url: agentUrl }
     );
   }
@@ -81,9 +138,37 @@ function selectAgentByUrl(brandJson, agentUrl) {
   }
   return matches[0];
 }
+function relyingPartyAgentRecord(brandJson, brandDomain) {
+  if (!brandJson || typeof brandJson !== "object") throw new TypeError("Invalid brand.json");
+  const obj = brandJson;
+  if (!obj.house || typeof obj.house !== "object") return obj;
+  const domainHost = (domain) => {
+    if (typeof domain !== "string" || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*\.?$/i.test(domain))
+      throw new TypeError("Invalid brand domain");
+    return new URL(canonicalAgentUrl(`https://${domain}`)).hostname;
+  };
+  const host = domainHost(brandDomain);
+  const house = obj.house;
+  if (house.domain !== void 0 && domainHost(house.domain) === host) {
+    return { agents: house.agents };
+  }
+  const brands = Array.isArray(obj.brands) ? obj.brands : [];
+  const matches = brands.filter((b) => {
+    try {
+      return b && typeof b === "object" && typeof b.url === "string" && new URL(canonicalAgentUrl(b.url)).hostname === host;
+    } catch {
+      return false;
+    }
+  });
+  if (matches.length !== 1) throw new TypeError("Brand domain is absent or ambiguous in portfolio");
+  return { agents: matches[0].agents === void 0 ? house.agents : matches[0].agents };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AgentSelectorError,
+  agentJwksUri,
+  canonicalAgentUrl,
   collectAgentEntries,
+  relyingPartyAgentRecord,
   selectAgentByUrl
 });

package/dist/lib/signing/agent-resolver/select-agent.mjs

@@ -1,3 +1,24 @@
+import { canonicalTargetUri, rejectNonAsciiHost } from "../canonicalize.mjs";
+function canonicalAgentUrl(raw) {
+  const authority = /^[a-z][a-z0-9+.\-]*:\/\/([^/?#]*)/i.exec(raw)?.[1];
+  if (authority) rejectNonAsciiHost(`https://${authority.slice(authority.lastIndexOf("@") + 1)}`);
+  const canonical = canonicalTargetUri(raw, "3.2");
+  if (!/^https?:\/\//.test(canonical)) throw new TypeError("Agent identifier must be an HTTP(S) URL");
+  return canonical.replace(/%([0-9a-f]{2})/gi, (_escape, hex) => {
+    const character = String.fromCharCode(parseInt(hex, 16));
+    return /^[a-z0-9._~-]$/i.test(character) ? character : `%${hex.toUpperCase()}`;
+  });
+}
+function agentJwksUri(entry) {
+  if (entry.jwks_uri !== void 0) {
+    if (typeof entry.jwks_uri !== "string" || !entry.jwks_uri) throw new TypeError("Invalid jwks_uri");
+    const source = new URL(entry.jwks_uri);
+    if (source.username || source.password) throw new TypeError("JWKS URI must not contain userinfo");
+    canonicalAgentUrl(entry.jwks_uri);
+    return entry.jwks_uri;
+  }
+  return `${new URL(canonicalAgentUrl(entry.url)).origin}/.well-known/jwks.json`;
+}
 class AgentSelectorError extends Error {
   code;
   detail;
@@ -9,22 +30,31 @@ class AgentSelectorError extends Error {
   }
 }
 function collectAgentEntries(brandJson) {
+  return agentCollections(brandJson).flat();
+}
+function agentCollections(brandJson) {
   if (!brandJson || typeof brandJson !== "object") return [];
-  const entries = [];
+  const collections = [];
   const obj = brandJson;
-  pushAgentArray(obj.agents, entries);
+  const add = (value) => {
+    const entries = [];
+    pushAgentArray(value, entries);
+    collections.push(entries);
+  };
+  if (obj.agents !== void 0) {
+    add(obj.agents);
+    return collections;
+  }
   const house = obj.house;
   if (house && typeof house === "object") {
-    pushAgentArray(house.agents, entries);
-  }
-  if (Array.isArray(obj.brands)) {
-    for (const brand of obj.brands) {
-      if (brand && typeof brand === "object") {
-        pushAgentArray(brand.agents, entries);
+    add(house.agents);
+    if (Array.isArray(obj.brands)) {
+      for (const brand of obj.brands) {
+        if (brand && typeof brand === "object") add(brand.agents);
       }
     }
   }
-  return entries;
+  return collections;
 }
 function pushAgentArray(value, out) {
   if (!Array.isArray(value)) return;
@@ -37,13 +67,37 @@ function pushAgentArray(value, out) {
     }
   }
 }
-function selectAgentByUrl(brandJson, agentUrl) {
-  const entries = collectAgentEntries(brandJson);
-  const matches = entries.filter((e) => e.url === agentUrl);
+function selectAgentByUrl(brandJson, agentUrl, selector = {}) {
+  const canonicalUrl = canonicalAgentUrl(agentUrl);
+  const matches = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const collection of agentCollections(brandJson)) {
+    const local = collection.filter((e) => {
+      try {
+        return canonicalAgentUrl(e.url) === canonicalUrl && (selector.agentType === void 0 || e.type === selector.agentType) && (selector.agentId === void 0 || e.id === selector.agentId);
+      } catch {
+        return false;
+      }
+    });
+    if (local.length > 1) {
+      throw new AgentSelectorError("brand_json_ambiguous", `Multiple brand.json agent entries match ${agentUrl}`, {
+        agent_url: agentUrl,
+        matched_count: local.length,
+        matched_entries: local
+      });
+    }
+    for (const entry of local) {
+      const source = JSON.stringify([entry.type, canonicalAgentUrl(agentJwksUri(entry))]);
+      if (!seen.has(source)) {
+        seen.add(source);
+        matches.push(entry);
+      }
+    }
+  }
   if (matches.length === 0) {
     throw new AgentSelectorError(
       "agent_not_in_brand_json",
-      `No brand.json agent entry has url byte-equal to ${agentUrl}`,
+      `No brand.json agent entry has canonical URL ${canonicalUrl}`,
       { agent_url: agentUrl }
     );
   }
@@ -56,8 +110,36 @@ function selectAgentByUrl(brandJson, agentUrl) {
   }
   return matches[0];
 }
+function relyingPartyAgentRecord(brandJson, brandDomain) {
+  if (!brandJson || typeof brandJson !== "object") throw new TypeError("Invalid brand.json");
+  const obj = brandJson;
+  if (!obj.house || typeof obj.house !== "object") return obj;
+  const domainHost = (domain) => {
+    if (typeof domain !== "string" || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*\.?$/i.test(domain))
+      throw new TypeError("Invalid brand domain");
+    return new URL(canonicalAgentUrl(`https://${domain}`)).hostname;
+  };
+  const host = domainHost(brandDomain);
+  const house = obj.house;
+  if (house.domain !== void 0 && domainHost(house.domain) === host) {
+    return { agents: house.agents };
+  }
+  const brands = Array.isArray(obj.brands) ? obj.brands : [];
+  const matches = brands.filter((b) => {
+    try {
+      return b && typeof b === "object" && typeof b.url === "string" && new URL(canonicalAgentUrl(b.url)).hostname === host;
+    } catch {
+      return false;
+    }
+  });
+  if (matches.length !== 1) throw new TypeError("Brand domain is absent or ambiguous in portfolio");
+  return { agents: matches[0].agents === void 0 ? house.agents : matches[0].agents };
+}
 export {
   AgentSelectorError,
+  agentJwksUri,
+  canonicalAgentUrl,
   collectAgentEntries,
+  relyingPartyAgentRecord,
   selectAgentByUrl
 };