@adcp/sdk 15.8.1 → 16.0.0-beta.1

package/dist/lib/core/postgres-webhook-registration-store.js

@@ -59,6 +59,8 @@ CREATE TABLE IF NOT EXISTS ${table} (
   callback_url                     TEXT NOT NULL,
   method                           TEXT NOT NULL,
   mode                             TEXT NOT NULL,
+  delivery_kind                    TEXT CHECK (delivery_kind IS NULL OR (mode = 'rfc9421' AND delivery_kind IN ('reporting', 'artifact'))),
+  signing_profile                  TEXT CHECK (signing_profile IS NULL OR (mode = 'rfc9421' AND signing_profile IN ('adcp/webhook-signing/v1', 'web-bot-auth'))),
   authorization_context_version    SMALLINT,
   delegated_operator_authorization JSONB,
   preview_mode                     TEXT,
@@ -80,6 +82,12 @@ CREATE TABLE IF NOT EXISTS ${table} (
   CONSTRAINT ${tableName}_valid_expiry CHECK (expires_at > created_at)
 );
 
+ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS signing_profile TEXT
+  CHECK (signing_profile IS NULL OR (mode = 'rfc9421' AND signing_profile IN ('adcp/webhook-signing/v1', 'web-bot-auth')));
+
+ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS delivery_kind TEXT
+  CHECK (delivery_kind IS NULL OR (mode = 'rfc9421' AND delivery_kind IN ('reporting', 'artifact')));
+
 CREATE INDEX IF NOT EXISTS idx_${tableName}_expires_at
   ON ${table}(expires_at);
 `.trim();
@@ -94,6 +102,8 @@ const RETURNING_REGISTRATION = `
   callback_url,
   method,
   mode,
+  signing_profile,
+  delivery_kind,
   authorization_context_version,
   delegated_operator_authorization,
   preview_mode,
@@ -148,6 +158,8 @@ function registrationFromRow(row, expectedKey) {
         callbackUrl: requiredString(row, "callback_url"),
         method: requiredString(row, "method"),
         mode: requiredString(row, "mode"),
+        ...row.signing_profile != null && { signingProfile: optionalString(row, "signing_profile") },
+        ...row.delivery_kind != null && { deliveryKind: optionalString(row, "delivery_kind") },
         ...authorizationContextVersion === 1 && { authorizationContextVersion },
         ...delegatedOperatorAuthorization !== null && { delegatedOperatorAuthorization },
         ...previewMode !== void 0 && { previewMode },
@@ -203,18 +215,18 @@ function pgWebhookRegistrationStore(db, options = {}) {
          INSERT INTO ${table} AS existing (
            agent_id, operation_id, agent_url, protocol, task_type, callback_url,
            method, mode, authorization_context_version, delegated_operator_authorization,
-           preview_mode, requires_durable_settlement, created_at, expires_at
+           preview_mode, requires_durable_settlement, created_at, expires_at, signing_profile, delivery_kind
          )
          SELECT
            $1, $2, $3, $4, $5, $6, $7, $8, $9, $10::jsonb, $11, $12,
            to_timestamp($13::double precision / 1000.0),
-           to_timestamp($14::double precision / 1000.0)
+           to_timestamp($14::double precision / 1000.0), $15, $16
          FROM backend_clock
          WHERE to_timestamp($14::double precision / 1000.0) > backend_clock.now
          ON CONFLICT (agent_id, operation_id) DO UPDATE SET (
            agent_url, protocol, task_type, callback_url, method, mode,
            authorization_context_version, delegated_operator_authorization,
-           preview_mode, requires_durable_settlement, created_at, expires_at
+           preview_mode, requires_durable_settlement, created_at, expires_at, signing_profile, delivery_kind
          ) = (
            SELECT
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.agent_url
@@ -240,7 +252,20 @@ function pgWebhookRegistrationStore(db, options = {}) {
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.created_at
                ELSE existing.created_at END,
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.expires_at
-               ELSE existing.expires_at END
+               WHEN existing.delivery_kind IS NOT NULL AND
+                 ROW(existing.agent_url, existing.protocol, existing.task_type, existing.callback_url, existing.method, existing.mode,
+                     existing.authorization_context_version, existing.delegated_operator_authorization, existing.preview_mode,
+                     COALESCE(existing.signing_profile, 'adcp/webhook-signing/v1'), existing.delivery_kind)
+                 IS NOT DISTINCT FROM
+                 ROW(EXCLUDED.agent_url, EXCLUDED.protocol, EXCLUDED.task_type, EXCLUDED.callback_url, EXCLUDED.method, EXCLUDED.mode,
+                     EXCLUDED.authorization_context_version, EXCLUDED.delegated_operator_authorization, EXCLUDED.preview_mode,
+                     COALESCE(EXCLUDED.signing_profile, 'adcp/webhook-signing/v1'), EXCLUDED.delivery_kind)
+               THEN GREATEST(existing.expires_at, EXCLUDED.expires_at)
+               ELSE existing.expires_at END,
+             CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.signing_profile
+               ELSE existing.signing_profile END,
+             CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.delivery_kind
+               ELSE existing.delivery_kind END
            FROM backend_clock
          )
          RETURNING ${RETURNING_REGISTRATION},
@@ -259,7 +284,9 @@ function pgWebhookRegistrationStore(db, options = {}) {
           proposed.previewMode ?? null,
           proposed.requiresDurableSettlement ?? null,
           proposed.createdAt,
-          proposed.expiresAt
+          proposed.expiresAt,
+          proposed.signingProfile ?? null,
+          proposed.deliveryKind ?? null
         ]
       );
       const row = result.rows[0];

package/dist/lib/core/postgres-webhook-registration-store.mjs

@@ -39,6 +39,8 @@ CREATE TABLE IF NOT EXISTS ${table} (
   callback_url                     TEXT NOT NULL,
   method                           TEXT NOT NULL,
   mode                             TEXT NOT NULL,
+  delivery_kind                    TEXT CHECK (delivery_kind IS NULL OR (mode = 'rfc9421' AND delivery_kind IN ('reporting', 'artifact'))),
+  signing_profile                  TEXT CHECK (signing_profile IS NULL OR (mode = 'rfc9421' AND signing_profile IN ('adcp/webhook-signing/v1', 'web-bot-auth'))),
   authorization_context_version    SMALLINT,
   delegated_operator_authorization JSONB,
   preview_mode                     TEXT,
@@ -60,6 +62,12 @@ CREATE TABLE IF NOT EXISTS ${table} (
   CONSTRAINT ${tableName}_valid_expiry CHECK (expires_at > created_at)
 );
 
+ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS signing_profile TEXT
+  CHECK (signing_profile IS NULL OR (mode = 'rfc9421' AND signing_profile IN ('adcp/webhook-signing/v1', 'web-bot-auth')));
+
+ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS delivery_kind TEXT
+  CHECK (delivery_kind IS NULL OR (mode = 'rfc9421' AND delivery_kind IN ('reporting', 'artifact')));
+
 CREATE INDEX IF NOT EXISTS idx_${tableName}_expires_at
   ON ${table}(expires_at);
 `.trim();
@@ -74,6 +82,8 @@ const RETURNING_REGISTRATION = `
   callback_url,
   method,
   mode,
+  signing_profile,
+  delivery_kind,
   authorization_context_version,
   delegated_operator_authorization,
   preview_mode,
@@ -128,6 +138,8 @@ function registrationFromRow(row, expectedKey) {
         callbackUrl: requiredString(row, "callback_url"),
         method: requiredString(row, "method"),
         mode: requiredString(row, "mode"),
+        ...row.signing_profile != null && { signingProfile: optionalString(row, "signing_profile") },
+        ...row.delivery_kind != null && { deliveryKind: optionalString(row, "delivery_kind") },
         ...authorizationContextVersion === 1 && { authorizationContextVersion },
         ...delegatedOperatorAuthorization !== null && { delegatedOperatorAuthorization },
         ...previewMode !== void 0 && { previewMode },
@@ -183,18 +195,18 @@ function pgWebhookRegistrationStore(db, options = {}) {
          INSERT INTO ${table} AS existing (
            agent_id, operation_id, agent_url, protocol, task_type, callback_url,
            method, mode, authorization_context_version, delegated_operator_authorization,
-           preview_mode, requires_durable_settlement, created_at, expires_at
+           preview_mode, requires_durable_settlement, created_at, expires_at, signing_profile, delivery_kind
          )
          SELECT
            $1, $2, $3, $4, $5, $6, $7, $8, $9, $10::jsonb, $11, $12,
            to_timestamp($13::double precision / 1000.0),
-           to_timestamp($14::double precision / 1000.0)
+           to_timestamp($14::double precision / 1000.0), $15, $16
          FROM backend_clock
          WHERE to_timestamp($14::double precision / 1000.0) > backend_clock.now
          ON CONFLICT (agent_id, operation_id) DO UPDATE SET (
            agent_url, protocol, task_type, callback_url, method, mode,
            authorization_context_version, delegated_operator_authorization,
-           preview_mode, requires_durable_settlement, created_at, expires_at
+           preview_mode, requires_durable_settlement, created_at, expires_at, signing_profile, delivery_kind
          ) = (
            SELECT
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.agent_url
@@ -220,7 +232,20 @@ function pgWebhookRegistrationStore(db, options = {}) {
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.created_at
                ELSE existing.created_at END,
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.expires_at
-               ELSE existing.expires_at END
+               WHEN existing.delivery_kind IS NOT NULL AND
+                 ROW(existing.agent_url, existing.protocol, existing.task_type, existing.callback_url, existing.method, existing.mode,
+                     existing.authorization_context_version, existing.delegated_operator_authorization, existing.preview_mode,
+                     COALESCE(existing.signing_profile, 'adcp/webhook-signing/v1'), existing.delivery_kind)
+                 IS NOT DISTINCT FROM
+                 ROW(EXCLUDED.agent_url, EXCLUDED.protocol, EXCLUDED.task_type, EXCLUDED.callback_url, EXCLUDED.method, EXCLUDED.mode,
+                     EXCLUDED.authorization_context_version, EXCLUDED.delegated_operator_authorization, EXCLUDED.preview_mode,
+                     COALESCE(EXCLUDED.signing_profile, 'adcp/webhook-signing/v1'), EXCLUDED.delivery_kind)
+               THEN GREATEST(existing.expires_at, EXCLUDED.expires_at)
+               ELSE existing.expires_at END,
+             CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.signing_profile
+               ELSE existing.signing_profile END,
+             CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.delivery_kind
+               ELSE existing.delivery_kind END
            FROM backend_clock
          )
          RETURNING ${RETURNING_REGISTRATION},
@@ -239,7 +264,9 @@ function pgWebhookRegistrationStore(db, options = {}) {
           proposed.previewMode ?? null,
           proposed.requiresDurableSettlement ?? null,
           proposed.createdAt,
-          proposed.expiresAt
+          proposed.expiresAt,
+          proposed.signingProfile ?? null,
+          proposed.deliveryKind ?? null
         ]
       );
       const row = result.rows[0];

package/dist/lib/core/redis-webhook-registration-store.js

@@ -77,6 +77,21 @@ if raw then
   if current_expires_at > now_ms then
     if redis.call('PTTL', KEYS[1]) < 0 then return cjson.encode({status = 'corrupt'}) end
     if stored.fingerprint == ARGV[3] then
+      if ARGV[6] == 'delivery' and proposed_expires_at > current_expires_at then
+        local registration_ok, registration = pcall(cjson.decode, stored.registration)
+        if not registration_ok or type(registration) ~= 'table' or not registration.deliveryKind then
+          return cjson.encode({status = 'corrupt'})
+        end
+        if registration.expiresAt ~= current_expires_at then return cjson.encode({status = 'corrupt'}) end
+        local replacements
+        stored.registration, replacements = string.gsub(stored.registration, '("expiresAt"%s*:%s*)%d+', function(prefix)
+          return prefix .. ARGV[4]
+        end)
+        if replacements ~= 1 then return cjson.encode({status = 'corrupt'}) end
+        stored.expiresAt = ARGV[4]
+        raw = cjson.encode(stored)
+        redis.call('SET', KEYS[1], raw, 'PXAT', ARGV[4])
+      end
       return cjson.encode({status = 'existing', record = raw})
     end
     return cjson.encode({status = 'conflict'})
@@ -283,7 +298,14 @@ function redisWebhookRegistrationStore(client, options = {}) {
         "putIfAbsent",
         PUT_IF_ABSENT_SCRIPT,
         [key],
-        [expectedKey.agentId, expectedKey.operationId, fingerprint, String(proposed.expiresAt), serialized]
+        [
+          expectedKey.agentId,
+          expectedKey.operationId,
+          fingerprint,
+          String(proposed.expiresAt),
+          serialized,
+          proposed.deliveryKind ? "delivery" : "operation"
+        ]
       );
       if (outcome.status === "conflict") {
         throw new import_errors.ConfigurationError(

package/dist/lib/core/redis-webhook-registration-store.mjs

@@ -61,6 +61,21 @@ if raw then
   if current_expires_at > now_ms then
     if redis.call('PTTL', KEYS[1]) < 0 then return cjson.encode({status = 'corrupt'}) end
     if stored.fingerprint == ARGV[3] then
+      if ARGV[6] == 'delivery' and proposed_expires_at > current_expires_at then
+        local registration_ok, registration = pcall(cjson.decode, stored.registration)
+        if not registration_ok or type(registration) ~= 'table' or not registration.deliveryKind then
+          return cjson.encode({status = 'corrupt'})
+        end
+        if registration.expiresAt ~= current_expires_at then return cjson.encode({status = 'corrupt'}) end
+        local replacements
+        stored.registration, replacements = string.gsub(stored.registration, '("expiresAt"%s*:%s*)%d+', function(prefix)
+          return prefix .. ARGV[4]
+        end)
+        if replacements ~= 1 then return cjson.encode({status = 'corrupt'}) end
+        stored.expiresAt = ARGV[4]
+        raw = cjson.encode(stored)
+        redis.call('SET', KEYS[1], raw, 'PXAT', ARGV[4])
+      end
       return cjson.encode({status = 'existing', record = raw})
     end
     return cjson.encode({status = 'conflict'})
@@ -267,7 +282,14 @@ function redisWebhookRegistrationStore(client, options = {}) {
         "putIfAbsent",
         PUT_IF_ABSENT_SCRIPT,
         [key],
-        [expectedKey.agentId, expectedKey.operationId, fingerprint, String(proposed.expiresAt), serialized]
+        [
+          expectedKey.agentId,
+          expectedKey.operationId,
+          fingerprint,
+          String(proposed.expiresAt),
+          serialized,
+          proposed.deliveryKind ? "delivery" : "operation"
+        ]
       );
       if (outcome.status === "conflict") {
         throw new ConfigurationError(

package/dist/lib/core/webhook-registration.d.mts

@@ -16,6 +16,9 @@ export interface WebhookRegistration {
     callbackUrl: string;
     method: 'POST';
     mode: WebhookAuthenticationMode;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
+    /** Out-of-band reports/artifacts bind to the destination, not a task operation. */
+    deliveryKind?: 'reporting' | 'artifact';
     /** Versioned marker distinguishing tuple-aware registrations from legacy rows. */
     authorizationContextVersion?: 1;
     /** Trusted local tuple used to re-authorize delegated seller keys after restart. */
@@ -33,7 +36,8 @@ export interface WebhookRegistrationStore {
     /** Return no record when `expiresAt` is at or before the current time. */
     get(agentId: string, operationId: string): Promise<Readonly<WebhookRegistration> | undefined>;
     /**
-     * Atomically create a registration. An identical retry is idempotent; a
+     * Atomically create a registration. An identical retry is idempotent; matching
+     * destination delivery routes also extend expiry to the later value. A
      * conflicting live registration for the same key MUST reject. A successful
      * return MUST provide immediate read-your-writes consistency through `get()`
      * so the SDK can verify trusted authorization provenance before dispatch.
@@ -68,3 +72,5 @@ export declare class InMemoryWebhookRegistrationStore implements WebhookRegistra
     markRequiresDurableSettlement(agentId: string, operationId: string): Promise<void>;
     private pruneExpired;
 }
+/** Stable, non-secret local route key. It is never sent as an authentication credential. */
+export declare function deliveryWebhookRegistrationId(kind: 'reporting' | 'artifact', url: string): string;

package/dist/lib/core/webhook-registration.d.ts

@@ -16,6 +16,9 @@ export interface WebhookRegistration {
     callbackUrl: string;
     method: 'POST';
     mode: WebhookAuthenticationMode;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
+    /** Out-of-band reports/artifacts bind to the destination, not a task operation. */
+    deliveryKind?: 'reporting' | 'artifact';
     /** Versioned marker distinguishing tuple-aware registrations from legacy rows. */
     authorizationContextVersion?: 1;
     /** Trusted local tuple used to re-authorize delegated seller keys after restart. */
@@ -33,7 +36,8 @@ export interface WebhookRegistrationStore {
     /** Return no record when `expiresAt` is at or before the current time. */
     get(agentId: string, operationId: string): Promise<Readonly<WebhookRegistration> | undefined>;
     /**
-     * Atomically create a registration. An identical retry is idempotent; a
+     * Atomically create a registration. An identical retry is idempotent; matching
+     * destination delivery routes also extend expiry to the later value. A
      * conflicting live registration for the same key MUST reject. A successful
      * return MUST provide immediate read-your-writes consistency through `get()`
      * so the SDK can verify trusted authorization provenance before dispatch.
@@ -68,3 +72,5 @@ export declare class InMemoryWebhookRegistrationStore implements WebhookRegistra
     markRequiresDurableSettlement(agentId: string, operationId: string): Promise<void>;
     private pruneExpired;
 }
+/** Stable, non-secret local route key. It is never sent as an authentication credential. */
+export declare function deliveryWebhookRegistrationId(kind: 'reporting' | 'artifact', url: string): string;

package/dist/lib/core/webhook-registration.js

@@ -21,6 +21,7 @@ __export(webhook_registration_exports, {
   InMemoryWebhookRegistrationStore: () => InMemoryWebhookRegistrationStore,
   WebhookRegistrationIntegrityError: () => WebhookRegistrationIntegrityError,
   canonicalDelegatedOperatorAuthorization: () => canonicalDelegatedOperatorAuthorization,
+  deliveryWebhookRegistrationId: () => deliveryWebhookRegistrationId,
   freezeWebhookRegistration: () => freezeWebhookRegistration,
   parseWebhookRegistration: () => parseWebhookRegistration,
   sameWebhookRegistration: () => sameWebhookRegistration,
@@ -31,6 +32,7 @@ __export(webhook_registration_exports, {
   webhookRegistrationStorageDigest: () => webhookRegistrationStorageDigest
 });
 module.exports = __toCommonJS(webhook_registration_exports);
+var import_canonicalize = require('../signing/canonicalize.js');
 var import_node_crypto = require("node:crypto");
 var import_errors = require('../errors/index.js');
 var import_webhook_verifier = require('../signing/webhook-verifier.js');
@@ -68,7 +70,11 @@ class InMemoryWebhookRegistrationStore {
     const key = registrationKey(parsed.agentId, parsed.operationId);
     const existing = this.entries.get(key);
     if (existing) {
-      if (sameWebhookRegistration(existing, parsed)) return;
+      if (sameWebhookRegistration(existing, parsed)) {
+        if (parsed.deliveryKind && parsed.expiresAt > existing.expiresAt)
+          this.entries.set(key, freezeWebhookRegistration({ ...existing, expiresAt: parsed.expiresAt }));
+        return;
+      }
       throw new import_errors.ConfigurationError(
         "Webhook operation id is already registered with different trusted provenance.",
         "operationId"
@@ -170,6 +176,8 @@ function parseWebhookRegistration(value, expectedKey) {
   if (input.requiresDurableSettlement !== void 0 && typeof input.requiresDurableSettlement !== "boolean") {
     throw new TypeError("Webhook registration requiresDurableSettlement must be boolean.");
   }
+  if (input.signingProfile !== void 0 && (input.mode !== "rfc9421" || !["adcp/webhook-signing/v1", "web-bot-auth"].includes(input.signingProfile)))
+    throw new TypeError("Invalid registered webhook signing profile");
   const createdAt = requireEpochMs("createdAt", input.createdAt);
   const expiresAt = requireEpochMs("expiresAt", input.expiresAt);
   if (expiresAt <= createdAt) {
@@ -198,6 +206,8 @@ function parseWebhookRegistration(value, expectedKey) {
   if (agent.username || agent.password || agent.hash) {
     throw new TypeError("Webhook agentUrl cannot contain userinfo credentials or a fragment.");
   }
+  if (input.deliveryKind !== void 0 && (!["reporting", "artifact"].includes(input.deliveryKind) || input.mode !== "rfc9421"))
+    throw new TypeError("Invalid delivery registration kind");
   const parsed = {
     agentId,
     agentUrl,
@@ -207,6 +217,12 @@ function parseWebhookRegistration(value, expectedKey) {
     callbackUrl,
     method: "POST",
     mode: input.mode,
+    ...input.signingProfile !== void 0 && {
+      signingProfile: input.signingProfile
+    },
+    ...input.deliveryKind !== void 0 && {
+      deliveryKind: input.deliveryKind
+    },
     ...input.authorizationContextVersion === 1 && { authorizationContextVersion: 1 },
     ...delegatedOperatorAuthorization !== void 0 && {
       delegatedOperatorAuthorization: { ...delegatedOperatorAuthorization }
@@ -289,7 +305,9 @@ function webhookRegistrationFingerprint(registration) {
     parsed.mode,
     parsed.previewMode ?? null,
     parsed.authorizationContextVersion ?? null,
-    canonicalDelegatedOperatorAuthorization(parsed.delegatedOperatorAuthorization)
+    canonicalDelegatedOperatorAuthorization(parsed.delegatedOperatorAuthorization),
+    ...parsed.signingProfile === "web-bot-auth" ? [parsed.signingProfile] : [],
+    ...parsed.deliveryKind !== void 0 ? ["delivery", parsed.deliveryKind] : []
   ]);
 }
 function sameWebhookRegistration(a, b) {
@@ -299,11 +317,15 @@ function webhookRegistrationStorageDigest(agentId, operationId) {
   validateWebhookRegistrationKey(agentId, operationId);
   return (0, import_node_crypto.createHash)("sha256").update(JSON.stringify([agentId, operationId])).digest("hex");
 }
+function deliveryWebhookRegistrationId(kind, url) {
+  return `delivery_route:${kind}:` + (0, import_node_crypto.createHash)("sha256").update((0, import_canonicalize.canonicalTargetUri)(url, "3.2")).digest("hex");
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   InMemoryWebhookRegistrationStore,
   WebhookRegistrationIntegrityError,
   canonicalDelegatedOperatorAuthorization,
+  deliveryWebhookRegistrationId,
   freezeWebhookRegistration,
   parseWebhookRegistration,
   sameWebhookRegistration,

package/dist/lib/core/webhook-registration.mjs

@@ -1,3 +1,4 @@
+import { canonicalTargetUri } from "../signing/canonicalize.mjs";
 import { createHash } from "node:crypto";
 import { ConfigurationError } from "../errors/index.mjs";
 import { isWebhookLoopbackHost } from "../signing/webhook-verifier.mjs";
@@ -35,7 +36,11 @@ class InMemoryWebhookRegistrationStore {
     const key = registrationKey(parsed.agentId, parsed.operationId);
     const existing = this.entries.get(key);
     if (existing) {
-      if (sameWebhookRegistration(existing, parsed)) return;
+      if (sameWebhookRegistration(existing, parsed)) {
+        if (parsed.deliveryKind && parsed.expiresAt > existing.expiresAt)
+          this.entries.set(key, freezeWebhookRegistration({ ...existing, expiresAt: parsed.expiresAt }));
+        return;
+      }
       throw new ConfigurationError(
         "Webhook operation id is already registered with different trusted provenance.",
         "operationId"
@@ -137,6 +142,8 @@ function parseWebhookRegistration(value, expectedKey) {
   if (input.requiresDurableSettlement !== void 0 && typeof input.requiresDurableSettlement !== "boolean") {
     throw new TypeError("Webhook registration requiresDurableSettlement must be boolean.");
   }
+  if (input.signingProfile !== void 0 && (input.mode !== "rfc9421" || !["adcp/webhook-signing/v1", "web-bot-auth"].includes(input.signingProfile)))
+    throw new TypeError("Invalid registered webhook signing profile");
   const createdAt = requireEpochMs("createdAt", input.createdAt);
   const expiresAt = requireEpochMs("expiresAt", input.expiresAt);
   if (expiresAt <= createdAt) {
@@ -165,6 +172,8 @@ function parseWebhookRegistration(value, expectedKey) {
   if (agent.username || agent.password || agent.hash) {
     throw new TypeError("Webhook agentUrl cannot contain userinfo credentials or a fragment.");
   }
+  if (input.deliveryKind !== void 0 && (!["reporting", "artifact"].includes(input.deliveryKind) || input.mode !== "rfc9421"))
+    throw new TypeError("Invalid delivery registration kind");
   const parsed = {
     agentId,
     agentUrl,
@@ -174,6 +183,12 @@ function parseWebhookRegistration(value, expectedKey) {
     callbackUrl,
     method: "POST",
     mode: input.mode,
+    ...input.signingProfile !== void 0 && {
+      signingProfile: input.signingProfile
+    },
+    ...input.deliveryKind !== void 0 && {
+      deliveryKind: input.deliveryKind
+    },
     ...input.authorizationContextVersion === 1 && { authorizationContextVersion: 1 },
     ...delegatedOperatorAuthorization !== void 0 && {
       delegatedOperatorAuthorization: { ...delegatedOperatorAuthorization }
@@ -256,7 +271,9 @@ function webhookRegistrationFingerprint(registration) {
     parsed.mode,
     parsed.previewMode ?? null,
     parsed.authorizationContextVersion ?? null,
-    canonicalDelegatedOperatorAuthorization(parsed.delegatedOperatorAuthorization)
+    canonicalDelegatedOperatorAuthorization(parsed.delegatedOperatorAuthorization),
+    ...parsed.signingProfile === "web-bot-auth" ? [parsed.signingProfile] : [],
+    ...parsed.deliveryKind !== void 0 ? ["delivery", parsed.deliveryKind] : []
   ]);
 }
 function sameWebhookRegistration(a, b) {
@@ -266,10 +283,14 @@ function webhookRegistrationStorageDigest(agentId, operationId) {
   validateWebhookRegistrationKey(agentId, operationId);
   return createHash("sha256").update(JSON.stringify([agentId, operationId])).digest("hex");
 }
+function deliveryWebhookRegistrationId(kind, url) {
+  return `delivery_route:${kind}:` + createHash("sha256").update(canonicalTargetUri(url, "3.2")).digest("hex");
+}
 export {
   InMemoryWebhookRegistrationStore,
   WebhookRegistrationIntegrityError,
   canonicalDelegatedOperatorAuthorization,
+  deliveryWebhookRegistrationId,
   freezeWebhookRegistration,
   parseWebhookRegistration,
   sameWebhookRegistration,

package/dist/lib/errors/index.d.mts

@@ -119,9 +119,9 @@ export declare class AccountPaymentRequiredError extends BuyerSetupError {
     constructor(message?: string);
 }
 export declare class AccountNotProvisionedError extends AccountNotFoundError {
-    readonly account: import('../types/index.mjs').AccountReference;
+    readonly account: import('../types/index.mjs').AccountReference | undefined;
     readonly taskName: string;
-    constructor(account: import('../types/index.mjs').AccountReference, taskName: string);
+    constructor(account: import('../types/index.mjs').AccountReference | undefined, taskName: string);
 }
 /**
  * Error thrown when protocol communication fails

package/dist/lib/errors/index.d.ts

@@ -119,9 +119,9 @@ export declare class AccountPaymentRequiredError extends BuyerSetupError {
     constructor(message?: string);
 }
 export declare class AccountNotProvisionedError extends AccountNotFoundError {
-    readonly account: import('../types').AccountReference;
+    readonly account: import('../types').AccountReference | undefined;
     readonly taskName: string;
-    constructor(account: import('../types').AccountReference, taskName: string);
+    constructor(account: import('../types').AccountReference | undefined, taskName: string);
 }
 /**
  * Error thrown when protocol communication fails

package/dist/lib/errors/index.js

@@ -157,7 +157,7 @@ class UnsupportedBuyingModeError extends ADCPError {
 class AccountRequiredError extends ADCPError {
   constructor(accountModel, taskName, reason) {
     super(
-      reason ?? `${taskName} requires an account for this ${accountModel}-account seller. ` + (accountModel === "explicit" ? "Call resolveAccount() to discover an account_id, then pass account: { account_id }." : "Call resolveAccount({ brand, operator }) to sync the account, then pass its natural key.")
+      reason ?? `${taskName} requires an account for this ${accountModel}-account seller. ` + (accountModel === "explicit" ? "Call resolveAccount() to discover an account_id, then pass account: { account_id }." : "Call resolveAccount({ brand, operator }) to sync the account, then pass the returned reference.")
     );
     this.accountModel = accountModel;
     this.taskName = taskName;
@@ -212,7 +212,9 @@ class AccountPaymentRequiredError extends BuyerSetupError {
 }
 class AccountNotProvisionedError extends AccountNotFoundError {
   constructor(account, taskName) {
-    super(`${taskName} requires an account provisioned at this seller. Call client.accounts.ensure first.`);
+    super(
+      account ? `${taskName} requires an account provisioned at this seller. Call client.accounts.ensure first.` : `${taskName} requires a provisioned account reference. Call client.accounts.ensure and pass the account reference.`
+    );
     this.account = account;
     this.taskName = taskName;
   }

package/dist/lib/errors/index.mjs

@@ -97,7 +97,7 @@ class UnsupportedBuyingModeError extends ADCPError {
 class AccountRequiredError extends ADCPError {
   constructor(accountModel, taskName, reason) {
     super(
-      reason ?? `${taskName} requires an account for this ${accountModel}-account seller. ` + (accountModel === "explicit" ? "Call resolveAccount() to discover an account_id, then pass account: { account_id }." : "Call resolveAccount({ brand, operator }) to sync the account, then pass its natural key.")
+      reason ?? `${taskName} requires an account for this ${accountModel}-account seller. ` + (accountModel === "explicit" ? "Call resolveAccount() to discover an account_id, then pass account: { account_id }." : "Call resolveAccount({ brand, operator }) to sync the account, then pass the returned reference.")
     );
     this.accountModel = accountModel;
     this.taskName = taskName;
@@ -152,7 +152,9 @@ class AccountPaymentRequiredError extends BuyerSetupError {
 }
 class AccountNotProvisionedError extends AccountNotFoundError {
   constructor(account, taskName) {
-    super(`${taskName} requires an account provisioned at this seller. Call client.accounts.ensure first.`);
+    super(
+      account ? `${taskName} requires an account provisioned at this seller. Call client.accounts.ensure first.` : `${taskName} requires a provisioned account reference. Call client.accounts.ensure and pass the account reference.`
+    );
     this.account = account;
     this.taskName = taskName;
   }

package/dist/lib/identity-3.3/index.d.mts

@@ -0,0 +1,10 @@
+export * from './types.mjs';
+export * from './trust.mjs';
+export * from './lifecycle.mjs';
+export * from './revocation.mjs';
+export { WEB_BOT_AUTH_DRAFT_REVISION, verifyWebBotAuth, signWebBotAuth, createWebBotAuthFetch, createSignedSignatureDirectory, SignatureDirectoryResolver, verifySignatureDirectory, selectSignatureProfile, jwkThumbprint, WebBotAuthError, } from '../signing/web-bot-auth.mjs';
+export type { WebBotSigningKey, WebBotSigningOptions, VerifiedWebBotSigner, VerifyWebBotAuthOptions, } from '../signing/web-bot-auth.mjs';
+export { validateIdentity33Payload } from './validation.mjs';
+export { createIdentity33PrincipalResolver, createIdentity33PrincipalScopeResolver, createIdentity33Authorization, withIdentity33PrincipalHandlers, isIdentity33UnboundContext, } from './server.mjs';
+export { createIdentity33StateStores } from './store.mjs';
+export { deliveryWebhookRegistrationId } from '../core/webhook-registration.mjs';

package/dist/lib/identity-3.3/index.d.ts

@@ -0,0 +1,10 @@
+export * from './types';
+export * from './trust';
+export * from './lifecycle';
+export * from './revocation';
+export { WEB_BOT_AUTH_DRAFT_REVISION, verifyWebBotAuth, signWebBotAuth, createWebBotAuthFetch, createSignedSignatureDirectory, SignatureDirectoryResolver, verifySignatureDirectory, selectSignatureProfile, jwkThumbprint, WebBotAuthError, } from '../signing/web-bot-auth';
+export type { WebBotSigningKey, WebBotSigningOptions, VerifiedWebBotSigner, VerifyWebBotAuthOptions, } from '../signing/web-bot-auth';
+export { validateIdentity33Payload } from './validation';
+export { createIdentity33PrincipalResolver, createIdentity33PrincipalScopeResolver, createIdentity33Authorization, withIdentity33PrincipalHandlers, isIdentity33UnboundContext, } from './server';
+export { createIdentity33StateStores } from './store';
+export { deliveryWebhookRegistrationId } from '../core/webhook-registration';

package/dist/lib/identity-3.3/index.js

@@ -0,0 +1,75 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var identity_3_exports = {};
+__export(identity_3_exports, {
+  SignatureDirectoryResolver: () => import_web_bot_auth.SignatureDirectoryResolver,
+  WEB_BOT_AUTH_DRAFT_REVISION: () => import_web_bot_auth.WEB_BOT_AUTH_DRAFT_REVISION,
+  WebBotAuthError: () => import_web_bot_auth.WebBotAuthError,
+  createIdentity33Authorization: () => import_server.createIdentity33Authorization,
+  createIdentity33PrincipalResolver: () => import_server.createIdentity33PrincipalResolver,
+  createIdentity33PrincipalScopeResolver: () => import_server.createIdentity33PrincipalScopeResolver,
+  createIdentity33StateStores: () => import_store.createIdentity33StateStores,
+  createSignedSignatureDirectory: () => import_web_bot_auth.createSignedSignatureDirectory,
+  createWebBotAuthFetch: () => import_web_bot_auth.createWebBotAuthFetch,
+  deliveryWebhookRegistrationId: () => import_webhook_registration.deliveryWebhookRegistrationId,
+  isIdentity33UnboundContext: () => import_server.isIdentity33UnboundContext,
+  jwkThumbprint: () => import_web_bot_auth.jwkThumbprint,
+  selectSignatureProfile: () => import_web_bot_auth.selectSignatureProfile,
+  signWebBotAuth: () => import_web_bot_auth.signWebBotAuth,
+  validateIdentity33Payload: () => import_validation.validateIdentity33Payload,
+  verifySignatureDirectory: () => import_web_bot_auth.verifySignatureDirectory,
+  verifyWebBotAuth: () => import_web_bot_auth.verifyWebBotAuth,
+  withIdentity33PrincipalHandlers: () => import_server.withIdentity33PrincipalHandlers
+});
+module.exports = __toCommonJS(identity_3_exports);
+__reExport(identity_3_exports, require('./types.js'), module.exports);
+__reExport(identity_3_exports, require('./trust.js'), module.exports);
+__reExport(identity_3_exports, require('./lifecycle.js'), module.exports);
+__reExport(identity_3_exports, require('./revocation.js'), module.exports);
+var import_web_bot_auth = require('../signing/web-bot-auth.js');
+var import_validation = require('./validation.js');
+var import_server = require('./server.js');
+var import_store = require('./store.js');
+var import_webhook_registration = require('../core/webhook-registration.js');
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SignatureDirectoryResolver,
+  WEB_BOT_AUTH_DRAFT_REVISION,
+  WebBotAuthError,
+  createIdentity33Authorization,
+  createIdentity33PrincipalResolver,
+  createIdentity33PrincipalScopeResolver,
+  createIdentity33StateStores,
+  createSignedSignatureDirectory,
+  createWebBotAuthFetch,
+  deliveryWebhookRegistrationId,
+  isIdentity33UnboundContext,
+  jwkThumbprint,
+  selectSignatureProfile,
+  signWebBotAuth,
+  validateIdentity33Payload,
+  verifySignatureDirectory,
+  verifyWebBotAuth,
+  withIdentity33PrincipalHandlers,
+  ...require('./types.js'),
+  ...require('./trust.js'),
+  ...require('./lifecycle.js'),
+  ...require('./revocation.js')
+});