@adcp/sdk 15.9.0 → 16.0.0-beta.1

package/dist/lib/identity-3.3/server.d.mts

@@ -0,0 +1,34 @@
+import type { AuthPrincipal } from '../server/auth.mjs';
+import type { HandlerContext, ProtocolHandlers } from '../server/create-adcp-server.mjs';
+import { type VerifiedWebBotSigner } from '../signing/web-bot-auth.mjs';
+import type { ResolvedOperation } from '../signing/operation-resolution.mjs';
+import type { OriginIdentityLifecycle } from './lifecycle.mjs';
+import { type DemandGrantClaim, type DemandGrantOptions } from './trust.mjs';
+export declare function isIdentity33UnboundContext(ctx: HandlerContext<unknown>): boolean;
+/** Maps only audited bindings. An unknown origin remains in anonymous scope. */
+export declare function createIdentity33PrincipalResolver(options: {
+    lifecycle: OriginIdentityLifecycle;
+    anonymousPrincipal?: string;
+    anonymousTools?: readonly string[];
+}): (signers: readonly VerifiedWebBotSigner[], operation: ResolvedOperation) => Promise<AuthPrincipal>;
+/** Pass to createAdcpServer.identity33.authorize; framework runs it before its replay cache. */
+export declare function createIdentity33Authorization<TAccount>(options: {
+    lifecycle: OriginIdentityLifecycle;
+    /** Explicitly declared custom read tools still re-check identity membership. */
+    readOnlyTools?: readonly string[];
+    anonymousTools?: readonly string[];
+    grants: DemandGrantOptions;
+    /** Runs before account resolution: look up existing seller accounts read-only. sync_accounts includes all proposed rows. Never trust request reassignment or provision here. */
+    resolveClaims: (ctx: HandlerContext<TAccount>, tool: string, params: unknown) => Promise<readonly (Omit<DemandGrantClaim, 'signerOrigin'> & {
+        sandbox?: boolean;
+        billing?: 'operator' | 'agent' | 'advertiser';
+    })[]>;
+}): (ctx: HandlerContext<TAccount>, tool: string, params: unknown) => Promise<void>;
+/** Adds caller-only relationship readback; unknown reads never run the durable principal runtime. */
+export declare function withIdentity33PrincipalHandlers<TAccount>(base: ProtocolHandlers<TAccount>, lifecycle: OriginIdentityLifecycle): ProtocolHandlers<TAccount>;
+/** Use as createPrincipalLifecycle.resolvePrincipal to keep the configuration record on the audited binding. */
+export declare function createIdentity33PrincipalScopeResolver<TAccount>(options: {
+    lifecycle: OriginIdentityLifecycle;
+    tenantId: string;
+    legacy?: (ctx: HandlerContext<TAccount>) => Promise<import('../server/principal/types.mjs').ResolvedPrincipalScope>;
+}): (ctx: HandlerContext<TAccount>) => Promise<import('../server/principal/types.mjs').ResolvedPrincipalScope>;

package/dist/lib/identity-3.3/server.d.ts

@@ -0,0 +1,34 @@
+import type { AuthPrincipal } from '../server/auth';
+import type { HandlerContext, ProtocolHandlers } from '../server/create-adcp-server';
+import { type VerifiedWebBotSigner } from '../signing/web-bot-auth';
+import type { ResolvedOperation } from '../signing/operation-resolution';
+import type { OriginIdentityLifecycle } from './lifecycle';
+import { type DemandGrantClaim, type DemandGrantOptions } from './trust';
+export declare function isIdentity33UnboundContext(ctx: HandlerContext<unknown>): boolean;
+/** Maps only audited bindings. An unknown origin remains in anonymous scope. */
+export declare function createIdentity33PrincipalResolver(options: {
+    lifecycle: OriginIdentityLifecycle;
+    anonymousPrincipal?: string;
+    anonymousTools?: readonly string[];
+}): (signers: readonly VerifiedWebBotSigner[], operation: ResolvedOperation) => Promise<AuthPrincipal>;
+/** Pass to createAdcpServer.identity33.authorize; framework runs it before its replay cache. */
+export declare function createIdentity33Authorization<TAccount>(options: {
+    lifecycle: OriginIdentityLifecycle;
+    /** Explicitly declared custom read tools still re-check identity membership. */
+    readOnlyTools?: readonly string[];
+    anonymousTools?: readonly string[];
+    grants: DemandGrantOptions;
+    /** Runs before account resolution: look up existing seller accounts read-only. sync_accounts includes all proposed rows. Never trust request reassignment or provision here. */
+    resolveClaims: (ctx: HandlerContext<TAccount>, tool: string, params: unknown) => Promise<readonly (Omit<DemandGrantClaim, 'signerOrigin'> & {
+        sandbox?: boolean;
+        billing?: 'operator' | 'agent' | 'advertiser';
+    })[]>;
+}): (ctx: HandlerContext<TAccount>, tool: string, params: unknown) => Promise<void>;
+/** Adds caller-only relationship readback; unknown reads never run the durable principal runtime. */
+export declare function withIdentity33PrincipalHandlers<TAccount>(base: ProtocolHandlers<TAccount>, lifecycle: OriginIdentityLifecycle): ProtocolHandlers<TAccount>;
+/** Use as createPrincipalLifecycle.resolvePrincipal to keep the configuration record on the audited binding. */
+export declare function createIdentity33PrincipalScopeResolver<TAccount>(options: {
+    lifecycle: OriginIdentityLifecycle;
+    tenantId: string;
+    legacy?: (ctx: HandlerContext<TAccount>) => Promise<import('../server/principal/types').ResolvedPrincipalScope>;
+}): (ctx: HandlerContext<TAccount>) => Promise<import('../server/principal/types').ResolvedPrincipalScope>;

package/dist/lib/identity-3.3/server.js

@@ -0,0 +1,219 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var server_exports = {};
+__export(server_exports, {
+  createIdentity33Authorization: () => createIdentity33Authorization,
+  createIdentity33PrincipalResolver: () => createIdentity33PrincipalResolver,
+  createIdentity33PrincipalScopeResolver: () => createIdentity33PrincipalScopeResolver,
+  isIdentity33UnboundContext: () => isIdentity33UnboundContext,
+  withIdentity33PrincipalHandlers: () => withIdentity33PrincipalHandlers
+});
+module.exports = __toCommonJS(server_exports);
+var import_crypto = require("crypto");
+var import_web_bot_auth = require('../signing/web-bot-auth.js');
+var import_errors = require('../signing/errors.js');
+var import_enums = require('../types/enums.generated.js');
+var import_async_outcome = require('../server/decisioning/async-outcome.js');
+var import_web_bot_auth2 = require('../signing/web-bot-auth.js');
+var import_buyer_agent = require('../server/decisioning/buyer-agent.js');
+var import_web_bot_auth3 = require('../signing/web-bot-auth.js');
+var import_trust = require('./trust.js');
+var import_idempotency = require('../utils/idempotency.js');
+const IDENTITY_ADMIN_TOOLS = /* @__PURE__ */ new Set(["sync_principal", "sync_agent_notification_configs"]);
+const KNOWN_TOOLS = /* @__PURE__ */ new Set([...import_enums.TaskTypeValues, "get_task_status", "list_tasks", "tasks_get"]);
+const SPEND_TOOLS = new Set([...import_idempotency.MUTATING_TASKS].filter((tool) => !IDENTITY_ADMIN_TOOLS.has(tool)));
+function needsSpendAuthorization(tool, params) {
+  if (SPEND_TOOLS.has(tool) || !KNOWN_TOOLS.has(tool)) return true;
+  if (tool !== "get_products" || !params || typeof params !== "object") return false;
+  const refine = params.refine;
+  return (Array.isArray(refine) ? refine : [refine]).some(
+    (entry) => entry && typeof entry === "object" && entry.action === "finalize"
+  );
+}
+function claimFromContext(ctx) {
+  const claim = ctx.authInfo?.extra?.identity33;
+  return claim && (0, import_web_bot_auth3.isVerifiedWebBotSigner)(claim.signer) ? claim : void 0;
+}
+function isIdentity33UnboundContext(ctx) {
+  return claimFromContext(ctx)?.state === "identity-established";
+}
+function createIdentity33PrincipalResolver(options) {
+  const anonymousTools = new Set(
+    options.anonymousTools ?? [
+      "get_adcp_capabilities",
+      "get_principal",
+      "sync_principal",
+      "list_creative_formats",
+      "get_products"
+    ]
+  );
+  const resolver = async (signers, operation) => {
+    if (!signers.length || signers.some((s) => !(0, import_web_bot_auth3.isVerifiedWebBotSigner)(s)))
+      throw new import_web_bot_auth3.WebBotAuthError(403, "unverified_identity");
+    const signer = signers[signers.length - 1];
+    const revoked = signers.find((s) => s.authorizationFailure);
+    const { binding } = revoked ? { binding: void 0 } : await options.lifecycle.getPrincipal(signer.origin);
+    if (!binding && operation !== void 0 && typeof operation !== "string")
+      throw new import_web_bot_auth3.WebBotAuthError(400, "operation");
+    const authorizationFailure = revoked?.authorizationFailure ?? (!binding && typeof operation === "string" && !anonymousTools.has(operation) ? (0, import_web_bot_auth2.createWebBotAuthAuthorizationFailure)("identity_not_bound") : void 0);
+    return {
+      principal: binding?.principalId ?? `${options.anonymousPrincipal ?? "anonymous"}:${(0, import_crypto.createHash)("sha256").update(signer.origin).digest("hex")}`,
+      extra: {
+        identity33: {
+          state: binding ? "bound" : "identity-established",
+          signer: revoked ?? signer,
+          ...authorizationFailure && { authorizationFailure }
+        }
+      },
+      ...binding ? {
+        credential: (0, import_buyer_agent.markVerifiedHttpSig)({
+          kind: "http_sig",
+          keyid: signer.keyid,
+          agent_url: signer.origin,
+          verified_at: signer.verified_at
+        })
+      } : {}
+    };
+  };
+  (0, import_web_bot_auth.registerWebBotAuthLegacyOriginGate)(resolver, async (origin) => {
+    if ((await options.lifecycle.getPrincipal(origin)).binding)
+      throw new import_errors.RequestSignatureError(
+        "request_signature_key_unknown",
+        7,
+        "Origin-bound principals require Web Bot Auth"
+      );
+  });
+  return resolver;
+}
+function createIdentity33Authorization(options) {
+  return async (ctx, tool, params) => {
+    const identity = claimFromContext(ctx);
+    const failure = (0, import_web_bot_auth2.getWebBotAuthAuthorizationFailure)(ctx.authInfo?.extra);
+    if (failure) throw new import_async_outcome.AdcpError(failure.code, failure);
+    if (!identity) {
+      const verified = ctx.authInfo?.extra?.webBotAuthAuthorization;
+      if ((0, import_web_bot_auth3.isVerifiedWebBotSigner)(verified?.signer))
+        throw new import_async_outcome.AdcpError("PERMISSION_DENIED", {
+          message: "Web Bot Auth resolver did not supply an audited identity claim"
+        });
+      return;
+    }
+    if (identity.state === "identity-established") {
+      if (tool === "sync_principal") {
+        const dryRun = !!params && typeof params === "object" && params.dry_run === true;
+        const binding = await options.lifecycle.syncOpen(identity.signer.origin, { dryRun });
+        if (dryRun) return;
+        if (!ctx.authInfo) throw new import_trust.IdentityAuthorizationError();
+        ctx.authInfo.clientId = binding.principalId;
+        ctx.authInfo.credential = (0, import_buyer_agent.markVerifiedHttpSig)({
+          kind: "http_sig",
+          keyid: identity.signer.keyid,
+          agent_url: identity.signer.origin,
+          verified_at: identity.signer.verified_at
+        });
+        ctx.authInfo.extra = {
+          ...ctx.authInfo.extra,
+          credential: ctx.authInfo.credential,
+          identity33: { ...identity, state: "bound" }
+        };
+        return;
+      }
+      if ((options.anonymousTools ?? ["get_principal", "get_adcp_capabilities", "list_creative_formats", "get_products"]).includes(tool) && !needsSpendAuthorization(tool, params))
+        return;
+      throw new import_async_outcome.AdcpError("PERMISSION_DENIED", { message: "Agent identity is not onboarded for this operation" });
+    }
+    const origin = identity.signer.origin;
+    if (IDENTITY_ADMIN_TOOLS.has(tool)) {
+      await options.lifecycle.authorizeBound(origin, { identityConfiguration: true });
+      return;
+    }
+    if (!needsSpendAuthorization(tool, params) || !KNOWN_TOOLS.has(tool) && options.readOnlyTools?.includes(tool)) {
+      await options.lifecycle.authorizeBound(origin, { readOnly: true });
+      return;
+    }
+    const claims = await options.resolveClaims(ctx, tool, params);
+    if (!claims.length) throw new import_trust.IdentityAuthorizationError();
+    for (const claim of claims) {
+      await options.lifecycle.authorizeBound(origin, {
+        sandbox: claim.sandbox,
+        billing: claim.billing,
+        brandDomain: claim.brand.domain
+      });
+      await (0, import_trust.authorizeDemandGrant)({ ...claim, signerOrigin: origin }, options.grants);
+    }
+  };
+}
+function withIdentity33PrincipalHandlers(base, lifecycle) {
+  return {
+    ...base,
+    async syncPrincipal(params, ctx) {
+      const identity = claimFromContext(ctx);
+      if (identity?.state === "identity-established" && params.dry_run === true)
+        return { result: { kind: "validated", action: "would_update", dry_run: true } };
+      if (!base.syncPrincipal) throw new import_trust.IdentityAuthorizationError();
+      return base.syncPrincipal(params, ctx);
+    },
+    async getPrincipal(params, ctx) {
+      const identity = claimFromContext(ctx);
+      if (!identity) {
+        if (!base.getPrincipal) throw new import_trust.IdentityAuthorizationError();
+        return base.getPrincipal(params, ctx);
+      }
+      const read = await lifecycle.getPrincipal(identity.signer.origin);
+      if (!read.binding) return { result: read.result };
+      if (!base.getPrincipal) return { result: read.result };
+      const response = await base.getPrincipal(params, ctx);
+      if (read.result.relationship && response && typeof response === "object") {
+        const boxed = "structuredContent" in response;
+        const payload = boxed ? response.structuredContent : response;
+        if (payload?.result && ["current", "recognized", "unconfigured"].includes(payload.result.kind ?? "")) {
+          const augmented = { ...payload, result: { ...payload.result, relationship: read.result.relationship } };
+          return boxed ? { ...response, structuredContent: augmented } : augmented;
+        }
+      }
+      return response;
+    }
+  };
+}
+function createIdentity33PrincipalScopeResolver(options) {
+  if (!options.tenantId) throw new TypeError("Principal scope requires a trusted tenant id");
+  return async (ctx) => {
+    const identity = claimFromContext(ctx);
+    if (!identity) {
+      if (!options.legacy) throw new import_trust.IdentityAuthorizationError();
+      return options.legacy(ctx);
+    }
+    const { binding } = await options.lifecycle.getPrincipal(identity.signer.origin);
+    if (!binding) throw new import_trust.IdentityAuthorizationError();
+    return {
+      tenant_id: options.tenantId,
+      principal_id: binding.principalId,
+      principal_record_id: binding.principalId,
+      principal_kind: binding.principalKind ?? "buyer_agent"
+    };
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createIdentity33Authorization,
+  createIdentity33PrincipalResolver,
+  createIdentity33PrincipalScopeResolver,
+  isIdentity33UnboundContext,
+  withIdentity33PrincipalHandlers
+});

package/dist/lib/identity-3.3/server.mjs

@@ -0,0 +1,194 @@
+import { createHash } from "crypto";
+import { registerWebBotAuthLegacyOriginGate } from "../signing/web-bot-auth.mjs";
+import { RequestSignatureError } from "../signing/errors.mjs";
+import { TaskTypeValues } from "../types/enums.generated.mjs";
+import { AdcpError } from "../server/decisioning/async-outcome.mjs";
+import { createWebBotAuthAuthorizationFailure, getWebBotAuthAuthorizationFailure } from "../signing/web-bot-auth.mjs";
+import { markVerifiedHttpSig } from "../server/decisioning/buyer-agent.mjs";
+import { isVerifiedWebBotSigner, WebBotAuthError } from "../signing/web-bot-auth.mjs";
+import {
+  authorizeDemandGrant,
+  IdentityAuthorizationError
+} from "./trust.mjs";
+import { MUTATING_TASKS } from "../utils/idempotency.mjs";
+const IDENTITY_ADMIN_TOOLS = /* @__PURE__ */ new Set(["sync_principal", "sync_agent_notification_configs"]);
+const KNOWN_TOOLS = /* @__PURE__ */ new Set([...TaskTypeValues, "get_task_status", "list_tasks", "tasks_get"]);
+const SPEND_TOOLS = new Set([...MUTATING_TASKS].filter((tool) => !IDENTITY_ADMIN_TOOLS.has(tool)));
+function needsSpendAuthorization(tool, params) {
+  if (SPEND_TOOLS.has(tool) || !KNOWN_TOOLS.has(tool)) return true;
+  if (tool !== "get_products" || !params || typeof params !== "object") return false;
+  const refine = params.refine;
+  return (Array.isArray(refine) ? refine : [refine]).some(
+    (entry) => entry && typeof entry === "object" && entry.action === "finalize"
+  );
+}
+function claimFromContext(ctx) {
+  const claim = ctx.authInfo?.extra?.identity33;
+  return claim && isVerifiedWebBotSigner(claim.signer) ? claim : void 0;
+}
+function isIdentity33UnboundContext(ctx) {
+  return claimFromContext(ctx)?.state === "identity-established";
+}
+function createIdentity33PrincipalResolver(options) {
+  const anonymousTools = new Set(
+    options.anonymousTools ?? [
+      "get_adcp_capabilities",
+      "get_principal",
+      "sync_principal",
+      "list_creative_formats",
+      "get_products"
+    ]
+  );
+  const resolver = async (signers, operation) => {
+    if (!signers.length || signers.some((s) => !isVerifiedWebBotSigner(s)))
+      throw new WebBotAuthError(403, "unverified_identity");
+    const signer = signers[signers.length - 1];
+    const revoked = signers.find((s) => s.authorizationFailure);
+    const { binding } = revoked ? { binding: void 0 } : await options.lifecycle.getPrincipal(signer.origin);
+    if (!binding && operation !== void 0 && typeof operation !== "string")
+      throw new WebBotAuthError(400, "operation");
+    const authorizationFailure = revoked?.authorizationFailure ?? (!binding && typeof operation === "string" && !anonymousTools.has(operation) ? createWebBotAuthAuthorizationFailure("identity_not_bound") : void 0);
+    return {
+      principal: binding?.principalId ?? `${options.anonymousPrincipal ?? "anonymous"}:${createHash("sha256").update(signer.origin).digest("hex")}`,
+      extra: {
+        identity33: {
+          state: binding ? "bound" : "identity-established",
+          signer: revoked ?? signer,
+          ...authorizationFailure && { authorizationFailure }
+        }
+      },
+      ...binding ? {
+        credential: markVerifiedHttpSig({
+          kind: "http_sig",
+          keyid: signer.keyid,
+          agent_url: signer.origin,
+          verified_at: signer.verified_at
+        })
+      } : {}
+    };
+  };
+  registerWebBotAuthLegacyOriginGate(resolver, async (origin) => {
+    if ((await options.lifecycle.getPrincipal(origin)).binding)
+      throw new RequestSignatureError(
+        "request_signature_key_unknown",
+        7,
+        "Origin-bound principals require Web Bot Auth"
+      );
+  });
+  return resolver;
+}
+function createIdentity33Authorization(options) {
+  return async (ctx, tool, params) => {
+    const identity = claimFromContext(ctx);
+    const failure = getWebBotAuthAuthorizationFailure(ctx.authInfo?.extra);
+    if (failure) throw new AdcpError(failure.code, failure);
+    if (!identity) {
+      const verified = ctx.authInfo?.extra?.webBotAuthAuthorization;
+      if (isVerifiedWebBotSigner(verified?.signer))
+        throw new AdcpError("PERMISSION_DENIED", {
+          message: "Web Bot Auth resolver did not supply an audited identity claim"
+        });
+      return;
+    }
+    if (identity.state === "identity-established") {
+      if (tool === "sync_principal") {
+        const dryRun = !!params && typeof params === "object" && params.dry_run === true;
+        const binding = await options.lifecycle.syncOpen(identity.signer.origin, { dryRun });
+        if (dryRun) return;
+        if (!ctx.authInfo) throw new IdentityAuthorizationError();
+        ctx.authInfo.clientId = binding.principalId;
+        ctx.authInfo.credential = markVerifiedHttpSig({
+          kind: "http_sig",
+          keyid: identity.signer.keyid,
+          agent_url: identity.signer.origin,
+          verified_at: identity.signer.verified_at
+        });
+        ctx.authInfo.extra = {
+          ...ctx.authInfo.extra,
+          credential: ctx.authInfo.credential,
+          identity33: { ...identity, state: "bound" }
+        };
+        return;
+      }
+      if ((options.anonymousTools ?? ["get_principal", "get_adcp_capabilities", "list_creative_formats", "get_products"]).includes(tool) && !needsSpendAuthorization(tool, params))
+        return;
+      throw new AdcpError("PERMISSION_DENIED", { message: "Agent identity is not onboarded for this operation" });
+    }
+    const origin = identity.signer.origin;
+    if (IDENTITY_ADMIN_TOOLS.has(tool)) {
+      await options.lifecycle.authorizeBound(origin, { identityConfiguration: true });
+      return;
+    }
+    if (!needsSpendAuthorization(tool, params) || !KNOWN_TOOLS.has(tool) && options.readOnlyTools?.includes(tool)) {
+      await options.lifecycle.authorizeBound(origin, { readOnly: true });
+      return;
+    }
+    const claims = await options.resolveClaims(ctx, tool, params);
+    if (!claims.length) throw new IdentityAuthorizationError();
+    for (const claim of claims) {
+      await options.lifecycle.authorizeBound(origin, {
+        sandbox: claim.sandbox,
+        billing: claim.billing,
+        brandDomain: claim.brand.domain
+      });
+      await authorizeDemandGrant({ ...claim, signerOrigin: origin }, options.grants);
+    }
+  };
+}
+function withIdentity33PrincipalHandlers(base, lifecycle) {
+  return {
+    ...base,
+    async syncPrincipal(params, ctx) {
+      const identity = claimFromContext(ctx);
+      if (identity?.state === "identity-established" && params.dry_run === true)
+        return { result: { kind: "validated", action: "would_update", dry_run: true } };
+      if (!base.syncPrincipal) throw new IdentityAuthorizationError();
+      return base.syncPrincipal(params, ctx);
+    },
+    async getPrincipal(params, ctx) {
+      const identity = claimFromContext(ctx);
+      if (!identity) {
+        if (!base.getPrincipal) throw new IdentityAuthorizationError();
+        return base.getPrincipal(params, ctx);
+      }
+      const read = await lifecycle.getPrincipal(identity.signer.origin);
+      if (!read.binding) return { result: read.result };
+      if (!base.getPrincipal) return { result: read.result };
+      const response = await base.getPrincipal(params, ctx);
+      if (read.result.relationship && response && typeof response === "object") {
+        const boxed = "structuredContent" in response;
+        const payload = boxed ? response.structuredContent : response;
+        if (payload?.result && ["current", "recognized", "unconfigured"].includes(payload.result.kind ?? "")) {
+          const augmented = { ...payload, result: { ...payload.result, relationship: read.result.relationship } };
+          return boxed ? { ...response, structuredContent: augmented } : augmented;
+        }
+      }
+      return response;
+    }
+  };
+}
+function createIdentity33PrincipalScopeResolver(options) {
+  if (!options.tenantId) throw new TypeError("Principal scope requires a trusted tenant id");
+  return async (ctx) => {
+    const identity = claimFromContext(ctx);
+    if (!identity) {
+      if (!options.legacy) throw new IdentityAuthorizationError();
+      return options.legacy(ctx);
+    }
+    const { binding } = await options.lifecycle.getPrincipal(identity.signer.origin);
+    if (!binding) throw new IdentityAuthorizationError();
+    return {
+      tenant_id: options.tenantId,
+      principal_id: binding.principalId,
+      principal_record_id: binding.principalId,
+      principal_kind: binding.principalKind ?? "buyer_agent"
+    };
+  };
+}
+export {
+  createIdentity33Authorization,
+  createIdentity33PrincipalResolver,
+  createIdentity33PrincipalScopeResolver,
+  isIdentity33UnboundContext,
+  withIdentity33PrincipalHandlers
+};

package/dist/lib/identity-3.3/store.d.mts

@@ -0,0 +1,24 @@
+import type { AdcpStateStore } from '../server/state-store.mjs';
+import { type MonotonicOriginRevocationStore } from './revocation.mjs';
+import type { OriginIdentityStore } from './lifecycle.mjs';
+/** CAS-backed stores work with the SDK's PostgresStateStore and custom shared backends. */
+export declare function createIdentity33StateStores(options: {
+    store: AdcpStateStore;
+    tenantId: string;
+    collection?: string;
+    /** Separate capacity for bound and unbound origins. Raising limits preserves every existing fact. */
+    revocationLimits?: {
+        keys?: number;
+        origins?: number;
+        operatorKeys?: number;
+        operatorOrigins?: number;
+        originKeys?: number;
+    };
+}): {
+    identity: OriginIdentityStore;
+    authorityHistory: {
+        has(operator: string): Promise<boolean>;
+        mark(operator: string): Promise<void>;
+    };
+    revocations: MonotonicOriginRevocationStore;
+};

package/dist/lib/identity-3.3/store.d.ts

@@ -0,0 +1,24 @@
+import type { AdcpStateStore } from '../server/state-store';
+import { type MonotonicOriginRevocationStore } from './revocation';
+import type { OriginIdentityStore } from './lifecycle';
+/** CAS-backed stores work with the SDK's PostgresStateStore and custom shared backends. */
+export declare function createIdentity33StateStores(options: {
+    store: AdcpStateStore;
+    tenantId: string;
+    collection?: string;
+    /** Separate capacity for bound and unbound origins. Raising limits preserves every existing fact. */
+    revocationLimits?: {
+        keys?: number;
+        origins?: number;
+        operatorKeys?: number;
+        operatorOrigins?: number;
+        originKeys?: number;
+    };
+}): {
+    identity: OriginIdentityStore;
+    authorityHistory: {
+        has(operator: string): Promise<boolean>;
+        mark(operator: string): Promise<void>;
+    };
+    revocations: MonotonicOriginRevocationStore;
+};