@adcp/sdk 15.9.0 → 16.0.0-beta.1

package/dist/lib/identity-3.3/trust.js

@@ -0,0 +1,278 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var trust_exports = {};
+__export(trust_exports, {
+  IdentityAuthorizationError: () => IdentityAuthorizationError,
+  TrustEvaluator: () => TrustEvaluator,
+  authorizeDemandGrant: () => authorizeDemandGrant,
+  createTrustRecord: () => createTrustRecord,
+  validateIdentity33Schema: () => validateIdentity33Schema,
+  validateTrustRecord: () => validateTrustRecord
+});
+module.exports = __toCommonJS(trust_exports);
+var import_ajv = __toESM(require("ajv"));
+var import_ajv_formats = __toESM(require("ajv-formats"));
+var import_net = require('../net/index.js');
+var import_canonicalize = require('../signing/agent-resolver/canonicalize.js');
+var import_etld = require('../signing/agent-resolver/etld.js');
+var import_strict_json = require('../signing/agent-resolver/strict-json.js');
+var import_schemas = __toESM(require('./schemas.draft.js'));
+const ajv = new import_ajv.default({ strict: false, allErrors: false });
+(0, import_ajv_formats.default)(ajv);
+for (const schema of import_schemas.default) ajv.addSchema(schema);
+function validateIdentity33Schema(id, value) {
+  return ajv.getSchema(`/schemas/${id}.json`)?.(value) === true;
+}
+class IdentityAuthorizationError extends Error {
+  code = "PERMISSION_DENIED";
+  details;
+  constructor(reason = "authorization_failed") {
+    super(reason === "grant_absent" ? "Agent authority is not granted" : "Agent authorization failed");
+    this.name = "IdentityAuthorizationError";
+    this.details = reason === "grant_absent" ? { scope: "agent", reason } : void 0;
+  }
+}
+function failure(cause) {
+  const error = new IdentityAuthorizationError();
+  if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
+  throw error;
+}
+function validateTrustRecord(value) {
+  if (!validateIdentity33Schema("trust/v1/trust", value)) failure();
+  const record = value;
+  const origins = /* @__PURE__ */ new Set();
+  for (const agent of record.agents ?? []) {
+    if (agent.jwks_uri !== void 0) failure();
+    const origin = (0, import_canonicalize.canonicalAgentOrigin)(agent.url);
+    if (origins.has(origin)) failure();
+    origins.add(origin);
+  }
+}
+function createTrustRecord(record) {
+  validateTrustRecord(record);
+  return structuredClone(record);
+}
+class TrustEvaluator {
+  constructor(options = {}) {
+    this.options = options;
+    this.pollingIntervalSeconds = options.pollingIntervalSeconds ?? 300;
+    if (!Number.isFinite(this.pollingIntervalSeconds) || this.pollingIntervalSeconds < 60 || this.pollingIntervalSeconds > 1800)
+      throw new TypeError("Trust polling interval must be 60\u20131800 seconds");
+  }
+  options;
+  cache = /* @__PURE__ */ new Map();
+  negative = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  urlRequests = /* @__PURE__ */ new Map();
+  hostRates = /* @__PURE__ */ new Map();
+  authoritativeOperators = /* @__PURE__ */ new Set();
+  authorityHistoryOverflowed = false;
+  pollingIntervalSeconds;
+  async get(domainOrOrigin, force = false) {
+    let operator;
+    try {
+      operator = (0, import_etld.eTldPlusOne)(domainOrOrigin);
+    } catch {
+      return failure();
+    }
+    const now = this.now();
+    const cached = this.cache.get(operator);
+    if (!force && cached && cached.freshUntil > now) return cached;
+    if ((this.negative.get(operator) ?? 0) > now) failure();
+    let pending = this.pending.get(operator);
+    if (!pending) {
+      if (this.pending.size >= (this.options.maxConcurrentFetches ?? 16)) failure();
+      pending = this.fetch(operator, now);
+      this.pending.set(operator, pending);
+    }
+    try {
+      return await pending;
+    } finally {
+      if (this.pending.get(operator) === pending) this.pending.delete(operator);
+    }
+  }
+  async match(origin, role, countries) {
+    const canonical = (0, import_canonicalize.canonicalAgentOrigin)(origin);
+    const result = await this.get(canonical);
+    if (result.status !== "present") failure();
+    const entries = (result.record.agents ?? []).filter((agent2) => (0, import_canonicalize.canonicalAgentOrigin)(agent2.url) === canonical);
+    if (entries.length !== 1 || !entries[0].roles.includes(role)) failure();
+    const agent = entries[0];
+    if (agent.countries && countries?.length && countries.some((country) => !agent.countries.includes(country)))
+      failure();
+    return { operator: result.operator, agent, record: result.record, freshUntil: result.freshUntil };
+  }
+  invalidate(domain) {
+    this.cache.delete((0, import_etld.eTldPlusOne)(domain));
+  }
+  hasAuthoritativeRecord(domain) {
+    return this.authoritativeOperators.has((0, import_etld.eTldPlusOne)(domain));
+  }
+  now() {
+    return (this.options.now ?? (() => Date.now() / 1e3))();
+  }
+  async request(url) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash) failure();
+    const host = parsed.hostname;
+    const pending = this.urlRequests.get(url);
+    if (pending) return pending;
+    const now = this.now(), rate = this.hostRates.get(host);
+    if (rate && now - rate.started < 60 && rate.count >= 10) failure();
+    if (!rate && this.hostRates.size >= (this.options.maxEntries ?? 1e3))
+      this.hostRates.delete(this.hostRates.keys().next().value);
+    this.hostRates.set(
+      host,
+      rate && now - rate.started < 60 ? { ...rate, count: rate.count + 1 } : { started: now, count: 1 }
+    );
+    const request = (0, import_net.ssrfSafeFetch)(url, {
+      ...this.options.fetchOptions,
+      maxBodyBytes: 2 * 1024 * 1024,
+      timeoutMs: 1e4,
+      headers: { accept: "application/json" }
+    });
+    this.urlRequests.set(url, request);
+    try {
+      return await request;
+    } finally {
+      if (this.urlRequests.get(url) === request) this.urlRequests.delete(url);
+    }
+  }
+  async fetch(operator, now) {
+    try {
+      let response = await this.request(`https://${operator}/.well-known/trust.json`);
+      let result;
+      if (response.status === 404 || response.status === 410) {
+        if (this.authorityHistoryOverflowed || this.authoritativeOperators.has(operator) || await this.options.authorityHistory?.has(operator))
+          failure();
+        result = { status: "absent", operator, checkedAt: now, freshUntil: now + 60 };
+      } else {
+        if (response.status !== 200) failure();
+        if (!this.authoritativeOperators.has(operator) && this.authoritativeOperators.size >= (this.options.maxEntries ?? 1e3)) {
+          if (!this.options.authorityHistory) this.authorityHistoryOverflowed = true;
+          this.authoritativeOperators.delete(this.authoritativeOperators.values().next().value);
+        }
+        await this.options.authorityHistory?.mark(operator);
+        this.authoritativeOperators.add(operator);
+        let record = (0, import_strict_json.parseStrictJson)(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
+        validateTrustRecord(record);
+        if (record.authoritative_location) {
+          response = await this.request(record.authoritative_location);
+          if (response.status !== 200) failure();
+          record = (0, import_strict_json.parseStrictJson)(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
+          validateTrustRecord(record);
+          if (record.authoritative_location) failure();
+        }
+        result = {
+          status: "present",
+          operator,
+          record,
+          checkedAt: now,
+          freshUntil: now + this.pollingIntervalSeconds
+        };
+      }
+      const max = this.options.maxEntries ?? 1e3;
+      if (this.cache.size >= max && !this.cache.has(operator)) this.cache.delete(this.cache.keys().next().value);
+      this.cache.set(operator, result);
+      this.negative.delete(operator);
+      return result;
+    } catch (cause) {
+      if (this.negative.size >= (this.options.maxEntries ?? 1e3))
+        this.negative.delete(this.negative.keys().next().value);
+      this.negative.set(operator, now + 60);
+      return failure(cause);
+    }
+  }
+}
+function grantMatches(grant, target, claim, now) {
+  if ((0, import_etld.eTldPlusOne)(grant.grantee) !== target) return false;
+  if (!grant.scopes.some(
+    (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
+  ))
+    return false;
+  if (grant.agents && !grant.agents.some((agent) => (0, import_canonicalize.canonicalAgentOrigin)(agent.url) === (0, import_canonicalize.canonicalAgentOrigin)(claim.signerOrigin)))
+    return false;
+  const brands = grant.profiles?.adcp?.brands;
+  if (brands && !brands.includes("*") && (!claim.brand.brand_id || !brands.includes(claim.brand.brand_id)))
+    return false;
+  if (grant.countries && (!claim.brand.countries?.length || claim.brand.countries.some((country) => !grant.countries.includes(country))))
+    return false;
+  if (grant.valid_from && Date.parse(grant.valid_from) / 1e3 > now) return false;
+  if (grant.valid_until && Date.parse(grant.valid_until) / 1e3 <= now) return false;
+  return true;
+}
+async function authorizeDemandGrant(claim, options) {
+  const now = (options.now ?? (() => Date.now() / 1e3))();
+  const signer = await options.evaluator.match(claim.signerOrigin, "adcp:buying", claim.brand.countries);
+  if (signer.agent.countries && !claim.brand.countries?.length) failure();
+  const brand = (0, import_etld.eTldPlusOne)(claim.brand.domain), account = (0, import_etld.eTldPlusOne)(claim.accountOperator), operator = signer.operator;
+  const result = (source, chain, grants = []) => ({
+    source,
+    chain,
+    operator,
+    checkedAt: now,
+    ...grants.some((g) => g.valid_until) ? { expiresAt: Math.min(...grants.map((g) => g.valid_until ? Date.parse(g.valid_until) / 1e3 : Infinity)) } : {}
+  });
+  if (brand === operator && account === operator) return result("implicit", [brand]);
+  if (brand === operator && account !== operator) throw new IdentityAuthorizationError("grant_absent");
+  const house = await options.resolveBrandHouse?.(claim.brand);
+  const authoritativeBrand = house ? (0, import_etld.eTldPlusOne)(house.domain) : brand;
+  const grantClaim = house ? { ...claim, brand: { ...claim.brand, brand_id: house.brand_id } } : claim;
+  const record = await options.evaluator.get(authoritativeBrand);
+  if (record.status === "absent") {
+    if (await options.legacyAuthorization?.(claim)) return result("legacy", [brand, account, operator]);
+    throw new IdentityAuthorizationError("grant_absent");
+  }
+  const first = (record.record.grants ?? []).filter((g) => grantMatches(g, account, grantClaim, now));
+  if (account === operator && first.length) return result("trust", [brand, operator], [first[0]]);
+  if (account !== operator && account !== brand && first.length) {
+    const intermediary = await options.evaluator.get(account);
+    if (intermediary.status === "present") {
+      const second = (intermediary.record.grants ?? []).find((g) => grantMatches(g, operator, grantClaim, now));
+      if (second) return result("trust", [brand, account, operator], [first[0], second]);
+    }
+  }
+  const covered = (record.record.grants ?? []).some(
+    (g) => (0, import_etld.eTldPlusOne)(g.grantee) === account && g.scopes.some(
+      (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
+    )
+  );
+  if (!covered && !record.record.exclusive_grants && await options.sellerAuthorization?.(claim))
+    return result("seller", [brand, account, operator]);
+  throw new IdentityAuthorizationError("grant_absent");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IdentityAuthorizationError,
+  TrustEvaluator,
+  authorizeDemandGrant,
+  createTrustRecord,
+  validateIdentity33Schema,
+  validateTrustRecord
+});

package/dist/lib/identity-3.3/trust.mjs

@@ -0,0 +1,239 @@
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
+import { ssrfSafeFetch } from "../net/index.mjs";
+import { canonicalAgentOrigin } from "../signing/agent-resolver/canonicalize.mjs";
+import { eTldPlusOne } from "../signing/agent-resolver/etld.mjs";
+import { parseStrictJson } from "../signing/agent-resolver/strict-json.mjs";
+import schemas from "./schemas.draft.mjs";
+const ajv = new Ajv({ strict: false, allErrors: false });
+addFormats(ajv);
+for (const schema of schemas) ajv.addSchema(schema);
+function validateIdentity33Schema(id, value) {
+  return ajv.getSchema(`/schemas/${id}.json`)?.(value) === true;
+}
+class IdentityAuthorizationError extends Error {
+  code = "PERMISSION_DENIED";
+  details;
+  constructor(reason = "authorization_failed") {
+    super(reason === "grant_absent" ? "Agent authority is not granted" : "Agent authorization failed");
+    this.name = "IdentityAuthorizationError";
+    this.details = reason === "grant_absent" ? { scope: "agent", reason } : void 0;
+  }
+}
+function failure(cause) {
+  const error = new IdentityAuthorizationError();
+  if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
+  throw error;
+}
+function validateTrustRecord(value) {
+  if (!validateIdentity33Schema("trust/v1/trust", value)) failure();
+  const record = value;
+  const origins = /* @__PURE__ */ new Set();
+  for (const agent of record.agents ?? []) {
+    if (agent.jwks_uri !== void 0) failure();
+    const origin = canonicalAgentOrigin(agent.url);
+    if (origins.has(origin)) failure();
+    origins.add(origin);
+  }
+}
+function createTrustRecord(record) {
+  validateTrustRecord(record);
+  return structuredClone(record);
+}
+class TrustEvaluator {
+  constructor(options = {}) {
+    this.options = options;
+    this.pollingIntervalSeconds = options.pollingIntervalSeconds ?? 300;
+    if (!Number.isFinite(this.pollingIntervalSeconds) || this.pollingIntervalSeconds < 60 || this.pollingIntervalSeconds > 1800)
+      throw new TypeError("Trust polling interval must be 60\u20131800 seconds");
+  }
+  options;
+  cache = /* @__PURE__ */ new Map();
+  negative = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  urlRequests = /* @__PURE__ */ new Map();
+  hostRates = /* @__PURE__ */ new Map();
+  authoritativeOperators = /* @__PURE__ */ new Set();
+  authorityHistoryOverflowed = false;
+  pollingIntervalSeconds;
+  async get(domainOrOrigin, force = false) {
+    let operator;
+    try {
+      operator = eTldPlusOne(domainOrOrigin);
+    } catch {
+      return failure();
+    }
+    const now = this.now();
+    const cached = this.cache.get(operator);
+    if (!force && cached && cached.freshUntil > now) return cached;
+    if ((this.negative.get(operator) ?? 0) > now) failure();
+    let pending = this.pending.get(operator);
+    if (!pending) {
+      if (this.pending.size >= (this.options.maxConcurrentFetches ?? 16)) failure();
+      pending = this.fetch(operator, now);
+      this.pending.set(operator, pending);
+    }
+    try {
+      return await pending;
+    } finally {
+      if (this.pending.get(operator) === pending) this.pending.delete(operator);
+    }
+  }
+  async match(origin, role, countries) {
+    const canonical = canonicalAgentOrigin(origin);
+    const result = await this.get(canonical);
+    if (result.status !== "present") failure();
+    const entries = (result.record.agents ?? []).filter((agent2) => canonicalAgentOrigin(agent2.url) === canonical);
+    if (entries.length !== 1 || !entries[0].roles.includes(role)) failure();
+    const agent = entries[0];
+    if (agent.countries && countries?.length && countries.some((country) => !agent.countries.includes(country)))
+      failure();
+    return { operator: result.operator, agent, record: result.record, freshUntil: result.freshUntil };
+  }
+  invalidate(domain) {
+    this.cache.delete(eTldPlusOne(domain));
+  }
+  hasAuthoritativeRecord(domain) {
+    return this.authoritativeOperators.has(eTldPlusOne(domain));
+  }
+  now() {
+    return (this.options.now ?? (() => Date.now() / 1e3))();
+  }
+  async request(url) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash) failure();
+    const host = parsed.hostname;
+    const pending = this.urlRequests.get(url);
+    if (pending) return pending;
+    const now = this.now(), rate = this.hostRates.get(host);
+    if (rate && now - rate.started < 60 && rate.count >= 10) failure();
+    if (!rate && this.hostRates.size >= (this.options.maxEntries ?? 1e3))
+      this.hostRates.delete(this.hostRates.keys().next().value);
+    this.hostRates.set(
+      host,
+      rate && now - rate.started < 60 ? { ...rate, count: rate.count + 1 } : { started: now, count: 1 }
+    );
+    const request = ssrfSafeFetch(url, {
+      ...this.options.fetchOptions,
+      maxBodyBytes: 2 * 1024 * 1024,
+      timeoutMs: 1e4,
+      headers: { accept: "application/json" }
+    });
+    this.urlRequests.set(url, request);
+    try {
+      return await request;
+    } finally {
+      if (this.urlRequests.get(url) === request) this.urlRequests.delete(url);
+    }
+  }
+  async fetch(operator, now) {
+    try {
+      let response = await this.request(`https://${operator}/.well-known/trust.json`);
+      let result;
+      if (response.status === 404 || response.status === 410) {
+        if (this.authorityHistoryOverflowed || this.authoritativeOperators.has(operator) || await this.options.authorityHistory?.has(operator))
+          failure();
+        result = { status: "absent", operator, checkedAt: now, freshUntil: now + 60 };
+      } else {
+        if (response.status !== 200) failure();
+        if (!this.authoritativeOperators.has(operator) && this.authoritativeOperators.size >= (this.options.maxEntries ?? 1e3)) {
+          if (!this.options.authorityHistory) this.authorityHistoryOverflowed = true;
+          this.authoritativeOperators.delete(this.authoritativeOperators.values().next().value);
+        }
+        await this.options.authorityHistory?.mark(operator);
+        this.authoritativeOperators.add(operator);
+        let record = parseStrictJson(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
+        validateTrustRecord(record);
+        if (record.authoritative_location) {
+          response = await this.request(record.authoritative_location);
+          if (response.status !== 200) failure();
+          record = parseStrictJson(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
+          validateTrustRecord(record);
+          if (record.authoritative_location) failure();
+        }
+        result = {
+          status: "present",
+          operator,
+          record,
+          checkedAt: now,
+          freshUntil: now + this.pollingIntervalSeconds
+        };
+      }
+      const max = this.options.maxEntries ?? 1e3;
+      if (this.cache.size >= max && !this.cache.has(operator)) this.cache.delete(this.cache.keys().next().value);
+      this.cache.set(operator, result);
+      this.negative.delete(operator);
+      return result;
+    } catch (cause) {
+      if (this.negative.size >= (this.options.maxEntries ?? 1e3))
+        this.negative.delete(this.negative.keys().next().value);
+      this.negative.set(operator, now + 60);
+      return failure(cause);
+    }
+  }
+}
+function grantMatches(grant, target, claim, now) {
+  if (eTldPlusOne(grant.grantee) !== target) return false;
+  if (!grant.scopes.some(
+    (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
+  ))
+    return false;
+  if (grant.agents && !grant.agents.some((agent) => canonicalAgentOrigin(agent.url) === canonicalAgentOrigin(claim.signerOrigin)))
+    return false;
+  const brands = grant.profiles?.adcp?.brands;
+  if (brands && !brands.includes("*") && (!claim.brand.brand_id || !brands.includes(claim.brand.brand_id)))
+    return false;
+  if (grant.countries && (!claim.brand.countries?.length || claim.brand.countries.some((country) => !grant.countries.includes(country))))
+    return false;
+  if (grant.valid_from && Date.parse(grant.valid_from) / 1e3 > now) return false;
+  if (grant.valid_until && Date.parse(grant.valid_until) / 1e3 <= now) return false;
+  return true;
+}
+async function authorizeDemandGrant(claim, options) {
+  const now = (options.now ?? (() => Date.now() / 1e3))();
+  const signer = await options.evaluator.match(claim.signerOrigin, "adcp:buying", claim.brand.countries);
+  if (signer.agent.countries && !claim.brand.countries?.length) failure();
+  const brand = eTldPlusOne(claim.brand.domain), account = eTldPlusOne(claim.accountOperator), operator = signer.operator;
+  const result = (source, chain, grants = []) => ({
+    source,
+    chain,
+    operator,
+    checkedAt: now,
+    ...grants.some((g) => g.valid_until) ? { expiresAt: Math.min(...grants.map((g) => g.valid_until ? Date.parse(g.valid_until) / 1e3 : Infinity)) } : {}
+  });
+  if (brand === operator && account === operator) return result("implicit", [brand]);
+  if (brand === operator && account !== operator) throw new IdentityAuthorizationError("grant_absent");
+  const house = await options.resolveBrandHouse?.(claim.brand);
+  const authoritativeBrand = house ? eTldPlusOne(house.domain) : brand;
+  const grantClaim = house ? { ...claim, brand: { ...claim.brand, brand_id: house.brand_id } } : claim;
+  const record = await options.evaluator.get(authoritativeBrand);
+  if (record.status === "absent") {
+    if (await options.legacyAuthorization?.(claim)) return result("legacy", [brand, account, operator]);
+    throw new IdentityAuthorizationError("grant_absent");
+  }
+  const first = (record.record.grants ?? []).filter((g) => grantMatches(g, account, grantClaim, now));
+  if (account === operator && first.length) return result("trust", [brand, operator], [first[0]]);
+  if (account !== operator && account !== brand && first.length) {
+    const intermediary = await options.evaluator.get(account);
+    if (intermediary.status === "present") {
+      const second = (intermediary.record.grants ?? []).find((g) => grantMatches(g, operator, grantClaim, now));
+      if (second) return result("trust", [brand, account, operator], [first[0], second]);
+    }
+  }
+  const covered = (record.record.grants ?? []).some(
+    (g) => eTldPlusOne(g.grantee) === account && g.scopes.some(
+      (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
+    )
+  );
+  if (!covered && !record.record.exclusive_grants && await options.sellerAuthorization?.(claim))
+    return result("seller", [brand, account, operator]);
+  throw new IdentityAuthorizationError("grant_absent");
+}
+export {
+  IdentityAuthorizationError,
+  TrustEvaluator,
+  authorizeDemandGrant,
+  createTrustRecord,
+  validateIdentity33Schema,
+  validateTrustRecord
+};

package/dist/lib/identity-3.3/types.d.mts

@@ -0,0 +1,127 @@
+/** Experimental drafts; the released SDK wire/schema pin remains 3.2.4. */
+export type AgentOnboardingMode = 'open' | 'application' | 'invite_only';
+export type BillingParty = 'operator' | 'agent' | 'advertiser';
+export type AgentOnboardingRequirementKind = 'agent_identity' | 'grant' | 'billing_entity' | 'contract' | 'credit_application' | 'aao_verified' | 'storyboard' | 'sandbox' | 'experimental_feature';
+export interface AgentOnboardingRequirement {
+    kind: AgentOnboardingRequirementKind | (string & {});
+    role?: string;
+    verification_modes?: string[];
+    specialisms?: string[];
+    adcp_version?: string;
+    id?: string;
+    ext?: Record<string, unknown>;
+}
+export interface AgentOnboardingTier {
+    mode: AgentOnboardingMode;
+    url?: string;
+    requirements?: AgentOnboardingRequirement[];
+    ext?: Record<string, unknown>;
+}
+export interface AgentOnboarding {
+    sandbox?: AgentOnboardingTier;
+    billing?: Partial<Record<BillingParty, AgentOnboardingTier>>;
+    url?: string;
+    documentation_url?: string;
+    message?: string;
+    ext?: Record<string, unknown>;
+}
+export interface BuyerOnboardingPosture {
+    mode: 'considers_unsolicited' | 'application' | 'invite_only';
+    requirements?: AgentOnboardingRequirement[];
+    url?: string;
+    documentation_url?: string;
+    message?: string;
+    ext?: Record<string, unknown>;
+}
+export interface PrincipalRelationship {
+    status: 'pending' | 'active' | 'suspended' | 'blocked';
+    expires_at?: string;
+    setup?: {
+        message: string;
+        url?: string;
+        expires_at?: string;
+        [key: string]: unknown;
+    };
+    ext?: Record<string, unknown>;
+}
+export type IdentityPrincipalChangedReason = 'relationship_changed' | 'relationship_expiring';
+export interface TrustAgent {
+    url: string;
+    roles: string[];
+    id?: string;
+    protocols?: string[];
+    countries?: string[];
+    profiles?: {
+        adcp?: {
+            onboarding?: BuyerOnboardingPosture;
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface TrustGrant {
+    grantee: string;
+    scopes: string[];
+    agents?: {
+        url: string;
+    }[];
+    countries?: string[];
+    valid_from?: string;
+    valid_until?: string;
+    profiles?: {
+        adcp?: {
+            brands?: string[];
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface TrustRecord {
+    agents?: TrustAgent[];
+    grants?: TrustGrant[];
+    acknowledgements?: unknown[];
+    exclusive_grants?: boolean;
+    authoritative_location?: string;
+    profiles?: {
+        adcp?: {
+            onboarding?: BuyerOnboardingPosture;
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export type RevocationReason = 'unspecified' | 'keyCompromise' | 'cACompromise' | 'affiliationChanged' | 'superseded' | 'cessationOfOperation' | 'certificateHold' | 'removeFromCRL' | 'privilegeWithdrawn' | 'aACompromise';
+export interface RevocationDetail {
+    reason?: RevocationReason;
+    invalidity_date?: string;
+}
+export interface AgentGrantDeniedDetails {
+    scope: 'agent';
+    reason: 'grant_absent';
+}
+export interface Identity33Capabilities {
+    request_signing?: {
+        profiles?: ('adcp/request-signing/v1' | 'web-bot-auth')[];
+        wba_draft_revision?: string;
+    };
+    webhook_signing?: {
+        supported: boolean;
+        profiles?: ('adcp/webhook-signing/v1' | 'web-bot-auth')[];
+        wba_draft_revision?: string;
+    };
+    account?: {
+        agent_onboarding?: AgentOnboarding;
+    };
+}
+export type Identity33GetPrincipalResponse = Omit<import('../types/tools.generated.mjs').GetPrincipalResponse, 'result'> & {
+    result: (Exclude<import('../types/tools.generated.mjs').GetPrincipalResponse['result'], {
+        kind: 'failed';
+    }> & {
+        relationship?: PrincipalRelationship;
+    }) | Extract<import('../types/tools.generated.mjs').GetPrincipalResponse['result'], {
+        kind: 'failed';
+    }>;
+};