@adcp/sdk 15.9.0 → 16.0.0-beta.1

package/dist/lib/server/notification-subscriptions/runtime.js

@@ -185,6 +185,7 @@ function createPersistentNotificationRuntime(options) {
       return {
         decision: "allow",
         authentication: null,
+        ...subscription.signingProfile && { signingProfile: subscription.signingProfile },
         ...checkpoint.attemptOrdinal === void 0 ? {} : { attemptOrdinal: checkpoint.attemptOrdinal }
       };
     }
@@ -269,6 +270,7 @@ function createPersistentNotificationRuntime(options) {
             accountEventTypes,
             callerEventTypes,
             callerOnlyEventTypes,
+            supportedSigningProfiles: options.supportedSigningProfiles,
             credentialAdapter: options.credentialAdapter,
             credentialStages,
             adopterCallbackTimeoutMs,
@@ -522,10 +524,13 @@ async function normalizeConfig(input) {
   if (config.product_payload_view !== void 0 && !eventTypes.some((eventType) => eventType.startsWith("product."))) {
     throw validation("product_payload_view requires a product.* event type", input.index, "product_payload_view");
   }
+  if (config.signing_profile !== void 0 && (!(input.supportedSigningProfiles ?? ["adcp/webhook-signing/v1"]).includes(config.signing_profile) || config.authentication !== void 0))
+    throw validation("Unsupported or ambiguous signing_profile", input.index, "signing_profile");
   const authentication = await normalizeAuthentication(input);
   const destinationGeneration = `dest_${(0, import_jcs.canonicalJsonSha256)({
     scope,
     subscriberId: config.subscriber_id,
+    ...config.signing_profile !== void 0 && { signingProfile: config.signing_profile },
     url,
     authentication,
     eventTypes,
@@ -535,6 +540,7 @@ async function normalizeConfig(input) {
   })}`;
   return {
     subscriberId: config.subscriber_id,
+    ...config.signing_profile !== void 0 && { signingProfile: config.signing_profile },
     url,
     eventTypes,
     active: config.active !== false,
@@ -668,6 +674,7 @@ async function normalizeAuthentication(input) {
 function projectSubscription(subscription, includeGenerations) {
   return {
     subscriber_id: subscription.subscriberId,
+    ...subscription.signingProfile !== void 0 && { signing_profile: subscription.signingProfile },
     url: subscription.url,
     event_types: [...subscription.eventTypes],
     active: subscription.active && subscription.deactivationNotificationId === void 0,
@@ -688,7 +695,8 @@ function projectNotificationSubscriptionReadback(views) {
     ...view.all_authorized_accounts === void 0 ? {} : { all_authorized_accounts: view.all_authorized_accounts },
     ...view.include_future_event_types === void 0 ? {} : { include_future_event_types: view.include_future_event_types },
     ...view.product_payload_view === void 0 ? {} : { product_payload_view: view.product_payload_view },
-    ...view.authentication === void 0 ? {} : { authentication: view.authentication }
+    ...view.authentication === void 0 ? {} : { authentication: view.authentication },
+    ...view.signing_profile !== void 0 && { signing_profile: view.signing_profile }
   }));
 }
 function projectStoredNotificationSubscriptionReadback(subscriptions) {

package/dist/lib/server/notification-subscriptions/runtime.mjs

@@ -156,6 +156,7 @@ function createPersistentNotificationRuntime(options) {
       return {
         decision: "allow",
         authentication: null,
+        ...subscription.signingProfile && { signingProfile: subscription.signingProfile },
         ...checkpoint.attemptOrdinal === void 0 ? {} : { attemptOrdinal: checkpoint.attemptOrdinal }
       };
     }
@@ -240,6 +241,7 @@ function createPersistentNotificationRuntime(options) {
             accountEventTypes,
             callerEventTypes,
             callerOnlyEventTypes,
+            supportedSigningProfiles: options.supportedSigningProfiles,
             credentialAdapter: options.credentialAdapter,
             credentialStages,
             adopterCallbackTimeoutMs,
@@ -493,10 +495,13 @@ async function normalizeConfig(input) {
   if (config.product_payload_view !== void 0 && !eventTypes.some((eventType) => eventType.startsWith("product."))) {
     throw validation("product_payload_view requires a product.* event type", input.index, "product_payload_view");
   }
+  if (config.signing_profile !== void 0 && (!(input.supportedSigningProfiles ?? ["adcp/webhook-signing/v1"]).includes(config.signing_profile) || config.authentication !== void 0))
+    throw validation("Unsupported or ambiguous signing_profile", input.index, "signing_profile");
   const authentication = await normalizeAuthentication(input);
   const destinationGeneration = `dest_${canonicalJsonSha256({
     scope,
     subscriberId: config.subscriber_id,
+    ...config.signing_profile !== void 0 && { signingProfile: config.signing_profile },
     url,
     authentication,
     eventTypes,
@@ -506,6 +511,7 @@ async function normalizeConfig(input) {
   })}`;
   return {
     subscriberId: config.subscriber_id,
+    ...config.signing_profile !== void 0 && { signingProfile: config.signing_profile },
     url,
     eventTypes,
     active: config.active !== false,
@@ -639,6 +645,7 @@ async function normalizeAuthentication(input) {
 function projectSubscription(subscription, includeGenerations) {
   return {
     subscriber_id: subscription.subscriberId,
+    ...subscription.signingProfile !== void 0 && { signing_profile: subscription.signingProfile },
     url: subscription.url,
     event_types: [...subscription.eventTypes],
     active: subscription.active && subscription.deactivationNotificationId === void 0,
@@ -659,7 +666,8 @@ function projectNotificationSubscriptionReadback(views) {
     ...view.all_authorized_accounts === void 0 ? {} : { all_authorized_accounts: view.all_authorized_accounts },
     ...view.include_future_event_types === void 0 ? {} : { include_future_event_types: view.include_future_event_types },
     ...view.product_payload_view === void 0 ? {} : { product_payload_view: view.product_payload_view },
-    ...view.authentication === void 0 ? {} : { authentication: view.authentication }
+    ...view.authentication === void 0 ? {} : { authentication: view.authentication },
+    ...view.signing_profile !== void 0 && { signing_profile: view.signing_profile }
   }));
 }
 function projectStoredNotificationSubscriptionReadback(subscriptions) {

package/dist/lib/server/notification-subscriptions/types.d.mts

@@ -14,6 +14,7 @@ export type NotificationEventAnchor = 'caller' | 'account';
 /** Structural input accepted from either generated notification-config shape. */
 export interface NotificationSubscriptionConfigInput {
     subscriber_id: string;
+    signing_profile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     event_types: readonly string[];
     all_authorized_accounts?: boolean;
@@ -33,6 +34,7 @@ export interface StoredNotificationAuthentication {
 }
 export interface StoredNotificationSubscription {
     subscriberId: string;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     eventTypes: string[];
     active: boolean;
@@ -190,6 +192,7 @@ export interface NotificationProofAdapter {
 export type NotificationDestinationValidator = (input: {
     scope: Readonly<NotificationSubscriptionScope>;
     subscriberId: string;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     signal: AbortSignal;
 }) => MaybePromise<{
@@ -303,6 +306,7 @@ export type NotificationDeliveryAttemptCheckpoint = (input: Readonly<Notificatio
 export type NotificationSuppressionDisposition = 'terminal' | 'retryable';
 export interface NotificationSubscriptionView {
     subscriber_id: string;
+    signing_profile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     event_types: string[];
     active: boolean;
@@ -404,6 +408,7 @@ export interface PersistentNotificationRuntimeOptions {
     /** Build the emitter with the supplied mandatory per-attempt authorizer. */
     createEmitter(authorizeAttempt: WebhookAttemptAuthorizer): RecoverableWebhookEmitter;
     supportedCallerEventTypes?: readonly string[];
+    supportedSigningProfiles?: readonly ('adcp/webhook-signing/v1' | 'web-bot-auth')[];
     supportedAccountEventTypes?: readonly string[];
     /**
      * Later-version caller-only events safe for `include_future_event_types`.

package/dist/lib/server/notification-subscriptions/types.d.ts

@@ -14,6 +14,7 @@ export type NotificationEventAnchor = 'caller' | 'account';
 /** Structural input accepted from either generated notification-config shape. */
 export interface NotificationSubscriptionConfigInput {
     subscriber_id: string;
+    signing_profile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     event_types: readonly string[];
     all_authorized_accounts?: boolean;
@@ -33,6 +34,7 @@ export interface StoredNotificationAuthentication {
 }
 export interface StoredNotificationSubscription {
     subscriberId: string;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     eventTypes: string[];
     active: boolean;
@@ -190,6 +192,7 @@ export interface NotificationProofAdapter {
 export type NotificationDestinationValidator = (input: {
     scope: Readonly<NotificationSubscriptionScope>;
     subscriberId: string;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     signal: AbortSignal;
 }) => MaybePromise<{
@@ -303,6 +306,7 @@ export type NotificationDeliveryAttemptCheckpoint = (input: Readonly<Notificatio
 export type NotificationSuppressionDisposition = 'terminal' | 'retryable';
 export interface NotificationSubscriptionView {
     subscriber_id: string;
+    signing_profile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     event_types: string[];
     active: boolean;
@@ -404,6 +408,7 @@ export interface PersistentNotificationRuntimeOptions {
     /** Build the emitter with the supplied mandatory per-attempt authorizer. */
     createEmitter(authorizeAttempt: WebhookAttemptAuthorizer): RecoverableWebhookEmitter;
     supportedCallerEventTypes?: readonly string[];
+    supportedSigningProfiles?: readonly ('adcp/webhook-signing/v1' | 'web-bot-auth')[];
     supportedAccountEventTypes?: readonly string[];
     /**
      * Later-version caller-only events safe for `include_future_event_types`.

package/dist/lib/server/principal/types.d.mts

@@ -38,7 +38,7 @@ export interface PendingPrincipalNotification {
     emissionId: string;
     changedAt: string;
     firedAt: string;
-    reason: 'destination_state_changed' | 'setup_expiring' | 'setup_expired' | 'proof_invalidated' | 'declarations_intersection_changed' | 'other';
+    reason: 'relationship_changed' | 'relationship_expiring' | 'destination_state_changed' | 'setup_expiring' | 'setup_expired' | 'proof_invalidated' | 'declarations_intersection_changed' | 'other';
     destinationId?: string;
     recipients: NotificationRecipientRef[];
 }

package/dist/lib/server/principal/types.d.ts

@@ -38,7 +38,7 @@ export interface PendingPrincipalNotification {
     emissionId: string;
     changedAt: string;
     firedAt: string;
-    reason: 'destination_state_changed' | 'setup_expiring' | 'setup_expired' | 'proof_invalidated' | 'declarations_intersection_changed' | 'other';
+    reason: 'relationship_changed' | 'relationship_expiring' | 'destination_state_changed' | 'setup_expiring' | 'setup_expired' | 'proof_invalidated' | 'declarations_intersection_changed' | 'other';
     destinationId?: string;
     recipients: NotificationRecipientRef[];
 }

package/dist/lib/server/serve.js

@@ -310,6 +310,11 @@ function serve(createAgent, options) {
         try {
           principal = await options.authenticate(req);
         } catch (err) {
+          if (err instanceof import_auth.AuthError && err.status) {
+            res.writeHead(err.status, { ...err.headers, "Content-Type": "application/json" });
+            res.end(JSON.stringify(err.body ?? { error: err.publicMessage }));
+            return;
+          }
           const publicMessage = err instanceof import_auth.AuthError ? err.publicMessage : "Credentials rejected.";
           console.error("[adcp/auth] rejected:", err);
           const signatureCode = (0, import_auth.signatureErrorCodeFromCause)(err);

package/dist/lib/server/serve.mjs

@@ -293,6 +293,11 @@ function serve(createAgent, options) {
         try {
           principal = await options.authenticate(req);
         } catch (err) {
+          if (err instanceof AuthError && err.status) {
+            res.writeHead(err.status, { ...err.headers, "Content-Type": "application/json" });
+            res.end(JSON.stringify(err.body ?? { error: err.publicMessage }));
+            return;
+          }
           const publicMessage = err instanceof AuthError ? err.publicMessage : "Credentials rejected.";
           console.error("[adcp/auth] rejected:", err);
           const signatureCode = signatureErrorCodeFromCause(err);

package/dist/lib/server/webhook-delivery/recovery.d.mts

@@ -30,6 +30,7 @@ export interface WebhookAuthenticationContext {
     snapshotContextFingerprint: string;
 }
 export interface StoredWebhookDeliverySnapshot {
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     payload: Record<string, unknown>;
     /** Non-secret live-authorization context; never serialized into the webhook body. */

package/dist/lib/server/webhook-delivery/recovery.d.ts

@@ -30,6 +30,7 @@ export interface WebhookAuthenticationContext {
     snapshotContextFingerprint: string;
 }
 export interface StoredWebhookDeliverySnapshot {
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     payload: Record<string, unknown>;
     /** Non-secret live-authorization context; never serialized into the webhook body. */

package/dist/lib/server/webhook-delivery/recovery.js

@@ -344,6 +344,7 @@ async function protectSnapshot(snapshot, key, adapter, protectPayloadToken) {
   if (cleartextPayloadToken !== void 0) delete payload.token;
   const base = {
     url: snapshot.url,
+    ...snapshot.signingProfile !== void 0 && { signingProfile: snapshot.signingProfile },
     payload,
     retries: { ...snapshot.retries },
     ...snapshot.attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: structuredClone(snapshot.attemptAuthorizationContext) }
@@ -402,6 +403,7 @@ async function resolveSnapshot(snapshot, key, adapter) {
     }
     return {
       url: snapshot.url,
+      ...snapshot.signingProfile !== void 0 && { signingProfile: snapshot.signingProfile },
       payload,
       authentication,
       retries: { ...snapshot.retries },
@@ -438,6 +440,7 @@ function authenticationContext(key, snapshot, purpose) {
       purpose,
       key,
       url: snapshot.url,
+      ...snapshot.signingProfile !== void 0 && { signingProfile: snapshot.signingProfile },
       payload: snapshot.payload,
       retries: snapshot.retries,
       ...snapshot.attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: snapshot.attemptAuthorizationContext }
@@ -494,6 +497,7 @@ function snapshotFingerprint(snapshot) {
   return (0, import_jcs.canonicalJsonSha256)({
     url: snapshot.url,
     payload: snapshot.payload,
+    ...snapshot.signingProfile !== void 0 && { signingProfile: snapshot.signingProfile },
     retries: snapshot.retries,
     ...snapshot.attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: snapshot.attemptAuthorizationContext },
     authentication: snapshot.authentication.kind === "none" ? { kind: "none" } : { kind: "protected", fingerprint: snapshot.authentication.fingerprint },

package/dist/lib/server/webhook-delivery/recovery.mjs

@@ -323,6 +323,7 @@ async function protectSnapshot(snapshot, key, adapter, protectPayloadToken) {
   if (cleartextPayloadToken !== void 0) delete payload.token;
   const base = {
     url: snapshot.url,
+    ...snapshot.signingProfile !== void 0 && { signingProfile: snapshot.signingProfile },
     payload,
     retries: { ...snapshot.retries },
     ...snapshot.attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: structuredClone(snapshot.attemptAuthorizationContext) }
@@ -381,6 +382,7 @@ async function resolveSnapshot(snapshot, key, adapter) {
     }
     return {
       url: snapshot.url,
+      ...snapshot.signingProfile !== void 0 && { signingProfile: snapshot.signingProfile },
       payload,
       authentication,
       retries: { ...snapshot.retries },
@@ -417,6 +419,7 @@ function authenticationContext(key, snapshot, purpose) {
       purpose,
       key,
       url: snapshot.url,
+      ...snapshot.signingProfile !== void 0 && { signingProfile: snapshot.signingProfile },
       payload: snapshot.payload,
       retries: snapshot.retries,
       ...snapshot.attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: snapshot.attemptAuthorizationContext }
@@ -473,6 +476,7 @@ function snapshotFingerprint(snapshot) {
   return canonicalJsonSha256({
     url: snapshot.url,
     payload: snapshot.payload,
+    ...snapshot.signingProfile !== void 0 && { signingProfile: snapshot.signingProfile },
     retries: snapshot.retries,
     ...snapshot.attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: snapshot.attemptAuthorizationContext },
     authentication: snapshot.authentication.kind === "none" ? { kind: "none" } : { kind: "protected", fingerprint: snapshot.authentication.fingerprint },

package/dist/lib/server/webhook-emitter.d.mts

@@ -1,3 +1,4 @@
+import { type WebBotSigningKey } from '../signing/web-bot-auth.mjs';
 /**
  * Publisher-side webhook emitter — the symmetric counterpart to PR #629's
  * receiver-side dedup. A seller / governance agent / rights agent building
@@ -65,6 +66,7 @@ export interface WebhookDeliveryProposal {
 }
 /** Exact caller-owned state required to reconstruct a delivery after restart. */
 export interface WebhookDeliverySnapshot {
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     payload: Record<string, unknown>;
     authentication: WebhookAuthentication;
@@ -173,6 +175,12 @@ export interface WebhookRetryOptions {
     jitter?: number;
 }
 export interface WebhookEmitterOptions {
+    /** Experimental profile must be selected by trusted subscription configuration. */
+    webBotAuth?: {
+        origin: string;
+        key: WebBotSigningKey;
+    };
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     /**
      * In-process JWK signing key. Its JWKS entry SHOULD carry
      * `adcp_use: "request-signing"` — webhooks are signed with the agent's
@@ -320,6 +328,7 @@ export interface WebhookEmitParams {
      * 9421 default.
      */
     authentication?: WebhookAuthentication;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     /** Per-emit retries override. */
     retries?: WebhookRetryOptions;
     /**
@@ -352,6 +361,7 @@ export type WebhookAttemptAuthorizationDecision = {
     decision: 'allow';
     /** Optional just-in-time override; `null` explicitly selects RFC 9421. */
     authentication?: WebhookAuthentication;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     /** Durable transport ordinal allocated by the pre-POST checkpoint. */
     attemptOrdinal?: number;
 } | {

package/dist/lib/server/webhook-emitter.d.ts

@@ -1,3 +1,4 @@
+import { type WebBotSigningKey } from '../signing/web-bot-auth';
 /**
  * Publisher-side webhook emitter — the symmetric counterpart to PR #629's
  * receiver-side dedup. A seller / governance agent / rights agent building
@@ -65,6 +66,7 @@ export interface WebhookDeliveryProposal {
 }
 /** Exact caller-owned state required to reconstruct a delivery after restart. */
 export interface WebhookDeliverySnapshot {
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     url: string;
     payload: Record<string, unknown>;
     authentication: WebhookAuthentication;
@@ -173,6 +175,12 @@ export interface WebhookRetryOptions {
     jitter?: number;
 }
 export interface WebhookEmitterOptions {
+    /** Experimental profile must be selected by trusted subscription configuration. */
+    webBotAuth?: {
+        origin: string;
+        key: WebBotSigningKey;
+    };
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     /**
      * In-process JWK signing key. Its JWKS entry SHOULD carry
      * `adcp_use: "request-signing"` — webhooks are signed with the agent's
@@ -320,6 +328,7 @@ export interface WebhookEmitParams {
      * 9421 default.
      */
     authentication?: WebhookAuthentication;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     /** Per-emit retries override. */
     retries?: WebhookRetryOptions;
     /**
@@ -352,6 +361,7 @@ export type WebhookAttemptAuthorizationDecision = {
     decision: 'allow';
     /** Optional just-in-time override; `null` explicitly selects RFC 9421. */
     authentication?: WebhookAuthentication;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     /** Durable transport ordinal allocated by the pre-POST checkpoint. */
     attemptOrdinal?: number;
 } | {

package/dist/lib/server/webhook-emitter.js

@@ -23,6 +23,7 @@ __export(webhook_emitter_exports, {
   memoryWebhookKeyStore: () => memoryWebhookKeyStore
 });
 module.exports = __toCommonJS(webhook_emitter_exports);
+var import_web_bot_auth = require('../signing/web-bot-auth.js');
 var import_signer = require('../signing/signer.js');
 var import_signer_async = require('../signing/signer-async.js');
 var import_jcs = require('../utils/jcs.js');
@@ -122,6 +123,7 @@ function createWebhookEmitter(options) {
         payload: delivery.snapshot.payload,
         authentication: delivery.snapshot.authentication,
         retries: delivery.snapshot.retries,
+        signingProfile: delivery.snapshot.signingProfile ?? "adcp/webhook-signing/v1",
         ...delivery.snapshot.attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: delivery.snapshot.attemptAuthorizationContext },
         delivery_id: delivery.key.deliveryId,
         __recoveryClaim: delivery
@@ -138,7 +140,12 @@ function createWebhookEmitter(options) {
         throw new TypeError("delivery_id must be a non-empty string");
       }
       const url = params.url;
+      const signingProfile = params.signingProfile ?? options.signingProfile ?? "adcp/webhook-signing/v1";
+      if (!["adcp/webhook-signing/v1", "web-bot-auth"].includes(signingProfile) || signingProfile === "web-bot-auth" && !options.webBotAuth)
+        throw new TypeError("Unsupported or unconfigured webhook signing profile");
       const payloadSnapshot = structuredClone(params.payload);
+      if (signingProfile === "web-bot-auth" && params.authentication != null)
+        throw new TypeError("Web Bot Auth cannot be combined with legacy webhook authentication");
       const authentication = params.authentication == null ? null : structuredClone(params.authentication);
       const attemptAuthorizationContext = params.attemptAuthorizationContext === void 0 ? void 0 : structuredClone(params.attemptAuthorizationContext);
       const retries = resolveRetries(params.retries === void 0 ? options.retries : structuredClone(params.retries));
@@ -151,6 +158,7 @@ function createWebhookEmitter(options) {
         payload: structuredClone(payloadSnapshot),
         authentication: authentication === null ? null : structuredClone(authentication),
         retries: { ...retries },
+        ...(signingProfile === "web-bot-auth" || options.signingProfile === "web-bot-auth") && { signingProfile },
         ...attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: structuredClone(attemptAuthorizationContext) }
       });
       const recoveryHeartbeat = recoveryClaim ? startRecoveryClaimHeartbeat(recoveryClaim) : void 0;
@@ -206,6 +214,7 @@ function createWebhookEmitter(options) {
           assertPositiveInteger(resolvedAttempt, "resolved webhook attempt ordinal", 1e6);
           let attemptInfo = { ...candidate, attempt: resolvedAttempt };
           let attemptAuthentication = authentication;
+          let attemptSigningProfile = signingProfile;
           if (options.authorizeAttempt) {
             let authorization;
             try {
@@ -243,10 +252,17 @@ function createWebhookEmitter(options) {
               assertPositiveInteger(authorization.attemptOrdinal, "authorized webhook attempt ordinal", 1e6);
               attemptInfo = { ...attemptInfo, attempt: authorization.attemptOrdinal };
             }
+            if (authorization.signingProfile !== void 0) {
+              if (!["adcp/webhook-signing/v1", "web-bot-auth"].includes(authorization.signingProfile) || authorization.signingProfile === "web-bot-auth" && !options.webBotAuth)
+                throw new TypeError("Attempt selected an unsupported webhook signing profile");
+              attemptSigningProfile = authorization.signingProfile;
+            }
             if ("authentication" in authorization) {
               attemptAuthentication = authorization.authentication == null ? null : structuredClone(authorization.authentication);
             }
           }
+          if (attemptSigningProfile === "web-bot-auth" && attemptAuthentication !== null)
+            throw new TypeError("Web Bot Auth cannot be combined with legacy webhook authentication");
           attempts = attempt;
           await observeAttempt(options, "attempt", attemptInfo);
           await recoveryHeartbeat?.renewNow();
@@ -262,6 +278,8 @@ function createWebhookEmitter(options) {
                 bodyBytes,
                 signerKey: options.signerKey,
                 signerProvider: options.signerProvider,
+                webBotAuth: options.webBotAuth,
+                signingProfile: attemptSigningProfile,
                 authentication: attemptAuthentication,
                 tag: options.tag,
                 userAgent: options.userAgent,
@@ -519,6 +537,10 @@ async function buildHeaders(args) {
     headers: baseHeaders,
     body: args.bodyBytes
   };
+  if (args.signingProfile === "web-bot-auth") {
+    if (!args.webBotAuth) throw new TypeError("Selected Web Bot Auth profile has no configured signing identity");
+    return (0, import_web_bot_auth.signWebBotAuth)(request, args.webBotAuth.key, { origin: args.webBotAuth.origin });
+  }
   const signOpts = args.tag !== void 0 ? { tag: args.tag } : {};
   const signed = args.signerProvider ? await (0, import_signer_async.signWebhookAsync)(request, args.signerProvider, signOpts) : (0, import_signer.signWebhook)(request, args.signerKey, signOpts);
   return { ...baseHeaders, ...signed.headers };

package/dist/lib/server/webhook-emitter.mjs

@@ -1,3 +1,4 @@
+import { signWebBotAuth } from "../signing/web-bot-auth.mjs";
 import { signWebhook } from "../signing/signer.mjs";
 import { signWebhookAsync } from "../signing/signer-async.mjs";
 import { canonicalJsonSha256 } from "../utils/jcs.mjs";
@@ -103,6 +104,7 @@ function createWebhookEmitter(options) {
         payload: delivery.snapshot.payload,
         authentication: delivery.snapshot.authentication,
         retries: delivery.snapshot.retries,
+        signingProfile: delivery.snapshot.signingProfile ?? "adcp/webhook-signing/v1",
         ...delivery.snapshot.attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: delivery.snapshot.attemptAuthorizationContext },
         delivery_id: delivery.key.deliveryId,
         __recoveryClaim: delivery
@@ -119,7 +121,12 @@ function createWebhookEmitter(options) {
         throw new TypeError("delivery_id must be a non-empty string");
       }
       const url = params.url;
+      const signingProfile = params.signingProfile ?? options.signingProfile ?? "adcp/webhook-signing/v1";
+      if (!["adcp/webhook-signing/v1", "web-bot-auth"].includes(signingProfile) || signingProfile === "web-bot-auth" && !options.webBotAuth)
+        throw new TypeError("Unsupported or unconfigured webhook signing profile");
       const payloadSnapshot = structuredClone(params.payload);
+      if (signingProfile === "web-bot-auth" && params.authentication != null)
+        throw new TypeError("Web Bot Auth cannot be combined with legacy webhook authentication");
       const authentication = params.authentication == null ? null : structuredClone(params.authentication);
       const attemptAuthorizationContext = params.attemptAuthorizationContext === void 0 ? void 0 : structuredClone(params.attemptAuthorizationContext);
       const retries = resolveRetries(params.retries === void 0 ? options.retries : structuredClone(params.retries));
@@ -132,6 +139,7 @@ function createWebhookEmitter(options) {
         payload: structuredClone(payloadSnapshot),
         authentication: authentication === null ? null : structuredClone(authentication),
         retries: { ...retries },
+        ...(signingProfile === "web-bot-auth" || options.signingProfile === "web-bot-auth") && { signingProfile },
         ...attemptAuthorizationContext === void 0 ? {} : { attemptAuthorizationContext: structuredClone(attemptAuthorizationContext) }
       });
       const recoveryHeartbeat = recoveryClaim ? startRecoveryClaimHeartbeat(recoveryClaim) : void 0;
@@ -187,6 +195,7 @@ function createWebhookEmitter(options) {
           assertPositiveInteger(resolvedAttempt, "resolved webhook attempt ordinal", 1e6);
           let attemptInfo = { ...candidate, attempt: resolvedAttempt };
           let attemptAuthentication = authentication;
+          let attemptSigningProfile = signingProfile;
           if (options.authorizeAttempt) {
             let authorization;
             try {
@@ -224,10 +233,17 @@ function createWebhookEmitter(options) {
               assertPositiveInteger(authorization.attemptOrdinal, "authorized webhook attempt ordinal", 1e6);
               attemptInfo = { ...attemptInfo, attempt: authorization.attemptOrdinal };
             }
+            if (authorization.signingProfile !== void 0) {
+              if (!["adcp/webhook-signing/v1", "web-bot-auth"].includes(authorization.signingProfile) || authorization.signingProfile === "web-bot-auth" && !options.webBotAuth)
+                throw new TypeError("Attempt selected an unsupported webhook signing profile");
+              attemptSigningProfile = authorization.signingProfile;
+            }
             if ("authentication" in authorization) {
               attemptAuthentication = authorization.authentication == null ? null : structuredClone(authorization.authentication);
             }
           }
+          if (attemptSigningProfile === "web-bot-auth" && attemptAuthentication !== null)
+            throw new TypeError("Web Bot Auth cannot be combined with legacy webhook authentication");
           attempts = attempt;
           await observeAttempt(options, "attempt", attemptInfo);
           await recoveryHeartbeat?.renewNow();
@@ -243,6 +259,8 @@ function createWebhookEmitter(options) {
                 bodyBytes,
                 signerKey: options.signerKey,
                 signerProvider: options.signerProvider,
+                webBotAuth: options.webBotAuth,
+                signingProfile: attemptSigningProfile,
                 authentication: attemptAuthentication,
                 tag: options.tag,
                 userAgent: options.userAgent,
@@ -500,6 +518,10 @@ async function buildHeaders(args) {
     headers: baseHeaders,
     body: args.bodyBytes
   };
+  if (args.signingProfile === "web-bot-auth") {
+    if (!args.webBotAuth) throw new TypeError("Selected Web Bot Auth profile has no configured signing identity");
+    return signWebBotAuth(request, args.webBotAuth.key, { origin: args.webBotAuth.origin });
+  }
   const signOpts = args.tag !== void 0 ? { tag: args.tag } : {};
   const signed = args.signerProvider ? await signWebhookAsync(request, args.signerProvider, signOpts) : signWebhook(request, args.signerKey, signOpts);
   return { ...baseHeaders, ...signed.headers };

package/dist/lib/signing/agent-context.d.mts

@@ -64,11 +64,6 @@ export interface AgentSigningContext {
  * scope.
  */
 export declare const signingContextStorage: import("async_hooks").AsyncLocalStorage<AgentSigningContext | undefined>;
-/**
- * Build an `AgentSigningContext` from an `AgentConfig` when signing is
- * configured. Returns `undefined` when the agent has no `request_signing`
- * block — callers use this to branch into the no-op fast path.
- */
 export declare function buildAgentSigningContext(agent: AgentConfig, options?: {
     cache?: CapabilityCache;
     adcpVersion?: string;

package/dist/lib/signing/agent-context.d.ts

@@ -64,11 +64,6 @@ export interface AgentSigningContext {
  * scope.
  */
 export declare const signingContextStorage: import("async_hooks").AsyncLocalStorage<AgentSigningContext | undefined>;
-/**
- * Build an `AgentSigningContext` from an `AgentConfig` when signing is
- * configured. Returns `undefined` when the agent has no `request_signing`
- * block — callers use this to branch into the no-op fast path.
- */
 export declare function buildAgentSigningContext(agent: AgentConfig, options?: {
     cache?: CapabilityCache;
     adcpVersion?: string;

package/dist/lib/signing/agent-context.js

@@ -28,12 +28,20 @@ var import_capability_cache = require('./capability-cache.js');
 var import_version = require('../version.js');
 const CAPABILITY_SCOPE_SALT = (0, import_node_crypto.randomBytes)(32);
 const signingContextStorage = (0, import_global_async_local_storage.globalAsyncLocalStorage)("signingContext");
+let rfcIdentityWarningEmitted = false;
 function buildAgentSigningContext(agent, options = {}) {
   const signing = agent.request_signing;
   if (!signing) return void 0;
+  if (signing.profile !== "web-bot-auth" && !rfcIdentityWarningEmitted) {
+    rfcIdentityWarningEmitted = true;
+    process.emitWarning(
+      "RFC 9421 agent identity discovery is deprecated in AdCP 3.3; opt into Web Bot Auth after counterparties advertise support. RFC configuration remains supported through 3.x.",
+      { code: "ADCP_RFC9421_IDENTITY_DEPRECATED", type: "Warning" }
+    );
+  }
   const cache = options.cache ?? import_capability_cache.defaultCapabilityCache;
   const identity = snapshotIdentity(signing);
-  const cacheFingerprint = deriveCacheFingerprint(identity);
+  const cacheFingerprint = signing.profile === "web-bot-auth" ? (0, import_node_crypto.createHash)("sha256").update(deriveCacheFingerprint(identity)).update("\0web-bot-auth\0").update(signing.agent_url).digest("hex").slice(0, 32) : deriveCacheFingerprint(identity);
   const adcpVersion = options.adcpVersion ?? import_version.ADCP_VERSION;
   const capabilityCacheKey = (0, import_capability_cache.buildCapabilityCacheKey)(
     agent.agent_uri,

package/dist/lib/signing/agent-context.mjs

@@ -7,12 +7,20 @@ import {
 import { ADCP_VERSION } from "../version.mjs";
 const CAPABILITY_SCOPE_SALT = randomBytes(32);
 const signingContextStorage = globalAsyncLocalStorage("signingContext");
+let rfcIdentityWarningEmitted = false;
 function buildAgentSigningContext(agent, options = {}) {
   const signing = agent.request_signing;
   if (!signing) return void 0;
+  if (signing.profile !== "web-bot-auth" && !rfcIdentityWarningEmitted) {
+    rfcIdentityWarningEmitted = true;
+    process.emitWarning(
+      "RFC 9421 agent identity discovery is deprecated in AdCP 3.3; opt into Web Bot Auth after counterparties advertise support. RFC configuration remains supported through 3.x.",
+      { code: "ADCP_RFC9421_IDENTITY_DEPRECATED", type: "Warning" }
+    );
+  }
   const cache = options.cache ?? defaultCapabilityCache;
   const identity = snapshotIdentity(signing);
-  const cacheFingerprint = deriveCacheFingerprint(identity);
+  const cacheFingerprint = signing.profile === "web-bot-auth" ? createHash("sha256").update(deriveCacheFingerprint(identity)).update("\0web-bot-auth\0").update(signing.agent_url).digest("hex").slice(0, 32) : deriveCacheFingerprint(identity);
   const adcpVersion = options.adcpVersion ?? ADCP_VERSION;
   const capabilityCacheKey = buildCapabilityCacheKey(
     agent.agent_uri,