@adcp/sdk 15.9.0 → 16.0.0-beta.1

package/dist/lib/signing/agent-fetch.js

@@ -112,12 +112,37 @@ function buildAgentSigningFetch(options) {
   const explicitUpstream = options.upstream;
   const upstream = explicitUpstream ?? ((input, init) => defaultUpstream()(input, init));
   const shouldSign = (_url, init) => {
-    if (carriesWebhookAuthentication(init?.body)) return true;
+    if (carriesWebhookAuthentication(init?.body)) {
+      if (signing.profile === "web-bot-auth" && !getCapability()?.requestSigning?.profiles?.includes("web-bot-auth"))
+        throw new TypeError("Seller did not advertise the Web Bot Auth request signing profile");
+      return true;
+    }
     const operation = extractAdcpOperation(init?.body);
     const entry = getCapability();
-    return shouldSignOperation(operation, entry?.requestSigning, signing);
+    const sign = signing.profile === "web-bot-auth" && !!operation && entry?.requestSigning?.profiles?.includes("web-bot-auth") ? true : shouldSignOperation(operation, entry?.requestSigning, signing);
+    if (sign && signing.profile === "web-bot-auth" && !entry?.requestSigning?.profiles?.includes("web-bot-auth"))
+      throw new TypeError("Seller did not advertise the Web Bot Auth request signing profile");
+    return sign;
   };
   const binaryEncoding = (0, import_content_digest.requestSigningEncodingForVersion)(options.adcpVersion ?? import_version.ADCP_VERSION);
+  if (signing.profile === "web-bot-auth") {
+    const { createWebBotAuthFetch, jwkThumbprint } = require('./web-bot-auth.js');
+    if (isProviderSigningConfig(signing)) {
+      if (!signing.public_key) throw new TypeError("Web Bot Auth providers require public_key");
+      return createWebBotAuthFetch(
+        upstream,
+        { provider: freezeProviderIdentity(signing.provider), publicKey: signing.public_key },
+        { origin: signing.agent_url, shouldSign }
+      );
+    }
+    if (jwkThumbprint(signing.private_key) !== signing.kid)
+      throw new TypeError("Web Bot Auth kid must be the public JWK thumbprint");
+    return createWebBotAuthFetch(
+      upstream,
+      { privateKey: signing.private_key },
+      { origin: signing.agent_url, shouldSign }
+    );
+  }
   const coverContentDigest = (_url, _init) => {
     if (binaryEncoding === "rfc8941-base64") return true;
     const entry = getCapability();

package/dist/lib/signing/agent-fetch.mjs

@@ -1,3 +1,8 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
 import { createSigningFetch } from "./fetch.mjs";
 import { createSigningFetchAsync } from "./fetch-async.mjs";
 import {
@@ -84,12 +89,37 @@ function buildAgentSigningFetch(options) {
   const explicitUpstream = options.upstream;
   const upstream = explicitUpstream ?? ((input, init) => defaultUpstream()(input, init));
   const shouldSign = (_url, init) => {
-    if (carriesWebhookAuthentication(init?.body)) return true;
+    if (carriesWebhookAuthentication(init?.body)) {
+      if (signing.profile === "web-bot-auth" && !getCapability()?.requestSigning?.profiles?.includes("web-bot-auth"))
+        throw new TypeError("Seller did not advertise the Web Bot Auth request signing profile");
+      return true;
+    }
     const operation = extractAdcpOperation(init?.body);
     const entry = getCapability();
-    return shouldSignOperation(operation, entry?.requestSigning, signing);
+    const sign = signing.profile === "web-bot-auth" && !!operation && entry?.requestSigning?.profiles?.includes("web-bot-auth") ? true : shouldSignOperation(operation, entry?.requestSigning, signing);
+    if (sign && signing.profile === "web-bot-auth" && !entry?.requestSigning?.profiles?.includes("web-bot-auth"))
+      throw new TypeError("Seller did not advertise the Web Bot Auth request signing profile");
+    return sign;
   };
   const binaryEncoding = requestSigningEncodingForVersion(options.adcpVersion ?? ADCP_VERSION);
+  if (signing.profile === "web-bot-auth") {
+    const { createWebBotAuthFetch, jwkThumbprint } = require2("./web-bot-auth");
+    if (isProviderSigningConfig(signing)) {
+      if (!signing.public_key) throw new TypeError("Web Bot Auth providers require public_key");
+      return createWebBotAuthFetch(
+        upstream,
+        { provider: freezeProviderIdentity(signing.provider), publicKey: signing.public_key },
+        { origin: signing.agent_url, shouldSign }
+      );
+    }
+    if (jwkThumbprint(signing.private_key) !== signing.kid)
+      throw new TypeError("Web Bot Auth kid must be the public JWK thumbprint");
+    return createWebBotAuthFetch(
+      upstream,
+      { privateKey: signing.private_key },
+      { origin: signing.agent_url, shouldSign }
+    );
+  }
   const coverContentDigest = (_url, _init) => {
     if (binaryEncoding === "rfc8941-base64") return true;
     const entry = getCapability();

package/dist/lib/signing/agent-resolver/canonicalize.d.mts

@@ -1,17 +1,3 @@
-/**
- * Origin canonicalization for the brand_json_url verifier algorithm.
- * `security.mdx` §"Quickstart: implement a `brand_json_url`-based verifier"
- * step 3 mandates: ASCII-lowercase the host, then convert to IDNA-2008
- * A-label (Punycode) form before byte-equality. A non-canonical comparison
- * (raw `Example.COM` vs `example.com`, or U-label vs A-label) silently
- * rejects legitimate traffic.
- *
- * Node's WHATWG URL parser already performs IDNA-2008 A-label conversion
- * and ASCII-lowercases the host on construction (`new URL('https://Bücher.example/').hostname`
- * returns `xn--bcher-kva.example`). We delegate to it rather than vendoring
- * an IDNA implementation — the rule is "use the platform's IDNA-2008", not
- * "ship our own".
- */
 export declare class CanonicalizeError extends Error {
     readonly meta: {
         input: string;
@@ -29,13 +15,22 @@ export declare function canonicalizeHost(host: string): string;
  * Canonicalize the origin component (scheme + host) of a URL or origin string.
  * Accepts either a full URL (`https://Example.COM/path`) or a bare origin
  * (`https://Example.COM`). Output is `https://example.com` form — scheme +
- * canonical host, no port when default, no path/query.
+ * canonical host, no port when default, no path/query. Authority validation
+ * follows the shared URL canonicalization steps 1–4, including removal of
+ * one DNS root-label dot and rejection of malformed authorities.
  *
  * Used for the step-7 `identity.key_origins` consistency check: the verifier
  * compares the canonicalized host of the resolved `jwks_uri` against the
  * canonicalized host of the declared `key_origins.{purpose}` value.
  */
 export declare function canonicalizeOrigin(originOrUrl: string): string;
+/**
+ * Canonical agent origin, without path, query, fragment, or userinfo.
+ * Normalizes producer inputs, including IDN U-labels. Wire comparers must
+ * separately reject unnormalized non-ASCII hostnames, as canonicalAgentUrl
+ * does. Normalizing a locator does not establish signer identity or authority.
+ */
+export declare const canonicalAgentOrigin: typeof canonicalizeOrigin;
 /**
  * Compare two origins (scheme + host + port) for byte-equality after
  * canonicalization. Wrong scheme, wrong port, or wrong host all return false.

package/dist/lib/signing/agent-resolver/canonicalize.d.ts

@@ -1,17 +1,3 @@
-/**
- * Origin canonicalization for the brand_json_url verifier algorithm.
- * `security.mdx` §"Quickstart: implement a `brand_json_url`-based verifier"
- * step 3 mandates: ASCII-lowercase the host, then convert to IDNA-2008
- * A-label (Punycode) form before byte-equality. A non-canonical comparison
- * (raw `Example.COM` vs `example.com`, or U-label vs A-label) silently
- * rejects legitimate traffic.
- *
- * Node's WHATWG URL parser already performs IDNA-2008 A-label conversion
- * and ASCII-lowercases the host on construction (`new URL('https://Bücher.example/').hostname`
- * returns `xn--bcher-kva.example`). We delegate to it rather than vendoring
- * an IDNA implementation — the rule is "use the platform's IDNA-2008", not
- * "ship our own".
- */
 export declare class CanonicalizeError extends Error {
     readonly meta: {
         input: string;
@@ -29,13 +15,22 @@ export declare function canonicalizeHost(host: string): string;
  * Canonicalize the origin component (scheme + host) of a URL or origin string.
  * Accepts either a full URL (`https://Example.COM/path`) or a bare origin
  * (`https://Example.COM`). Output is `https://example.com` form — scheme +
- * canonical host, no port when default, no path/query.
+ * canonical host, no port when default, no path/query. Authority validation
+ * follows the shared URL canonicalization steps 1–4, including removal of
+ * one DNS root-label dot and rejection of malformed authorities.
  *
  * Used for the step-7 `identity.key_origins` consistency check: the verifier
  * compares the canonicalized host of the resolved `jwks_uri` against the
  * canonicalized host of the declared `key_origins.{purpose}` value.
  */
 export declare function canonicalizeOrigin(originOrUrl: string): string;
+/**
+ * Canonical agent origin, without path, query, fragment, or userinfo.
+ * Normalizes producer inputs, including IDN U-labels. Wire comparers must
+ * separately reject unnormalized non-ASCII hostnames, as canonicalAgentUrl
+ * does. Normalizing a locator does not establish signer identity or authority.
+ */
+export declare const canonicalAgentOrigin: typeof canonicalizeOrigin;
 /**
  * Compare two origins (scheme + host + port) for byte-equality after
  * canonicalization. Wrong scheme, wrong port, or wrong host all return false.

package/dist/lib/signing/agent-resolver/canonicalize.js

@@ -19,11 +19,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var canonicalize_exports = {};
 __export(canonicalize_exports, {
   CanonicalizeError: () => CanonicalizeError,
+  canonicalAgentOrigin: () => canonicalAgentOrigin,
   canonicalizeHost: () => canonicalizeHost,
   canonicalizeOrigin: () => canonicalizeOrigin,
   originsEqual: () => originsEqual
 });
 module.exports = __toCommonJS(canonicalize_exports);
+var import_canonicalize = require('../canonicalize.js');
 class CanonicalizeError extends Error {
   constructor(message, meta) {
     super(message);
@@ -44,21 +46,30 @@ function canonicalizeHost(host) {
   }
 }
 function canonicalizeOrigin(originOrUrl) {
+  const errorMeta = { input: "[redacted]" };
   if (typeof originOrUrl !== "string" || originOrUrl.length === 0) {
-    throw new CanonicalizeError("Empty origin", { input: originOrUrl });
+    throw new CanonicalizeError("Empty origin", errorMeta);
+  }
+  const authority = /^[a-z][a-z0-9+.\-]*:\/\/([^/?#]*)/i.exec(originOrUrl)?.[1];
+  if (!authority || /[\u0000-\u0020\u007f\\]/.test(authority)) {
+    throw new CanonicalizeError("Malformed origin authority", errorMeta);
   }
   let parsed;
   try {
     parsed = new URL(originOrUrl);
   } catch {
-    throw new CanonicalizeError(`Invalid origin: ${originOrUrl}`, { input: originOrUrl });
+    throw new CanonicalizeError("Invalid origin", errorMeta);
   }
   if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    throw new CanonicalizeError(`Unsupported scheme: ${parsed.protocol}`, { input: originOrUrl });
+    throw new CanonicalizeError("Unsupported origin scheme", errorMeta);
+  }
+  try {
+    return `${parsed.protocol}//${(0, import_canonicalize.canonicalAuthority)(originOrUrl, "3.2")}`;
+  } catch {
+    throw new CanonicalizeError("Invalid origin authority", errorMeta);
   }
-  const port = parsed.port ? `:${parsed.port}` : "";
-  return `${parsed.protocol}//${parsed.hostname}${port}`;
 }
+const canonicalAgentOrigin = canonicalizeOrigin;
 function originsEqual(a, b) {
   try {
     return canonicalizeOrigin(a) === canonicalizeOrigin(b);
@@ -69,6 +80,7 @@ function originsEqual(a, b) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CanonicalizeError,
+  canonicalAgentOrigin,
   canonicalizeHost,
   canonicalizeOrigin,
   originsEqual

package/dist/lib/signing/agent-resolver/canonicalize.mjs

@@ -1,3 +1,4 @@
+import { canonicalAuthority } from "../canonicalize.mjs";
 class CanonicalizeError extends Error {
   constructor(message, meta) {
     super(message);
@@ -18,21 +19,30 @@ function canonicalizeHost(host) {
   }
 }
 function canonicalizeOrigin(originOrUrl) {
+  const errorMeta = { input: "[redacted]" };
   if (typeof originOrUrl !== "string" || originOrUrl.length === 0) {
-    throw new CanonicalizeError("Empty origin", { input: originOrUrl });
+    throw new CanonicalizeError("Empty origin", errorMeta);
+  }
+  const authority = /^[a-z][a-z0-9+.\-]*:\/\/([^/?#]*)/i.exec(originOrUrl)?.[1];
+  if (!authority || /[\u0000-\u0020\u007f\\]/.test(authority)) {
+    throw new CanonicalizeError("Malformed origin authority", errorMeta);
   }
   let parsed;
   try {
     parsed = new URL(originOrUrl);
   } catch {
-    throw new CanonicalizeError(`Invalid origin: ${originOrUrl}`, { input: originOrUrl });
+    throw new CanonicalizeError("Invalid origin", errorMeta);
   }
   if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    throw new CanonicalizeError(`Unsupported scheme: ${parsed.protocol}`, { input: originOrUrl });
+    throw new CanonicalizeError("Unsupported origin scheme", errorMeta);
+  }
+  try {
+    return `${parsed.protocol}//${canonicalAuthority(originOrUrl, "3.2")}`;
+  } catch {
+    throw new CanonicalizeError("Invalid origin authority", errorMeta);
   }
-  const port = parsed.port ? `:${parsed.port}` : "";
-  return `${parsed.protocol}//${parsed.hostname}${port}`;
 }
+const canonicalAgentOrigin = canonicalizeOrigin;
 function originsEqual(a, b) {
   try {
     return canonicalizeOrigin(a) === canonicalizeOrigin(b);
@@ -42,6 +52,7 @@ function originsEqual(a, b) {
 }
 export {
   CanonicalizeError,
+  canonicalAgentOrigin,
   canonicalizeHost,
   canonicalizeOrigin,
   originsEqual

package/dist/lib/signing/agent-resolver/index.d.mts

@@ -17,6 +17,7 @@
  */
 export { resolveAgent } from './resolve-agent.mjs';
 export { ResolvedAgentJwksResolver } from './resolved-agent-jwks.mjs';
+export { canonicalAgentOrigin, CanonicalizeError } from './canonicalize.mjs';
 export type { AgentResolution, AgentProtocol, AuthorizedOperatorScope, DelegatedOperatorAuthorizationContext, FetchCapabilitiesFn, ResolveAgentOptions, TraceStep, } from './resolve-agent.mjs';
 export type { ResolvedAgentJwksResolverOptions } from './resolved-agent-jwks.mjs';
 export { getAgentJwks, createAgentJwksSet } from './jwks-set.mjs';

package/dist/lib/signing/agent-resolver/index.d.ts

@@ -17,6 +17,7 @@
  */
 export { resolveAgent } from './resolve-agent';
 export { ResolvedAgentJwksResolver } from './resolved-agent-jwks';
+export { canonicalAgentOrigin, CanonicalizeError } from './canonicalize';
 export type { AgentResolution, AgentProtocol, AuthorizedOperatorScope, DelegatedOperatorAuthorizationContext, FetchCapabilitiesFn, ResolveAgentOptions, TraceStep, } from './resolve-agent';
 export type { ResolvedAgentJwksResolverOptions } from './resolved-agent-jwks';
 export { getAgentJwks, createAgentJwksSet } from './jwks-set';

package/dist/lib/signing/agent-resolver/index.js

@@ -20,8 +20,10 @@ var agent_resolver_exports = {};
 __export(agent_resolver_exports, {
   ATTACKER_INFLUENCED: () => import_errors.ATTACKER_INFLUENCED,
   AgentResolverError: () => import_errors.AgentResolverError,
+  CanonicalizeError: () => import_canonicalize.CanonicalizeError,
   ResolvedAgentJwksResolver: () => import_resolved_agent_jwks.ResolvedAgentJwksResolver,
   attackerInfluencedFields: () => import_errors.attackerInfluencedFields,
+  canonicalAgentOrigin: () => import_canonicalize.canonicalAgentOrigin,
   createAgentJwksSet: () => import_jwks_set.createAgentJwksSet,
   getAgentJwks: () => import_jwks_set.getAgentJwks,
   readBrandJsonUrl: () => import_capabilities_types.readBrandJsonUrl,
@@ -31,6 +33,7 @@ __export(agent_resolver_exports, {
 module.exports = __toCommonJS(agent_resolver_exports);
 var import_resolve_agent = require('./resolve-agent.js');
 var import_resolved_agent_jwks = require('./resolved-agent-jwks.js');
+var import_canonicalize = require('./canonicalize.js');
 var import_jwks_set = require('./jwks-set.js');
 var import_errors = require('./errors.js');
 var import_capabilities_types = require('./capabilities-types.js');
@@ -38,8 +41,10 @@ var import_capabilities_types = require('./capabilities-types.js');
 0 && (module.exports = {
   ATTACKER_INFLUENCED,
   AgentResolverError,
+  CanonicalizeError,
   ResolvedAgentJwksResolver,
   attackerInfluencedFields,
+  canonicalAgentOrigin,
   createAgentJwksSet,
   getAgentJwks,
   readBrandJsonUrl,

package/dist/lib/signing/agent-resolver/index.mjs

@@ -1,5 +1,6 @@
 import { resolveAgent } from "./resolve-agent.mjs";
 import { ResolvedAgentJwksResolver } from "./resolved-agent-jwks.mjs";
+import { canonicalAgentOrigin, CanonicalizeError } from "./canonicalize.mjs";
 import { getAgentJwks, createAgentJwksSet } from "./jwks-set.mjs";
 import {
   AgentResolverError,
@@ -10,8 +11,10 @@ import { readBrandJsonUrl, readIdentityPosture } from "./capabilities-types.mjs"
 export {
   ATTACKER_INFLUENCED,
   AgentResolverError,
+  CanonicalizeError,
   ResolvedAgentJwksResolver,
   attackerInfluencedFields,
+  canonicalAgentOrigin,
   createAgentJwksSet,
   getAgentJwks,
   readBrandJsonUrl,

package/dist/lib/signing/agent-resolver/resolved-agent-jwks.d.mts

@@ -19,6 +19,7 @@ export declare class ResolvedAgentJwksResolver implements JwksResolver {
     private readonly unknownKidCooldownSeconds;
     private readonly resolveAgentFn;
     private canonicalAgentUrl?;
+    private configuredOrigin?;
     private legacyWebhookFallback?;
     private operatorRecord?;
     get resolvedAgentUrl(): string | undefined;
@@ -29,8 +30,8 @@ export declare class ResolvedAgentJwksResolver implements JwksResolver {
     private lastDiscoveryAttemptAt;
     private inFlight?;
     constructor(agentUrl: string, protocol: AgentProtocol, options?: ResolvedAgentJwksResolverOptions);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
-    resolveWithMetadata(keyid: string): Promise<JwksResolution>;
+    resolve(keyid: string, signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
+    resolveWithMetadata(keyid: string, signerOrigin?: string): Promise<JwksResolution>;
     forceRefresh(): Promise<void>;
     private resolution;
     private refresh;

package/dist/lib/signing/agent-resolver/resolved-agent-jwks.d.ts

@@ -19,6 +19,7 @@ export declare class ResolvedAgentJwksResolver implements JwksResolver {
     private readonly unknownKidCooldownSeconds;
     private readonly resolveAgentFn;
     private canonicalAgentUrl?;
+    private configuredOrigin?;
     private legacyWebhookFallback?;
     private operatorRecord?;
     get resolvedAgentUrl(): string | undefined;
@@ -29,8 +30,8 @@ export declare class ResolvedAgentJwksResolver implements JwksResolver {
     private lastDiscoveryAttemptAt;
     private inFlight?;
     constructor(agentUrl: string, protocol: AgentProtocol, options?: ResolvedAgentJwksResolverOptions);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
-    resolveWithMetadata(keyid: string): Promise<JwksResolution>;
+    resolve(keyid: string, signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
+    resolveWithMetadata(keyid: string, signerOrigin?: string): Promise<JwksResolution>;
     forceRefresh(): Promise<void>;
     private resolution;
     private refresh;

package/dist/lib/signing/agent-resolver/resolved-agent-jwks.js

@@ -22,6 +22,8 @@ __export(resolved_agent_jwks_exports, {
 });
 module.exports = __toCommonJS(resolved_agent_jwks_exports);
 var import_errors = require('./errors.js');
+var import_canonicalize = require('./canonicalize.js');
+var import_select_agent = require('./select-agent.js');
 var import_resolve_agent = require('./resolve-agent.js');
 class ResolvedAgentJwksResolver {
   constructor(agentUrl, protocol, options = {}) {
@@ -47,6 +49,7 @@ class ResolvedAgentJwksResolver {
   unknownKidCooldownSeconds;
   resolveAgentFn;
   canonicalAgentUrl;
+  configuredOrigin;
   legacyWebhookFallback;
   operatorRecord;
   get resolvedAgentUrl() {
@@ -58,10 +61,34 @@ class ResolvedAgentJwksResolver {
   lastUnknownKidRefresh = Number.NEGATIVE_INFINITY;
   lastDiscoveryAttemptAt = Number.NEGATIVE_INFINITY;
   inFlight;
-  async resolve(keyid) {
-    return (await this.resolveWithMetadata(keyid)).jwk;
+  async resolve(keyid, signerOrigin) {
+    return (await this.resolveWithMetadata(keyid, signerOrigin)).jwk;
   }
-  async resolveWithMetadata(keyid) {
+  async resolveWithMetadata(keyid, signerOrigin) {
+    if (signerOrigin !== void 0) {
+      try {
+        this.configuredOrigin ??= (0, import_canonicalize.canonicalAgentOrigin)(this.agentUrl);
+      } catch {
+        throw new import_errors.AgentResolverError("request_signature_key_unknown", "Configured agent origin is malformed.");
+      }
+      let requestedOrigin;
+      try {
+        requestedOrigin = (0, import_canonicalize.canonicalAgentOrigin)(signerOrigin);
+        const authority = signerOrigin.slice(signerOrigin.indexOf("://") + 3).split(/[/?#]/, 1)[0];
+        if (authority.slice(authority.lastIndexOf("@") + 1).includes("%")) {
+          throw new TypeError("Signer origin host must use its ASCII spelling.");
+        }
+        (0, import_select_agent.canonicalAgentUrl)(signerOrigin);
+      } catch {
+        throw new import_errors.AgentResolverError("request_signature_key_unknown", "Signer origin is malformed.");
+      }
+      if (requestedOrigin !== this.configuredOrigin) {
+        throw new import_errors.AgentResolverError(
+          "request_signature_key_unknown",
+          "Signer origin does not match the configured agent origin."
+        );
+      }
+    }
     const now = this.now();
     let refreshed = false;
     if (now >= this.expiresAt) {

package/dist/lib/signing/agent-resolver/resolved-agent-jwks.mjs

@@ -1,4 +1,6 @@
 import { AgentResolverError } from "./errors.mjs";
+import { canonicalAgentOrigin } from "./canonicalize.mjs";
+import { canonicalAgentUrl } from "./select-agent.mjs";
 import { resolveAgent } from "./resolve-agent.mjs";
 class ResolvedAgentJwksResolver {
   constructor(agentUrl, protocol, options = {}) {
@@ -24,6 +26,7 @@ class ResolvedAgentJwksResolver {
   unknownKidCooldownSeconds;
   resolveAgentFn;
   canonicalAgentUrl;
+  configuredOrigin;
   legacyWebhookFallback;
   operatorRecord;
   get resolvedAgentUrl() {
@@ -35,10 +38,34 @@ class ResolvedAgentJwksResolver {
   lastUnknownKidRefresh = Number.NEGATIVE_INFINITY;
   lastDiscoveryAttemptAt = Number.NEGATIVE_INFINITY;
   inFlight;
-  async resolve(keyid) {
-    return (await this.resolveWithMetadata(keyid)).jwk;
+  async resolve(keyid, signerOrigin) {
+    return (await this.resolveWithMetadata(keyid, signerOrigin)).jwk;
   }
-  async resolveWithMetadata(keyid) {
+  async resolveWithMetadata(keyid, signerOrigin) {
+    if (signerOrigin !== void 0) {
+      try {
+        this.configuredOrigin ??= canonicalAgentOrigin(this.agentUrl);
+      } catch {
+        throw new AgentResolverError("request_signature_key_unknown", "Configured agent origin is malformed.");
+      }
+      let requestedOrigin;
+      try {
+        requestedOrigin = canonicalAgentOrigin(signerOrigin);
+        const authority = signerOrigin.slice(signerOrigin.indexOf("://") + 3).split(/[/?#]/, 1)[0];
+        if (authority.slice(authority.lastIndexOf("@") + 1).includes("%")) {
+          throw new TypeError("Signer origin host must use its ASCII spelling.");
+        }
+        canonicalAgentUrl(signerOrigin);
+      } catch {
+        throw new AgentResolverError("request_signature_key_unknown", "Signer origin is malformed.");
+      }
+      if (requestedOrigin !== this.configuredOrigin) {
+        throw new AgentResolverError(
+          "request_signature_key_unknown",
+          "Signer origin does not match the configured agent origin."
+        );
+      }
+    }
     const now = this.now();
     let refreshed = false;
     if (now >= this.expiresAt) {

package/dist/lib/signing/agent-resolver/strict-json.d.mts

@@ -40,7 +40,7 @@ export declare class StrictJsonError extends Error {
  * 256 KiB brand.json budget — both are linear, the constant factor is small,
  * and we never trust the tokenizer to produce the value (it's only a guard).
  */
-export declare function parseStrictJson(text: string): unknown;
+export declare function parseStrictJson(text: string, maxDepth?: number): unknown;
 /**
  * Walk the source character-by-character and reject when any object scope
  * declares the same key twice. Comments are not legal JSON, so a `//` or
@@ -51,4 +51,4 @@ export declare function parseStrictJson(text: string): unknown;
  *   - whether the next quoted-string at object scope is the key half of
  *     a key-value pair.
  */
-export declare function rejectDuplicateJsonKeys(text: string): void;
+export declare function rejectDuplicateJsonKeys(text: string, maxDepth?: number): void;

package/dist/lib/signing/agent-resolver/strict-json.d.ts

@@ -40,7 +40,7 @@ export declare class StrictJsonError extends Error {
  * 256 KiB brand.json budget — both are linear, the constant factor is small,
  * and we never trust the tokenizer to produce the value (it's only a guard).
  */
-export declare function parseStrictJson(text: string): unknown;
+export declare function parseStrictJson(text: string, maxDepth?: number): unknown;
 /**
  * Walk the source character-by-character and reject when any object scope
  * declares the same key twice. Comments are not legal JSON, so a `//` or
@@ -51,4 +51,4 @@ export declare function parseStrictJson(text: string): unknown;
  *   - whether the next quoted-string at object scope is the key half of
  *     a key-value pair.
  */
-export declare function rejectDuplicateJsonKeys(text: string): void;
+export declare function rejectDuplicateJsonKeys(text: string, maxDepth?: number): void;

package/dist/lib/signing/agent-resolver/strict-json.js

@@ -44,8 +44,8 @@ class StrictJsonError extends Error {
     this.detail = detail;
   }
 }
-function parseStrictJson(text) {
-  rejectDuplicateJsonKeys(text);
+function parseStrictJson(text, maxDepth = Number.POSITIVE_INFINITY) {
+  rejectDuplicateJsonKeys(text, maxDepth);
   try {
     return import_secure_json_parse.default.parse(text, null, { protoAction: "error", constructorAction: "error" });
   } catch (err) {
@@ -56,7 +56,7 @@ function parseStrictJson(text) {
     throw new StrictJsonError("invalid_json", message);
   }
 }
-function rejectDuplicateJsonKeys(text) {
+function rejectDuplicateJsonKeys(text, maxDepth = Number.POSITIVE_INFINITY) {
   const stack = [];
   let expectingKey = false;
   let i = 0;
@@ -68,6 +68,7 @@ function rejectDuplicateJsonKeys(text) {
       continue;
     }
     if (ch === "{") {
+      if (stack.length >= maxDepth) throw new StrictJsonError("invalid_json", "JSON nesting exceeds limit");
       stack.push({ kind: "object", keys: /* @__PURE__ */ new Set() });
       expectingKey = true;
       i++;
@@ -80,6 +81,7 @@ function rejectDuplicateJsonKeys(text) {
       continue;
     }
     if (ch === "[") {
+      if (stack.length >= maxDepth) throw new StrictJsonError("invalid_json", "JSON nesting exceeds limit");
       stack.push({ kind: "array" });
       expectingKey = false;
       i++;

package/dist/lib/signing/agent-resolver/strict-json.mjs

@@ -9,8 +9,8 @@ class StrictJsonError extends Error {
     this.detail = detail;
   }
 }
-function parseStrictJson(text) {
-  rejectDuplicateJsonKeys(text);
+function parseStrictJson(text, maxDepth = Number.POSITIVE_INFINITY) {
+  rejectDuplicateJsonKeys(text, maxDepth);
   try {
     return sjp.parse(text, null, { protoAction: "error", constructorAction: "error" });
   } catch (err) {
@@ -21,7 +21,7 @@ function parseStrictJson(text) {
     throw new StrictJsonError("invalid_json", message);
   }
 }
-function rejectDuplicateJsonKeys(text) {
+function rejectDuplicateJsonKeys(text, maxDepth = Number.POSITIVE_INFINITY) {
   const stack = [];
   let expectingKey = false;
   let i = 0;
@@ -33,6 +33,7 @@ function rejectDuplicateJsonKeys(text) {
       continue;
     }
     if (ch === "{") {
+      if (stack.length >= maxDepth) throw new StrictJsonError("invalid_json", "JSON nesting exceeds limit");
       stack.push({ kind: "object", keys: /* @__PURE__ */ new Set() });
       expectingKey = true;
       i++;
@@ -45,6 +46,7 @@ function rejectDuplicateJsonKeys(text) {
       continue;
     }
     if (ch === "[") {
+      if (stack.length >= maxDepth) throw new StrictJsonError("invalid_json", "JSON nesting exceeds limit");
       stack.push({ kind: "array" });
       expectingKey = false;
       i++;

package/dist/lib/signing/brand-jwks.d.mts

@@ -84,8 +84,8 @@ export declare class BrandJsonJwksResolver implements JwksResolver {
     constructor(brandJsonUrl: string, options: BrandJsonJwksResolverOptions);
     private createResolver;
     private confirmedResolver;
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
-    resolveWithMetadata(keyid: string): Promise<JwksResolution>;
+    resolve(keyid: string, signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
+    resolveWithMetadata(keyid: string, signerOrigin?: string): Promise<JwksResolution>;
     get agentUrl(): string | undefined;
     forceRefresh(): Promise<void>;
 }

package/dist/lib/signing/brand-jwks.d.ts

@@ -84,8 +84,8 @@ export declare class BrandJsonJwksResolver implements JwksResolver {
     constructor(brandJsonUrl: string, options: BrandJsonJwksResolverOptions);
     private createResolver;
     private confirmedResolver;
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
-    resolveWithMetadata(keyid: string): Promise<JwksResolution>;
+    resolve(keyid: string, signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
+    resolveWithMetadata(keyid: string, signerOrigin?: string): Promise<JwksResolution>;
     get agentUrl(): string | undefined;
     forceRefresh(): Promise<void>;
 }

package/dist/lib/signing/brand-jwks.js

@@ -113,11 +113,11 @@ class BrandJsonJwksResolver {
     });
     return this.onboarding;
   }
-  async resolve(keyid) {
-    return (await this.confirmedResolver()).resolve(keyid);
+  async resolve(keyid, signerOrigin) {
+    return (await this.confirmedResolver()).resolve(keyid, signerOrigin);
   }
-  async resolveWithMetadata(keyid) {
-    return (await this.confirmedResolver()).resolveWithMetadata(keyid);
+  async resolveWithMetadata(keyid, signerOrigin) {
+    return (await this.confirmedResolver()).resolveWithMetadata(keyid, signerOrigin);
   }
   get agentUrl() {
     return this.resolver?.resolvedAgentUrl;