@adcp/sdk 15.9.0 → 16.0.0-beta.1

package/dist/lib/signing/brand-jwks.mjs

@@ -88,11 +88,11 @@ class BrandJsonJwksResolver {
     });
     return this.onboarding;
   }
-  async resolve(keyid) {
-    return (await this.confirmedResolver()).resolve(keyid);
+  async resolve(keyid, signerOrigin) {
+    return (await this.confirmedResolver()).resolve(keyid, signerOrigin);
   }
-  async resolveWithMetadata(keyid) {
-    return (await this.confirmedResolver()).resolveWithMetadata(keyid);
+  async resolveWithMetadata(keyid, signerOrigin) {
+    return (await this.confirmedResolver()).resolveWithMetadata(keyid, signerOrigin);
   }
   get agentUrl() {
     return this.resolver?.resolvedAgentUrl;

package/dist/lib/signing/client.d.mts

@@ -23,3 +23,4 @@ export { buildAgentSigningFetch, createAgentSignedFetch, extractAdcpOperation, i
 export { buildAgentSigningContext, signingContextStorage, type AgentSigningContext, type AgentSigningIdentitySnapshot, } from './agent-context.mjs';
 export { ensureCapabilityLoaded, CAPABILITY_OP } from './capability-priming.mjs';
 export { pemToAdcpJwk, type AdcpUse, type PemToAdcpJwkOptions } from './jwks-helpers.mjs';
+export { canonicalAgentOrigin, CanonicalizeError } from './agent-resolver/canonicalize.mjs';

package/dist/lib/signing/client.d.ts

@@ -23,3 +23,4 @@ export { buildAgentSigningFetch, createAgentSignedFetch, extractAdcpOperation, i
 export { buildAgentSigningContext, signingContextStorage, type AgentSigningContext, type AgentSigningIdentitySnapshot, } from './agent-context';
 export { ensureCapabilityLoaded, CAPABILITY_OP } from './capability-priming';
 export { pemToAdcpJwk, type AdcpUse, type PemToAdcpJwkOptions } from './jwks-helpers';
+export { canonicalAgentOrigin, CanonicalizeError } from './agent-resolver/canonicalize';

package/dist/lib/signing/client.js

@@ -21,6 +21,7 @@ __export(client_exports, {
   ALLOWED_ALGS: () => import_types.ALLOWED_ALGS,
   CAPABILITY_OP: () => import_capability_priming.CAPABILITY_OP,
   CLOCK_SKEW_TOLERANCE_SECONDS: () => import_types.CLOCK_SKEW_TOLERANCE_SECONDS,
+  CanonicalizeError: () => import_canonicalize2.CanonicalizeError,
   CapabilityCache: () => import_capability_cache.CapabilityCache,
   MANDATORY_COMPONENTS: () => import_types.MANDATORY_COMPONENTS,
   MAX_SIGNATURE_WINDOW_SECONDS: () => import_types.MAX_SIGNATURE_WINDOW_SECONDS,
@@ -39,6 +40,7 @@ __export(client_exports, {
   buildCapabilityCacheKey: () => import_capability_cache.buildCapabilityCacheKey,
   buildResponseSignatureBase: () => import_canonicalize.buildResponseSignatureBase,
   buildSignatureBase: () => import_canonicalize.buildSignatureBase,
+  canonicalAgentOrigin: () => import_canonicalize2.canonicalAgentOrigin,
   canonicalAuthority: () => import_canonicalize.canonicalAuthority,
   canonicalMethod: () => import_canonicalize.canonicalMethod,
   canonicalTargetUri: () => import_canonicalize.canonicalTargetUri,
@@ -95,11 +97,13 @@ var import_agent_fetch = require('./agent-fetch.js');
 var import_agent_context = require('./agent-context.js');
 var import_capability_priming = require('./capability-priming.js');
 var import_jwks_helpers = require('./jwks-helpers.js');
+var import_canonicalize2 = require('./agent-resolver/canonicalize.js');
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ALLOWED_ALGS,
   CAPABILITY_OP,
   CLOCK_SKEW_TOLERANCE_SECONDS,
+  CanonicalizeError,
   CapabilityCache,
   MANDATORY_COMPONENTS,
   MAX_SIGNATURE_WINDOW_SECONDS,
@@ -118,6 +122,7 @@ var import_jwks_helpers = require('./jwks-helpers.js');
   buildCapabilityCacheKey,
   buildResponseSignatureBase,
   buildSignatureBase,
+  canonicalAgentOrigin,
   canonicalAuthority,
   canonicalMethod,
   canonicalTargetUri,

package/dist/lib/signing/client.mjs

@@ -71,10 +71,12 @@ import {
 } from "./agent-context.mjs";
 import { ensureCapabilityLoaded, CAPABILITY_OP } from "./capability-priming.mjs";
 import { pemToAdcpJwk } from "./jwks-helpers.mjs";
+import { canonicalAgentOrigin, CanonicalizeError } from "./agent-resolver/canonicalize.mjs";
 export {
   ALLOWED_ALGS,
   CAPABILITY_OP,
   CLOCK_SKEW_TOLERANCE_SECONDS,
+  CanonicalizeError,
   CapabilityCache,
   MANDATORY_COMPONENTS,
   MAX_SIGNATURE_WINDOW_SECONDS,
@@ -93,6 +95,7 @@ export {
   buildCapabilityCacheKey,
   buildResponseSignatureBase,
   buildSignatureBase,
+  canonicalAgentOrigin,
   canonicalAuthority,
   canonicalMethod,
   canonicalTargetUri,

package/dist/lib/signing/jwks-https.d.mts

@@ -58,7 +58,7 @@ export declare class HttpsJwksResolver implements JwksResolver {
     private inFlight;
     private lastAttemptAt;
     constructor(url: string, options?: HttpsJwksResolverOptions);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    resolve(keyid: string, _signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
     /**
      * Force a refetch, bypassing the cooldown. Primarily for tests and for
      * operator-triggered rotation flushes; normal callers should rely on the

package/dist/lib/signing/jwks-https.d.ts

@@ -58,7 +58,7 @@ export declare class HttpsJwksResolver implements JwksResolver {
     private inFlight;
     private lastAttemptAt;
     constructor(url: string, options?: HttpsJwksResolverOptions);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    resolve(keyid: string, _signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
     /**
      * Force a refetch, bypassing the cooldown. Primarily for tests and for
      * operator-triggered rotation flushes; normal callers should rely on the

package/dist/lib/signing/jwks-https.js

@@ -56,7 +56,7 @@ class HttpsJwksResolver {
     this.lookup = options.lookup;
     this.now = options.now ?? (() => Math.floor(Date.now() / 1e3));
   }
-  async resolve(keyid) {
+  async resolve(keyid, _signerOrigin) {
     if (!this.cache) {
       if (!this.inFlight && this.now() - this.lastAttemptAt < this.minCooldown) {
         throw new Error("JWKS lookup is in its retry cooldown");

package/dist/lib/signing/jwks-https.mjs

@@ -33,7 +33,7 @@ class HttpsJwksResolver {
     this.lookup = options.lookup;
     this.now = options.now ?? (() => Math.floor(Date.now() / 1e3));
   }
-  async resolve(keyid) {
+  async resolve(keyid, _signerOrigin) {
     if (!this.cache) {
       if (!this.inFlight && this.now() - this.lastAttemptAt < this.minCooldown) {
         throw new Error("JWKS lookup is in its retry cooldown");

package/dist/lib/signing/jwks.d.mts

@@ -13,12 +13,20 @@ export interface JwksResolution {
     operatorAuthorizationValidUntil?: number;
 }
 export interface JwksResolver {
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    /**
+     * Optional signer-origin locator for resolvers serving multiple signers.
+     * It is unverified request context, never proof of identity or authority.
+     * Origin-aware caches must scope entries by (canonical origin, keyid).
+     * Wrappers must forward it on both lookup methods. Existing one-argument
+     * implementations remain valid; static and HTTPS resolvers stay pinned to
+     * their configured key source and do not attribute identity from this value.
+     */
+    resolve(keyid: string, signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
     /** Optional metadata-aware lookup used by verifiers that must enforce delegation expiry at acceptance time. */
-    resolveWithMetadata?(keyid: string): Promise<JwksResolution>;
+    resolveWithMetadata?(keyid: string, signerOrigin?: string): Promise<JwksResolution>;
 }
 export declare class StaticJwksResolver implements JwksResolver {
     private readonly byKid;
     constructor(keys: AdcpJsonWebKey[]);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    resolve(keyid: string, _signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
 }

package/dist/lib/signing/jwks.d.ts

@@ -13,12 +13,20 @@ export interface JwksResolution {
     operatorAuthorizationValidUntil?: number;
 }
 export interface JwksResolver {
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    /**
+     * Optional signer-origin locator for resolvers serving multiple signers.
+     * It is unverified request context, never proof of identity or authority.
+     * Origin-aware caches must scope entries by (canonical origin, keyid).
+     * Wrappers must forward it on both lookup methods. Existing one-argument
+     * implementations remain valid; static and HTTPS resolvers stay pinned to
+     * their configured key source and do not attribute identity from this value.
+     */
+    resolve(keyid: string, signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
     /** Optional metadata-aware lookup used by verifiers that must enforce delegation expiry at acceptance time. */
-    resolveWithMetadata?(keyid: string): Promise<JwksResolution>;
+    resolveWithMetadata?(keyid: string, signerOrigin?: string): Promise<JwksResolution>;
 }
 export declare class StaticJwksResolver implements JwksResolver {
     private readonly byKid;
     constructor(keys: AdcpJsonWebKey[]);
-    resolve(keyid: string): Promise<AdcpJsonWebKey | null>;
+    resolve(keyid: string, _signerOrigin?: string): Promise<AdcpJsonWebKey | null>;
 }

package/dist/lib/signing/jwks.js

@@ -26,7 +26,7 @@ class StaticJwksResolver {
   constructor(keys) {
     for (const k of keys) this.byKid.set(k.kid, k);
   }
-  async resolve(keyid) {
+  async resolve(keyid, _signerOrigin) {
     return this.byKid.get(keyid) ?? null;
   }
 }

package/dist/lib/signing/jwks.mjs

@@ -3,7 +3,7 @@ class StaticJwksResolver {
   constructor(keys) {
     for (const k of keys) this.byKid.set(k.kid, k);
   }
-  async resolve(keyid) {
+  async resolve(keyid, _signerOrigin) {
     return this.byKid.get(keyid) ?? null;
   }
 }

package/dist/lib/signing/parser.d.mts

@@ -23,7 +23,7 @@ export interface ParsedSignature {
     label: string;
     bytes: Uint8Array;
 }
-export declare function parseSignatureInput(headerValue: string): ParsedSignatureInput;
+export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
  * RFC 8941 §3.2 parsers deduplicate by keeping the last value. The AdCP

package/dist/lib/signing/parser.d.ts

@@ -23,7 +23,7 @@ export interface ParsedSignature {
     label: string;
     bytes: Uint8Array;
 }
-export declare function parseSignatureInput(headerValue: string): ParsedSignatureInput;
+export declare function parseSignatureInput(headerValue: string, expectedLabel?: string): ParsedSignatureInput;
 export declare function parseSignature(headerValue: string, expectedLabel: string, encoding?: SfBinaryEncoding): ParsedSignature;
 /**
  * RFC 8941 §3.2 parsers deduplicate by keeping the last value. The AdCP

package/dist/lib/signing/parser.js

@@ -31,7 +31,7 @@ const INTEGER_PARAMS = /* @__PURE__ */ new Set(["created", "expires"]);
 function malformed(message) {
   throw new import_errors.RequestSignatureError("request_signature_header_malformed", 1, message);
 }
-function parseSignatureInput(headerValue) {
+function parseSignatureInput(headerValue, expectedLabel) {
   rejectDuplicateDictionaryKeys(headerValue, "Signature-Input");
   let dict;
   try {
@@ -41,7 +41,8 @@ function parseSignatureInput(headerValue) {
     throw e;
   }
   if (dict.size === 0) malformed("Signature-Input header is empty");
-  const label = dict.has("sig1") ? "sig1" : dict.keys().next().value;
+  const label = expectedLabel ?? (dict.has("sig1") ? "sig1" : dict.keys().next().value);
+  if (!dict.has(label)) malformed("Signature-Input label is missing");
   const entry = dict.get(label);
   if (!isInnerList(entry)) {
     malformed("Signature-Input value must be a parenthesized component list");
@@ -49,7 +50,8 @@ function parseSignatureInput(headerValue) {
   const components = [];
   for (const [bare, itemParams] of entry[0]) {
     if (typeof bare !== "string") malformed("Signature-Input components must all be strings");
-    components.push(itemParams instanceof Map && itemParams.get("req") === true ? `${bare};req` : bare);
+    const serialized = (0, import_structured_headers.serializeItem)([bare, itemParams]);
+    components.push(`${bare}${serialized.slice(serialized.indexOf('"', 1) + 1)}`);
   }
   const params = {};
   for (const [key, value] of entry[1]) {

package/dist/lib/signing/parser.mjs

@@ -1,4 +1,4 @@
-import { ParseError, parseDictionary, serializeInnerList } from "structured-headers";
+import { ParseError, parseDictionary, serializeInnerList, serializeItem } from "structured-headers";
 import { RequestSignatureError } from "./errors.mjs";
 import { isPaddedStandardBase64 } from "./content-digest.mjs";
 const STRING_PARAMS = /* @__PURE__ */ new Set(["nonce", "keyid", "alg", "tag"]);
@@ -6,7 +6,7 @@ const INTEGER_PARAMS = /* @__PURE__ */ new Set(["created", "expires"]);
 function malformed(message) {
   throw new RequestSignatureError("request_signature_header_malformed", 1, message);
 }
-function parseSignatureInput(headerValue) {
+function parseSignatureInput(headerValue, expectedLabel) {
   rejectDuplicateDictionaryKeys(headerValue, "Signature-Input");
   let dict;
   try {
@@ -16,7 +16,8 @@ function parseSignatureInput(headerValue) {
     throw e;
   }
   if (dict.size === 0) malformed("Signature-Input header is empty");
-  const label = dict.has("sig1") ? "sig1" : dict.keys().next().value;
+  const label = expectedLabel ?? (dict.has("sig1") ? "sig1" : dict.keys().next().value);
+  if (!dict.has(label)) malformed("Signature-Input label is missing");
   const entry = dict.get(label);
   if (!isInnerList(entry)) {
     malformed("Signature-Input value must be a parenthesized component list");
@@ -24,7 +25,8 @@ function parseSignatureInput(headerValue) {
   const components = [];
   for (const [bare, itemParams] of entry[0]) {
     if (typeof bare !== "string") malformed("Signature-Input components must all be strings");
-    components.push(itemParams instanceof Map && itemParams.get("req") === true ? `${bare};req` : bare);
+    const serialized = serializeItem([bare, itemParams]);
+    components.push(`${bare}${serialized.slice(serialized.indexOf('"', 1) + 1)}`);
   }
   const params = {};
   for (const [key, value] of entry[1]) {

package/dist/lib/signing/revocation.d.mts

@@ -1,10 +1,13 @@
+import type { RevocationDetail } from '../identity-3.3/types.mjs';
 import type { RevocationSnapshot } from './types.mjs';
 export interface RevocationStore {
     isRevoked(keyid: string): Promise<boolean>;
 }
 export declare class InMemoryRevocationStore implements RevocationStore {
-    private revokedKids;
+    private readonly revokedKids;
+    private readonly details;
     constructor(snapshot?: RevocationSnapshot);
     load(snapshot: RevocationSnapshot): void;
+    getDetails(keyid: string): RevocationDetail | undefined;
     isRevoked(keyid: string): Promise<boolean>;
 }

package/dist/lib/signing/revocation.d.ts

@@ -1,10 +1,13 @@
+import type { RevocationDetail } from '../identity-3.3/types';
 import type { RevocationSnapshot } from './types';
 export interface RevocationStore {
     isRevoked(keyid: string): Promise<boolean>;
 }
 export declare class InMemoryRevocationStore implements RevocationStore {
-    private revokedKids;
+    private readonly revokedKids;
+    private readonly details;
     constructor(snapshot?: RevocationSnapshot);
     load(snapshot: RevocationSnapshot): void;
+    getDetails(keyid: string): RevocationDetail | undefined;
     isRevoked(keyid: string): Promise<boolean>;
 }

package/dist/lib/signing/revocation.js

@@ -18,22 +18,52 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var revocation_exports = {};
 __export(revocation_exports, {
-  InMemoryRevocationStore: () => InMemoryRevocationStore
+  InMemoryRevocationStore: () => InMemoryRevocationStore,
+  mergeRevocationDetails: () => mergeRevocationDetails
 });
 module.exports = __toCommonJS(revocation_exports);
 class InMemoryRevocationStore {
   revokedKids = /* @__PURE__ */ new Set();
+  details = /* @__PURE__ */ new Map();
   constructor(snapshot) {
     if (snapshot) this.load(snapshot);
   }
   load(snapshot) {
-    this.revokedKids = new Set(snapshot.revoked_kids);
+    if ((/* @__PURE__ */ new Set([...this.revokedKids, ...snapshot.revoked_kids])).size > 1e5)
+      throw new RangeError("Revocation store capacity exceeded");
+    for (const kid of snapshot.revoked_kids) {
+      this.revokedKids.add(kid);
+      const detail = snapshot.revocation_details?.[kid];
+      this.details.set(kid, mergeRevocationDetails(this.details.get(kid), detail ?? {}));
+    }
+  }
+  getDetails(keyid) {
+    const detail = this.details.get(keyid);
+    return detail && { ...detail };
   }
   async isRevoked(keyid) {
     return this.revokedKids.has(keyid);
   }
 }
+const REASONS = [
+  "removeFromCRL",
+  "unspecified",
+  "superseded",
+  "cessationOfOperation",
+  "affiliationChanged",
+  "certificateHold",
+  "privilegeWithdrawn",
+  "aACompromise",
+  "cACompromise",
+  "keyCompromise"
+];
+function mergeRevocationDetails(prior, detail) {
+  const reason = REASONS.indexOf(detail.reason ?? "unspecified") > REASONS.indexOf(prior?.reason ?? "unspecified") ? detail.reason : prior?.reason ?? detail.reason;
+  const dates = [prior?.invalidity_date, detail.invalidity_date].filter((s) => !!s && Number.isFinite(Date.parse(s))).sort((a, b) => Date.parse(a) - Date.parse(b));
+  return { ...reason ? { reason } : {}, ...dates[0] ? { invalidity_date: dates[0] } : {} };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  InMemoryRevocationStore
+  InMemoryRevocationStore,
+  mergeRevocationDetails
 });

package/dist/lib/signing/revocation.mjs

@@ -1,15 +1,44 @@
 class InMemoryRevocationStore {
   revokedKids = /* @__PURE__ */ new Set();
+  details = /* @__PURE__ */ new Map();
   constructor(snapshot) {
     if (snapshot) this.load(snapshot);
   }
   load(snapshot) {
-    this.revokedKids = new Set(snapshot.revoked_kids);
+    if ((/* @__PURE__ */ new Set([...this.revokedKids, ...snapshot.revoked_kids])).size > 1e5)
+      throw new RangeError("Revocation store capacity exceeded");
+    for (const kid of snapshot.revoked_kids) {
+      this.revokedKids.add(kid);
+      const detail = snapshot.revocation_details?.[kid];
+      this.details.set(kid, mergeRevocationDetails(this.details.get(kid), detail ?? {}));
+    }
+  }
+  getDetails(keyid) {
+    const detail = this.details.get(keyid);
+    return detail && { ...detail };
   }
   async isRevoked(keyid) {
     return this.revokedKids.has(keyid);
   }
 }
+const REASONS = [
+  "removeFromCRL",
+  "unspecified",
+  "superseded",
+  "cessationOfOperation",
+  "affiliationChanged",
+  "certificateHold",
+  "privilegeWithdrawn",
+  "aACompromise",
+  "cACompromise",
+  "keyCompromise"
+];
+function mergeRevocationDetails(prior, detail) {
+  const reason = REASONS.indexOf(detail.reason ?? "unspecified") > REASONS.indexOf(prior?.reason ?? "unspecified") ? detail.reason : prior?.reason ?? detail.reason;
+  const dates = [prior?.invalidity_date, detail.invalidity_date].filter((s) => !!s && Number.isFinite(Date.parse(s))).sort((a, b) => Date.parse(a) - Date.parse(b));
+  return { ...reason ? { reason } : {}, ...dates[0] ? { invalidity_date: dates[0] } : {} };
+}
 export {
-  InMemoryRevocationStore
+  InMemoryRevocationStore,
+  mergeRevocationDetails
 };

package/dist/lib/signing/server.d.mts

@@ -30,5 +30,5 @@ export { createWebhookVerifier, isWebhookLoopbackHost, verifyWebhookSignature, W
 export { createExpressVerifier, type ExpressLike, type ExpressMiddlewareOptions } from './middleware.mjs';
 export { finalizeResponseSignature, prepareResponseSignature, signResponse, type PreparedResponseSignature, type SignedResponse, type SignResponseOptions, } from './signer.mjs';
 export { signResponseAsync } from './signer-async.mjs';
-export { resolveAgent, ResolvedAgentJwksResolver, getAgentJwks, createAgentJwksSet, AgentResolverError, attackerInfluencedFields, ATTACKER_INFLUENCED, readBrandJsonUrl, readIdentityPosture, type AgentResolution, type AgentProtocol, type AuthorizedOperatorScope, type DelegatedOperatorAuthorizationContext, type AgentResolverErrorCode, type AgentResolverErrorDetail, type AgentEntry, type AgentJwksResult, type CapabilitiesWithBrandJsonUrl, type CreateAgentJwksSetOptions, type FetchCapabilitiesFn, type GetAgentJwksOptions, type IdentityKeyOriginPurpose, type IdentityKeyOrigins, type IdentityPosture, type ResolveAgentOptions, type ResolvedAgentJwksResolverOptions, type TraceStep, } from './agent-resolver/index.mjs';
+export { resolveAgent, ResolvedAgentJwksResolver, canonicalAgentOrigin, CanonicalizeError, getAgentJwks, createAgentJwksSet, AgentResolverError, attackerInfluencedFields, ATTACKER_INFLUENCED, readBrandJsonUrl, readIdentityPosture, type AgentResolution, type AgentProtocol, type AuthorizedOperatorScope, type DelegatedOperatorAuthorizationContext, type AgentResolverErrorCode, type AgentResolverErrorDetail, type AgentEntry, type AgentJwksResult, type CapabilitiesWithBrandJsonUrl, type CreateAgentJwksSetOptions, type FetchCapabilitiesFn, type GetAgentJwksOptions, type IdentityKeyOriginPurpose, type IdentityKeyOrigins, type IdentityPosture, type ResolveAgentOptions, type ResolvedAgentJwksResolverOptions, type TraceStep, } from './agent-resolver/index.mjs';
 export type { PublisherSigningKeyPin } from './publisher-pins.mjs';

package/dist/lib/signing/server.d.ts

@@ -30,5 +30,5 @@ export { createWebhookVerifier, isWebhookLoopbackHost, verifyWebhookSignature, W
 export { createExpressVerifier, type ExpressLike, type ExpressMiddlewareOptions } from './middleware';
 export { finalizeResponseSignature, prepareResponseSignature, signResponse, type PreparedResponseSignature, type SignedResponse, type SignResponseOptions, } from './signer';
 export { signResponseAsync } from './signer-async';
-export { resolveAgent, ResolvedAgentJwksResolver, getAgentJwks, createAgentJwksSet, AgentResolverError, attackerInfluencedFields, ATTACKER_INFLUENCED, readBrandJsonUrl, readIdentityPosture, type AgentResolution, type AgentProtocol, type AuthorizedOperatorScope, type DelegatedOperatorAuthorizationContext, type AgentResolverErrorCode, type AgentResolverErrorDetail, type AgentEntry, type AgentJwksResult, type CapabilitiesWithBrandJsonUrl, type CreateAgentJwksSetOptions, type FetchCapabilitiesFn, type GetAgentJwksOptions, type IdentityKeyOriginPurpose, type IdentityKeyOrigins, type IdentityPosture, type ResolveAgentOptions, type ResolvedAgentJwksResolverOptions, type TraceStep, } from './agent-resolver';
+export { resolveAgent, ResolvedAgentJwksResolver, canonicalAgentOrigin, CanonicalizeError, getAgentJwks, createAgentJwksSet, AgentResolverError, attackerInfluencedFields, ATTACKER_INFLUENCED, readBrandJsonUrl, readIdentityPosture, type AgentResolution, type AgentProtocol, type AuthorizedOperatorScope, type DelegatedOperatorAuthorizationContext, type AgentResolverErrorCode, type AgentResolverErrorDetail, type AgentEntry, type AgentJwksResult, type CapabilitiesWithBrandJsonUrl, type CreateAgentJwksSetOptions, type FetchCapabilitiesFn, type GetAgentJwksOptions, type IdentityKeyOriginPurpose, type IdentityKeyOrigins, type IdentityPosture, type ResolveAgentOptions, type ResolvedAgentJwksResolverOptions, type TraceStep, } from './agent-resolver';
 export type { PublisherSigningKeyPin } from './publisher-pins';

package/dist/lib/signing/server.js

@@ -24,6 +24,7 @@ __export(server_exports, {
   BrandJsonJwksResolver: () => import_brand_jwks.BrandJsonJwksResolver,
   BrandJsonResolverError: () => import_brand_jwks.BrandJsonResolverError,
   CLOCK_SKEW_TOLERANCE_SECONDS: () => import_types.CLOCK_SKEW_TOLERANCE_SECONDS,
+  CanonicalizeError: () => import_agent_resolver.CanonicalizeError,
   HttpsJwksResolver: () => import_jwks_https.HttpsJwksResolver,
   HttpsRevocationStore: () => import_revocation_https.HttpsRevocationStore,
   InMemoryReplayStore: () => import_replay.InMemoryReplayStore,
@@ -48,6 +49,7 @@ __export(server_exports, {
   attackerInfluencedFields: () => import_agent_resolver.attackerInfluencedFields,
   buildResponseSignatureBase: () => import_canonicalize.buildResponseSignatureBase,
   buildSignatureBase: () => import_canonicalize.buildSignatureBase,
+  canonicalAgentOrigin: () => import_agent_resolver.canonicalAgentOrigin,
   canonicalAuthority: () => import_canonicalize.canonicalAuthority,
   canonicalMethod: () => import_canonicalize.canonicalMethod,
   canonicalTargetUri: () => import_canonicalize.canonicalTargetUri,
@@ -114,6 +116,7 @@ var import_agent_resolver = require('./agent-resolver/index.js');
   BrandJsonJwksResolver,
   BrandJsonResolverError,
   CLOCK_SKEW_TOLERANCE_SECONDS,
+  CanonicalizeError,
   HttpsJwksResolver,
   HttpsRevocationStore,
   InMemoryReplayStore,
@@ -138,6 +141,7 @@ var import_agent_resolver = require('./agent-resolver/index.js');
   attackerInfluencedFields,
   buildResponseSignatureBase,
   buildSignatureBase,
+  canonicalAgentOrigin,
   canonicalAuthority,
   canonicalMethod,
   canonicalTargetUri,

package/dist/lib/signing/server.mjs

@@ -74,6 +74,8 @@ import { signResponseAsync } from "./signer-async.mjs";
 import {
   resolveAgent,
   ResolvedAgentJwksResolver,
+  canonicalAgentOrigin,
+  CanonicalizeError,
   getAgentJwks,
   createAgentJwksSet,
   AgentResolverError,
@@ -89,6 +91,7 @@ export {
   BrandJsonJwksResolver,
   BrandJsonResolverError,
   CLOCK_SKEW_TOLERANCE_SECONDS,
+  CanonicalizeError,
   HttpsJwksResolver,
   HttpsRevocationStore,
   InMemoryReplayStore,
@@ -113,6 +116,7 @@ export {
   attackerInfluencedFields,
   buildResponseSignatureBase,
   buildSignatureBase,
+  canonicalAgentOrigin,
   canonicalAuthority,
   canonicalMethod,
   canonicalTargetUri,

package/dist/lib/signing/types.d.mts

@@ -1,5 +1,7 @@
 export type ContentDigestPolicy = 'required' | 'forbidden' | 'either';
 export interface VerifierCapability {
+    profiles?: ('adcp/request-signing/v1' | 'web-bot-auth')[];
+    wba_draft_revision?: string;
     supported: boolean;
     covers_content_digest: ContentDigestPolicy;
     required_for: string[];
@@ -46,6 +48,7 @@ export interface RevocationSnapshot {
     next_update: string;
     revoked_kids: string[];
     revoked_jtis: string[];
+    revocation_details?: Record<string, import('../identity-3.3/types.mjs').RevocationDetail>;
 }
 /**
  * Narrow "successfully verified" shape. Middleware sets `req.verifiedSigner`

package/dist/lib/signing/types.d.ts

@@ -1,5 +1,7 @@
 export type ContentDigestPolicy = 'required' | 'forbidden' | 'either';
 export interface VerifierCapability {
+    profiles?: ('adcp/request-signing/v1' | 'web-bot-auth')[];
+    wba_draft_revision?: string;
     supported: boolean;
     covers_content_digest: ContentDigestPolicy;
     required_for: string[];
@@ -46,6 +48,7 @@ export interface RevocationSnapshot {
     next_update: string;
     revoked_kids: string[];
     revoked_jtis: string[];
+    revocation_details?: Record<string, import('../identity-3.3/types').RevocationDetail>;
 }
 /**
  * Narrow "successfully verified" shape. Middleware sets `req.verifiedSigner`