@adcp/sdk 15.9.1 → 16.0.0-beta.2

package/dist/lib/identity-3.3/trust.d.ts

@@ -0,0 +1,155 @@
+import { type SsrfFetchOptions } from '../net';
+import type { TrustRecord, TrustAgent, AgentGrantDeniedDetails } from './types';
+export declare function validateIdentity33Schema(id: string, value: unknown): boolean;
+export declare class IdentityAuthorizationError extends Error {
+    readonly code = "PERMISSION_DENIED";
+    readonly details: AgentGrantDeniedDetails | undefined;
+    constructor(reason?: 'authorization_failed' | 'grant_absent');
+}
+/**
+ * The trust record could not be read (transport error, outage, capacity,
+ * invalid content). A fetch failure is never absence or delisting: spend
+ * fails closed with a retryable SERVICE_UNAVAILABLE, other calls continue
+ * under an existing binding.
+ */
+export declare class TrustRecordUnavailableError extends IdentityAuthorizationError {
+    readonly transient: true;
+    /**
+     * Set by `match()`: the last record read for this operator listed the origin
+     * with the role and is still within the seller's outage bound
+     * (`maxOutageContinuationSeconds` past its freshness). Only then may non-spend
+     * calls continue under a binding.
+     */
+    lastKnownListed: boolean;
+    constructor();
+}
+/**
+ * The operator's last record read does not list the origin with the required
+ * role (`unlisted`; operators retire agents by publishing an empty `agents[]`),
+ * or the operator has never published one (`absent`).
+ */
+export declare class TrustMembershipError extends IdentityAuthorizationError {
+    readonly membership: 'unlisted' | 'absent';
+    constructor(membership?: 'unlisted' | 'absent');
+}
+/** Schema plus semantic checks; publication never includes identity keys. */
+export declare function validateTrustRecord(value: unknown): asserts value is TrustRecord;
+export declare function createTrustRecord(record: TrustRecord): TrustRecord;
+export type TrustFetchResult = {
+    status: 'present';
+    operator: string;
+    record: TrustRecord;
+    checkedAt: number;
+    freshUntil: number;
+} | {
+    status: 'absent';
+    operator: string;
+    checkedAt: number;
+    freshUntil: number;
+};
+export interface TrustEvaluatorOptions {
+    /** Matches configured revocation polling: one minute through thirty minutes. */
+    pollingIntervalSeconds?: number;
+    /**
+     * Seller policy: how long past the last listing record's freshness a bound
+     * origin's non-spend calls may continue while its operator's record cannot
+     * be read. Spend never continues on an outage. Default four polling
+     * intervals.
+     */
+    maxOutageContinuationSeconds?: number;
+    now?: () => number;
+    fetchOptions?: Pick<SsrfFetchOptions, 'lookup' | 'trustedFetchFn'>;
+    maxEntries?: number;
+    /**
+     * Process-local authority history only: operators remembered per hosting
+     * provider, i.e. per ICANN registrable domain of a PSL PRIVATE-section name
+     * (every `*.vercel.app`, `*.s3.<region>.amazonaws.com` or
+     * `*.<project>.platformsh.site` operator shares one budget). ICANN
+     * registrable domains each count once. Default 32.
+     */
+    maxAuthoritativeOperatorsPerPrivateSuffix?: number;
+    /**
+     * Process-local authority history only: total slots all PRIVATE-section
+     * operators may hold together, so registrants of ICANN domains always keep
+     * headroom. Default half of `maxEntries`.
+     */
+    maxPrivateAuthoritativeOperators?: number;
+    maxConcurrentFetches?: number;
+    /** Share authoritative-history across restarts/replicas when legacy fallback is enabled. */
+    authorityHistory?: {
+        has(operator: string): Promise<boolean>;
+        mark(operator: string): Promise<void>;
+    };
+}
+/** Used by binding/grants/onboarding, never by cryptographic verification. */
+export declare class TrustEvaluator {
+    private readonly options;
+    private readonly cache;
+    private readonly negative;
+    private readonly pending;
+    private readonly urlRequests;
+    /** Keyed by (operator, host): one operator's authoritative_location hops never spend another's budget. */
+    private readonly hostRates;
+    private readonly authoritativeOperators;
+    /** Remembered authoritative operators per budget group (see authorityGroup). */
+    private readonly authorityGroups;
+    private privateAuthorityOperators;
+    readonly pollingIntervalSeconds: number;
+    readonly maxOutageContinuationSeconds: number;
+    constructor(options?: TrustEvaluatorOptions);
+    get(domainOrOrigin: string, force?: boolean): Promise<TrustFetchResult>;
+    match(origin: string, role: string, countries?: readonly string[]): Promise<{
+        operator: string;
+        agent: TrustAgent;
+        record: TrustRecord;
+        freshUntil: number;
+    }>;
+    invalidate(domain: string): void;
+    /**
+     * Record that `operator` served a trust record. With durable history the
+     * in-memory set is only a cache and may evict; without it, nothing is
+     * evicted and an operator over its group budget or the total is refused.
+     */
+    private rememberAuthority;
+    /**
+     * Process-local view only. With durable `authorityHistory` this set is a
+     * cache and may have evicted an operator that durable history still records.
+     */
+    hasAuthoritativeRecord(domain: string): boolean;
+    private now;
+    private request;
+    private fetch;
+}
+export interface DemandGrantClaim {
+    /** Only pass identity from an actual verifier. */
+    signerOrigin: string;
+    brand: {
+        domain: string;
+        brand_id?: string;
+        countries?: readonly string[];
+    };
+    accountOperator: string;
+    scope: string;
+}
+export interface DemandGrantAuthorization {
+    source: 'implicit' | 'trust' | 'seller' | 'legacy';
+    operator: string;
+    expiresAt?: number;
+    checkedAt: number;
+    chain: string[];
+}
+export interface DemandGrantOptions {
+    evaluator: TrustEvaluator;
+    now?: () => number;
+    /** Only evaluated for nonexclusive uncovered claims, never fetch failures. */
+    sellerAuthorization?: (claim: DemandGrantClaim) => Promise<boolean>;
+    /** Only for authoritative absence; never after a 200 or an exclusive record. */
+    legacyAuthorization?: (claim: DemandGrantClaim) => Promise<boolean>;
+    /** Seller-verified brand identity resolution, including the house's child-brand ID. Never accept a buyer-selected authorizer. */
+    resolveBrandHouse?: (brand: DemandGrantClaim['brand']) => Promise<{
+        domain: string;
+        brand_id: string;
+    } | undefined>;
+}
+/** Always invoke before sync_accounts side effects and before spend. No account mutation. */
+export declare function authorizeDemandGrant(claim: DemandGrantClaim, options: DemandGrantOptions): Promise<DemandGrantAuthorization>;

package/dist/lib/identity-3.3/trust.js

@@ -0,0 +1,383 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var trust_exports = {};
+__export(trust_exports, {
+  IdentityAuthorizationError: () => IdentityAuthorizationError,
+  TrustEvaluator: () => TrustEvaluator,
+  TrustMembershipError: () => TrustMembershipError,
+  TrustRecordUnavailableError: () => TrustRecordUnavailableError,
+  authorizeDemandGrant: () => authorizeDemandGrant,
+  createTrustRecord: () => createTrustRecord,
+  validateIdentity33Schema: () => validateIdentity33Schema,
+  validateTrustRecord: () => validateTrustRecord
+});
+module.exports = __toCommonJS(trust_exports);
+var import_ajv = __toESM(require("ajv"));
+var import_ajv_formats = __toESM(require("ajv-formats"));
+var import_net = require('../net/index.js');
+var import_canonicalize = require('../signing/agent-resolver/canonicalize.js');
+var import_etld = require('../signing/agent-resolver/etld.js');
+var import_strict_json = require('../signing/agent-resolver/strict-json.js');
+var import_tldts = require("tldts");
+var import_schemas = __toESM(require('./schemas.draft.js'));
+const ajv = new import_ajv.default({ strict: false, allErrors: false });
+(0, import_ajv_formats.default)(ajv);
+for (const schema of import_schemas.default) ajv.addSchema(schema);
+function validateIdentity33Schema(id, value) {
+  return ajv.getSchema(`/schemas/${id}.json`)?.(value) === true;
+}
+class IdentityAuthorizationError extends Error {
+  code = "PERMISSION_DENIED";
+  details;
+  constructor(reason = "authorization_failed") {
+    super(reason === "grant_absent" ? "Agent authority is not granted" : "Agent authorization failed");
+    this.name = "IdentityAuthorizationError";
+    this.details = reason === "grant_absent" ? { scope: "agent", reason } : void 0;
+  }
+}
+class TrustRecordUnavailableError extends IdentityAuthorizationError {
+  transient = true;
+  /**
+   * Set by `match()`: the last record read for this operator listed the origin
+   * with the role and is still within the seller's outage bound
+   * (`maxOutageContinuationSeconds` past its freshness). Only then may non-spend
+   * calls continue under a binding.
+   */
+  lastKnownListed = false;
+  constructor() {
+    super();
+    this.name = "TrustRecordUnavailableError";
+    this.message = "Agent trust record is temporarily unavailable";
+  }
+}
+class TrustMembershipError extends IdentityAuthorizationError {
+  constructor(membership = "unlisted") {
+    super();
+    this.membership = membership;
+    this.name = "TrustMembershipError";
+  }
+  membership;
+}
+function unavailable(cause) {
+  const error = new TrustRecordUnavailableError();
+  if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
+  throw error;
+}
+class TrustHostCapacityError extends Error {
+}
+const FOREIGN_HOST_BUDGET = "\0foreign";
+const OWN_HOST_REQUESTS_PER_MINUTE = 10;
+const FOREIGN_HOST_REQUESTS_PER_MINUTE = 30;
+function failure(cause) {
+  const error = new IdentityAuthorizationError();
+  if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
+  throw error;
+}
+function validateTrustRecord(value) {
+  if (!validateIdentity33Schema("trust/v1/trust", value)) failure();
+  const record = value;
+  const origins = /* @__PURE__ */ new Set();
+  for (const agent of record.agents ?? []) {
+    if (agent.jwks_uri !== void 0) failure();
+    const origin = (0, import_canonicalize.canonicalAgentOrigin)(agent.url);
+    if (origins.has(origin)) failure();
+    origins.add(origin);
+  }
+}
+function createTrustRecord(record) {
+  validateTrustRecord(record);
+  return structuredClone(record);
+}
+class TrustEvaluator {
+  constructor(options = {}) {
+    this.options = options;
+    this.pollingIntervalSeconds = options.pollingIntervalSeconds ?? 300;
+    this.maxOutageContinuationSeconds = options.maxOutageContinuationSeconds ?? 4 * this.pollingIntervalSeconds;
+    if (!Number.isFinite(this.maxOutageContinuationSeconds) || this.maxOutageContinuationSeconds < 0)
+      throw new TypeError("maxOutageContinuationSeconds must be a finite, non-negative number");
+    if (!Number.isFinite(this.pollingIntervalSeconds) || this.pollingIntervalSeconds < 60 || this.pollingIntervalSeconds > 1800)
+      throw new TypeError("Trust polling interval must be 60\u20131800 seconds");
+  }
+  options;
+  cache = /* @__PURE__ */ new Map();
+  negative = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  urlRequests = /* @__PURE__ */ new Map();
+  /** Keyed by (operator, host): one operator's authoritative_location hops never spend another's budget. */
+  hostRates = /* @__PURE__ */ new Map();
+  authoritativeOperators = /* @__PURE__ */ new Set();
+  /** Remembered authoritative operators per budget group (see authorityGroup). */
+  authorityGroups = /* @__PURE__ */ new Map();
+  privateAuthorityOperators = 0;
+  pollingIntervalSeconds;
+  maxOutageContinuationSeconds;
+  async get(domainOrOrigin, force = false) {
+    let operator;
+    try {
+      operator = (0, import_etld.eTldPlusOne)(domainOrOrigin);
+    } catch {
+      return failure();
+    }
+    const now = this.now();
+    const cached = this.cache.get(operator);
+    if (!force && cached && cached.freshUntil > now) return cached;
+    if ((this.negative.get(operator) ?? 0) > now) unavailable();
+    let pending = this.pending.get(operator);
+    if (!pending) {
+      if (this.pending.size >= (this.options.maxConcurrentFetches ?? 16)) unavailable();
+      pending = this.fetch(operator, now);
+      this.pending.set(operator, pending);
+    }
+    try {
+      return await pending;
+    } finally {
+      if (this.pending.get(operator) === pending) this.pending.delete(operator);
+    }
+  }
+  async match(origin, role, countries) {
+    const canonical = (0, import_canonicalize.canonicalAgentOrigin)(origin);
+    let result;
+    try {
+      result = await this.get(canonical);
+    } catch (error) {
+      if (!(error instanceof TrustRecordUnavailableError)) throw error;
+      const last = this.cache.get((0, import_etld.eTldPlusOne)(canonical));
+      if (last && !listedAgent(last, canonical, role))
+        throw new TrustMembershipError(last.status === "present" ? "unlisted" : "absent");
+      error.lastKnownListed = !!last && this.now() <= last.freshUntil + this.maxOutageContinuationSeconds;
+      throw error;
+    }
+    const agent = listedAgent(result, canonical, role);
+    if (result.status !== "present") throw new TrustMembershipError("absent");
+    if (!agent) throw new TrustMembershipError();
+    if (agent.countries && countries?.length && countries.some((country) => !agent.countries.includes(country)))
+      failure();
+    return { operator: result.operator, agent, record: result.record, freshUntil: result.freshUntil };
+  }
+  invalidate(domain) {
+    this.cache.delete((0, import_etld.eTldPlusOne)(domain));
+  }
+  /**
+   * Record that `operator` served a trust record. With durable history the
+   * in-memory set is only a cache and may evict; without it, nothing is
+   * evicted and an operator over its group budget or the total is refused.
+   */
+  rememberAuthority(operator, durable) {
+    if (this.authoritativeOperators.has(operator)) return true;
+    const max = this.options.maxEntries ?? 1e3;
+    if (durable) {
+      if (this.authoritativeOperators.size >= max)
+        this.authoritativeOperators.delete(this.authoritativeOperators.values().next().value);
+      this.authoritativeOperators.add(operator);
+      return true;
+    }
+    const group = authorityGroup(operator);
+    const hosted = group !== operator;
+    if (this.authoritativeOperators.size >= max || hosted && (this.privateAuthorityOperators >= (this.options.maxPrivateAuthoritativeOperators ?? Math.floor(max / 2)) || (this.authorityGroups.get(group) ?? 0) >= (this.options.maxAuthoritativeOperatorsPerPrivateSuffix ?? 32)))
+      return false;
+    this.authoritativeOperators.add(operator);
+    if (hosted) {
+      this.privateAuthorityOperators++;
+      this.authorityGroups.set(group, (this.authorityGroups.get(group) ?? 0) + 1);
+    }
+    return true;
+  }
+  /**
+   * Process-local view only. With durable `authorityHistory` this set is a
+   * cache and may have evicted an operator that durable history still records.
+   */
+  hasAuthoritativeRecord(domain) {
+    return this.authoritativeOperators.has((0, import_etld.eTldPlusOne)(domain));
+  }
+  now() {
+    return (this.options.now ?? (() => Date.now() / 1e3))();
+  }
+  async request(url, operator) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash) failure();
+    let own = false;
+    try {
+      own = (0, import_etld.eTldPlusOne)(parsed.hostname) === operator;
+    } catch {
+    }
+    const host = JSON.stringify([own ? operator : FOREIGN_HOST_BUDGET, parsed.hostname]);
+    const limit = own ? OWN_HOST_REQUESTS_PER_MINUTE : FOREIGN_HOST_REQUESTS_PER_MINUTE;
+    const pending = this.urlRequests.get(url);
+    if (pending) return pending;
+    const now = this.now(), rate = this.hostRates.get(host);
+    if (rate && now - rate.started < 60 && rate.count >= limit) throw new TrustHostCapacityError();
+    if (!rate && this.hostRates.size >= (this.options.maxEntries ?? 1e3))
+      this.hostRates.delete(this.hostRates.keys().next().value);
+    this.hostRates.set(
+      host,
+      rate && now - rate.started < 60 ? { ...rate, count: rate.count + 1 } : { started: now, count: 1 }
+    );
+    const request = (0, import_net.ssrfSafeFetch)(url, {
+      ...this.options.fetchOptions,
+      maxBodyBytes: 2 * 1024 * 1024,
+      timeoutMs: 1e4,
+      headers: { accept: "application/json" }
+    });
+    this.urlRequests.set(url, request);
+    try {
+      return await request;
+    } finally {
+      if (this.urlRequests.get(url) === request) this.urlRequests.delete(url);
+    }
+  }
+  async fetch(operator, now) {
+    try {
+      let response = await this.request(`https://${operator}/.well-known/trust.json`, operator);
+      let result;
+      if (response.status === 404 || response.status === 410) {
+        if (this.authoritativeOperators.has(operator) || await this.options.authorityHistory?.has(operator))
+          failure();
+        result = { status: "absent", operator, checkedAt: now, freshUntil: now + 60 };
+      } else {
+        if (response.status !== 200) failure();
+        if (this.options.authorityHistory) {
+          await this.options.authorityHistory.mark(operator);
+          this.rememberAuthority(operator, true);
+        } else if (!this.rememberAuthority(operator, false)) {
+          failure();
+        }
+        let record = (0, import_strict_json.parseStrictJson)(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
+        validateTrustRecord(record);
+        if (record.authoritative_location) {
+          response = await this.request(record.authoritative_location, operator);
+          if (response.status !== 200) failure();
+          record = (0, import_strict_json.parseStrictJson)(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
+          validateTrustRecord(record);
+          if (record.authoritative_location) failure();
+        }
+        result = {
+          status: "present",
+          operator,
+          record,
+          checkedAt: now,
+          freshUntil: now + this.pollingIntervalSeconds
+        };
+      }
+      const max = this.options.maxEntries ?? 1e3;
+      if (this.cache.size >= max && !this.cache.has(operator)) this.cache.delete(this.cache.keys().next().value);
+      this.cache.set(operator, result);
+      this.negative.delete(operator);
+      return result;
+    } catch (cause) {
+      if (cause instanceof TrustHostCapacityError) return unavailable(cause);
+      if (this.negative.size >= (this.options.maxEntries ?? 1e3))
+        this.negative.delete(this.negative.keys().next().value);
+      this.negative.set(operator, now + 60);
+      return unavailable(cause);
+    }
+  }
+}
+function listedAgent(result, origin, role) {
+  if (result.status !== "present") return void 0;
+  const entries = (result.record.agents ?? []).filter((agent) => (0, import_canonicalize.canonicalAgentOrigin)(agent.url) === origin);
+  return entries.length === 1 && entries[0].roles.includes(role) ? entries[0] : void 0;
+}
+function authorityGroup(operator) {
+  if (!(0, import_tldts.parse)(operator, { allowPrivateDomains: true }).isPrivate) return operator;
+  const provider = (0, import_tldts.parse)(operator).domain;
+  return `private:${provider ?? operator}`;
+}
+function grantMatches(grant, target, claim, now) {
+  if ((0, import_etld.eTldPlusOne)(grant.grantee) !== target) return false;
+  if (!grant.scopes.some(
+    (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
+  ))
+    return false;
+  if (grant.agents && !grant.agents.some((agent) => (0, import_canonicalize.canonicalAgentOrigin)(agent.url) === (0, import_canonicalize.canonicalAgentOrigin)(claim.signerOrigin)))
+    return false;
+  const brands = grant.profiles?.adcp?.brands;
+  if (brands && !brands.includes("*") && (!claim.brand.brand_id || !brands.includes(claim.brand.brand_id)))
+    return false;
+  if (grant.countries && (!claim.brand.countries?.length || claim.brand.countries.some((country) => !grant.countries.includes(country))))
+    return false;
+  if (grant.valid_from && Date.parse(grant.valid_from) / 1e3 > now) return false;
+  if (grant.valid_until && Date.parse(grant.valid_until) / 1e3 <= now) return false;
+  return true;
+}
+async function authorizeDemandGrant(claim, options) {
+  const now = (options.now ?? (() => Date.now() / 1e3))();
+  const signer = await options.evaluator.match(claim.signerOrigin, "adcp:buying", claim.brand.countries);
+  if (signer.agent.countries && !claim.brand.countries?.length) failure();
+  const brand = (0, import_etld.eTldPlusOne)(claim.brand.domain), account = (0, import_etld.eTldPlusOne)(claim.accountOperator), operator = signer.operator;
+  const result = (source, chain, grants = []) => ({
+    source,
+    chain,
+    operator,
+    checkedAt: now,
+    ...grants.some((g) => g.valid_until) ? { expiresAt: Math.min(...grants.map((g) => g.valid_until ? Date.parse(g.valid_until) / 1e3 : Infinity)) } : {}
+  });
+  if (brand === operator && account === operator) return result("implicit", [brand]);
+  if (brand === operator && account !== operator) throw new IdentityAuthorizationError("grant_absent");
+  const house = await options.resolveBrandHouse?.(claim.brand);
+  const authoritativeBrand = house ? (0, import_etld.eTldPlusOne)(house.domain) : brand;
+  const grantClaim = house ? { ...claim, brand: { ...claim.brand, brand_id: house.brand_id } } : claim;
+  const record = await options.evaluator.get(authoritativeBrand);
+  if (record.status === "absent") {
+    if (await options.legacyAuthorization?.(claim)) return result("legacy", [brand, account, operator]);
+    throw new IdentityAuthorizationError("grant_absent");
+  }
+  const first = (record.record.grants ?? []).filter((g) => grantMatches(g, account, grantClaim, now));
+  if (account === operator && first.length) return result("trust", [brand, operator], [first[0]]);
+  const selfOperated = account === brand || account === authoritativeBrand;
+  if (selfOperated && account !== operator) {
+    const direct = (record.record.grants ?? []).find((g) => grantMatches(g, operator, grantClaim, now));
+    if (direct) return result("trust", [brand, operator], [direct]);
+  }
+  if (account !== operator && account !== brand && first.length) {
+    const intermediary = await options.evaluator.get(account);
+    if (intermediary.status === "present") {
+      const second = (intermediary.record.grants ?? []).find((g) => grantMatches(g, operator, grantClaim, now));
+      if (second) return result("trust", [brand, account, operator], [first[0], second]);
+    }
+  }
+  const covered = (record.record.grants ?? []).some(
+    (g) => ((0, import_etld.eTldPlusOne)(g.grantee) === account || selfOperated && (0, import_etld.eTldPlusOne)(g.grantee) === operator) && g.scopes.some(
+      (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
+    )
+  );
+  if (!covered && !record.record.exclusive_grants && await options.sellerAuthorization?.(claim))
+    return result("seller", [brand, account, operator]);
+  throw new IdentityAuthorizationError("grant_absent");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IdentityAuthorizationError,
+  TrustEvaluator,
+  TrustMembershipError,
+  TrustRecordUnavailableError,
+  authorizeDemandGrant,
+  createTrustRecord,
+  validateIdentity33Schema,
+  validateTrustRecord
+});