@adcp/sdk 15.9.1 → 16.0.0-beta.2

package/dist/lib/identity-3.3/trust.mjs

@@ -0,0 +1,342 @@
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
+import { ssrfSafeFetch } from "../net/index.mjs";
+import { canonicalAgentOrigin } from "../signing/agent-resolver/canonicalize.mjs";
+import { eTldPlusOne } from "../signing/agent-resolver/etld.mjs";
+import { parseStrictJson } from "../signing/agent-resolver/strict-json.mjs";
+import { parse as parseDomain } from "tldts";
+import schemas from "./schemas.draft.mjs";
+const ajv = new Ajv({ strict: false, allErrors: false });
+addFormats(ajv);
+for (const schema of schemas) ajv.addSchema(schema);
+function validateIdentity33Schema(id, value) {
+  return ajv.getSchema(`/schemas/${id}.json`)?.(value) === true;
+}
+class IdentityAuthorizationError extends Error {
+  code = "PERMISSION_DENIED";
+  details;
+  constructor(reason = "authorization_failed") {
+    super(reason === "grant_absent" ? "Agent authority is not granted" : "Agent authorization failed");
+    this.name = "IdentityAuthorizationError";
+    this.details = reason === "grant_absent" ? { scope: "agent", reason } : void 0;
+  }
+}
+class TrustRecordUnavailableError extends IdentityAuthorizationError {
+  transient = true;
+  /**
+   * Set by `match()`: the last record read for this operator listed the origin
+   * with the role and is still within the seller's outage bound
+   * (`maxOutageContinuationSeconds` past its freshness). Only then may non-spend
+   * calls continue under a binding.
+   */
+  lastKnownListed = false;
+  constructor() {
+    super();
+    this.name = "TrustRecordUnavailableError";
+    this.message = "Agent trust record is temporarily unavailable";
+  }
+}
+class TrustMembershipError extends IdentityAuthorizationError {
+  constructor(membership = "unlisted") {
+    super();
+    this.membership = membership;
+    this.name = "TrustMembershipError";
+  }
+  membership;
+}
+function unavailable(cause) {
+  const error = new TrustRecordUnavailableError();
+  if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
+  throw error;
+}
+class TrustHostCapacityError extends Error {
+}
+const FOREIGN_HOST_BUDGET = "\0foreign";
+const OWN_HOST_REQUESTS_PER_MINUTE = 10;
+const FOREIGN_HOST_REQUESTS_PER_MINUTE = 30;
+function failure(cause) {
+  const error = new IdentityAuthorizationError();
+  if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
+  throw error;
+}
+function validateTrustRecord(value) {
+  if (!validateIdentity33Schema("trust/v1/trust", value)) failure();
+  const record = value;
+  const origins = /* @__PURE__ */ new Set();
+  for (const agent of record.agents ?? []) {
+    if (agent.jwks_uri !== void 0) failure();
+    const origin = canonicalAgentOrigin(agent.url);
+    if (origins.has(origin)) failure();
+    origins.add(origin);
+  }
+}
+function createTrustRecord(record) {
+  validateTrustRecord(record);
+  return structuredClone(record);
+}
+class TrustEvaluator {
+  constructor(options = {}) {
+    this.options = options;
+    this.pollingIntervalSeconds = options.pollingIntervalSeconds ?? 300;
+    this.maxOutageContinuationSeconds = options.maxOutageContinuationSeconds ?? 4 * this.pollingIntervalSeconds;
+    if (!Number.isFinite(this.maxOutageContinuationSeconds) || this.maxOutageContinuationSeconds < 0)
+      throw new TypeError("maxOutageContinuationSeconds must be a finite, non-negative number");
+    if (!Number.isFinite(this.pollingIntervalSeconds) || this.pollingIntervalSeconds < 60 || this.pollingIntervalSeconds > 1800)
+      throw new TypeError("Trust polling interval must be 60\u20131800 seconds");
+  }
+  options;
+  cache = /* @__PURE__ */ new Map();
+  negative = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  urlRequests = /* @__PURE__ */ new Map();
+  /** Keyed by (operator, host): one operator's authoritative_location hops never spend another's budget. */
+  hostRates = /* @__PURE__ */ new Map();
+  authoritativeOperators = /* @__PURE__ */ new Set();
+  /** Remembered authoritative operators per budget group (see authorityGroup). */
+  authorityGroups = /* @__PURE__ */ new Map();
+  privateAuthorityOperators = 0;
+  pollingIntervalSeconds;
+  maxOutageContinuationSeconds;
+  async get(domainOrOrigin, force = false) {
+    let operator;
+    try {
+      operator = eTldPlusOne(domainOrOrigin);
+    } catch {
+      return failure();
+    }
+    const now = this.now();
+    const cached = this.cache.get(operator);
+    if (!force && cached && cached.freshUntil > now) return cached;
+    if ((this.negative.get(operator) ?? 0) > now) unavailable();
+    let pending = this.pending.get(operator);
+    if (!pending) {
+      if (this.pending.size >= (this.options.maxConcurrentFetches ?? 16)) unavailable();
+      pending = this.fetch(operator, now);
+      this.pending.set(operator, pending);
+    }
+    try {
+      return await pending;
+    } finally {
+      if (this.pending.get(operator) === pending) this.pending.delete(operator);
+    }
+  }
+  async match(origin, role, countries) {
+    const canonical = canonicalAgentOrigin(origin);
+    let result;
+    try {
+      result = await this.get(canonical);
+    } catch (error) {
+      if (!(error instanceof TrustRecordUnavailableError)) throw error;
+      const last = this.cache.get(eTldPlusOne(canonical));
+      if (last && !listedAgent(last, canonical, role))
+        throw new TrustMembershipError(last.status === "present" ? "unlisted" : "absent");
+      error.lastKnownListed = !!last && this.now() <= last.freshUntil + this.maxOutageContinuationSeconds;
+      throw error;
+    }
+    const agent = listedAgent(result, canonical, role);
+    if (result.status !== "present") throw new TrustMembershipError("absent");
+    if (!agent) throw new TrustMembershipError();
+    if (agent.countries && countries?.length && countries.some((country) => !agent.countries.includes(country)))
+      failure();
+    return { operator: result.operator, agent, record: result.record, freshUntil: result.freshUntil };
+  }
+  invalidate(domain) {
+    this.cache.delete(eTldPlusOne(domain));
+  }
+  /**
+   * Record that `operator` served a trust record. With durable history the
+   * in-memory set is only a cache and may evict; without it, nothing is
+   * evicted and an operator over its group budget or the total is refused.
+   */
+  rememberAuthority(operator, durable) {
+    if (this.authoritativeOperators.has(operator)) return true;
+    const max = this.options.maxEntries ?? 1e3;
+    if (durable) {
+      if (this.authoritativeOperators.size >= max)
+        this.authoritativeOperators.delete(this.authoritativeOperators.values().next().value);
+      this.authoritativeOperators.add(operator);
+      return true;
+    }
+    const group = authorityGroup(operator);
+    const hosted = group !== operator;
+    if (this.authoritativeOperators.size >= max || hosted && (this.privateAuthorityOperators >= (this.options.maxPrivateAuthoritativeOperators ?? Math.floor(max / 2)) || (this.authorityGroups.get(group) ?? 0) >= (this.options.maxAuthoritativeOperatorsPerPrivateSuffix ?? 32)))
+      return false;
+    this.authoritativeOperators.add(operator);
+    if (hosted) {
+      this.privateAuthorityOperators++;
+      this.authorityGroups.set(group, (this.authorityGroups.get(group) ?? 0) + 1);
+    }
+    return true;
+  }
+  /**
+   * Process-local view only. With durable `authorityHistory` this set is a
+   * cache and may have evicted an operator that durable history still records.
+   */
+  hasAuthoritativeRecord(domain) {
+    return this.authoritativeOperators.has(eTldPlusOne(domain));
+  }
+  now() {
+    return (this.options.now ?? (() => Date.now() / 1e3))();
+  }
+  async request(url, operator) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash) failure();
+    let own = false;
+    try {
+      own = eTldPlusOne(parsed.hostname) === operator;
+    } catch {
+    }
+    const host = JSON.stringify([own ? operator : FOREIGN_HOST_BUDGET, parsed.hostname]);
+    const limit = own ? OWN_HOST_REQUESTS_PER_MINUTE : FOREIGN_HOST_REQUESTS_PER_MINUTE;
+    const pending = this.urlRequests.get(url);
+    if (pending) return pending;
+    const now = this.now(), rate = this.hostRates.get(host);
+    if (rate && now - rate.started < 60 && rate.count >= limit) throw new TrustHostCapacityError();
+    if (!rate && this.hostRates.size >= (this.options.maxEntries ?? 1e3))
+      this.hostRates.delete(this.hostRates.keys().next().value);
+    this.hostRates.set(
+      host,
+      rate && now - rate.started < 60 ? { ...rate, count: rate.count + 1 } : { started: now, count: 1 }
+    );
+    const request = ssrfSafeFetch(url, {
+      ...this.options.fetchOptions,
+      maxBodyBytes: 2 * 1024 * 1024,
+      timeoutMs: 1e4,
+      headers: { accept: "application/json" }
+    });
+    this.urlRequests.set(url, request);
+    try {
+      return await request;
+    } finally {
+      if (this.urlRequests.get(url) === request) this.urlRequests.delete(url);
+    }
+  }
+  async fetch(operator, now) {
+    try {
+      let response = await this.request(`https://${operator}/.well-known/trust.json`, operator);
+      let result;
+      if (response.status === 404 || response.status === 410) {
+        if (this.authoritativeOperators.has(operator) || await this.options.authorityHistory?.has(operator))
+          failure();
+        result = { status: "absent", operator, checkedAt: now, freshUntil: now + 60 };
+      } else {
+        if (response.status !== 200) failure();
+        if (this.options.authorityHistory) {
+          await this.options.authorityHistory.mark(operator);
+          this.rememberAuthority(operator, true);
+        } else if (!this.rememberAuthority(operator, false)) {
+          failure();
+        }
+        let record = parseStrictJson(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
+        validateTrustRecord(record);
+        if (record.authoritative_location) {
+          response = await this.request(record.authoritative_location, operator);
+          if (response.status !== 200) failure();
+          record = parseStrictJson(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
+          validateTrustRecord(record);
+          if (record.authoritative_location) failure();
+        }
+        result = {
+          status: "present",
+          operator,
+          record,
+          checkedAt: now,
+          freshUntil: now + this.pollingIntervalSeconds
+        };
+      }
+      const max = this.options.maxEntries ?? 1e3;
+      if (this.cache.size >= max && !this.cache.has(operator)) this.cache.delete(this.cache.keys().next().value);
+      this.cache.set(operator, result);
+      this.negative.delete(operator);
+      return result;
+    } catch (cause) {
+      if (cause instanceof TrustHostCapacityError) return unavailable(cause);
+      if (this.negative.size >= (this.options.maxEntries ?? 1e3))
+        this.negative.delete(this.negative.keys().next().value);
+      this.negative.set(operator, now + 60);
+      return unavailable(cause);
+    }
+  }
+}
+function listedAgent(result, origin, role) {
+  if (result.status !== "present") return void 0;
+  const entries = (result.record.agents ?? []).filter((agent) => canonicalAgentOrigin(agent.url) === origin);
+  return entries.length === 1 && entries[0].roles.includes(role) ? entries[0] : void 0;
+}
+function authorityGroup(operator) {
+  if (!parseDomain(operator, { allowPrivateDomains: true }).isPrivate) return operator;
+  const provider = parseDomain(operator).domain;
+  return `private:${provider ?? operator}`;
+}
+function grantMatches(grant, target, claim, now) {
+  if (eTldPlusOne(grant.grantee) !== target) return false;
+  if (!grant.scopes.some(
+    (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
+  ))
+    return false;
+  if (grant.agents && !grant.agents.some((agent) => canonicalAgentOrigin(agent.url) === canonicalAgentOrigin(claim.signerOrigin)))
+    return false;
+  const brands = grant.profiles?.adcp?.brands;
+  if (brands && !brands.includes("*") && (!claim.brand.brand_id || !brands.includes(claim.brand.brand_id)))
+    return false;
+  if (grant.countries && (!claim.brand.countries?.length || claim.brand.countries.some((country) => !grant.countries.includes(country))))
+    return false;
+  if (grant.valid_from && Date.parse(grant.valid_from) / 1e3 > now) return false;
+  if (grant.valid_until && Date.parse(grant.valid_until) / 1e3 <= now) return false;
+  return true;
+}
+async function authorizeDemandGrant(claim, options) {
+  const now = (options.now ?? (() => Date.now() / 1e3))();
+  const signer = await options.evaluator.match(claim.signerOrigin, "adcp:buying", claim.brand.countries);
+  if (signer.agent.countries && !claim.brand.countries?.length) failure();
+  const brand = eTldPlusOne(claim.brand.domain), account = eTldPlusOne(claim.accountOperator), operator = signer.operator;
+  const result = (source, chain, grants = []) => ({
+    source,
+    chain,
+    operator,
+    checkedAt: now,
+    ...grants.some((g) => g.valid_until) ? { expiresAt: Math.min(...grants.map((g) => g.valid_until ? Date.parse(g.valid_until) / 1e3 : Infinity)) } : {}
+  });
+  if (brand === operator && account === operator) return result("implicit", [brand]);
+  if (brand === operator && account !== operator) throw new IdentityAuthorizationError("grant_absent");
+  const house = await options.resolveBrandHouse?.(claim.brand);
+  const authoritativeBrand = house ? eTldPlusOne(house.domain) : brand;
+  const grantClaim = house ? { ...claim, brand: { ...claim.brand, brand_id: house.brand_id } } : claim;
+  const record = await options.evaluator.get(authoritativeBrand);
+  if (record.status === "absent") {
+    if (await options.legacyAuthorization?.(claim)) return result("legacy", [brand, account, operator]);
+    throw new IdentityAuthorizationError("grant_absent");
+  }
+  const first = (record.record.grants ?? []).filter((g) => grantMatches(g, account, grantClaim, now));
+  if (account === operator && first.length) return result("trust", [brand, operator], [first[0]]);
+  const selfOperated = account === brand || account === authoritativeBrand;
+  if (selfOperated && account !== operator) {
+    const direct = (record.record.grants ?? []).find((g) => grantMatches(g, operator, grantClaim, now));
+    if (direct) return result("trust", [brand, operator], [direct]);
+  }
+  if (account !== operator && account !== brand && first.length) {
+    const intermediary = await options.evaluator.get(account);
+    if (intermediary.status === "present") {
+      const second = (intermediary.record.grants ?? []).find((g) => grantMatches(g, operator, grantClaim, now));
+      if (second) return result("trust", [brand, account, operator], [first[0], second]);
+    }
+  }
+  const covered = (record.record.grants ?? []).some(
+    (g) => (eTldPlusOne(g.grantee) === account || selfOperated && eTldPlusOne(g.grantee) === operator) && g.scopes.some(
+      (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
+    )
+  );
+  if (!covered && !record.record.exclusive_grants && await options.sellerAuthorization?.(claim))
+    return result("seller", [brand, account, operator]);
+  throw new IdentityAuthorizationError("grant_absent");
+}
+export {
+  IdentityAuthorizationError,
+  TrustEvaluator,
+  TrustMembershipError,
+  TrustRecordUnavailableError,
+  authorizeDemandGrant,
+  createTrustRecord,
+  validateIdentity33Schema,
+  validateTrustRecord
+};

package/dist/lib/identity-3.3/types.d.mts

@@ -0,0 +1,155 @@
+/** Experimental drafts; the released SDK wire/schema pin remains 3.2.4. */
+import type { GeneratedAccountCapabilities, ResolveAgentOnboarding } from './generated-compat.mjs';
+export type BillingParty = 'operator' | 'agent' | 'advertiser';
+type DraftAgentOnboardingRequirementKind = 'agent_identity' | 'grant' | 'billing_entity' | 'contract' | 'credit_application' | 'aao_verified' | 'storyboard' | 'sandbox' | 'experimental_feature';
+interface DraftAgentOnboardingRequirement {
+    kind: DraftAgentOnboardingRequirementKind;
+    role?: string;
+    verification_modes?: string[];
+    specialisms?: string[];
+    adcp_version?: string;
+    id?: string;
+    ext?: Record<string, unknown>;
+}
+interface DraftAgentOnboardingTier {
+    mode: 'open' | 'application' | 'invite_only';
+    url?: string;
+    requirements?: DraftAgentOnboardingRequirement[];
+    ext?: Record<string, unknown>;
+}
+interface DraftAgentOnboarding {
+    sandbox?: DraftAgentOnboardingTier;
+    billing?: Partial<Record<BillingParty, DraftAgentOnboardingTier>>;
+    url?: string;
+    documentation_url?: string;
+    message?: string;
+    ext?: Record<string, unknown>;
+}
+/** `get_adcp_capabilities.account.agent_onboarding`: how a seller onboards buyer agents. */
+export type AgentOnboarding = ResolveAgentOnboarding<GeneratedAccountCapabilities, DraftAgentOnboarding>;
+type AgentOnboardingBilling = NonNullable<AgentOnboarding['billing']>;
+/** The onboarding mode for sandbox access or for one billing party. */
+export type AgentOnboardingTier = NonNullable<AgentOnboarding['sandbox']> | NonNullable<AgentOnboardingBilling[keyof AgentOnboardingBilling]>;
+export type AgentOnboardingMode = AgentOnboardingTier['mode'];
+/** One requirement an onboarding mode imposes, discriminated by `kind`. */
+export type AgentOnboardingRequirement = NonNullable<AgentOnboardingTier['requirements']>[number];
+export type AgentOnboardingRequirementKind = AgentOnboardingRequirement['kind'];
+/**
+ * A requirement as an evaluator sees it. `kind` accepts any string because a
+ * counterparty on a newer revision may publish kinds this SDK does not know,
+ * and readers MUST treat those as unsatisfiable rather than reject the
+ * posture. Structural on purpose: every {@link AgentOnboardingRequirement} is
+ * assignable to it, whichever shape the pinned schemas give that type.
+ * `verified_specialisms` is the revised #8170 name for `specialisms`.
+ */
+export interface ObservedAgentOnboardingRequirement {
+    kind: AgentOnboardingRequirementKind | (string & {});
+    role?: string;
+    verification_modes?: readonly string[];
+    specialisms?: readonly string[];
+    verified_specialisms?: readonly string[];
+    adcp_version?: string;
+    id?: string;
+    ext?: Record<string, unknown>;
+}
+export interface BuyerOnboardingPosture {
+    mode: 'considers_unsolicited' | 'application' | 'invite_only';
+    requirements?: ObservedAgentOnboardingRequirement[];
+    url?: string;
+    documentation_url?: string;
+    message?: string;
+    ext?: Record<string, unknown>;
+}
+export interface PrincipalRelationship {
+    status: 'pending' | 'active' | 'suspended' | 'blocked';
+    expires_at?: string;
+    setup?: {
+        message: string;
+        url?: string;
+        expires_at?: string;
+        [key: string]: unknown;
+    };
+    ext?: Record<string, unknown>;
+}
+export type IdentityPrincipalChangedReason = 'relationship_changed' | 'relationship_expiring';
+export interface TrustAgent {
+    url: string;
+    roles: string[];
+    id?: string;
+    protocols?: string[];
+    countries?: string[];
+    profiles?: {
+        adcp?: {
+            onboarding?: BuyerOnboardingPosture;
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface TrustGrant {
+    grantee: string;
+    scopes: string[];
+    agents?: {
+        url: string;
+    }[];
+    countries?: string[];
+    valid_from?: string;
+    valid_until?: string;
+    profiles?: {
+        adcp?: {
+            brands?: string[];
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface TrustRecord {
+    agents?: TrustAgent[];
+    grants?: TrustGrant[];
+    acknowledgements?: unknown[];
+    exclusive_grants?: boolean;
+    authoritative_location?: string;
+    profiles?: {
+        adcp?: {
+            onboarding?: BuyerOnboardingPosture;
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export type RevocationReason = 'unspecified' | 'keyCompromise' | 'cACompromise' | 'affiliationChanged' | 'superseded' | 'cessationOfOperation' | 'certificateHold' | 'removeFromCRL' | 'privilegeWithdrawn' | 'aACompromise';
+export interface RevocationDetail {
+    reason?: RevocationReason;
+    invalidity_date?: string;
+}
+export interface AgentGrantDeniedDetails {
+    scope: 'agent';
+    reason: 'grant_absent';
+}
+export interface Identity33Capabilities {
+    request_signing?: {
+        profiles?: ('adcp/request-signing/v1' | 'web-bot-auth')[];
+        wba_draft_revision?: string;
+    };
+    webhook_signing?: {
+        supported: boolean;
+        profiles?: ('adcp/webhook-signing/v1' | 'web-bot-auth')[];
+        wba_draft_revision?: string;
+    };
+    account?: {
+        agent_onboarding?: AgentOnboarding;
+    };
+}
+export type Identity33GetPrincipalResponse = Omit<import('../types/tools.generated.mjs').GetPrincipalResponse, 'result'> & {
+    result: (Exclude<import('../types/tools.generated.mjs').GetPrincipalResponse['result'], {
+        kind: 'failed';
+    }> & {
+        relationship?: PrincipalRelationship;
+    }) | Extract<import('../types/tools.generated.mjs').GetPrincipalResponse['result'], {
+        kind: 'failed';
+    }>;
+};
+export {};

package/dist/lib/identity-3.3/types.d.ts

@@ -0,0 +1,155 @@
+/** Experimental drafts; the released SDK wire/schema pin remains 3.2.4. */
+import type { GeneratedAccountCapabilities, ResolveAgentOnboarding } from './generated-compat';
+export type BillingParty = 'operator' | 'agent' | 'advertiser';
+type DraftAgentOnboardingRequirementKind = 'agent_identity' | 'grant' | 'billing_entity' | 'contract' | 'credit_application' | 'aao_verified' | 'storyboard' | 'sandbox' | 'experimental_feature';
+interface DraftAgentOnboardingRequirement {
+    kind: DraftAgentOnboardingRequirementKind;
+    role?: string;
+    verification_modes?: string[];
+    specialisms?: string[];
+    adcp_version?: string;
+    id?: string;
+    ext?: Record<string, unknown>;
+}
+interface DraftAgentOnboardingTier {
+    mode: 'open' | 'application' | 'invite_only';
+    url?: string;
+    requirements?: DraftAgentOnboardingRequirement[];
+    ext?: Record<string, unknown>;
+}
+interface DraftAgentOnboarding {
+    sandbox?: DraftAgentOnboardingTier;
+    billing?: Partial<Record<BillingParty, DraftAgentOnboardingTier>>;
+    url?: string;
+    documentation_url?: string;
+    message?: string;
+    ext?: Record<string, unknown>;
+}
+/** `get_adcp_capabilities.account.agent_onboarding`: how a seller onboards buyer agents. */
+export type AgentOnboarding = ResolveAgentOnboarding<GeneratedAccountCapabilities, DraftAgentOnboarding>;
+type AgentOnboardingBilling = NonNullable<AgentOnboarding['billing']>;
+/** The onboarding mode for sandbox access or for one billing party. */
+export type AgentOnboardingTier = NonNullable<AgentOnboarding['sandbox']> | NonNullable<AgentOnboardingBilling[keyof AgentOnboardingBilling]>;
+export type AgentOnboardingMode = AgentOnboardingTier['mode'];
+/** One requirement an onboarding mode imposes, discriminated by `kind`. */
+export type AgentOnboardingRequirement = NonNullable<AgentOnboardingTier['requirements']>[number];
+export type AgentOnboardingRequirementKind = AgentOnboardingRequirement['kind'];
+/**
+ * A requirement as an evaluator sees it. `kind` accepts any string because a
+ * counterparty on a newer revision may publish kinds this SDK does not know,
+ * and readers MUST treat those as unsatisfiable rather than reject the
+ * posture. Structural on purpose: every {@link AgentOnboardingRequirement} is
+ * assignable to it, whichever shape the pinned schemas give that type.
+ * `verified_specialisms` is the revised #8170 name for `specialisms`.
+ */
+export interface ObservedAgentOnboardingRequirement {
+    kind: AgentOnboardingRequirementKind | (string & {});
+    role?: string;
+    verification_modes?: readonly string[];
+    specialisms?: readonly string[];
+    verified_specialisms?: readonly string[];
+    adcp_version?: string;
+    id?: string;
+    ext?: Record<string, unknown>;
+}
+export interface BuyerOnboardingPosture {
+    mode: 'considers_unsolicited' | 'application' | 'invite_only';
+    requirements?: ObservedAgentOnboardingRequirement[];
+    url?: string;
+    documentation_url?: string;
+    message?: string;
+    ext?: Record<string, unknown>;
+}
+export interface PrincipalRelationship {
+    status: 'pending' | 'active' | 'suspended' | 'blocked';
+    expires_at?: string;
+    setup?: {
+        message: string;
+        url?: string;
+        expires_at?: string;
+        [key: string]: unknown;
+    };
+    ext?: Record<string, unknown>;
+}
+export type IdentityPrincipalChangedReason = 'relationship_changed' | 'relationship_expiring';
+export interface TrustAgent {
+    url: string;
+    roles: string[];
+    id?: string;
+    protocols?: string[];
+    countries?: string[];
+    profiles?: {
+        adcp?: {
+            onboarding?: BuyerOnboardingPosture;
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface TrustGrant {
+    grantee: string;
+    scopes: string[];
+    agents?: {
+        url: string;
+    }[];
+    countries?: string[];
+    valid_from?: string;
+    valid_until?: string;
+    profiles?: {
+        adcp?: {
+            brands?: string[];
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface TrustRecord {
+    agents?: TrustAgent[];
+    grants?: TrustGrant[];
+    acknowledgements?: unknown[];
+    exclusive_grants?: boolean;
+    authoritative_location?: string;
+    profiles?: {
+        adcp?: {
+            onboarding?: BuyerOnboardingPosture;
+            [key: string]: unknown;
+        };
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export type RevocationReason = 'unspecified' | 'keyCompromise' | 'cACompromise' | 'affiliationChanged' | 'superseded' | 'cessationOfOperation' | 'certificateHold' | 'removeFromCRL' | 'privilegeWithdrawn' | 'aACompromise';
+export interface RevocationDetail {
+    reason?: RevocationReason;
+    invalidity_date?: string;
+}
+export interface AgentGrantDeniedDetails {
+    scope: 'agent';
+    reason: 'grant_absent';
+}
+export interface Identity33Capabilities {
+    request_signing?: {
+        profiles?: ('adcp/request-signing/v1' | 'web-bot-auth')[];
+        wba_draft_revision?: string;
+    };
+    webhook_signing?: {
+        supported: boolean;
+        profiles?: ('adcp/webhook-signing/v1' | 'web-bot-auth')[];
+        wba_draft_revision?: string;
+    };
+    account?: {
+        agent_onboarding?: AgentOnboarding;
+    };
+}
+export type Identity33GetPrincipalResponse = Omit<import('../types/tools.generated').GetPrincipalResponse, 'result'> & {
+    result: (Exclude<import('../types/tools.generated').GetPrincipalResponse['result'], {
+        kind: 'failed';
+    }> & {
+        relationship?: PrincipalRelationship;
+    }) | Extract<import('../types/tools.generated').GetPrincipalResponse['result'], {
+        kind: 'failed';
+    }>;
+};
+export {};

package/dist/lib/identity-3.3/types.js

@@ -0,0 +1,16 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/lib/identity-3.3/validation.d.mts

@@ -0,0 +1,2 @@
+import type { ValidationOutcome } from '../validation/schema-validator.mjs';
+export declare function validateIdentity33Payload(tool: string, direction: 'request' | 'response', payload: unknown, version?: string): ValidationOutcome;

package/dist/lib/identity-3.3/validation.d.ts

@@ -0,0 +1,2 @@
+import type { ValidationOutcome } from '../validation/schema-validator';
+export declare function validateIdentity33Payload(tool: string, direction: 'request' | 'response', payload: unknown, version?: string): ValidationOutcome;