@adcp/sdk 15.9.1 → 16.0.0-beta.2

package/dist/lib/server/account-sync-contract.js

@@ -0,0 +1,225 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var account_sync_contract_exports = {};
+__export(account_sync_contract_exports, {
+  checkSyncAccountRows: () => checkSyncAccountRows,
+  diagnoseAccountBilling: () => diagnoseAccountBilling,
+  existingSyncAccounts: () => existingSyncAccounts,
+  isolateAccountCallbackInput: () => isolateAccountCallbackInput,
+  projectAccountList: () => projectAccountList
+});
+module.exports = __toCommonJS(account_sync_contract_exports);
+var import_account_key = require('../core/account-key.js');
+var import_account = require('./decisioning/account.js');
+var import_async_outcome = require('./decisioning/async-outcome.js');
+function isolateAccountCallbackInput(ctx) {
+  const descriptors = Object.getOwnPropertyDescriptors(ctx);
+  delete descriptors.input;
+  const copy = Object.defineProperties({}, descriptors);
+  if ("input" in ctx) {
+    let captured = false;
+    let input;
+    Object.defineProperty(copy, "input", {
+      enumerable: true,
+      configurable: true,
+      get() {
+        if (!captured) {
+          const source = ctx.input;
+          input = source === void 0 ? void 0 : structuredClone(source);
+          captured = true;
+        }
+        return input;
+      },
+      set(value) {
+        input = value;
+        captured = true;
+      }
+    });
+  }
+  return copy;
+}
+function naturalRef(entry) {
+  const ref = entry.account ?? entry;
+  if (!ref || "account_id" in ref || !("brand" in ref) || !ref.brand || typeof ref.operator !== "string")
+    return void 0;
+  return ref;
+}
+async function lookup(accounts, ref, ctx, onUnsupported) {
+  try {
+    const account = await accounts.resolve(
+      structuredClone(ref),
+      isolateAccountCallbackInput({ ...ctx, provisioning: false })
+    );
+    if (account && "account_id" in ref && account.id !== ref.account_id) return null;
+    if (account && "brand" in ref) {
+      const identity = account;
+      const values = identity;
+      const known = Object.fromEntries(
+        ["operator_unit", "currency", "timezone", "sandbox"].filter((field) => values[field] !== void 0).map((field) => [field, values[field]])
+      );
+      const projected = {
+        ...ref,
+        ...known,
+        brand: { ...ref.brand, ...identity.brand },
+        operator: identity.operator ?? ref.operator
+      };
+      if ((0, import_account_key.accountReferenceKey)(projected) !== (0, import_account_key.accountReferenceKey)(ref)) return null;
+    }
+    return account ? { ...account, billing: account.billing && { ...account.billing } } : null;
+  } catch (error) {
+    if (error instanceof import_account.AccountNotFoundError || error instanceof import_async_outcome.AdcpError && error.code === "ACCOUNT_NOT_FOUND")
+      return null;
+    if (error instanceof import_async_outcome.AdcpError && ["INVALID_REQUEST", "UNSUPPORTED_FEATURE"].includes(error.code)) {
+      onUnsupported?.();
+      return null;
+    }
+    throw error;
+  }
+}
+async function existingSyncAccounts(accounts, entries, ctx, logger) {
+  const existing = [];
+  for (const [index, entry] of entries.entries()) {
+    const ref = accounts.resolution === "derived" ? void 0 : naturalRef(entry);
+    const account = ref ? await lookup(accounts, ref, ctx, () => {
+      if (logger)
+        diagnose(accounts, logger, { code: "ACCOUNT_SYNC_LOOKUP_UNSUPPORTED", toolName: "sync_accounts", index });
+    }) : null;
+    existing.push(
+      typeof account?.brand?.domain === "string" && account.brand.domain.length > 0 && typeof account.operator === "string" ? account : null
+    );
+  }
+  return existing;
+}
+function diagnose(accounts, logger, diagnostic) {
+  if (process.env.NODE_ENV !== "production") safeWarn(logger, "Account store contract violation", { ...diagnostic });
+  try {
+    const pending = accounts.onDiagnostic?.(diagnostic);
+    if (pending) void Promise.resolve(pending).catch(() => safeWarn(logger, "Account diagnostic callback failed"));
+  } catch {
+    safeWarn(logger, "Account diagnostic callback failed");
+  }
+}
+function safeWarn(logger, message, data) {
+  try {
+    logger.warn(message, data);
+  } catch {
+  }
+}
+function diagnoseAccountBilling(accounts, logger, account, toolName, index) {
+  if (account.billing === "agent" && account.payment_terms === void 0) {
+    diagnose(accounts, logger, { code: "ACCOUNT_BILLING_FIELDS_MISSING", toolName, index });
+  }
+}
+async function projectAccountList(accounts, items, ctx, logger) {
+  const rows = [];
+  for (const [index, account] of items.entries()) {
+    const row = (0, import_account.toWireAccount)(account);
+    if (row.billing === void 0 || row.payment_terms === void 0) {
+      const ref = accounts.resolution === "implicit" ? naturalRef(account) : { account_id: account.id };
+      if (ref) {
+        try {
+          const stored = await lookup(accounts, ref, ctx);
+          if (stored?.id === account.id) {
+            const wire = (0, import_account.toWireAccount)(stored);
+            row.billing ??= wire.billing;
+            row.payment_terms ??= wire.payment_terms;
+          }
+        } catch {
+          safeWarn(logger, "Could not enrich listed account billing fields");
+        }
+      }
+    }
+    diagnoseAccountBilling(accounts, logger, row, "list_accounts", index);
+    rows.push(row);
+  }
+  return rows;
+}
+async function checkSyncAccountRows(accounts, entries, existing, rows, indices, ctx, logger) {
+  const seen = /* @__PURE__ */ new Map();
+  const checked = [];
+  for (const [offset, inputRow] of rows.entries()) {
+    const entry = entries[offset];
+    const index = indices[offset];
+    const ref = naturalRef(entry);
+    const key = ref && (0, import_account_key.accountReferenceKey)(ref);
+    const priorId = existing[offset]?.id ?? (key ? seen.get(key) : void 0);
+    let row = { ...inputRow };
+    if (row.action === "failed") {
+      checked.push(row);
+      continue;
+    }
+    const idViolation = priorId !== void 0 && (row.account_id !== priorId || row.action === "created");
+    if (idViolation)
+      diagnose(accounts, logger, { code: "ACCOUNT_SYNC_IDEMPOTENCY_VIOLATION", toolName: "sync_accounts", index });
+    const requestedRef = entry.account ?? entry;
+    const enrichmentRef = ref ?? ("account_id" in requestedRef && accounts.resolution !== "implicit" ? { account_id: requestedRef.account_id } : void 0);
+    let stored = null;
+    if (enrichmentRef && (row.billing === void 0 || row.payment_terms === void 0)) {
+      try {
+        stored = await lookup(accounts, enrichmentRef, ctx);
+      } catch {
+        safeWarn(logger, "Could not enrich account sync billing fields");
+      }
+    }
+    const source = stored?.id === row.account_id ? stored : existing[offset]?.id === row.account_id ? existing[offset] : null;
+    if (source) {
+      const wire = (0, import_account.toWireAccount)(source);
+      row.billing ??= wire.billing;
+      row.payment_terms ??= wire.payment_terms;
+    }
+    const missing = (entry.billing === "agent" || row.billing === "agent") && (row.billing === void 0 || row.payment_terms === void 0);
+    if (missing)
+      diagnose(accounts, logger, { code: "ACCOUNT_BILLING_FIELDS_MISSING", toolName: "sync_accounts", index });
+    const termsViolation = entry.payment_terms !== void 0 && row.status === "active" && row.payment_terms !== entry.payment_terms;
+    const billingViolation = entry.billing === "agent" && row.status === "active" && row.billing !== void 0 && row.billing !== "agent";
+    if (billingViolation)
+      diagnose(accounts, logger, { code: "ACCOUNT_SYNC_BILLING_MISMATCH", toolName: "sync_accounts", index });
+    if (termsViolation)
+      diagnose(accounts, logger, { code: "ACCOUNT_SYNC_PAYMENT_TERMS_MISMATCH", toolName: "sync_accounts", index });
+    if (key && row.account_id) seen.set(key, priorId ?? row.account_id);
+    if (accounts.strictIdempotency && (idViolation || termsViolation || billingViolation)) {
+      const error = new import_async_outcome.AdcpError(
+        termsViolation ? "PAYMENT_TERMS_NOT_SUPPORTED" : billingViolation ? "BILLING_NOT_SUPPORTED" : "SERVICE_UNAVAILABLE",
+        {
+          message: termsViolation ? "The seller did not accept the requested payment terms." : billingViolation ? "The seller did not accept agent billing." : "The account store did not preserve the existing account identity.",
+          recovery: termsViolation || billingViolation ? "correctable" : "transient",
+          field: `accounts[${index}]${termsViolation ? ".payment_terms" : billingViolation ? ".billing" : ""}`
+        }
+      ).toStructuredError();
+      row = {
+        brand: row.brand,
+        operator: row.operator,
+        ...priorId === row.account_id && priorId && { account_id: priorId },
+        action: "failed",
+        status: existing[offset]?.status ?? row.status,
+        errors: [error]
+      };
+    }
+    checked.push(row);
+  }
+  return checked;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  checkSyncAccountRows,
+  diagnoseAccountBilling,
+  existingSyncAccounts,
+  isolateAccountCallbackInput,
+  projectAccountList
+});

package/dist/lib/server/account-sync-contract.mjs

@@ -0,0 +1,197 @@
+import { accountReferenceKey } from "../core/account-key.mjs";
+import { AccountNotFoundError, toWireAccount } from "./decisioning/account.mjs";
+import { AdcpError } from "./decisioning/async-outcome.mjs";
+function isolateAccountCallbackInput(ctx) {
+  const descriptors = Object.getOwnPropertyDescriptors(ctx);
+  delete descriptors.input;
+  const copy = Object.defineProperties({}, descriptors);
+  if ("input" in ctx) {
+    let captured = false;
+    let input;
+    Object.defineProperty(copy, "input", {
+      enumerable: true,
+      configurable: true,
+      get() {
+        if (!captured) {
+          const source = ctx.input;
+          input = source === void 0 ? void 0 : structuredClone(source);
+          captured = true;
+        }
+        return input;
+      },
+      set(value) {
+        input = value;
+        captured = true;
+      }
+    });
+  }
+  return copy;
+}
+function naturalRef(entry) {
+  const ref = entry.account ?? entry;
+  if (!ref || "account_id" in ref || !("brand" in ref) || !ref.brand || typeof ref.operator !== "string")
+    return void 0;
+  return ref;
+}
+async function lookup(accounts, ref, ctx, onUnsupported) {
+  try {
+    const account = await accounts.resolve(
+      structuredClone(ref),
+      isolateAccountCallbackInput({ ...ctx, provisioning: false })
+    );
+    if (account && "account_id" in ref && account.id !== ref.account_id) return null;
+    if (account && "brand" in ref) {
+      const identity = account;
+      const values = identity;
+      const known = Object.fromEntries(
+        ["operator_unit", "currency", "timezone", "sandbox"].filter((field) => values[field] !== void 0).map((field) => [field, values[field]])
+      );
+      const projected = {
+        ...ref,
+        ...known,
+        brand: { ...ref.brand, ...identity.brand },
+        operator: identity.operator ?? ref.operator
+      };
+      if (accountReferenceKey(projected) !== accountReferenceKey(ref)) return null;
+    }
+    return account ? { ...account, billing: account.billing && { ...account.billing } } : null;
+  } catch (error) {
+    if (error instanceof AccountNotFoundError || error instanceof AdcpError && error.code === "ACCOUNT_NOT_FOUND")
+      return null;
+    if (error instanceof AdcpError && ["INVALID_REQUEST", "UNSUPPORTED_FEATURE"].includes(error.code)) {
+      onUnsupported?.();
+      return null;
+    }
+    throw error;
+  }
+}
+async function existingSyncAccounts(accounts, entries, ctx, logger) {
+  const existing = [];
+  for (const [index, entry] of entries.entries()) {
+    const ref = accounts.resolution === "derived" ? void 0 : naturalRef(entry);
+    const account = ref ? await lookup(accounts, ref, ctx, () => {
+      if (logger)
+        diagnose(accounts, logger, { code: "ACCOUNT_SYNC_LOOKUP_UNSUPPORTED", toolName: "sync_accounts", index });
+    }) : null;
+    existing.push(
+      typeof account?.brand?.domain === "string" && account.brand.domain.length > 0 && typeof account.operator === "string" ? account : null
+    );
+  }
+  return existing;
+}
+function diagnose(accounts, logger, diagnostic) {
+  if (process.env.NODE_ENV !== "production") safeWarn(logger, "Account store contract violation", { ...diagnostic });
+  try {
+    const pending = accounts.onDiagnostic?.(diagnostic);
+    if (pending) void Promise.resolve(pending).catch(() => safeWarn(logger, "Account diagnostic callback failed"));
+  } catch {
+    safeWarn(logger, "Account diagnostic callback failed");
+  }
+}
+function safeWarn(logger, message, data) {
+  try {
+    logger.warn(message, data);
+  } catch {
+  }
+}
+function diagnoseAccountBilling(accounts, logger, account, toolName, index) {
+  if (account.billing === "agent" && account.payment_terms === void 0) {
+    diagnose(accounts, logger, { code: "ACCOUNT_BILLING_FIELDS_MISSING", toolName, index });
+  }
+}
+async function projectAccountList(accounts, items, ctx, logger) {
+  const rows = [];
+  for (const [index, account] of items.entries()) {
+    const row = toWireAccount(account);
+    if (row.billing === void 0 || row.payment_terms === void 0) {
+      const ref = accounts.resolution === "implicit" ? naturalRef(account) : { account_id: account.id };
+      if (ref) {
+        try {
+          const stored = await lookup(accounts, ref, ctx);
+          if (stored?.id === account.id) {
+            const wire = toWireAccount(stored);
+            row.billing ??= wire.billing;
+            row.payment_terms ??= wire.payment_terms;
+          }
+        } catch {
+          safeWarn(logger, "Could not enrich listed account billing fields");
+        }
+      }
+    }
+    diagnoseAccountBilling(accounts, logger, row, "list_accounts", index);
+    rows.push(row);
+  }
+  return rows;
+}
+async function checkSyncAccountRows(accounts, entries, existing, rows, indices, ctx, logger) {
+  const seen = /* @__PURE__ */ new Map();
+  const checked = [];
+  for (const [offset, inputRow] of rows.entries()) {
+    const entry = entries[offset];
+    const index = indices[offset];
+    const ref = naturalRef(entry);
+    const key = ref && accountReferenceKey(ref);
+    const priorId = existing[offset]?.id ?? (key ? seen.get(key) : void 0);
+    let row = { ...inputRow };
+    if (row.action === "failed") {
+      checked.push(row);
+      continue;
+    }
+    const idViolation = priorId !== void 0 && (row.account_id !== priorId || row.action === "created");
+    if (idViolation)
+      diagnose(accounts, logger, { code: "ACCOUNT_SYNC_IDEMPOTENCY_VIOLATION", toolName: "sync_accounts", index });
+    const requestedRef = entry.account ?? entry;
+    const enrichmentRef = ref ?? ("account_id" in requestedRef && accounts.resolution !== "implicit" ? { account_id: requestedRef.account_id } : void 0);
+    let stored = null;
+    if (enrichmentRef && (row.billing === void 0 || row.payment_terms === void 0)) {
+      try {
+        stored = await lookup(accounts, enrichmentRef, ctx);
+      } catch {
+        safeWarn(logger, "Could not enrich account sync billing fields");
+      }
+    }
+    const source = stored?.id === row.account_id ? stored : existing[offset]?.id === row.account_id ? existing[offset] : null;
+    if (source) {
+      const wire = toWireAccount(source);
+      row.billing ??= wire.billing;
+      row.payment_terms ??= wire.payment_terms;
+    }
+    const missing = (entry.billing === "agent" || row.billing === "agent") && (row.billing === void 0 || row.payment_terms === void 0);
+    if (missing)
+      diagnose(accounts, logger, { code: "ACCOUNT_BILLING_FIELDS_MISSING", toolName: "sync_accounts", index });
+    const termsViolation = entry.payment_terms !== void 0 && row.status === "active" && row.payment_terms !== entry.payment_terms;
+    const billingViolation = entry.billing === "agent" && row.status === "active" && row.billing !== void 0 && row.billing !== "agent";
+    if (billingViolation)
+      diagnose(accounts, logger, { code: "ACCOUNT_SYNC_BILLING_MISMATCH", toolName: "sync_accounts", index });
+    if (termsViolation)
+      diagnose(accounts, logger, { code: "ACCOUNT_SYNC_PAYMENT_TERMS_MISMATCH", toolName: "sync_accounts", index });
+    if (key && row.account_id) seen.set(key, priorId ?? row.account_id);
+    if (accounts.strictIdempotency && (idViolation || termsViolation || billingViolation)) {
+      const error = new AdcpError(
+        termsViolation ? "PAYMENT_TERMS_NOT_SUPPORTED" : billingViolation ? "BILLING_NOT_SUPPORTED" : "SERVICE_UNAVAILABLE",
+        {
+          message: termsViolation ? "The seller did not accept the requested payment terms." : billingViolation ? "The seller did not accept agent billing." : "The account store did not preserve the existing account identity.",
+          recovery: termsViolation || billingViolation ? "correctable" : "transient",
+          field: `accounts[${index}]${termsViolation ? ".payment_terms" : billingViolation ? ".billing" : ""}`
+        }
+      ).toStructuredError();
+      row = {
+        brand: row.brand,
+        operator: row.operator,
+        ...priorId === row.account_id && priorId && { account_id: priorId },
+        action: "failed",
+        status: existing[offset]?.status ?? row.status,
+        errors: [error]
+      };
+    }
+    checked.push(row);
+  }
+  return checked;
+}
+export {
+  checkSyncAccountRows,
+  diagnoseAccountBilling,
+  existingSyncAccounts,
+  isolateAccountCallbackInput,
+  projectAccountList
+};

package/dist/lib/server/adcp-server.js

@@ -225,6 +225,11 @@ function wrapMcpServer(inner, compliance, adcpVersion = import_version.ADCP_VERS
     return handler({ method: request.method, params: request.params ?? {} }, extra);
   };
   const invoke = async (options2) => {
+    if (options2.authInfo?.extra?.identity33 || options2.authInfo?.extra?.webBotAuthAuthorization) {
+      const { getWebBotAuthAuthorizationFailure, webBotAuthToolFailure } = require('../signing/web-bot-auth.js');
+      const failure = getWebBotAuthAuthorizationFailure(options2.authInfo.extra);
+      if (failure) return webBotAuthToolFailure(failure, adcpVersion);
+    }
     const tool = getRegisteredTool(mcp, options2.toolName);
     if (!tool) {
       throw new Error(`AdcpServer.invoke: tool "${options2.toolName}" is not registered`);

package/dist/lib/server/adcp-server.mjs

@@ -1,3 +1,8 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
 import { ADCP_VERSION } from "../version.mjs";
 import {
   applyStructuredContentTextFallback
@@ -175,6 +180,11 @@ function wrapMcpServer(inner, compliance, adcpVersion = ADCP_VERSION, options =
     return handler({ method: request.method, params: request.params ?? {} }, extra);
   };
   const invoke = async (options2) => {
+    if (options2.authInfo?.extra?.identity33 || options2.authInfo?.extra?.webBotAuthAuthorization) {
+      const { getWebBotAuthAuthorizationFailure, webBotAuthToolFailure } = require2("../signing/web-bot-auth");
+      const failure = getWebBotAuthAuthorizationFailure(options2.authInfo.extra);
+      if (failure) return webBotAuthToolFailure(failure, adcpVersion);
+    }
     const tool = getRegisteredTool(mcp, options2.toolName);
     if (!tool) {
       throw new Error(`AdcpServer.invoke: tool "${options2.toolName}" is not registered`);

package/dist/lib/server/auth-signature.d.mts

@@ -38,6 +38,7 @@
  * `serve()` buffers `req.rawBody` before authentication runs.
  */
 import type { IncomingMessage } from 'http';
+import { type VerifiedWebBotSigner } from '../signing/web-bot-auth.mjs';
 import type { JwksResolver } from '../signing/jwks.mjs';
 import { type ReplayStore } from '../signing/replay.mjs';
 import { type RevocationStore } from '../signing/revocation.mjs';
@@ -45,6 +46,20 @@ import type { VerifiedSigner, VerifierCapability } from '../signing/types.mjs';
 import { type OperationResolutionInput, type ResolvedOperation } from '../signing/operation-resolution.mjs';
 import { type AuthPrincipal, type Authenticator } from './auth.mjs';
 export interface VerifySignatureAsAuthenticatorOptions {
+    /** Explicit experimental profile. Verification never creates a principal or fetches trust.json. */
+    webBotAuth?: {
+        directory: import('../signing/web-bot-auth.mjs').SignatureDirectoryResolver;
+        /**
+         * @deprecated Revocation belongs to the identity layer: use
+         * `createIdentity33PrincipalResolver({ revocation })`. Required only when
+         * `resolvePrincipal` does not check revocation itself.
+         */
+        isRevoked?: (origin: string, keyid: string) => Promise<boolean>;
+        /** Resolve only an existing audited binding; handle identity-established callers with anonymous scope. */
+        resolvePrincipal: (signers: readonly VerifiedWebBotSigner[], operation: ResolvedOperation) => Promise<AuthPrincipal>;
+    };
+    /** Refuse legacy credentials for an origin already bound to Web Bot Auth. */
+    assertLegacyOriginAllowed?: (agentUrl: string) => Promise<void>;
     /** Verifier capability block. `required_for` is not enforced here — unsigned
      *  requests fall through to the next authenticator — so set it to whatever
      *  your `request_signing` capability claim advertises. */

package/dist/lib/server/auth-signature.d.ts

@@ -38,6 +38,7 @@
  * `serve()` buffers `req.rawBody` before authentication runs.
  */
 import type { IncomingMessage } from 'http';
+import { type VerifiedWebBotSigner } from '../signing/web-bot-auth';
 import type { JwksResolver } from '../signing/jwks';
 import { type ReplayStore } from '../signing/replay';
 import { type RevocationStore } from '../signing/revocation';
@@ -45,6 +46,20 @@ import type { VerifiedSigner, VerifierCapability } from '../signing/types';
 import { type OperationResolutionInput, type ResolvedOperation } from '../signing/operation-resolution';
 import { type AuthPrincipal, type Authenticator } from './auth';
 export interface VerifySignatureAsAuthenticatorOptions {
+    /** Explicit experimental profile. Verification never creates a principal or fetches trust.json. */
+    webBotAuth?: {
+        directory: import('../signing/web-bot-auth').SignatureDirectoryResolver;
+        /**
+         * @deprecated Revocation belongs to the identity layer: use
+         * `createIdentity33PrincipalResolver({ revocation })`. Required only when
+         * `resolvePrincipal` does not check revocation itself.
+         */
+        isRevoked?: (origin: string, keyid: string) => Promise<boolean>;
+        /** Resolve only an existing audited binding; handle identity-established callers with anonymous scope. */
+        resolvePrincipal: (signers: readonly VerifiedWebBotSigner[], operation: ResolvedOperation) => Promise<AuthPrincipal>;
+    };
+    /** Refuse legacy credentials for an origin already bound to Web Bot Auth. */
+    assertLegacyOriginAllowed?: (agentUrl: string) => Promise<void>;
     /** Verifier capability block. `required_for` is not enforced here — unsigned
      *  requests fall through to the next authenticator — so set it to whatever
      *  your `request_signing` capability claim advertises. */

package/dist/lib/server/auth-signature.js

@@ -26,7 +26,9 @@ __export(auth_signature_exports, {
   verifySignatureAsAuthenticator: () => verifySignatureAsAuthenticator
 });
 module.exports = __toCommonJS(auth_signature_exports);
+var import_web_bot_auth = require('../signing/web-bot-auth.js');
 var import_errors = require('../signing/errors.js');
+var import_web_bot_auth2 = require('../signing/web-bot-auth.js');
 var import_replay = require('../signing/replay.js');
 var import_revocation = require('../signing/revocation.js');
 var import_operation_resolution = require('../signing/operation-resolution.js');
@@ -35,6 +37,15 @@ var import_buyer_agent = require('./decisioning/buyer-agent.js');
 var import_auth = require('./auth.js');
 function verifySignatureAsAuthenticator(options) {
   const replayStore = options.replayStore ?? new import_replay.InMemoryReplayStore();
+  const legacyOriginGate = options.assertLegacyOriginAllowed ?? (0, import_web_bot_auth.getWebBotAuthLegacyOriginGate)(options.webBotAuth?.resolvePrincipal);
+  if (options.webBotAuth && !legacyOriginGate)
+    throw new TypeError(
+      "Web Bot Auth requires an origin-binding migration fence; use createIdentity33PrincipalResolver or supply assertLegacyOriginAllowed"
+    );
+  if (options.webBotAuth && !options.webBotAuth.isRevoked && !(0, import_web_bot_auth2.isWebBotAuthRevocationChecked)(options.webBotAuth.resolvePrincipal))
+    throw new TypeError(
+      "Web Bot Auth requires origin revocation: use createIdentity33PrincipalResolver({ revocation }) or supply isRevoked"
+    );
   const revocationStore = options.revocationStore ?? new import_revocation.InMemoryRevocationStore();
   const authenticator = async (req) => {
     if (!hasSignatureHeader(req)) return null;
@@ -48,6 +59,49 @@ function verifySignatureAsAuthenticator(options) {
     };
     let result;
     try {
+      if ((0, import_web_bot_auth2.selectSignatureProfile)(requestLike) === "web-bot-auth") {
+        if (!options.getUrl && !(0, import_auth.getServeRequestContext)(req)?.publicUrl || !options.webBotAuth || !options.capability.profiles?.includes("web-bot-auth"))
+          throw new import_web_bot_auth2.WebBotAuthError(403, "profile_disabled");
+        if (req.method !== "GET" && req.rawBody === void 0)
+          throw new import_web_bot_auth2.WebBotAuthError(403, "raw_body_missing");
+        const signers = await (0, import_web_bot_auth2.verifyWebBotAuth)(requestLike, {
+          directory: options.webBotAuth.directory,
+          replayStore,
+          now: options.now,
+          ...options.webBotAuth.isRevoked && { isRevoked: options.webBotAuth.isRevoked }
+        });
+        const operation = options.resolveOperation(req);
+        let principal2;
+        let deferredFailure;
+        try {
+          principal2 = await options.webBotAuth.resolvePrincipal(signers, operation);
+        } catch (error) {
+          if (error instanceof import_web_bot_auth2.WebBotAuthError || error instanceof import_web_bot_auth2.WebBotAuthUnavailableError) throw error;
+          if (typeof operation !== "string") throw (0, import_web_bot_auth2.webBotAuthPrincipalFailureError)(error);
+          const deferred = (0, import_web_bot_auth2.deferWebBotAuthPrincipalFailure)(signers, error);
+          principal2 = { principal: deferred.principal };
+          deferredFailure = deferred.authorizationFailure;
+        }
+        const signer2 = signers[signers.length - 1];
+        req.verifiedSigner = {
+          keyid: signer2.keyid,
+          agent_url: signer2.origin,
+          verified_at: signer2.verified_at
+        };
+        const failed = signers.find((s) => s.authorizationFailure);
+        return {
+          ...principal2,
+          extra: {
+            ...principal2.extra,
+            webBotAuthAuthorization: {
+              signer: failed ?? signer2,
+              ...(failed?.authorizationFailure ?? deferredFailure) && {
+                authorizationFailure: failed?.authorizationFailure ?? deferredFailure
+              }
+            }
+          }
+        };
+      }
       result = await (0, import_verifier.verifyRequestSignature)(requestLike, {
         capability: options.capability,
         jwks: options.jwks,
@@ -58,7 +112,22 @@ function verifySignatureAsAuthenticator(options) {
         operation: options.resolveOperation(req),
         agentUrlForKeyid: options.agentUrlForKeyid
       });
+      if (result.status === "verified" && legacyOriginGate) {
+        if (!result.agent_url)
+          throw new import_errors.RequestSignatureError(
+            "request_signature_key_unknown",
+            7,
+            "Legacy signer must resolve an agent origin when migration fencing is enabled"
+          );
+        await legacyOriginGate(result.agent_url);
+      }
     } catch (err) {
+      if (err instanceof import_web_bot_auth2.WebBotAuthError)
+        throw new import_auth.AuthError(err.message, { cause: err, status: err.status, headers: err.headers, body: err.body });
+      if (err instanceof import_web_bot_auth2.WebBotAuthUnavailableError) {
+        const outage = (0, import_web_bot_auth2.webBotAuthUnavailableResponse)();
+        throw new import_auth.AuthError(err.message, { cause: err, ...outage });
+      }
       if (err instanceof import_errors.RequestSignatureError) {
         throw new import_auth.AuthError(`Signature rejected (${err.code}).`, { cause: err });
       }
@@ -79,7 +148,8 @@ function verifySignatureAsAuthenticator(options) {
     req.verifiedSigner = signer;
     return principal;
   };
-  return (0, import_auth.tagAuthenticatorNeedsRawBody)(authenticator);
+  const tagged = (0, import_auth.tagAuthenticatorNeedsRawBody)(authenticator);
+  return options.webBotAuth ? (0, import_auth.tagAuthenticatorPresenceGated)(tagged) : tagged;
 }
 function principalForVerifiedSigner(signer, makePrincipal) {
   if (!SAFE_KEYID.test(signer.keyid)) {
@@ -206,7 +276,7 @@ function logUnresolvable(req) {
 }
 const SAFE_KEYID = /^[A-Za-z0-9._-]{1,256}$/;
 function hasSignatureHeader(req) {
-  return nonEmptyHeader(req.headers["signature-input"]) || nonEmptyHeader(req.headers["signature"]);
+  return req.headers["signature-agent"] !== void 0 || nonEmptyHeader(req.headers["signature-input"]) || nonEmptyHeader(req.headers["signature"]);
 }
 function nonEmptyHeader(v) {
   if (typeof v === "string") return v.length > 0;