@adcp/sdk 15.9.1 → 16.0.0-beta.2

package/dist/lib/core/TaskExecutor.js

@@ -38,6 +38,9 @@ __export(TaskExecutor_exports, {
   transferDeferredSettlementAcknowledgement: () => transferDeferredSettlementAcknowledgement
 });
 module.exports = __toCommonJS(TaskExecutor_exports);
+var import_webhook_registration = require('./webhook-registration.js');
+var import_adcp_version_config = require('../utils/adcp-version-config.js');
+var import_schema_errors = require('../validation/schema-errors.js');
 var import_crypto = require("crypto");
 var import_protocols = require('../protocols/index.js');
 var import_mcp_tasks = require('../protocols/mcp-tasks.js');
@@ -67,6 +70,9 @@ var import_match = require('./match.js');
 var import_webhook_url = require('./webhook-url.js');
 var import_task_deadline = require('./task-deadline.js');
 var import_errors2 = require('../errors/index.js');
+function validateIdentity33Payload(...args) {
+  return require('../identity-3.3/validation.js').validateIdentity33Payload(...args);
+}
 class MaxClarificationError extends Error {
   constructor(taskId, maxAttempts) {
     super(`Task ${taskId} exceeded maximum clarification attempts: ${maxAttempts}`);
@@ -191,8 +197,15 @@ function webhookRegistrationFromPreparedCall(_agent, preparedCall) {
   if (typeof candidate.url !== "string") {
     throw new import_errors.ConfigurationError("push_notification_config.url must be a string.", "push_notification_config.url");
   }
+  const profile = candidate.signing_profile;
   if (!Object.prototype.hasOwnProperty.call(candidate, "authentication")) {
-    return { callbackUrl: candidate.url, mode: "rfc9421" };
+    if (profile !== void 0 && !["adcp/webhook-signing/v1", "web-bot-auth"].includes(profile))
+      throw new import_errors.ConfigurationError("Unsupported webhook signing profile", "signing_profile");
+    return {
+      callbackUrl: candidate.url,
+      mode: "rfc9421",
+      ...profile !== void 0 && { signingProfile: profile }
+    };
   }
   const authentication = candidate.authentication;
   if (!authentication || typeof authentication !== "object" || Array.isArray(authentication)) {
@@ -670,6 +683,15 @@ class TaskExecutor {
    * Throws in strict, logs to `debugLogs` in warn, no-ops in off.
    */
   validateRequest(taskName, params, debugLogs) {
+    if (this.config.experimentalIdentity33?.() && this.requestValidationMode !== "off") {
+      const outcome = validateIdentity33Payload(taskName, "request", params, this.config.adcpVersion);
+      if (!outcome.valid) {
+        if (this.requestValidationMode === "strict") throw (0, import_schema_errors.buildValidationError)(taskName, "request", outcome.issues);
+        if (debugLogs)
+          this.logDebug(debugLogs, "warning", `Request validation failed for ${taskName}`, { issues: outcome.issues });
+      }
+      return;
+    }
     (0, import_client_hooks.validateOutgoingRequest)(taskName, params, this.requestValidationMode, debugLogs, this.config.adcpVersion);
   }
   /**
@@ -861,19 +883,29 @@ class TaskExecutor {
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
       (0, import_abort.throwIfAborted)(options.signal);
+      const callbackProfile = this.config.signedIdentity33Webhooks?.() && (webhookUrl || params?.reporting_webhook || params?.artifact_webhook || params?.push_notification_config) ? this.config.webhookSigningProfile?.() : void 0;
+      const applyCallbackProfiles = (args) => {
+        if (!callbackProfile || options.preserveGovernedPayload) return;
+        for (const field of ["push_notification_config", "reporting_webhook", "artifact_webhook"]) {
+          const callback = args[field];
+          if (callback && typeof callback === "object" && callback.authentication === void 0 && callback.signing_profile === void 0)
+            callback.signing_profile = callbackProfile;
+        }
+      };
       const governanceMiddleware = this.governanceMiddleware;
       if (governanceMiddleware) {
         const modernGovernance = targetCapabilities !== void 0 && (0, import_governance.targetDeclaresGovernanceEnforcement)(targetCapabilities, taskName);
         const governableParams = modernGovernance ? (0, import_protocols.prepareProtocolToolCall)(agent, params, {
           toolName: taskName,
           webhookUrl,
-          webhookSecret: this.config.webhookSecret,
+          webhookSecret: this.config.signedIdentity33Webhooks?.() ? void 0 : this.config.webhookSecret,
           operationId: taskId,
           serverVersion: effectiveServerVersion,
           adcpVersion: this.config.adcpVersion,
           wireAdcpVersion,
           versionEnvelope
         }).args : params;
+        if (modernGovernance) applyCallbackProfiles(governableParams);
         if (await governanceMiddleware.shouldCheck(taskName, governableParams, targetCapabilities)) {
           const sdkInjectedPushConfig = modernGovernance && webhookUrl !== void 0 && this.config.webhookSecret !== void 0;
           assertGovernedPayloadHasNoCallbackCredentials(taskName, governableParams, { sdkInjectedPushConfig });
@@ -918,13 +950,42 @@ class TaskExecutor {
       const preparedCall = (0, import_protocols.prepareProtocolToolCall)(agent, dispatchParams, {
         toolName: taskName,
         webhookUrl,
-        webhookSecret: this.config.webhookSecret,
+        webhookSecret: this.config.signedIdentity33Webhooks?.() ? void 0 : this.config.webhookSecret,
         operationId: taskId,
         serverVersion: effectiveServerVersion,
         adcpVersion: this.config.adcpVersion,
         wireAdcpVersion,
         versionEnvelope
       });
+      applyCallbackProfiles(preparedCall.args);
+      const signingProfile = options.preserveGovernedPayload ? void 0 : callbackProfile;
+      if (signingProfile && preparedCall.args.push_notification_config && typeof preparedCall.args.push_notification_config === "object") {
+        const registration = preparedCall.args.push_notification_config;
+        if (registration.authentication === void 0 && registration.signing_profile === void 0)
+          registration.signing_profile = signingProfile;
+      }
+      if (this.config.signedIdentity33Webhooks?.()) {
+        for (const [field, deliveryKind, taskType] of [
+          ["reporting_webhook", "reporting", "media_buy_delivery"],
+          ["artifact_webhook", "artifact", "artifact_delivery"]
+        ]) {
+          const delivery = preparedCall.args[field];
+          if (!delivery || typeof delivery.url !== "string" || delivery.authentication !== void 0) continue;
+          const selected = delivery.signing_profile ?? (options.preserveGovernedPayload ? "adcp/webhook-signing/v1" : callbackProfile);
+          if (selected !== "adcp/webhook-signing/v1" && selected !== "web-bot-auth")
+            throw new Error("Invalid delivery signing profile");
+          if (!options.preserveGovernedPayload) delivery.signing_profile = selected;
+          await this.config.onWebhookRegistration?.({
+            agent,
+            taskType,
+            operationId: (0, import_webhook_registration.deliveryWebhookRegistrationId)(deliveryKind, delivery.url),
+            callbackUrl: delivery.url,
+            mode: "rfc9421",
+            signingProfile: selected,
+            deliveryKind
+          });
+        }
+      }
       let webhookRegistrationPersisted = false;
       if (webhookUrl && this.config.onWebhookRegistration) {
         const registration = webhookRegistrationFromPreparedCall(agent, preparedCall);
@@ -997,7 +1058,7 @@ class TaskExecutor {
       const callOptions = {
         debugLogs,
         webhookUrl,
-        webhookSecret: this.config.webhookSecret,
+        webhookSecret: this.config.signedIdentity33Webhooks?.() ? void 0 : this.config.webhookSecret,
         operationId: taskId,
         serverVersion: effectiveServerVersion,
         session: { contextId: options.contextId, taskId: options.taskId },
@@ -4399,7 +4460,7 @@ class TaskExecutor {
     try {
       const validationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
       const normalizedResponse = this.normalizeResponseForValidation(response, taskName, validationVersion === "v2.5");
-      const outcome = (0, import_client_hooks.validateIncomingResponse)(taskName, normalizedResponse, mode, void 0, validationVersion);
+      const outcome = (this.config.experimentalIdentity33?.() || this.config.identity33SchemaExperiment && normalizedResponse && typeof normalizedResponse === "object" && (0, import_adcp_version_config.isAdcpVersionAtLeast)(normalizedResponse.adcp_version, "3.3")) && mode !== "off" ? validateIdentity33Payload(taskName, "response", normalizedResponse, validationVersion) : (0, import_client_hooks.validateIncomingResponse)(taskName, normalizedResponse, mode, void 0, validationVersion);
       if (outcome.valid) return { valid: true, errors: [] };
       const errorStrings = outcome.issues.map((i) => `${i.pointer}: ${i.message}`);
       if (logViolations) {

package/dist/lib/core/TaskExecutor.mjs

@@ -1,3 +1,14 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
+import { deliveryWebhookRegistrationId } from "./webhook-registration.mjs";
+import { isAdcpVersionAtLeast } from "../utils/adcp-version-config.mjs";
+function validateIdentity33Payload(...args) {
+  return require2("../identity-3.3/validation").validateIdentity33Payload(...args);
+}
+import { buildValidationError } from "../validation/schema-errors.mjs";
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
 import {
   ProtocolClient,
@@ -164,8 +175,15 @@ function webhookRegistrationFromPreparedCall(_agent, preparedCall) {
   if (typeof candidate.url !== "string") {
     throw new ConfigurationError("push_notification_config.url must be a string.", "push_notification_config.url");
   }
+  const profile = candidate.signing_profile;
   if (!Object.prototype.hasOwnProperty.call(candidate, "authentication")) {
-    return { callbackUrl: candidate.url, mode: "rfc9421" };
+    if (profile !== void 0 && !["adcp/webhook-signing/v1", "web-bot-auth"].includes(profile))
+      throw new ConfigurationError("Unsupported webhook signing profile", "signing_profile");
+    return {
+      callbackUrl: candidate.url,
+      mode: "rfc9421",
+      ...profile !== void 0 && { signingProfile: profile }
+    };
   }
   const authentication = candidate.authentication;
   if (!authentication || typeof authentication !== "object" || Array.isArray(authentication)) {
@@ -643,6 +661,15 @@ class TaskExecutor {
    * Throws in strict, logs to `debugLogs` in warn, no-ops in off.
    */
   validateRequest(taskName, params, debugLogs) {
+    if (this.config.experimentalIdentity33?.() && this.requestValidationMode !== "off") {
+      const outcome = validateIdentity33Payload(taskName, "request", params, this.config.adcpVersion);
+      if (!outcome.valid) {
+        if (this.requestValidationMode === "strict") throw buildValidationError(taskName, "request", outcome.issues);
+        if (debugLogs)
+          this.logDebug(debugLogs, "warning", `Request validation failed for ${taskName}`, { issues: outcome.issues });
+      }
+      return;
+    }
     validateOutgoingRequest(taskName, params, this.requestValidationMode, debugLogs, this.config.adcpVersion);
   }
   /**
@@ -834,19 +861,29 @@ class TaskExecutor {
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
       throwIfAborted(options.signal);
+      const callbackProfile = this.config.signedIdentity33Webhooks?.() && (webhookUrl || params?.reporting_webhook || params?.artifact_webhook || params?.push_notification_config) ? this.config.webhookSigningProfile?.() : void 0;
+      const applyCallbackProfiles = (args) => {
+        if (!callbackProfile || options.preserveGovernedPayload) return;
+        for (const field of ["push_notification_config", "reporting_webhook", "artifact_webhook"]) {
+          const callback = args[field];
+          if (callback && typeof callback === "object" && callback.authentication === void 0 && callback.signing_profile === void 0)
+            callback.signing_profile = callbackProfile;
+        }
+      };
       const governanceMiddleware = this.governanceMiddleware;
       if (governanceMiddleware) {
         const modernGovernance = targetCapabilities !== void 0 && targetDeclaresGovernanceEnforcement(targetCapabilities, taskName);
         const governableParams = modernGovernance ? prepareProtocolToolCall(agent, params, {
           toolName: taskName,
           webhookUrl,
-          webhookSecret: this.config.webhookSecret,
+          webhookSecret: this.config.signedIdentity33Webhooks?.() ? void 0 : this.config.webhookSecret,
           operationId: taskId,
           serverVersion: effectiveServerVersion,
           adcpVersion: this.config.adcpVersion,
           wireAdcpVersion,
           versionEnvelope
         }).args : params;
+        if (modernGovernance) applyCallbackProfiles(governableParams);
         if (await governanceMiddleware.shouldCheck(taskName, governableParams, targetCapabilities)) {
           const sdkInjectedPushConfig = modernGovernance && webhookUrl !== void 0 && this.config.webhookSecret !== void 0;
           assertGovernedPayloadHasNoCallbackCredentials(taskName, governableParams, { sdkInjectedPushConfig });
@@ -891,13 +928,42 @@ class TaskExecutor {
       const preparedCall = prepareProtocolToolCall(agent, dispatchParams, {
         toolName: taskName,
         webhookUrl,
-        webhookSecret: this.config.webhookSecret,
+        webhookSecret: this.config.signedIdentity33Webhooks?.() ? void 0 : this.config.webhookSecret,
         operationId: taskId,
         serverVersion: effectiveServerVersion,
         adcpVersion: this.config.adcpVersion,
         wireAdcpVersion,
         versionEnvelope
       });
+      applyCallbackProfiles(preparedCall.args);
+      const signingProfile = options.preserveGovernedPayload ? void 0 : callbackProfile;
+      if (signingProfile && preparedCall.args.push_notification_config && typeof preparedCall.args.push_notification_config === "object") {
+        const registration = preparedCall.args.push_notification_config;
+        if (registration.authentication === void 0 && registration.signing_profile === void 0)
+          registration.signing_profile = signingProfile;
+      }
+      if (this.config.signedIdentity33Webhooks?.()) {
+        for (const [field, deliveryKind, taskType] of [
+          ["reporting_webhook", "reporting", "media_buy_delivery"],
+          ["artifact_webhook", "artifact", "artifact_delivery"]
+        ]) {
+          const delivery = preparedCall.args[field];
+          if (!delivery || typeof delivery.url !== "string" || delivery.authentication !== void 0) continue;
+          const selected = delivery.signing_profile ?? (options.preserveGovernedPayload ? "adcp/webhook-signing/v1" : callbackProfile);
+          if (selected !== "adcp/webhook-signing/v1" && selected !== "web-bot-auth")
+            throw new Error("Invalid delivery signing profile");
+          if (!options.preserveGovernedPayload) delivery.signing_profile = selected;
+          await this.config.onWebhookRegistration?.({
+            agent,
+            taskType,
+            operationId: deliveryWebhookRegistrationId(deliveryKind, delivery.url),
+            callbackUrl: delivery.url,
+            mode: "rfc9421",
+            signingProfile: selected,
+            deliveryKind
+          });
+        }
+      }
       let webhookRegistrationPersisted = false;
       if (webhookUrl && this.config.onWebhookRegistration) {
         const registration = webhookRegistrationFromPreparedCall(agent, preparedCall);
@@ -970,7 +1036,7 @@ class TaskExecutor {
       const callOptions = {
         debugLogs,
         webhookUrl,
-        webhookSecret: this.config.webhookSecret,
+        webhookSecret: this.config.signedIdentity33Webhooks?.() ? void 0 : this.config.webhookSecret,
         operationId: taskId,
         serverVersion: effectiveServerVersion,
         session: { contextId: options.contextId, taskId: options.taskId },
@@ -4372,7 +4438,7 @@ class TaskExecutor {
     try {
       const validationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? ADCP_VERSION;
       const normalizedResponse = this.normalizeResponseForValidation(response, taskName, validationVersion === "v2.5");
-      const outcome = validateIncomingResponse(taskName, normalizedResponse, mode, void 0, validationVersion);
+      const outcome = (this.config.experimentalIdentity33?.() || this.config.identity33SchemaExperiment && normalizedResponse && typeof normalizedResponse === "object" && isAdcpVersionAtLeast(normalizedResponse.adcp_version, "3.3")) && mode !== "off" ? validateIdentity33Payload(taskName, "response", normalizedResponse, validationVersion) : validateIncomingResponse(taskName, normalizedResponse, mode, void 0, validationVersion);
       if (outcome.valid) return { valid: true, errors: [] };
       const errorStrings = outcome.issues.map((i) => `${i.pointer}: ${i.message}`);
       if (logViolations) {

package/dist/lib/core/postgres-webhook-registration-store.js

@@ -59,6 +59,8 @@ CREATE TABLE IF NOT EXISTS ${table} (
   callback_url                     TEXT NOT NULL,
   method                           TEXT NOT NULL,
   mode                             TEXT NOT NULL,
+  delivery_kind                    TEXT CHECK (delivery_kind IS NULL OR (mode = 'rfc9421' AND delivery_kind IN ('reporting', 'artifact'))),
+  signing_profile                  TEXT CHECK (signing_profile IS NULL OR (mode = 'rfc9421' AND signing_profile IN ('adcp/webhook-signing/v1', 'web-bot-auth'))),
   authorization_context_version    SMALLINT,
   delegated_operator_authorization JSONB,
   preview_mode                     TEXT,
@@ -80,6 +82,12 @@ CREATE TABLE IF NOT EXISTS ${table} (
   CONSTRAINT ${tableName}_valid_expiry CHECK (expires_at > created_at)
 );
 
+ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS signing_profile TEXT
+  CHECK (signing_profile IS NULL OR (mode = 'rfc9421' AND signing_profile IN ('adcp/webhook-signing/v1', 'web-bot-auth')));
+
+ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS delivery_kind TEXT
+  CHECK (delivery_kind IS NULL OR (mode = 'rfc9421' AND delivery_kind IN ('reporting', 'artifact')));
+
 CREATE INDEX IF NOT EXISTS idx_${tableName}_expires_at
   ON ${table}(expires_at);
 `.trim();
@@ -94,6 +102,8 @@ const RETURNING_REGISTRATION = `
   callback_url,
   method,
   mode,
+  signing_profile,
+  delivery_kind,
   authorization_context_version,
   delegated_operator_authorization,
   preview_mode,
@@ -148,6 +158,8 @@ function registrationFromRow(row, expectedKey) {
         callbackUrl: requiredString(row, "callback_url"),
         method: requiredString(row, "method"),
         mode: requiredString(row, "mode"),
+        ...row.signing_profile != null && { signingProfile: optionalString(row, "signing_profile") },
+        ...row.delivery_kind != null && { deliveryKind: optionalString(row, "delivery_kind") },
         ...authorizationContextVersion === 1 && { authorizationContextVersion },
         ...delegatedOperatorAuthorization !== null && { delegatedOperatorAuthorization },
         ...previewMode !== void 0 && { previewMode },
@@ -203,18 +215,18 @@ function pgWebhookRegistrationStore(db, options = {}) {
          INSERT INTO ${table} AS existing (
            agent_id, operation_id, agent_url, protocol, task_type, callback_url,
            method, mode, authorization_context_version, delegated_operator_authorization,
-           preview_mode, requires_durable_settlement, created_at, expires_at
+           preview_mode, requires_durable_settlement, created_at, expires_at, signing_profile, delivery_kind
          )
          SELECT
            $1, $2, $3, $4, $5, $6, $7, $8, $9, $10::jsonb, $11, $12,
            to_timestamp($13::double precision / 1000.0),
-           to_timestamp($14::double precision / 1000.0)
+           to_timestamp($14::double precision / 1000.0), $15, $16
          FROM backend_clock
          WHERE to_timestamp($14::double precision / 1000.0) > backend_clock.now
          ON CONFLICT (agent_id, operation_id) DO UPDATE SET (
            agent_url, protocol, task_type, callback_url, method, mode,
            authorization_context_version, delegated_operator_authorization,
-           preview_mode, requires_durable_settlement, created_at, expires_at
+           preview_mode, requires_durable_settlement, created_at, expires_at, signing_profile, delivery_kind
          ) = (
            SELECT
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.agent_url
@@ -240,7 +252,20 @@ function pgWebhookRegistrationStore(db, options = {}) {
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.created_at
                ELSE existing.created_at END,
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.expires_at
-               ELSE existing.expires_at END
+               WHEN existing.delivery_kind IS NOT NULL AND
+                 ROW(existing.agent_url, existing.protocol, existing.task_type, existing.callback_url, existing.method, existing.mode,
+                     existing.authorization_context_version, existing.delegated_operator_authorization, existing.preview_mode,
+                     COALESCE(existing.signing_profile, 'adcp/webhook-signing/v1'), existing.delivery_kind)
+                 IS NOT DISTINCT FROM
+                 ROW(EXCLUDED.agent_url, EXCLUDED.protocol, EXCLUDED.task_type, EXCLUDED.callback_url, EXCLUDED.method, EXCLUDED.mode,
+                     EXCLUDED.authorization_context_version, EXCLUDED.delegated_operator_authorization, EXCLUDED.preview_mode,
+                     COALESCE(EXCLUDED.signing_profile, 'adcp/webhook-signing/v1'), EXCLUDED.delivery_kind)
+               THEN GREATEST(existing.expires_at, EXCLUDED.expires_at)
+               ELSE existing.expires_at END,
+             CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.signing_profile
+               ELSE existing.signing_profile END,
+             CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.delivery_kind
+               ELSE existing.delivery_kind END
            FROM backend_clock
          )
          RETURNING ${RETURNING_REGISTRATION},
@@ -259,7 +284,9 @@ function pgWebhookRegistrationStore(db, options = {}) {
           proposed.previewMode ?? null,
           proposed.requiresDurableSettlement ?? null,
           proposed.createdAt,
-          proposed.expiresAt
+          proposed.expiresAt,
+          proposed.signingProfile ?? null,
+          proposed.deliveryKind ?? null
         ]
       );
       const row = result.rows[0];

package/dist/lib/core/postgres-webhook-registration-store.mjs

@@ -39,6 +39,8 @@ CREATE TABLE IF NOT EXISTS ${table} (
   callback_url                     TEXT NOT NULL,
   method                           TEXT NOT NULL,
   mode                             TEXT NOT NULL,
+  delivery_kind                    TEXT CHECK (delivery_kind IS NULL OR (mode = 'rfc9421' AND delivery_kind IN ('reporting', 'artifact'))),
+  signing_profile                  TEXT CHECK (signing_profile IS NULL OR (mode = 'rfc9421' AND signing_profile IN ('adcp/webhook-signing/v1', 'web-bot-auth'))),
   authorization_context_version    SMALLINT,
   delegated_operator_authorization JSONB,
   preview_mode                     TEXT,
@@ -60,6 +62,12 @@ CREATE TABLE IF NOT EXISTS ${table} (
   CONSTRAINT ${tableName}_valid_expiry CHECK (expires_at > created_at)
 );
 
+ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS signing_profile TEXT
+  CHECK (signing_profile IS NULL OR (mode = 'rfc9421' AND signing_profile IN ('adcp/webhook-signing/v1', 'web-bot-auth')));
+
+ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS delivery_kind TEXT
+  CHECK (delivery_kind IS NULL OR (mode = 'rfc9421' AND delivery_kind IN ('reporting', 'artifact')));
+
 CREATE INDEX IF NOT EXISTS idx_${tableName}_expires_at
   ON ${table}(expires_at);
 `.trim();
@@ -74,6 +82,8 @@ const RETURNING_REGISTRATION = `
   callback_url,
   method,
   mode,
+  signing_profile,
+  delivery_kind,
   authorization_context_version,
   delegated_operator_authorization,
   preview_mode,
@@ -128,6 +138,8 @@ function registrationFromRow(row, expectedKey) {
         callbackUrl: requiredString(row, "callback_url"),
         method: requiredString(row, "method"),
         mode: requiredString(row, "mode"),
+        ...row.signing_profile != null && { signingProfile: optionalString(row, "signing_profile") },
+        ...row.delivery_kind != null && { deliveryKind: optionalString(row, "delivery_kind") },
         ...authorizationContextVersion === 1 && { authorizationContextVersion },
         ...delegatedOperatorAuthorization !== null && { delegatedOperatorAuthorization },
         ...previewMode !== void 0 && { previewMode },
@@ -183,18 +195,18 @@ function pgWebhookRegistrationStore(db, options = {}) {
          INSERT INTO ${table} AS existing (
            agent_id, operation_id, agent_url, protocol, task_type, callback_url,
            method, mode, authorization_context_version, delegated_operator_authorization,
-           preview_mode, requires_durable_settlement, created_at, expires_at
+           preview_mode, requires_durable_settlement, created_at, expires_at, signing_profile, delivery_kind
          )
          SELECT
            $1, $2, $3, $4, $5, $6, $7, $8, $9, $10::jsonb, $11, $12,
            to_timestamp($13::double precision / 1000.0),
-           to_timestamp($14::double precision / 1000.0)
+           to_timestamp($14::double precision / 1000.0), $15, $16
          FROM backend_clock
          WHERE to_timestamp($14::double precision / 1000.0) > backend_clock.now
          ON CONFLICT (agent_id, operation_id) DO UPDATE SET (
            agent_url, protocol, task_type, callback_url, method, mode,
            authorization_context_version, delegated_operator_authorization,
-           preview_mode, requires_durable_settlement, created_at, expires_at
+           preview_mode, requires_durable_settlement, created_at, expires_at, signing_profile, delivery_kind
          ) = (
            SELECT
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.agent_url
@@ -220,7 +232,20 @@ function pgWebhookRegistrationStore(db, options = {}) {
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.created_at
                ELSE existing.created_at END,
              CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.expires_at
-               ELSE existing.expires_at END
+               WHEN existing.delivery_kind IS NOT NULL AND
+                 ROW(existing.agent_url, existing.protocol, existing.task_type, existing.callback_url, existing.method, existing.mode,
+                     existing.authorization_context_version, existing.delegated_operator_authorization, existing.preview_mode,
+                     COALESCE(existing.signing_profile, 'adcp/webhook-signing/v1'), existing.delivery_kind)
+                 IS NOT DISTINCT FROM
+                 ROW(EXCLUDED.agent_url, EXCLUDED.protocol, EXCLUDED.task_type, EXCLUDED.callback_url, EXCLUDED.method, EXCLUDED.mode,
+                     EXCLUDED.authorization_context_version, EXCLUDED.delegated_operator_authorization, EXCLUDED.preview_mode,
+                     COALESCE(EXCLUDED.signing_profile, 'adcp/webhook-signing/v1'), EXCLUDED.delivery_kind)
+               THEN GREATEST(existing.expires_at, EXCLUDED.expires_at)
+               ELSE existing.expires_at END,
+             CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.signing_profile
+               ELSE existing.signing_profile END,
+             CASE WHEN existing.expires_at <= backend_clock.now THEN EXCLUDED.delivery_kind
+               ELSE existing.delivery_kind END
            FROM backend_clock
          )
          RETURNING ${RETURNING_REGISTRATION},
@@ -239,7 +264,9 @@ function pgWebhookRegistrationStore(db, options = {}) {
           proposed.previewMode ?? null,
           proposed.requiresDurableSettlement ?? null,
           proposed.createdAt,
-          proposed.expiresAt
+          proposed.expiresAt,
+          proposed.signingProfile ?? null,
+          proposed.deliveryKind ?? null
         ]
       );
       const row = result.rows[0];

package/dist/lib/core/redis-webhook-registration-store.js

@@ -77,6 +77,21 @@ if raw then
   if current_expires_at > now_ms then
     if redis.call('PTTL', KEYS[1]) < 0 then return cjson.encode({status = 'corrupt'}) end
     if stored.fingerprint == ARGV[3] then
+      if ARGV[6] == 'delivery' and proposed_expires_at > current_expires_at then
+        local registration_ok, registration = pcall(cjson.decode, stored.registration)
+        if not registration_ok or type(registration) ~= 'table' or not registration.deliveryKind then
+          return cjson.encode({status = 'corrupt'})
+        end
+        if registration.expiresAt ~= current_expires_at then return cjson.encode({status = 'corrupt'}) end
+        local replacements
+        stored.registration, replacements = string.gsub(stored.registration, '("expiresAt"%s*:%s*)%d+', function(prefix)
+          return prefix .. ARGV[4]
+        end)
+        if replacements ~= 1 then return cjson.encode({status = 'corrupt'}) end
+        stored.expiresAt = ARGV[4]
+        raw = cjson.encode(stored)
+        redis.call('SET', KEYS[1], raw, 'PXAT', ARGV[4])
+      end
       return cjson.encode({status = 'existing', record = raw})
     end
     return cjson.encode({status = 'conflict'})
@@ -283,7 +298,14 @@ function redisWebhookRegistrationStore(client, options = {}) {
         "putIfAbsent",
         PUT_IF_ABSENT_SCRIPT,
         [key],
-        [expectedKey.agentId, expectedKey.operationId, fingerprint, String(proposed.expiresAt), serialized]
+        [
+          expectedKey.agentId,
+          expectedKey.operationId,
+          fingerprint,
+          String(proposed.expiresAt),
+          serialized,
+          proposed.deliveryKind ? "delivery" : "operation"
+        ]
       );
       if (outcome.status === "conflict") {
         throw new import_errors.ConfigurationError(

package/dist/lib/core/redis-webhook-registration-store.mjs

@@ -61,6 +61,21 @@ if raw then
   if current_expires_at > now_ms then
     if redis.call('PTTL', KEYS[1]) < 0 then return cjson.encode({status = 'corrupt'}) end
     if stored.fingerprint == ARGV[3] then
+      if ARGV[6] == 'delivery' and proposed_expires_at > current_expires_at then
+        local registration_ok, registration = pcall(cjson.decode, stored.registration)
+        if not registration_ok or type(registration) ~= 'table' or not registration.deliveryKind then
+          return cjson.encode({status = 'corrupt'})
+        end
+        if registration.expiresAt ~= current_expires_at then return cjson.encode({status = 'corrupt'}) end
+        local replacements
+        stored.registration, replacements = string.gsub(stored.registration, '("expiresAt"%s*:%s*)%d+', function(prefix)
+          return prefix .. ARGV[4]
+        end)
+        if replacements ~= 1 then return cjson.encode({status = 'corrupt'}) end
+        stored.expiresAt = ARGV[4]
+        raw = cjson.encode(stored)
+        redis.call('SET', KEYS[1], raw, 'PXAT', ARGV[4])
+      end
       return cjson.encode({status = 'existing', record = raw})
     end
     return cjson.encode({status = 'conflict'})
@@ -267,7 +282,14 @@ function redisWebhookRegistrationStore(client, options = {}) {
         "putIfAbsent",
         PUT_IF_ABSENT_SCRIPT,
         [key],
-        [expectedKey.agentId, expectedKey.operationId, fingerprint, String(proposed.expiresAt), serialized]
+        [
+          expectedKey.agentId,
+          expectedKey.operationId,
+          fingerprint,
+          String(proposed.expiresAt),
+          serialized,
+          proposed.deliveryKind ? "delivery" : "operation"
+        ]
       );
       if (outcome.status === "conflict") {
         throw new ConfigurationError(

package/dist/lib/core/webhook-registration.d.mts

@@ -16,6 +16,9 @@ export interface WebhookRegistration {
     callbackUrl: string;
     method: 'POST';
     mode: WebhookAuthenticationMode;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
+    /** Out-of-band reports/artifacts bind to the destination, not a task operation. */
+    deliveryKind?: 'reporting' | 'artifact';
     /** Versioned marker distinguishing tuple-aware registrations from legacy rows. */
     authorizationContextVersion?: 1;
     /** Trusted local tuple used to re-authorize delegated seller keys after restart. */
@@ -33,7 +36,8 @@ export interface WebhookRegistrationStore {
     /** Return no record when `expiresAt` is at or before the current time. */
     get(agentId: string, operationId: string): Promise<Readonly<WebhookRegistration> | undefined>;
     /**
-     * Atomically create a registration. An identical retry is idempotent; a
+     * Atomically create a registration. An identical retry is idempotent; matching
+     * destination delivery routes also extend expiry to the later value. A
      * conflicting live registration for the same key MUST reject. A successful
      * return MUST provide immediate read-your-writes consistency through `get()`
      * so the SDK can verify trusted authorization provenance before dispatch.
@@ -68,3 +72,5 @@ export declare class InMemoryWebhookRegistrationStore implements WebhookRegistra
     markRequiresDurableSettlement(agentId: string, operationId: string): Promise<void>;
     private pruneExpired;
 }
+/** Stable, non-secret local route key. It is never sent as an authentication credential. */
+export declare function deliveryWebhookRegistrationId(kind: 'reporting' | 'artifact', url: string): string;

package/dist/lib/core/webhook-registration.d.ts

@@ -16,6 +16,9 @@ export interface WebhookRegistration {
     callbackUrl: string;
     method: 'POST';
     mode: WebhookAuthenticationMode;
+    signingProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
+    /** Out-of-band reports/artifacts bind to the destination, not a task operation. */
+    deliveryKind?: 'reporting' | 'artifact';
     /** Versioned marker distinguishing tuple-aware registrations from legacy rows. */
     authorizationContextVersion?: 1;
     /** Trusted local tuple used to re-authorize delegated seller keys after restart. */
@@ -33,7 +36,8 @@ export interface WebhookRegistrationStore {
     /** Return no record when `expiresAt` is at or before the current time. */
     get(agentId: string, operationId: string): Promise<Readonly<WebhookRegistration> | undefined>;
     /**
-     * Atomically create a registration. An identical retry is idempotent; a
+     * Atomically create a registration. An identical retry is idempotent; matching
+     * destination delivery routes also extend expiry to the later value. A
      * conflicting live registration for the same key MUST reject. A successful
      * return MUST provide immediate read-your-writes consistency through `get()`
      * so the SDK can verify trusted authorization provenance before dispatch.
@@ -68,3 +72,5 @@ export declare class InMemoryWebhookRegistrationStore implements WebhookRegistra
     markRequiresDurableSettlement(agentId: string, operationId: string): Promise<void>;
     private pruneExpired;
 }
+/** Stable, non-secret local route key. It is never sent as an authentication credential. */
+export declare function deliveryWebhookRegistrationId(kind: 'reporting' | 'artifact', url: string): string;