@adcp/sdk 16.0.0-beta.1 → 16.0.0-beta.2

package/dist/lib/identity-3.3/trust.js

@@ -30,6 +30,8 @@ var trust_exports = {};
 __export(trust_exports, {
   IdentityAuthorizationError: () => IdentityAuthorizationError,
   TrustEvaluator: () => TrustEvaluator,
+  TrustMembershipError: () => TrustMembershipError,
+  TrustRecordUnavailableError: () => TrustRecordUnavailableError,
   authorizeDemandGrant: () => authorizeDemandGrant,
   createTrustRecord: () => createTrustRecord,
   validateIdentity33Schema: () => validateIdentity33Schema,
@@ -42,6 +44,7 @@ var import_net = require('../net/index.js');
 var import_canonicalize = require('../signing/agent-resolver/canonicalize.js');
 var import_etld = require('../signing/agent-resolver/etld.js');
 var import_strict_json = require('../signing/agent-resolver/strict-json.js');
+var import_tldts = require("tldts");
 var import_schemas = __toESM(require('./schemas.draft.js'));
 const ajv = new import_ajv.default({ strict: false, allErrors: false });
 (0, import_ajv_formats.default)(ajv);
@@ -58,6 +61,39 @@ class IdentityAuthorizationError extends Error {
     this.details = reason === "grant_absent" ? { scope: "agent", reason } : void 0;
   }
 }
+class TrustRecordUnavailableError extends IdentityAuthorizationError {
+  transient = true;
+  /**
+   * Set by `match()`: the last record read for this operator listed the origin
+   * with the role and is still within the seller's outage bound
+   * (`maxOutageContinuationSeconds` past its freshness). Only then may non-spend
+   * calls continue under a binding.
+   */
+  lastKnownListed = false;
+  constructor() {
+    super();
+    this.name = "TrustRecordUnavailableError";
+    this.message = "Agent trust record is temporarily unavailable";
+  }
+}
+class TrustMembershipError extends IdentityAuthorizationError {
+  constructor(membership = "unlisted") {
+    super();
+    this.membership = membership;
+    this.name = "TrustMembershipError";
+  }
+  membership;
+}
+function unavailable(cause) {
+  const error = new TrustRecordUnavailableError();
+  if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
+  throw error;
+}
+class TrustHostCapacityError extends Error {
+}
+const FOREIGN_HOST_BUDGET = "\0foreign";
+const OWN_HOST_REQUESTS_PER_MINUTE = 10;
+const FOREIGN_HOST_REQUESTS_PER_MINUTE = 30;
 function failure(cause) {
   const error = new IdentityAuthorizationError();
   if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
@@ -82,6 +118,9 @@ class TrustEvaluator {
   constructor(options = {}) {
     this.options = options;
     this.pollingIntervalSeconds = options.pollingIntervalSeconds ?? 300;
+    this.maxOutageContinuationSeconds = options.maxOutageContinuationSeconds ?? 4 * this.pollingIntervalSeconds;
+    if (!Number.isFinite(this.maxOutageContinuationSeconds) || this.maxOutageContinuationSeconds < 0)
+      throw new TypeError("maxOutageContinuationSeconds must be a finite, non-negative number");
     if (!Number.isFinite(this.pollingIntervalSeconds) || this.pollingIntervalSeconds < 60 || this.pollingIntervalSeconds > 1800)
       throw new TypeError("Trust polling interval must be 60\u20131800 seconds");
   }
@@ -90,10 +129,14 @@ class TrustEvaluator {
   negative = /* @__PURE__ */ new Map();
   pending = /* @__PURE__ */ new Map();
   urlRequests = /* @__PURE__ */ new Map();
+  /** Keyed by (operator, host): one operator's authoritative_location hops never spend another's budget. */
   hostRates = /* @__PURE__ */ new Map();
   authoritativeOperators = /* @__PURE__ */ new Set();
-  authorityHistoryOverflowed = false;
+  /** Remembered authoritative operators per budget group (see authorityGroup). */
+  authorityGroups = /* @__PURE__ */ new Map();
+  privateAuthorityOperators = 0;
   pollingIntervalSeconds;
+  maxOutageContinuationSeconds;
   async get(domainOrOrigin, force = false) {
     let operator;
     try {
@@ -104,10 +147,10 @@ class TrustEvaluator {
     const now = this.now();
     const cached = this.cache.get(operator);
     if (!force && cached && cached.freshUntil > now) return cached;
-    if ((this.negative.get(operator) ?? 0) > now) failure();
+    if ((this.negative.get(operator) ?? 0) > now) unavailable();
     let pending = this.pending.get(operator);
     if (!pending) {
-      if (this.pending.size >= (this.options.maxConcurrentFetches ?? 16)) failure();
+      if (this.pending.size >= (this.options.maxConcurrentFetches ?? 16)) unavailable();
       pending = this.fetch(operator, now);
       this.pending.set(operator, pending);
     }
@@ -119,11 +162,20 @@ class TrustEvaluator {
   }
   async match(origin, role, countries) {
     const canonical = (0, import_canonicalize.canonicalAgentOrigin)(origin);
-    const result = await this.get(canonical);
-    if (result.status !== "present") failure();
-    const entries = (result.record.agents ?? []).filter((agent2) => (0, import_canonicalize.canonicalAgentOrigin)(agent2.url) === canonical);
-    if (entries.length !== 1 || !entries[0].roles.includes(role)) failure();
-    const agent = entries[0];
+    let result;
+    try {
+      result = await this.get(canonical);
+    } catch (error) {
+      if (!(error instanceof TrustRecordUnavailableError)) throw error;
+      const last = this.cache.get((0, import_etld.eTldPlusOne)(canonical));
+      if (last && !listedAgent(last, canonical, role))
+        throw new TrustMembershipError(last.status === "present" ? "unlisted" : "absent");
+      error.lastKnownListed = !!last && this.now() <= last.freshUntil + this.maxOutageContinuationSeconds;
+      throw error;
+    }
+    const agent = listedAgent(result, canonical, role);
+    if (result.status !== "present") throw new TrustMembershipError("absent");
+    if (!agent) throw new TrustMembershipError();
     if (agent.countries && countries?.length && countries.some((country) => !agent.countries.includes(country)))
       failure();
     return { operator: result.operator, agent, record: result.record, freshUntil: result.freshUntil };
@@ -131,20 +183,55 @@ class TrustEvaluator {
   invalidate(domain) {
     this.cache.delete((0, import_etld.eTldPlusOne)(domain));
   }
+  /**
+   * Record that `operator` served a trust record. With durable history the
+   * in-memory set is only a cache and may evict; without it, nothing is
+   * evicted and an operator over its group budget or the total is refused.
+   */
+  rememberAuthority(operator, durable) {
+    if (this.authoritativeOperators.has(operator)) return true;
+    const max = this.options.maxEntries ?? 1e3;
+    if (durable) {
+      if (this.authoritativeOperators.size >= max)
+        this.authoritativeOperators.delete(this.authoritativeOperators.values().next().value);
+      this.authoritativeOperators.add(operator);
+      return true;
+    }
+    const group = authorityGroup(operator);
+    const hosted = group !== operator;
+    if (this.authoritativeOperators.size >= max || hosted && (this.privateAuthorityOperators >= (this.options.maxPrivateAuthoritativeOperators ?? Math.floor(max / 2)) || (this.authorityGroups.get(group) ?? 0) >= (this.options.maxAuthoritativeOperatorsPerPrivateSuffix ?? 32)))
+      return false;
+    this.authoritativeOperators.add(operator);
+    if (hosted) {
+      this.privateAuthorityOperators++;
+      this.authorityGroups.set(group, (this.authorityGroups.get(group) ?? 0) + 1);
+    }
+    return true;
+  }
+  /**
+   * Process-local view only. With durable `authorityHistory` this set is a
+   * cache and may have evicted an operator that durable history still records.
+   */
   hasAuthoritativeRecord(domain) {
     return this.authoritativeOperators.has((0, import_etld.eTldPlusOne)(domain));
   }
   now() {
     return (this.options.now ?? (() => Date.now() / 1e3))();
   }
-  async request(url) {
+  async request(url, operator) {
     const parsed = new URL(url);
     if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash) failure();
-    const host = parsed.hostname;
+    let own = false;
+    try {
+      own = (0, import_etld.eTldPlusOne)(parsed.hostname) === operator;
+    } catch {
+    }
+    const host = JSON.stringify([own ? operator : FOREIGN_HOST_BUDGET, parsed.hostname]);
+    const limit = own ? OWN_HOST_REQUESTS_PER_MINUTE : FOREIGN_HOST_REQUESTS_PER_MINUTE;
     const pending = this.urlRequests.get(url);
     if (pending) return pending;
     const now = this.now(), rate = this.hostRates.get(host);
-    if (rate && now - rate.started < 60 && rate.count >= 10) failure();
+    if (rate && now - rate.started < 60 && rate.count >= limit) throw new TrustHostCapacityError();
     if (!rate && this.hostRates.size >= (this.options.maxEntries ?? 1e3))
       this.hostRates.delete(this.hostRates.keys().next().value);
     this.hostRates.set(
@@ -166,24 +253,24 @@ class TrustEvaluator {
   }
   async fetch(operator, now) {
     try {
-      let response = await this.request(`https://${operator}/.well-known/trust.json`);
+      let response = await this.request(`https://${operator}/.well-known/trust.json`, operator);
       let result;
       if (response.status === 404 || response.status === 410) {
-        if (this.authorityHistoryOverflowed || this.authoritativeOperators.has(operator) || await this.options.authorityHistory?.has(operator))
+        if (this.authoritativeOperators.has(operator) || await this.options.authorityHistory?.has(operator))
           failure();
         result = { status: "absent", operator, checkedAt: now, freshUntil: now + 60 };
       } else {
         if (response.status !== 200) failure();
-        if (!this.authoritativeOperators.has(operator) && this.authoritativeOperators.size >= (this.options.maxEntries ?? 1e3)) {
-          if (!this.options.authorityHistory) this.authorityHistoryOverflowed = true;
-          this.authoritativeOperators.delete(this.authoritativeOperators.values().next().value);
+        if (this.options.authorityHistory) {
+          await this.options.authorityHistory.mark(operator);
+          this.rememberAuthority(operator, true);
+        } else if (!this.rememberAuthority(operator, false)) {
+          failure();
         }
-        await this.options.authorityHistory?.mark(operator);
-        this.authoritativeOperators.add(operator);
         let record = (0, import_strict_json.parseStrictJson)(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
         validateTrustRecord(record);
         if (record.authoritative_location) {
-          response = await this.request(record.authoritative_location);
+          response = await this.request(record.authoritative_location, operator);
           if (response.status !== 200) failure();
           record = (0, import_strict_json.parseStrictJson)(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
           validateTrustRecord(record);
@@ -203,13 +290,24 @@ class TrustEvaluator {
       this.negative.delete(operator);
       return result;
     } catch (cause) {
+      if (cause instanceof TrustHostCapacityError) return unavailable(cause);
       if (this.negative.size >= (this.options.maxEntries ?? 1e3))
         this.negative.delete(this.negative.keys().next().value);
       this.negative.set(operator, now + 60);
-      return failure(cause);
+      return unavailable(cause);
     }
   }
 }
+function listedAgent(result, origin, role) {
+  if (result.status !== "present") return void 0;
+  const entries = (result.record.agents ?? []).filter((agent) => (0, import_canonicalize.canonicalAgentOrigin)(agent.url) === origin);
+  return entries.length === 1 && entries[0].roles.includes(role) ? entries[0] : void 0;
+}
+function authorityGroup(operator) {
+  if (!(0, import_tldts.parse)(operator, { allowPrivateDomains: true }).isPrivate) return operator;
+  const provider = (0, import_tldts.parse)(operator).domain;
+  return `private:${provider ?? operator}`;
+}
 function grantMatches(grant, target, claim, now) {
   if ((0, import_etld.eTldPlusOne)(grant.grantee) !== target) return false;
   if (!grant.scopes.some(
@@ -251,6 +349,11 @@ async function authorizeDemandGrant(claim, options) {
   }
   const first = (record.record.grants ?? []).filter((g) => grantMatches(g, account, grantClaim, now));
   if (account === operator && first.length) return result("trust", [brand, operator], [first[0]]);
+  const selfOperated = account === brand || account === authoritativeBrand;
+  if (selfOperated && account !== operator) {
+    const direct = (record.record.grants ?? []).find((g) => grantMatches(g, operator, grantClaim, now));
+    if (direct) return result("trust", [brand, operator], [direct]);
+  }
   if (account !== operator && account !== brand && first.length) {
     const intermediary = await options.evaluator.get(account);
     if (intermediary.status === "present") {
@@ -259,7 +362,7 @@ async function authorizeDemandGrant(claim, options) {
     }
   }
   const covered = (record.record.grants ?? []).some(
-    (g) => (0, import_etld.eTldPlusOne)(g.grantee) === account && g.scopes.some(
+    (g) => ((0, import_etld.eTldPlusOne)(g.grantee) === account || selfOperated && (0, import_etld.eTldPlusOne)(g.grantee) === operator) && g.scopes.some(
       (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
     )
   );
@@ -271,6 +374,8 @@ async function authorizeDemandGrant(claim, options) {
 0 && (module.exports = {
   IdentityAuthorizationError,
   TrustEvaluator,
+  TrustMembershipError,
+  TrustRecordUnavailableError,
   authorizeDemandGrant,
   createTrustRecord,
   validateIdentity33Schema,

package/dist/lib/identity-3.3/trust.mjs

@@ -4,6 +4,7 @@ import { ssrfSafeFetch } from "../net/index.mjs";
 import { canonicalAgentOrigin } from "../signing/agent-resolver/canonicalize.mjs";
 import { eTldPlusOne } from "../signing/agent-resolver/etld.mjs";
 import { parseStrictJson } from "../signing/agent-resolver/strict-json.mjs";
+import { parse as parseDomain } from "tldts";
 import schemas from "./schemas.draft.mjs";
 const ajv = new Ajv({ strict: false, allErrors: false });
 addFormats(ajv);
@@ -20,6 +21,39 @@ class IdentityAuthorizationError extends Error {
     this.details = reason === "grant_absent" ? { scope: "agent", reason } : void 0;
   }
 }
+class TrustRecordUnavailableError extends IdentityAuthorizationError {
+  transient = true;
+  /**
+   * Set by `match()`: the last record read for this operator listed the origin
+   * with the role and is still within the seller's outage bound
+   * (`maxOutageContinuationSeconds` past its freshness). Only then may non-spend
+   * calls continue under a binding.
+   */
+  lastKnownListed = false;
+  constructor() {
+    super();
+    this.name = "TrustRecordUnavailableError";
+    this.message = "Agent trust record is temporarily unavailable";
+  }
+}
+class TrustMembershipError extends IdentityAuthorizationError {
+  constructor(membership = "unlisted") {
+    super();
+    this.membership = membership;
+    this.name = "TrustMembershipError";
+  }
+  membership;
+}
+function unavailable(cause) {
+  const error = new TrustRecordUnavailableError();
+  if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
+  throw error;
+}
+class TrustHostCapacityError extends Error {
+}
+const FOREIGN_HOST_BUDGET = "\0foreign";
+const OWN_HOST_REQUESTS_PER_MINUTE = 10;
+const FOREIGN_HOST_REQUESTS_PER_MINUTE = 30;
 function failure(cause) {
   const error = new IdentityAuthorizationError();
   if (cause !== void 0) Object.defineProperty(error, "cause", { value: cause });
@@ -44,6 +78,9 @@ class TrustEvaluator {
   constructor(options = {}) {
     this.options = options;
     this.pollingIntervalSeconds = options.pollingIntervalSeconds ?? 300;
+    this.maxOutageContinuationSeconds = options.maxOutageContinuationSeconds ?? 4 * this.pollingIntervalSeconds;
+    if (!Number.isFinite(this.maxOutageContinuationSeconds) || this.maxOutageContinuationSeconds < 0)
+      throw new TypeError("maxOutageContinuationSeconds must be a finite, non-negative number");
     if (!Number.isFinite(this.pollingIntervalSeconds) || this.pollingIntervalSeconds < 60 || this.pollingIntervalSeconds > 1800)
       throw new TypeError("Trust polling interval must be 60\u20131800 seconds");
   }
@@ -52,10 +89,14 @@ class TrustEvaluator {
   negative = /* @__PURE__ */ new Map();
   pending = /* @__PURE__ */ new Map();
   urlRequests = /* @__PURE__ */ new Map();
+  /** Keyed by (operator, host): one operator's authoritative_location hops never spend another's budget. */
   hostRates = /* @__PURE__ */ new Map();
   authoritativeOperators = /* @__PURE__ */ new Set();
-  authorityHistoryOverflowed = false;
+  /** Remembered authoritative operators per budget group (see authorityGroup). */
+  authorityGroups = /* @__PURE__ */ new Map();
+  privateAuthorityOperators = 0;
   pollingIntervalSeconds;
+  maxOutageContinuationSeconds;
   async get(domainOrOrigin, force = false) {
     let operator;
     try {
@@ -66,10 +107,10 @@ class TrustEvaluator {
     const now = this.now();
     const cached = this.cache.get(operator);
     if (!force && cached && cached.freshUntil > now) return cached;
-    if ((this.negative.get(operator) ?? 0) > now) failure();
+    if ((this.negative.get(operator) ?? 0) > now) unavailable();
     let pending = this.pending.get(operator);
     if (!pending) {
-      if (this.pending.size >= (this.options.maxConcurrentFetches ?? 16)) failure();
+      if (this.pending.size >= (this.options.maxConcurrentFetches ?? 16)) unavailable();
       pending = this.fetch(operator, now);
       this.pending.set(operator, pending);
     }
@@ -81,11 +122,20 @@ class TrustEvaluator {
   }
   async match(origin, role, countries) {
     const canonical = canonicalAgentOrigin(origin);
-    const result = await this.get(canonical);
-    if (result.status !== "present") failure();
-    const entries = (result.record.agents ?? []).filter((agent2) => canonicalAgentOrigin(agent2.url) === canonical);
-    if (entries.length !== 1 || !entries[0].roles.includes(role)) failure();
-    const agent = entries[0];
+    let result;
+    try {
+      result = await this.get(canonical);
+    } catch (error) {
+      if (!(error instanceof TrustRecordUnavailableError)) throw error;
+      const last = this.cache.get(eTldPlusOne(canonical));
+      if (last && !listedAgent(last, canonical, role))
+        throw new TrustMembershipError(last.status === "present" ? "unlisted" : "absent");
+      error.lastKnownListed = !!last && this.now() <= last.freshUntil + this.maxOutageContinuationSeconds;
+      throw error;
+    }
+    const agent = listedAgent(result, canonical, role);
+    if (result.status !== "present") throw new TrustMembershipError("absent");
+    if (!agent) throw new TrustMembershipError();
     if (agent.countries && countries?.length && countries.some((country) => !agent.countries.includes(country)))
       failure();
     return { operator: result.operator, agent, record: result.record, freshUntil: result.freshUntil };
@@ -93,20 +143,55 @@ class TrustEvaluator {
   invalidate(domain) {
     this.cache.delete(eTldPlusOne(domain));
   }
+  /**
+   * Record that `operator` served a trust record. With durable history the
+   * in-memory set is only a cache and may evict; without it, nothing is
+   * evicted and an operator over its group budget or the total is refused.
+   */
+  rememberAuthority(operator, durable) {
+    if (this.authoritativeOperators.has(operator)) return true;
+    const max = this.options.maxEntries ?? 1e3;
+    if (durable) {
+      if (this.authoritativeOperators.size >= max)
+        this.authoritativeOperators.delete(this.authoritativeOperators.values().next().value);
+      this.authoritativeOperators.add(operator);
+      return true;
+    }
+    const group = authorityGroup(operator);
+    const hosted = group !== operator;
+    if (this.authoritativeOperators.size >= max || hosted && (this.privateAuthorityOperators >= (this.options.maxPrivateAuthoritativeOperators ?? Math.floor(max / 2)) || (this.authorityGroups.get(group) ?? 0) >= (this.options.maxAuthoritativeOperatorsPerPrivateSuffix ?? 32)))
+      return false;
+    this.authoritativeOperators.add(operator);
+    if (hosted) {
+      this.privateAuthorityOperators++;
+      this.authorityGroups.set(group, (this.authorityGroups.get(group) ?? 0) + 1);
+    }
+    return true;
+  }
+  /**
+   * Process-local view only. With durable `authorityHistory` this set is a
+   * cache and may have evicted an operator that durable history still records.
+   */
   hasAuthoritativeRecord(domain) {
     return this.authoritativeOperators.has(eTldPlusOne(domain));
   }
   now() {
     return (this.options.now ?? (() => Date.now() / 1e3))();
   }
-  async request(url) {
+  async request(url, operator) {
     const parsed = new URL(url);
     if (parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.hash) failure();
-    const host = parsed.hostname;
+    let own = false;
+    try {
+      own = eTldPlusOne(parsed.hostname) === operator;
+    } catch {
+    }
+    const host = JSON.stringify([own ? operator : FOREIGN_HOST_BUDGET, parsed.hostname]);
+    const limit = own ? OWN_HOST_REQUESTS_PER_MINUTE : FOREIGN_HOST_REQUESTS_PER_MINUTE;
     const pending = this.urlRequests.get(url);
     if (pending) return pending;
     const now = this.now(), rate = this.hostRates.get(host);
-    if (rate && now - rate.started < 60 && rate.count >= 10) failure();
+    if (rate && now - rate.started < 60 && rate.count >= limit) throw new TrustHostCapacityError();
     if (!rate && this.hostRates.size >= (this.options.maxEntries ?? 1e3))
       this.hostRates.delete(this.hostRates.keys().next().value);
     this.hostRates.set(
@@ -128,24 +213,24 @@ class TrustEvaluator {
   }
   async fetch(operator, now) {
     try {
-      let response = await this.request(`https://${operator}/.well-known/trust.json`);
+      let response = await this.request(`https://${operator}/.well-known/trust.json`, operator);
       let result;
       if (response.status === 404 || response.status === 410) {
-        if (this.authorityHistoryOverflowed || this.authoritativeOperators.has(operator) || await this.options.authorityHistory?.has(operator))
+        if (this.authoritativeOperators.has(operator) || await this.options.authorityHistory?.has(operator))
           failure();
         result = { status: "absent", operator, checkedAt: now, freshUntil: now + 60 };
       } else {
         if (response.status !== 200) failure();
-        if (!this.authoritativeOperators.has(operator) && this.authoritativeOperators.size >= (this.options.maxEntries ?? 1e3)) {
-          if (!this.options.authorityHistory) this.authorityHistoryOverflowed = true;
-          this.authoritativeOperators.delete(this.authoritativeOperators.values().next().value);
+        if (this.options.authorityHistory) {
+          await this.options.authorityHistory.mark(operator);
+          this.rememberAuthority(operator, true);
+        } else if (!this.rememberAuthority(operator, false)) {
+          failure();
         }
-        await this.options.authorityHistory?.mark(operator);
-        this.authoritativeOperators.add(operator);
         let record = parseStrictJson(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
         validateTrustRecord(record);
         if (record.authoritative_location) {
-          response = await this.request(record.authoritative_location);
+          response = await this.request(record.authoritative_location, operator);
           if (response.status !== 200) failure();
           record = parseStrictJson(new TextDecoder("utf-8", { fatal: true }).decode(response.body), 32);
           validateTrustRecord(record);
@@ -165,13 +250,24 @@ class TrustEvaluator {
       this.negative.delete(operator);
       return result;
     } catch (cause) {
+      if (cause instanceof TrustHostCapacityError) return unavailable(cause);
       if (this.negative.size >= (this.options.maxEntries ?? 1e3))
         this.negative.delete(this.negative.keys().next().value);
       this.negative.set(operator, now + 60);
-      return failure(cause);
+      return unavailable(cause);
     }
   }
 }
+function listedAgent(result, origin, role) {
+  if (result.status !== "present") return void 0;
+  const entries = (result.record.agents ?? []).filter((agent) => canonicalAgentOrigin(agent.url) === origin);
+  return entries.length === 1 && entries[0].roles.includes(role) ? entries[0] : void 0;
+}
+function authorityGroup(operator) {
+  if (!parseDomain(operator, { allowPrivateDomains: true }).isPrivate) return operator;
+  const provider = parseDomain(operator).domain;
+  return `private:${provider ?? operator}`;
+}
 function grantMatches(grant, target, claim, now) {
   if (eTldPlusOne(grant.grantee) !== target) return false;
   if (!grant.scopes.some(
@@ -213,6 +309,11 @@ async function authorizeDemandGrant(claim, options) {
   }
   const first = (record.record.grants ?? []).filter((g) => grantMatches(g, account, grantClaim, now));
   if (account === operator && first.length) return result("trust", [brand, operator], [first[0]]);
+  const selfOperated = account === brand || account === authoritativeBrand;
+  if (selfOperated && account !== operator) {
+    const direct = (record.record.grants ?? []).find((g) => grantMatches(g, operator, grantClaim, now));
+    if (direct) return result("trust", [brand, operator], [direct]);
+  }
   if (account !== operator && account !== brand && first.length) {
     const intermediary = await options.evaluator.get(account);
     if (intermediary.status === "present") {
@@ -221,7 +322,7 @@ async function authorizeDemandGrant(claim, options) {
     }
   }
   const covered = (record.record.grants ?? []).some(
-    (g) => eTldPlusOne(g.grantee) === account && g.scopes.some(
+    (g) => (eTldPlusOne(g.grantee) === account || selfOperated && eTldPlusOne(g.grantee) === operator) && g.scopes.some(
       (scope) => scope === "*" || scope === claim.scope || scope === "adcp:all" && claim.scope.startsWith("adcp:")
     )
   );
@@ -232,6 +333,8 @@ async function authorizeDemandGrant(claim, options) {
 export {
   IdentityAuthorizationError,
   TrustEvaluator,
+  TrustMembershipError,
+  TrustRecordUnavailableError,
   authorizeDemandGrant,
   createTrustRecord,
   validateIdentity33Schema,

package/dist/lib/identity-3.3/types.d.mts

@@ -1,9 +1,9 @@
 /** Experimental drafts; the released SDK wire/schema pin remains 3.2.4. */
-export type AgentOnboardingMode = 'open' | 'application' | 'invite_only';
+import type { GeneratedAccountCapabilities, ResolveAgentOnboarding } from './generated-compat.mjs';
 export type BillingParty = 'operator' | 'agent' | 'advertiser';
-export type AgentOnboardingRequirementKind = 'agent_identity' | 'grant' | 'billing_entity' | 'contract' | 'credit_application' | 'aao_verified' | 'storyboard' | 'sandbox' | 'experimental_feature';
-export interface AgentOnboardingRequirement {
-    kind: AgentOnboardingRequirementKind | (string & {});
+type DraftAgentOnboardingRequirementKind = 'agent_identity' | 'grant' | 'billing_entity' | 'contract' | 'credit_application' | 'aao_verified' | 'storyboard' | 'sandbox' | 'experimental_feature';
+interface DraftAgentOnboardingRequirement {
+    kind: DraftAgentOnboardingRequirementKind;
     role?: string;
     verification_modes?: string[];
     specialisms?: string[];
@@ -11,23 +11,50 @@ export interface AgentOnboardingRequirement {
     id?: string;
     ext?: Record<string, unknown>;
 }
-export interface AgentOnboardingTier {
-    mode: AgentOnboardingMode;
+interface DraftAgentOnboardingTier {
+    mode: 'open' | 'application' | 'invite_only';
     url?: string;
-    requirements?: AgentOnboardingRequirement[];
+    requirements?: DraftAgentOnboardingRequirement[];
     ext?: Record<string, unknown>;
 }
-export interface AgentOnboarding {
-    sandbox?: AgentOnboardingTier;
-    billing?: Partial<Record<BillingParty, AgentOnboardingTier>>;
+interface DraftAgentOnboarding {
+    sandbox?: DraftAgentOnboardingTier;
+    billing?: Partial<Record<BillingParty, DraftAgentOnboardingTier>>;
     url?: string;
     documentation_url?: string;
     message?: string;
     ext?: Record<string, unknown>;
 }
+/** `get_adcp_capabilities.account.agent_onboarding`: how a seller onboards buyer agents. */
+export type AgentOnboarding = ResolveAgentOnboarding<GeneratedAccountCapabilities, DraftAgentOnboarding>;
+type AgentOnboardingBilling = NonNullable<AgentOnboarding['billing']>;
+/** The onboarding mode for sandbox access or for one billing party. */
+export type AgentOnboardingTier = NonNullable<AgentOnboarding['sandbox']> | NonNullable<AgentOnboardingBilling[keyof AgentOnboardingBilling]>;
+export type AgentOnboardingMode = AgentOnboardingTier['mode'];
+/** One requirement an onboarding mode imposes, discriminated by `kind`. */
+export type AgentOnboardingRequirement = NonNullable<AgentOnboardingTier['requirements']>[number];
+export type AgentOnboardingRequirementKind = AgentOnboardingRequirement['kind'];
+/**
+ * A requirement as an evaluator sees it. `kind` accepts any string because a
+ * counterparty on a newer revision may publish kinds this SDK does not know,
+ * and readers MUST treat those as unsatisfiable rather than reject the
+ * posture. Structural on purpose: every {@link AgentOnboardingRequirement} is
+ * assignable to it, whichever shape the pinned schemas give that type.
+ * `verified_specialisms` is the revised #8170 name for `specialisms`.
+ */
+export interface ObservedAgentOnboardingRequirement {
+    kind: AgentOnboardingRequirementKind | (string & {});
+    role?: string;
+    verification_modes?: readonly string[];
+    specialisms?: readonly string[];
+    verified_specialisms?: readonly string[];
+    adcp_version?: string;
+    id?: string;
+    ext?: Record<string, unknown>;
+}
 export interface BuyerOnboardingPosture {
     mode: 'considers_unsolicited' | 'application' | 'invite_only';
-    requirements?: AgentOnboardingRequirement[];
+    requirements?: ObservedAgentOnboardingRequirement[];
     url?: string;
     documentation_url?: string;
     message?: string;
@@ -125,3 +152,4 @@ export type Identity33GetPrincipalResponse = Omit<import('../types/tools.generat
         kind: 'failed';
     }>;
 };
+export {};