@adcp/sdk 16.0.0-beta.6 → 16.0.0-beta.8

package/dist/lib/registry/index.js

@@ -15,6 +15,7 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var registry_exports = {};
 __export(registry_exports, {
@@ -37,6 +38,8 @@ __export(registry_exports, {
   sanitizeStreamText: () => import_feed_stream2.sanitizeStreamText
 });
 module.exports = __toCommonJS(registry_exports);
+var import_identifiers = require('../identifiers.js');
+__reExport(registry_exports, require('../identifiers.js'), module.exports);
 var import_validation = require('../supply-path/validation.js');
 var import_feed_stream = require('./feed-stream.js');
 var import_sync = require('./sync.js');
@@ -51,6 +54,9 @@ const ERROR_BODY_PREVIEW_CHARS = 200;
 const MAX_BRAND_BULK_DOMAINS = 25;
 const MAX_BULK_DOMAINS = 100;
 const MAX_CHECK_DOMAINS = 1e4;
+const MAX_RESOLVE_IDENTIFIERS = 1e4;
+const DEFAULT_RESOLVE_REQUEST_BYTES = 1024 * 1024;
+const DEFAULT_RESOLVE_RESPONSE_BYTES = 16 * 1024 * 1024;
 const COMMUNITY_MIRROR_PLATFORM_RE = /^[a-z0-9_-]{1,64}$/;
 const MAX_REGISTRY_ERROR_DETAILS_BYTES = 64 * 1024;
 const MAX_RETRY_AFTER_MS = 2147483647;
@@ -303,7 +309,15 @@ class RegistryClient {
   }
   /** Save or update a hosted property. Requires authentication. */
   async saveProperty(property) {
-    if (!property?.publisher_domain?.trim()) throw new Error("publisher_domain is required");
+    if (typeof property?.publisher_domain !== "string" || !property.publisher_domain.trim()) {
+      throw new import_identifiers.IdentifierValidationError(
+        "invalid_publisher_domain",
+        "publisher_domain",
+        "publisher_domain is required"
+      );
+    }
+    const domain = (0, import_identifiers.validatePublisherDomain)(property.publisher_domain);
+    if (!domain.ok) throw domain.error;
     if (!this.apiKey) throw new Error("apiKey is required for save operations");
     const payload = this.normalizeSavePropertyRequest(property);
     return this.post(`${this.baseUrl}/api/properties/save`, payload);
@@ -335,17 +349,19 @@ class RegistryClient {
    */
   async saveProperties(properties, options) {
     const concurrency = options?.concurrency ?? 5;
-    const results = {};
+    if (!Number.isSafeInteger(concurrency) || concurrency < 1)
+      throw new RangeError("concurrency must be a positive integer");
+    const results = /* @__PURE__ */ Object.create(null);
     for (let i = 0; i < properties.length; i += concurrency) {
       const batch = properties.slice(i, i + concurrency);
       const settled = await Promise.allSettled(batch.map((p) => this.saveProperty(p)));
       for (let j = 0; j < batch.length; j++) {
         const domain = batch[j].publisher_domain;
         const s = settled[j];
-        results[domain] = s.status === "fulfilled" ? s.value : { error: String(s.reason) };
+        results[domain] = s.status === "fulfilled" ? s.value : { error: String(s.reason), ...s.reason instanceof Error ? { cause: s.reason } : {} };
       }
     }
-    return results;
+    return Object.fromEntries(Object.entries(results));
   }
   /**
    * Resolve catalog identifiers to stable property_rids.
@@ -354,11 +370,147 @@ class RegistryClient {
    */
   async resolveIdentifiers(request) {
     if (!request?.identifiers?.length) throw new Error("identifiers are required");
+    if (request.identifiers.length > MAX_RESOLVE_IDENTIFIERS) {
+      throw new RangeError("At most 10,000 identifiers are allowed; use resolveIdentifiersAll for larger lists");
+    }
     if ((request.mode ?? "resolve") !== "lookup" && !this.apiKey) {
       throw new Error("apiKey is required for resolveIdentifiers in resolve mode");
     }
     return this.post(`${this.baseUrl}/api/registry/resolve`, request);
   }
+  /**
+   * Bulk catalog registration (`resolve`, the default) or read-only `lookup`.
+   * Splits by identifier count and UTF-8 request bytes, bounds concurrency,
+   * and honors Retry-After on 429. Results retain input order and duplicates.
+   * Network/5xx failures are not retried: resolve contributions have additive
+   * activity logs even though identifier-to-RID mapping is idempotent.
+   */
+  async resolveIdentifiersAll(request, options = {}) {
+    const {
+      batchSize = MAX_RESOLVE_IDENTIFIERS,
+      maxRequestBytes = DEFAULT_RESOLVE_REQUEST_BYTES,
+      concurrency = 2,
+      maxRetries = 3,
+      maxRetryDelayMs = 6e4
+    } = options;
+    for (const [name, value, minimum] of [
+      ["batchSize", batchSize, 1],
+      ["maxRequestBytes", maxRequestBytes, 1],
+      ["concurrency", concurrency, 1],
+      ["maxRetries", maxRetries, 0],
+      ["maxRetryDelayMs", maxRetryDelayMs, 0]
+    ]) {
+      if (!Number.isSafeInteger(value) || value < minimum)
+        throw new RangeError(`${name} must be an integer >= ${minimum}`);
+    }
+    if (batchSize > MAX_RESOLVE_IDENTIFIERS) throw new RangeError("batchSize must not exceed 10,000");
+    if (!Array.isArray(request?.identifiers)) throw new TypeError("identifiers are required");
+    if ((request.mode ?? "resolve") !== "lookup" && !this.apiKey)
+      throw new Error("apiKey is required for resolveIdentifiers in resolve mode");
+    const { identifiers, ...envelope } = request;
+    const envelopeBytes = Buffer.byteLength(JSON.stringify({ ...envelope, identifiers: [] }), "utf8");
+    const outcomes = new Array(identifiers.length);
+    const batches = [];
+    let batch = { indexes: [], identifiers: [] };
+    let bytes = envelopeBytes;
+    for (const [index, identifier] of identifiers.entries()) {
+      if (!identifier || typeof identifier !== "object" || typeof identifier.type !== "string" || typeof identifier.value !== "string") {
+        outcomes[index] = {
+          index,
+          identifier,
+          success: false,
+          error: new TypeError("Identifier must contain string type and value")
+        };
+        continue;
+      }
+      const size = Buffer.byteLength(JSON.stringify(identifier), "utf8");
+      if (envelopeBytes + size > maxRequestBytes) {
+        outcomes[index] = {
+          index,
+          identifier,
+          success: false,
+          error: new RangeError("Identifier and provenance exceed maxRequestBytes")
+        };
+        continue;
+      }
+      if (batch.indexes.length && (batch.indexes.length >= batchSize || bytes + size + 1 > maxRequestBytes)) {
+        batches.push(batch);
+        batch = { indexes: [], identifiers: [] };
+        bytes = envelopeBytes;
+      }
+      bytes += size + (batch.indexes.length ? 1 : 0);
+      batch.indexes.push(index);
+      batch.identifiers.push(identifier);
+    }
+    if (batch.indexes.length) batches.push(batch);
+    let nextBatch = 0;
+    let retryNotBefore = 0;
+    let rateLimitFailure;
+    const worker = async () => {
+      while (nextBatch < batches.length) {
+        const current = batches[nextBatch++];
+        let response;
+        let failure;
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+          if (rateLimitFailure) {
+            failure = rateLimitFailure;
+            break;
+          }
+          while (!rateLimitFailure && retryNotBefore > Date.now())
+            await new Promise(
+              (resolve) => setTimeout(resolve, Math.min(retryNotBefore - Date.now(), MAX_RETRY_AFTER_MS))
+            );
+          if (rateLimitFailure) {
+            failure = rateLimitFailure;
+            break;
+          }
+          try {
+            response = await this.resolveIdentifiers({ ...envelope, identifiers: current.identifiers });
+            if (!response || !Array.isArray(response.resolved)) {
+              throw new TypeError("Registry returned an invalid identifier resolution response");
+            }
+            break;
+          } catch (error) {
+            response = void 0;
+            failure = error instanceof Error ? error : new Error("Registry resolution failed");
+            if (!isRegistryRequestError(error) || error.status !== 429) break;
+            const delay = typeof error.retryAfterMs === "number" && Number.isFinite(error.retryAfterMs) && error.retryAfterMs >= 0 ? error.retryAfterMs : Math.min(1e3 * 2 ** attempt, 3e4);
+            if (delay > maxRetryDelayMs) {
+              rateLimitFailure = error;
+              break;
+            }
+            retryNotBefore = Math.max(retryNotBefore, Date.now() + delay);
+            if (attempt === maxRetries) break;
+          }
+        }
+        const entries = /* @__PURE__ */ new Map();
+        let malformedEntries = false;
+        for (const entry of response?.resolved ?? []) {
+          if (!entry || typeof entry !== "object" || !entry.identifier || typeof entry.identifier.type !== "string" || typeof entry.identifier.value !== "string" || entry.property_rid !== null && typeof entry.property_rid !== "string" || !["existing", "created", "excluded"].includes(entry.status)) {
+            malformedEntries = true;
+            continue;
+          }
+          const key = JSON.stringify([entry.identifier.type, entry.identifier.value]);
+          const group = entries.get(key) ?? [];
+          group.push(entry);
+          entries.set(key, group);
+        }
+        for (const index of current.indexes) {
+          const identifier = identifiers[index];
+          const group = entries.get(JSON.stringify([identifier.type, identifier.value]));
+          const entry = group && (group.length > 1 ? group.shift() : group[0]);
+          outcomes[index] = entry ? { index, identifier, success: true, result: entry } : {
+            index,
+            identifier,
+            success: false,
+            error: response ? malformedEntries ? new TypeError("Registry returned an invalid identifier resolution response") : new Error("Registry response omitted identifier") : failure
+          };
+        }
+      }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, batches.length) }, worker));
+    return outcomes;
+  }
   /** File a catalog fact dispute. Requires authentication. */
   async fileCatalogDispute(request) {
     if (!request?.subject_type?.trim()) throw new Error("subject_type is required");
@@ -1130,6 +1282,7 @@ class RegistryClient {
   bodyLimitForUrl(url) {
     if (this.hasCustomMaxBodyBytes) return this.maxBodyBytes;
     const path = new URL(url).pathname;
+    if (path === "/api/registry/resolve") return DEFAULT_RESOLVE_RESPONSE_BYTES;
     if (path === "/api/brands/registry" || path === "/api/brands/resolve/bulk" || path === "/api/properties/registry" || path === "/api/properties/resolve/bulk" || path === "/api/registry/agents" || path === "/api/registry/publishers" || path === "/api/registry/feed" || path === "/api/registry/mirrors" || path === "/api/registry/agents/search" || path === "/api/registry/authorizations" || path === "/api/registry/authorizations/snapshot" || path === "/api/search" || path === "/api/policies/registry" || path === "/api/policies/resolve/bulk" || path === "/api/public/discover-agent" || path === "/api/public/agent-formats" || path === "/api/public/agent-products" || path === "/api/public/validate-publisher" || path === "/api/registry/agents/storyboard-status" || path.startsWith("/api/registry/agents/") && path.endsWith("/storyboard-status") || path.startsWith("/api/registry/mirrors/") || path.startsWith("/api/properties/check")) {
       return DEFAULT_LARGE_RESPONSE_MAX_BODY_BYTES;
     }
@@ -1239,5 +1392,6 @@ class RegistryClient {
   isRegistryRequestError,
   openFeedStream,
   parseSseStream,
-  sanitizeStreamText
+  sanitizeStreamText,
+  ...require('../identifiers.js')
 });

package/dist/lib/registry/index.mjs

@@ -1,3 +1,5 @@
+import { validatePublisherDomain, IdentifierValidationError } from "../identifiers.mjs";
+export * from "../identifiers.mjs";
 import { validateSupplyPathRequest, assertRegistrySupplyPathResult } from "../supply-path/validation.mjs";
 import { openFeedStream } from "./feed-stream.mjs";
 import { RegistrySync } from "./sync.mjs";
@@ -22,6 +24,9 @@ const ERROR_BODY_PREVIEW_CHARS = 200;
 const MAX_BRAND_BULK_DOMAINS = 25;
 const MAX_BULK_DOMAINS = 100;
 const MAX_CHECK_DOMAINS = 1e4;
+const MAX_RESOLVE_IDENTIFIERS = 1e4;
+const DEFAULT_RESOLVE_REQUEST_BYTES = 1024 * 1024;
+const DEFAULT_RESOLVE_RESPONSE_BYTES = 16 * 1024 * 1024;
 const COMMUNITY_MIRROR_PLATFORM_RE = /^[a-z0-9_-]{1,64}$/;
 const MAX_REGISTRY_ERROR_DETAILS_BYTES = 64 * 1024;
 const MAX_RETRY_AFTER_MS = 2147483647;
@@ -274,7 +279,15 @@ class RegistryClient {
   }
   /** Save or update a hosted property. Requires authentication. */
   async saveProperty(property) {
-    if (!property?.publisher_domain?.trim()) throw new Error("publisher_domain is required");
+    if (typeof property?.publisher_domain !== "string" || !property.publisher_domain.trim()) {
+      throw new IdentifierValidationError(
+        "invalid_publisher_domain",
+        "publisher_domain",
+        "publisher_domain is required"
+      );
+    }
+    const domain = validatePublisherDomain(property.publisher_domain);
+    if (!domain.ok) throw domain.error;
     if (!this.apiKey) throw new Error("apiKey is required for save operations");
     const payload = this.normalizeSavePropertyRequest(property);
     return this.post(`${this.baseUrl}/api/properties/save`, payload);
@@ -306,17 +319,19 @@ class RegistryClient {
    */
   async saveProperties(properties, options) {
     const concurrency = options?.concurrency ?? 5;
-    const results = {};
+    if (!Number.isSafeInteger(concurrency) || concurrency < 1)
+      throw new RangeError("concurrency must be a positive integer");
+    const results = /* @__PURE__ */ Object.create(null);
     for (let i = 0; i < properties.length; i += concurrency) {
       const batch = properties.slice(i, i + concurrency);
       const settled = await Promise.allSettled(batch.map((p) => this.saveProperty(p)));
       for (let j = 0; j < batch.length; j++) {
         const domain = batch[j].publisher_domain;
         const s = settled[j];
-        results[domain] = s.status === "fulfilled" ? s.value : { error: String(s.reason) };
+        results[domain] = s.status === "fulfilled" ? s.value : { error: String(s.reason), ...s.reason instanceof Error ? { cause: s.reason } : {} };
       }
     }
-    return results;
+    return Object.fromEntries(Object.entries(results));
   }
   /**
    * Resolve catalog identifiers to stable property_rids.
@@ -325,11 +340,147 @@ class RegistryClient {
    */
   async resolveIdentifiers(request) {
     if (!request?.identifiers?.length) throw new Error("identifiers are required");
+    if (request.identifiers.length > MAX_RESOLVE_IDENTIFIERS) {
+      throw new RangeError("At most 10,000 identifiers are allowed; use resolveIdentifiersAll for larger lists");
+    }
     if ((request.mode ?? "resolve") !== "lookup" && !this.apiKey) {
       throw new Error("apiKey is required for resolveIdentifiers in resolve mode");
     }
     return this.post(`${this.baseUrl}/api/registry/resolve`, request);
   }
+  /**
+   * Bulk catalog registration (`resolve`, the default) or read-only `lookup`.
+   * Splits by identifier count and UTF-8 request bytes, bounds concurrency,
+   * and honors Retry-After on 429. Results retain input order and duplicates.
+   * Network/5xx failures are not retried: resolve contributions have additive
+   * activity logs even though identifier-to-RID mapping is idempotent.
+   */
+  async resolveIdentifiersAll(request, options = {}) {
+    const {
+      batchSize = MAX_RESOLVE_IDENTIFIERS,
+      maxRequestBytes = DEFAULT_RESOLVE_REQUEST_BYTES,
+      concurrency = 2,
+      maxRetries = 3,
+      maxRetryDelayMs = 6e4
+    } = options;
+    for (const [name, value, minimum] of [
+      ["batchSize", batchSize, 1],
+      ["maxRequestBytes", maxRequestBytes, 1],
+      ["concurrency", concurrency, 1],
+      ["maxRetries", maxRetries, 0],
+      ["maxRetryDelayMs", maxRetryDelayMs, 0]
+    ]) {
+      if (!Number.isSafeInteger(value) || value < minimum)
+        throw new RangeError(`${name} must be an integer >= ${minimum}`);
+    }
+    if (batchSize > MAX_RESOLVE_IDENTIFIERS) throw new RangeError("batchSize must not exceed 10,000");
+    if (!Array.isArray(request?.identifiers)) throw new TypeError("identifiers are required");
+    if ((request.mode ?? "resolve") !== "lookup" && !this.apiKey)
+      throw new Error("apiKey is required for resolveIdentifiers in resolve mode");
+    const { identifiers, ...envelope } = request;
+    const envelopeBytes = Buffer.byteLength(JSON.stringify({ ...envelope, identifiers: [] }), "utf8");
+    const outcomes = new Array(identifiers.length);
+    const batches = [];
+    let batch = { indexes: [], identifiers: [] };
+    let bytes = envelopeBytes;
+    for (const [index, identifier] of identifiers.entries()) {
+      if (!identifier || typeof identifier !== "object" || typeof identifier.type !== "string" || typeof identifier.value !== "string") {
+        outcomes[index] = {
+          index,
+          identifier,
+          success: false,
+          error: new TypeError("Identifier must contain string type and value")
+        };
+        continue;
+      }
+      const size = Buffer.byteLength(JSON.stringify(identifier), "utf8");
+      if (envelopeBytes + size > maxRequestBytes) {
+        outcomes[index] = {
+          index,
+          identifier,
+          success: false,
+          error: new RangeError("Identifier and provenance exceed maxRequestBytes")
+        };
+        continue;
+      }
+      if (batch.indexes.length && (batch.indexes.length >= batchSize || bytes + size + 1 > maxRequestBytes)) {
+        batches.push(batch);
+        batch = { indexes: [], identifiers: [] };
+        bytes = envelopeBytes;
+      }
+      bytes += size + (batch.indexes.length ? 1 : 0);
+      batch.indexes.push(index);
+      batch.identifiers.push(identifier);
+    }
+    if (batch.indexes.length) batches.push(batch);
+    let nextBatch = 0;
+    let retryNotBefore = 0;
+    let rateLimitFailure;
+    const worker = async () => {
+      while (nextBatch < batches.length) {
+        const current = batches[nextBatch++];
+        let response;
+        let failure;
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+          if (rateLimitFailure) {
+            failure = rateLimitFailure;
+            break;
+          }
+          while (!rateLimitFailure && retryNotBefore > Date.now())
+            await new Promise(
+              (resolve) => setTimeout(resolve, Math.min(retryNotBefore - Date.now(), MAX_RETRY_AFTER_MS))
+            );
+          if (rateLimitFailure) {
+            failure = rateLimitFailure;
+            break;
+          }
+          try {
+            response = await this.resolveIdentifiers({ ...envelope, identifiers: current.identifiers });
+            if (!response || !Array.isArray(response.resolved)) {
+              throw new TypeError("Registry returned an invalid identifier resolution response");
+            }
+            break;
+          } catch (error) {
+            response = void 0;
+            failure = error instanceof Error ? error : new Error("Registry resolution failed");
+            if (!isRegistryRequestError(error) || error.status !== 429) break;
+            const delay = typeof error.retryAfterMs === "number" && Number.isFinite(error.retryAfterMs) && error.retryAfterMs >= 0 ? error.retryAfterMs : Math.min(1e3 * 2 ** attempt, 3e4);
+            if (delay > maxRetryDelayMs) {
+              rateLimitFailure = error;
+              break;
+            }
+            retryNotBefore = Math.max(retryNotBefore, Date.now() + delay);
+            if (attempt === maxRetries) break;
+          }
+        }
+        const entries = /* @__PURE__ */ new Map();
+        let malformedEntries = false;
+        for (const entry of response?.resolved ?? []) {
+          if (!entry || typeof entry !== "object" || !entry.identifier || typeof entry.identifier.type !== "string" || typeof entry.identifier.value !== "string" || entry.property_rid !== null && typeof entry.property_rid !== "string" || !["existing", "created", "excluded"].includes(entry.status)) {
+            malformedEntries = true;
+            continue;
+          }
+          const key = JSON.stringify([entry.identifier.type, entry.identifier.value]);
+          const group = entries.get(key) ?? [];
+          group.push(entry);
+          entries.set(key, group);
+        }
+        for (const index of current.indexes) {
+          const identifier = identifiers[index];
+          const group = entries.get(JSON.stringify([identifier.type, identifier.value]));
+          const entry = group && (group.length > 1 ? group.shift() : group[0]);
+          outcomes[index] = entry ? { index, identifier, success: true, result: entry } : {
+            index,
+            identifier,
+            success: false,
+            error: response ? malformedEntries ? new TypeError("Registry returned an invalid identifier resolution response") : new Error("Registry response omitted identifier") : failure
+          };
+        }
+      }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, batches.length) }, worker));
+    return outcomes;
+  }
   /** File a catalog fact dispute. Requires authentication. */
   async fileCatalogDispute(request) {
     if (!request?.subject_type?.trim()) throw new Error("subject_type is required");
@@ -1101,6 +1252,7 @@ class RegistryClient {
   bodyLimitForUrl(url) {
     if (this.hasCustomMaxBodyBytes) return this.maxBodyBytes;
     const path = new URL(url).pathname;
+    if (path === "/api/registry/resolve") return DEFAULT_RESOLVE_RESPONSE_BYTES;
     if (path === "/api/brands/registry" || path === "/api/brands/resolve/bulk" || path === "/api/properties/registry" || path === "/api/properties/resolve/bulk" || path === "/api/registry/agents" || path === "/api/registry/publishers" || path === "/api/registry/feed" || path === "/api/registry/mirrors" || path === "/api/registry/agents/search" || path === "/api/registry/authorizations" || path === "/api/registry/authorizations/snapshot" || path === "/api/search" || path === "/api/policies/registry" || path === "/api/policies/resolve/bulk" || path === "/api/public/discover-agent" || path === "/api/public/agent-formats" || path === "/api/public/agent-products" || path === "/api/public/validate-publisher" || path === "/api/registry/agents/storyboard-status" || path.startsWith("/api/registry/agents/") && path.endsWith("/storyboard-status") || path.startsWith("/api/registry/mirrors/") || path.startsWith("/api/properties/check")) {
       return DEFAULT_LARGE_RESPONSE_MAX_BODY_BYTES;
     }

package/dist/lib/registry/types.d.mts

@@ -150,6 +150,29 @@ export type ResolveIdentifiersRequest = Omit<RegistryResolveIdentifiersRequest,
 };
 /** Response from POST /api/registry/resolve (200) */
 export type ResolveIdentifiersResponse = operations['resolveIdentifiers']['responses']['200']['content']['application/json'];
+export interface ResolveIdentifiersAllOptions {
+    /** Per-request identifier cap, from 1 through the registry limit of 10,000. */
+    batchSize?: number;
+    /** UTF-8 JSON request cap including provenance and envelope. Default: 1 MiB. */
+    maxRequestBytes?: number;
+    /** Maximum simultaneous requests. Default: 2. */
+    concurrency?: number;
+    /** Retries for HTTP 429 only. Other failures are returned without retrying contributions. Default: 3. */
+    maxRetries?: number;
+    /** Maximum server-requested retry delay. Default: 60 seconds; longer rate limits return errors without early retries. */
+    maxRetryDelayMs?: number;
+}
+/** One outcome per input, in input order (including duplicates). */
+export type ResolveIdentifierOutcome = {
+    index: number;
+    identifier: ResolveIdentifiersRequest['identifiers'][number];
+} & ({
+    success: true;
+    result: ResolveIdentifiersResponse['resolved'][number];
+} | {
+    success: false;
+    error: Error;
+});
 /** Request body for POST /api/registry/catalog/disputes */
 export type FileCatalogDisputeRequest = NonNullable<operations['fileCatalogDispute']['requestBody']>['content']['application/json'];
 /** Response from POST /api/registry/catalog/disputes (200) */

package/dist/lib/registry/types.d.ts

@@ -150,6 +150,29 @@ export type ResolveIdentifiersRequest = Omit<RegistryResolveIdentifiersRequest,
 };
 /** Response from POST /api/registry/resolve (200) */
 export type ResolveIdentifiersResponse = operations['resolveIdentifiers']['responses']['200']['content']['application/json'];
+export interface ResolveIdentifiersAllOptions {
+    /** Per-request identifier cap, from 1 through the registry limit of 10,000. */
+    batchSize?: number;
+    /** UTF-8 JSON request cap including provenance and envelope. Default: 1 MiB. */
+    maxRequestBytes?: number;
+    /** Maximum simultaneous requests. Default: 2. */
+    concurrency?: number;
+    /** Retries for HTTP 429 only. Other failures are returned without retrying contributions. Default: 3. */
+    maxRetries?: number;
+    /** Maximum server-requested retry delay. Default: 60 seconds; longer rate limits return errors without early retries. */
+    maxRetryDelayMs?: number;
+}
+/** One outcome per input, in input order (including duplicates). */
+export type ResolveIdentifierOutcome = {
+    index: number;
+    identifier: ResolveIdentifiersRequest['identifiers'][number];
+} & ({
+    success: true;
+    result: ResolveIdentifiersResponse['resolved'][number];
+} | {
+    success: false;
+    error: Error;
+});
 /** Request body for POST /api/registry/catalog/disputes */
 export type FileCatalogDisputeRequest = NonNullable<operations['fileCatalogDispute']['requestBody']>['content']['application/json'];
 /** Response from POST /api/registry/catalog/disputes (200) */

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-10-16T23:30:06.203Z"
+  "synced_at": "2026-10-18T02:15:53.357Z"
 }

package/dist/lib/server/auth-signature.js

@@ -149,8 +149,29 @@ function verifySignatureAsAuthenticator(options) {
     return principal;
   };
   const tagged = (0, import_auth.tagAuthenticatorNeedsRawBody)(authenticator);
+  if (options.webBotAuth) webBotAuthProfiles.set(tagged, options.capability.profiles ?? []);
   return options.webBotAuth ? (0, import_auth.tagAuthenticatorPresenceGated)(tagged) : tagged;
 }
+const webBotAuthProfiles = /* @__PURE__ */ new WeakMap();
+function unsignedRequiredError(err, signatureAuth, body) {
+  const profiles = webBotAuthProfiles.get(signatureAuth);
+  if (!profiles?.includes("web-bot-auth") || !(err instanceof import_errors.RequestSignatureError) || err.code !== "request_signature_required")
+    return asSignatureAuthError(err);
+  const hasBody = body !== void 0 && body !== "";
+  if ((0, import_web_bot_auth2.advertisesOnlyWebBotAuth)(profiles)) {
+    const refused = (0, import_web_bot_auth2.unsignedWebBotAuthError)(hasBody);
+    return new import_auth.AuthError(refused.message, {
+      cause: refused,
+      status: refused.status,
+      headers: refused.headers,
+      body: refused.body
+    });
+  }
+  return new import_auth.AuthError(`Signature rejected (${err.code}).`, {
+    cause: err,
+    headers: { "Accept-Signature": (0, import_web_bot_auth2.webBotAuthAcceptSignature)("sig1", hasBody) }
+  });
+}
 function principalForVerifiedSigner(signer, makePrincipal) {
   if (!SAFE_KEYID.test(signer.keyid)) {
     throw new import_auth.AuthError("Signature key id contains unsupported characters.", {
@@ -207,7 +228,7 @@ function requireSignatureWhenPresent(signatureAuth, fallbackAuth, options = {})
     try {
       (0, import_verifier.assertUnsignedWebhookAuthenticationAbsent)(body);
     } catch (err) {
-      throw asSignatureAuthError(err);
+      throw unsignedRequiredError(err, signatureAuth, body);
     }
     let fallbackResult = null;
     let fallbackError;
@@ -223,7 +244,7 @@ function requireSignatureWhenPresent(signatureAuth, fallbackAuth, options = {})
       (0, import_verifier.assertUnsignedOperationNotRequired)(operation, unsignedCapability);
       (0, import_verifier.assertUnsignedProtocolMethodNotRequired)(body, unsignedCapability);
     } catch (err) {
-      throw asSignatureAuthError(err);
+      throw unsignedRequiredError(err, signatureAuth, body);
     }
     if (fallbackThrew) throw fallbackError;
     return null;

package/dist/lib/server/auth-signature.mjs

@@ -1,8 +1,11 @@
 import { getWebBotAuthLegacyOriginGate } from "../signing/web-bot-auth.mjs";
 import { RequestSignatureError } from "../signing/errors.mjs";
 import {
+  advertisesOnlyWebBotAuth,
   selectSignatureProfile,
+  unsignedWebBotAuthError,
   verifyWebBotAuth,
+  webBotAuthAcceptSignature,
   isWebBotAuthRevocationChecked,
   webBotAuthUnavailableResponse,
   WebBotAuthUnavailableError,
@@ -146,8 +149,29 @@ function verifySignatureAsAuthenticator(options) {
     return principal;
   };
   const tagged = tagAuthenticatorNeedsRawBody(authenticator);
+  if (options.webBotAuth) webBotAuthProfiles.set(tagged, options.capability.profiles ?? []);
   return options.webBotAuth ? tagAuthenticatorPresenceGated(tagged) : tagged;
 }
+const webBotAuthProfiles = /* @__PURE__ */ new WeakMap();
+function unsignedRequiredError(err, signatureAuth, body) {
+  const profiles = webBotAuthProfiles.get(signatureAuth);
+  if (!profiles?.includes("web-bot-auth") || !(err instanceof RequestSignatureError) || err.code !== "request_signature_required")
+    return asSignatureAuthError(err);
+  const hasBody = body !== void 0 && body !== "";
+  if (advertisesOnlyWebBotAuth(profiles)) {
+    const refused = unsignedWebBotAuthError(hasBody);
+    return new AuthError(refused.message, {
+      cause: refused,
+      status: refused.status,
+      headers: refused.headers,
+      body: refused.body
+    });
+  }
+  return new AuthError(`Signature rejected (${err.code}).`, {
+    cause: err,
+    headers: { "Accept-Signature": webBotAuthAcceptSignature("sig1", hasBody) }
+  });
+}
 function principalForVerifiedSigner(signer, makePrincipal) {
   if (!SAFE_KEYID.test(signer.keyid)) {
     throw new AuthError("Signature key id contains unsupported characters.", {
@@ -204,7 +228,7 @@ function requireSignatureWhenPresent(signatureAuth, fallbackAuth, options = {})
     try {
       assertUnsignedWebhookAuthenticationAbsent(body);
     } catch (err) {
-      throw asSignatureAuthError(err);
+      throw unsignedRequiredError(err, signatureAuth, body);
     }
     let fallbackResult = null;
     let fallbackError;
@@ -220,7 +244,7 @@ function requireSignatureWhenPresent(signatureAuth, fallbackAuth, options = {})
       assertUnsignedOperationNotRequired(operation, unsignedCapability);
       assertUnsignedProtocolMethodNotRequired(body, unsignedCapability);
     } catch (err) {
-      throw asSignatureAuthError(err);
+      throw unsignedRequiredError(err, signatureAuth, body);
     }
     if (fallbackThrew) throw fallbackError;
     return null;

package/dist/lib/server/auth.d.mts

@@ -346,6 +346,12 @@ export interface RespondUnauthorizedOptions {
      * directly.
      */
     signatureError?: RequestSignatureErrorCode;
+    /**
+     * Additional response headers, such as the Web Bot Auth `Accept-Signature`
+     * challenge added to an AdCP RFC 9421 `request_signature_required` answer.
+     * Cannot replace `WWW-Authenticate` or `Content-Type`.
+     */
+    headers?: Record<string, string>;
 }
 /**
  * Send an RFC 6750-compliant 401/403 response with the `WWW-Authenticate`

package/dist/lib/server/auth.d.ts

@@ -346,6 +346,12 @@ export interface RespondUnauthorizedOptions {
      * directly.
      */
     signatureError?: RequestSignatureErrorCode;
+    /**
+     * Additional response headers, such as the Web Bot Auth `Accept-Signature`
+     * challenge added to an AdCP RFC 9421 `request_signature_required` answer.
+     * Cannot replace `WWW-Authenticate` or `Content-Type`.
+     */
+    headers?: Record<string, string>;
 }
 /**
  * Send an RFC 6750-compliant 401/403 response with the `WWW-Authenticate`

package/dist/lib/server/auth.js

@@ -247,7 +247,13 @@ function respondUnauthorized(_req, res, options = {}) {
   if (options.errorDescription) parts.push(`error_description="${escapeQuotes(options.errorDescription)}"`);
   if (options.resourceMetadata) parts.push(`resource_metadata="${escapeQuotes(options.resourceMetadata)}"`);
   const scheme = useSignatureChallenge ? "Signature" : "Bearer";
+  const extra = Object.fromEntries(
+    Object.entries(options.headers ?? {}).filter(
+      ([name]) => !["content-type", "www-authenticate"].includes(name.toLowerCase())
+    )
+  );
   res.writeHead(options.status ?? 401, {
+    ...extra,
     "Content-Type": "application/json",
     "WWW-Authenticate": `${scheme} ${parts.join(", ")}`
   });