@adcp/sdk 16.0.0 → 16.2.0

package/dist/lib/governance/authorization.js

@@ -35,7 +35,8 @@ __export(authorization_exports, {
   governanceTaskRequiresProposedCommitment: () => governanceTaskRequiresProposedCommitment,
   targetDeclaresGovernanceEnforcement: () => targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness: () => targetDeclaresLegacyGovernanceAwareness,
-  verifyGovernanceAuthorization: () => verifyGovernanceAuthorization
+  verifyGovernanceAuthorization: () => verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext: () => verifyHistoricalGovernanceContext
 });
 module.exports = __toCommonJS(authorization_exports);
 var import_node_crypto = require("node:crypto");
@@ -44,11 +45,18 @@ var import_jcs = require('../utils/jcs.js');
 var import_jwks_https = require('../signing/jwks-https.js');
 var import_select_agent = require('../signing/agent-resolver/select-agent.js');
 var import_strict_json = require('../signing/agent-resolver/strict-json.js');
+var import_jws_artifacts = require('../identity-3.3/jws-artifacts.js');
 const GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS = Object.freeze([
   "authorized_commitment",
   "authorized_task",
   "authorized_payload_hash"
 ]);
+const GOVERNANCE_JWS_TYP = "adcp-gov+jws";
+const GOVERNANCE_CRIT = {
+  authorized_commitment: true,
+  authorized_task: true,
+  authorized_payload_hash: true
+};
 class GovernanceReplayStoreAdapter {
   constructor(replayStore) {
     this.replayStore = replayStore;
@@ -282,27 +290,19 @@ function targetDeclaresLegacyGovernanceAwareness(capabilities, task) {
   const mediaBuy = isRecord(root?.media_buy) ? root.media_buy : void 0;
   return mediaBuy?.governance_aware === true;
 }
-async function verifyGovernanceAuthorization(options) {
+function parseGovernanceJws(token, expectedIssuer) {
   const reject = (error, message) => ({
     ok: false,
     error,
     message
   });
-  if (!options.authenticatedCaller) {
-    return reject("governance_token_invalid", "Authenticated caller is required");
-  }
-  try {
-    buildGovernanceCommitment(options.actualCommitment.amount, options.actualCommitment.currency);
-  } catch (error) {
-    return reject("governance_token_invalid", error.message);
-  }
-  if (typeof options.token !== "string" || options.token.length === 0) {
+  if (typeof token !== "string" || token.length === 0) {
     return reject("governance_token_invalid", "governance_context is required");
   }
-  if (options.token.length > 4096) {
+  if (token.length > 4096) {
     return reject("governance_token_invalid", "governance_context exceeds the protocol size limit");
   }
-  const parts = options.token.split(".");
+  const parts = token.split(".");
   if (parts.length !== 3 || parts.some((part) => !part || !/^[A-Za-z0-9_-]+$/.test(part))) {
     return reject("governance_token_invalid", "governance_context is not a compact JWS");
   }
@@ -315,7 +315,7 @@ async function verifyGovernanceAuthorization(options) {
   if (alg !== "EdDSA" && alg !== "ES256") {
     return reject("governance_token_invalid", "Unsupported governance JWS algorithm");
   }
-  if (protectedHeader.typ !== "adcp-gov+jws") {
+  if (protectedHeader.typ !== GOVERNANCE_JWS_TYP) {
     return reject("governance_token_invalid", "Invalid governance JWS typ");
   }
   const critical = protectedHeader.crit;
@@ -343,35 +343,71 @@ async function verifyGovernanceAuthorization(options) {
   try {
     if (typeof decodedClaims.iss !== "string") throw new TypeError("Missing issuer");
     canonicalIssuer = (0, import_select_agent.canonicalAgentUrl)(decodedClaims.iss);
-    if (canonicalIssuer !== (0, import_select_agent.canonicalAgentUrl)(options.expectedIssuer)) throw new TypeError("Issuer mismatch");
+    if (canonicalIssuer !== (0, import_select_agent.canonicalAgentUrl)(expectedIssuer)) throw new TypeError("Issuer mismatch");
   } catch {
     return reject("governance_token_invalid", "Governance token issuer mismatch");
   }
-  const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
-  if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
-  let jwk;
+  return { ok: true, token, protectedHeader, decodedClaims, canonicalIssuer, alg };
+}
+async function verifyGovernanceAuthorization(options) {
+  const reject = (error, message) => ({
+    ok: false,
+    error,
+    message
+  });
+  if (!options.authenticatedCaller) {
+    return reject("governance_token_invalid", "Authenticated caller is required");
+  }
   try {
-    const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
-    if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
-    jwk = await resolver.resolve(kid);
-  } catch {
-    return reject("governance_key_unknown", "Governance signing key could not be resolved");
+    buildGovernanceCommitment(options.actualCommitment.amount, options.actualCommitment.currency);
+  } catch (error) {
+    return reject("governance_token_invalid", error.message);
   }
-  if (!jwk || jwk.adcp_use !== "governance-signing" || jwk.use !== "sig" || !jwk.key_ops?.includes("verify") || jwk.alg !== void 0 && jwk.alg !== alg) {
-    return reject("governance_key_unknown", "Governance signing key is unknown or not authorized");
+  const parsed = parseGovernanceJws(options.token, options.expectedIssuer);
+  if (!parsed.ok) return parsed;
+  const { protectedHeader, decodedClaims, canonicalIssuer, alg } = parsed;
+  const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
+  if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
+  let profile;
+  if (options.webBotAuth) {
+    try {
+      profile = await (0, import_jws_artifacts.selectJwsArtifactProfile)(options.expectedIssuer, options.webBotAuth.trust);
+    } catch {
+      return { ...reject("governance_key_unknown", "Governance issuer trust record is unavailable"), retryable: true };
+    }
   }
-  try {
-    const key = await (0, import_jose.importJWK)(jwk, alg);
-    await (0, import_jose.compactVerify)(options.token, key, {
-      algorithms: [alg],
-      crit: {
-        authorized_commitment: true,
-        authorized_task: true,
-        authorized_payload_hash: true
+  if (profile?.profile === "web-bot-auth") {
+    if (options.buyerIdentity) {
+      try {
+        const record = (0, import_select_agent.relyingPartyAgentRecord)(options.buyerIdentity.brandJson, options.buyerIdentity.brandDomain);
+        (0, import_select_agent.selectAgentByUrl)(record, canonicalIssuer, { agentType: "governance" });
+      } catch {
+        return reject("governance_key_unknown", "Governance issuer is not the buyer's governance agent");
       }
-    });
-  } catch {
-    return reject("governance_token_invalid", "Governance token signature verification failed");
+    }
+    const failure = await verifyGovernanceJwsOnWebBotAuth(options.token, profile.origin, options.webBotAuth);
+    if (failure) return failure;
+  } else {
+    let jwk;
+    try {
+      const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
+      if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
+      jwk = await resolver.resolve(kid);
+    } catch {
+      return reject("governance_key_unknown", "Governance signing key could not be resolved");
+    }
+    if (!jwk || jwk.adcp_use !== "governance-signing" || jwk.use !== "sig" || !jwk.key_ops?.includes("verify") || jwk.alg !== void 0 && jwk.alg !== alg) {
+      return reject("governance_key_unknown", "Governance signing key is unknown or not authorized");
+    }
+    try {
+      const key = await (0, import_jose.importJWK)(jwk, alg);
+      await (0, import_jose.compactVerify)(options.token, key, {
+        algorithms: [alg],
+        crit: GOVERNANCE_CRIT
+      });
+    } catch {
+      return reject("governance_token_invalid", "Governance token signature verification failed");
+    }
   }
   try {
     if (options.revocationStore && await options.revocationStore.isRevoked(kid)) {
@@ -529,6 +565,113 @@ async function verifyGovernanceAuthorization(options) {
     payloadHash
   };
 }
+function governanceFailureFromJwsArtifact(error) {
+  if (!(error instanceof import_jws_artifacts.JwsArtifactError))
+    return {
+      ok: false,
+      error: "governance_key_unknown",
+      message: "Governance signing key could not be resolved",
+      retryable: true
+    };
+  switch (error.code) {
+    case "jws_key_revoked":
+      return { ok: false, error: "governance_token_revoked", message: "Governance signing key is revoked" };
+    case "jws_revocation_unavailable":
+      return {
+        ok: false,
+        error: "governance_token_revoked",
+        message: "Governance revocation status could not be established",
+        retryable: true
+      };
+    case "jws_invalid":
+      return {
+        ok: false,
+        error: "governance_token_invalid",
+        message: `Governance token verification failed: ${error.message}`
+      };
+    case "jws_key_unavailable":
+      return {
+        ok: false,
+        error: "governance_key_unknown",
+        message: "Governance signing key could not be resolved",
+        retryable: true
+      };
+    default:
+      return { ok: false, error: "governance_key_unknown", message: "Governance signing key could not be resolved" };
+  }
+}
+const NO_ORIGIN_REVOCATION = Object.freeze({
+  ok: false,
+  error: "governance_token_revoked",
+  message: "No origin revocation source is configured for the Web Bot Auth path"
+});
+async function verifyGovernanceJwsOnWebBotAuth(token, origin, webBotAuth) {
+  if (!webBotAuth.revocation) return { ...NO_ORIGIN_REVOCATION };
+  try {
+    await (0, import_jws_artifacts.verifyWebBotAuthJwsArtifact)(token, origin, {
+      typ: GOVERNANCE_JWS_TYP,
+      directory: webBotAuth.directory,
+      revocation: webBotAuth.revocation,
+      // A governance context authorizes spend: an origin that serves no list fails closed.
+      revocationAbsent: "reject",
+      crit: GOVERNANCE_CRIT
+    });
+    return void 0;
+  } catch (error) {
+    return governanceFailureFromJwsArtifact(error);
+  }
+}
+async function verifyHistoricalGovernanceContext(options) {
+  const parsed = parseGovernanceJws(options.token, options.expectedIssuer);
+  if (!parsed.ok) return parsed;
+  if (parsed.alg !== "EdDSA")
+    return {
+      ok: false,
+      error: "governance_token_invalid",
+      message: "A Web Bot Auth governance context uses alg EdDSA"
+    };
+  if (!options.webBotAuth.revocation) return { ...NO_ORIGIN_REVOCATION };
+  let profile;
+  try {
+    profile = await (0, import_jws_artifacts.selectJwsArtifactProfile)(options.expectedIssuer, options.webBotAuth.trust);
+  } catch {
+    return {
+      ok: false,
+      error: "governance_key_unknown",
+      message: "Governance issuer trust record is unavailable",
+      retryable: true
+    };
+  }
+  if (profile.profile !== "web-bot-auth")
+    return {
+      ok: false,
+      error: "governance_key_unknown",
+      message: "Governance issuer is on the 3.2 profile; its trust record does not list its origin",
+      profile: "3.2"
+    };
+  try {
+    const verified = await (0, import_jws_artifacts.verifyWebBotAuthJwsArtifact)(parsed.token, profile.origin, {
+      typ: GOVERNANCE_JWS_TYP,
+      directory: options.webBotAuth.directory,
+      archive: options.webBotAuth.archive,
+      revocation: options.webBotAuth.revocation,
+      // No spend rides on an audit: an origin that serves no list has revoked nothing.
+      revocationAbsent: "accept",
+      revokedKey: "report",
+      crit: GOVERNANCE_CRIT
+    });
+    return {
+      ok: true,
+      claims: parsed.decodedClaims,
+      protectedHeader: parsed.protectedHeader,
+      keySource: verified.keySource,
+      revocation: verified.revocation,
+      ...verified.revocationDetail ? { revocationDetail: verified.revocationDetail } : {}
+    };
+  } catch (error) {
+    return governanceFailureFromJwsArtifact(error);
+  }
+}
 class GovernanceAuthorizationError extends Error {
   code;
   constructor(result) {
@@ -585,5 +728,6 @@ function decodeJsonObject(segment) {
   governanceTaskRequiresProposedCommitment,
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
-  verifyGovernanceAuthorization
+  verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext
 });

package/dist/lib/governance/authorization.mjs

@@ -9,11 +9,22 @@ import {
   canonicalAgentUrl
 } from "../signing/agent-resolver/select-agent.mjs";
 import { parseStrictJson } from "../signing/agent-resolver/strict-json.mjs";
+import {
+  JwsArtifactError,
+  selectJwsArtifactProfile,
+  verifyWebBotAuthJwsArtifact
+} from "../identity-3.3/jws-artifacts.mjs";
 const GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS = Object.freeze([
   "authorized_commitment",
   "authorized_task",
   "authorized_payload_hash"
 ]);
+const GOVERNANCE_JWS_TYP = "adcp-gov+jws";
+const GOVERNANCE_CRIT = {
+  authorized_commitment: true,
+  authorized_task: true,
+  authorized_payload_hash: true
+};
 class GovernanceReplayStoreAdapter {
   constructor(replayStore) {
     this.replayStore = replayStore;
@@ -247,27 +258,19 @@ function targetDeclaresLegacyGovernanceAwareness(capabilities, task) {
   const mediaBuy = isRecord(root?.media_buy) ? root.media_buy : void 0;
   return mediaBuy?.governance_aware === true;
 }
-async function verifyGovernanceAuthorization(options) {
+function parseGovernanceJws(token, expectedIssuer) {
   const reject = (error, message) => ({
     ok: false,
     error,
     message
   });
-  if (!options.authenticatedCaller) {
-    return reject("governance_token_invalid", "Authenticated caller is required");
-  }
-  try {
-    buildGovernanceCommitment(options.actualCommitment.amount, options.actualCommitment.currency);
-  } catch (error) {
-    return reject("governance_token_invalid", error.message);
-  }
-  if (typeof options.token !== "string" || options.token.length === 0) {
+  if (typeof token !== "string" || token.length === 0) {
     return reject("governance_token_invalid", "governance_context is required");
   }
-  if (options.token.length > 4096) {
+  if (token.length > 4096) {
     return reject("governance_token_invalid", "governance_context exceeds the protocol size limit");
   }
-  const parts = options.token.split(".");
+  const parts = token.split(".");
   if (parts.length !== 3 || parts.some((part) => !part || !/^[A-Za-z0-9_-]+$/.test(part))) {
     return reject("governance_token_invalid", "governance_context is not a compact JWS");
   }
@@ -280,7 +283,7 @@ async function verifyGovernanceAuthorization(options) {
   if (alg !== "EdDSA" && alg !== "ES256") {
     return reject("governance_token_invalid", "Unsupported governance JWS algorithm");
   }
-  if (protectedHeader.typ !== "adcp-gov+jws") {
+  if (protectedHeader.typ !== GOVERNANCE_JWS_TYP) {
     return reject("governance_token_invalid", "Invalid governance JWS typ");
   }
   const critical = protectedHeader.crit;
@@ -308,35 +311,71 @@ async function verifyGovernanceAuthorization(options) {
   try {
     if (typeof decodedClaims.iss !== "string") throw new TypeError("Missing issuer");
     canonicalIssuer = canonicalAgentUrl(decodedClaims.iss);
-    if (canonicalIssuer !== canonicalAgentUrl(options.expectedIssuer)) throw new TypeError("Issuer mismatch");
+    if (canonicalIssuer !== canonicalAgentUrl(expectedIssuer)) throw new TypeError("Issuer mismatch");
   } catch {
     return reject("governance_token_invalid", "Governance token issuer mismatch");
   }
-  const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
-  if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
-  let jwk;
+  return { ok: true, token, protectedHeader, decodedClaims, canonicalIssuer, alg };
+}
+async function verifyGovernanceAuthorization(options) {
+  const reject = (error, message) => ({
+    ok: false,
+    error,
+    message
+  });
+  if (!options.authenticatedCaller) {
+    return reject("governance_token_invalid", "Authenticated caller is required");
+  }
   try {
-    const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
-    if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
-    jwk = await resolver.resolve(kid);
-  } catch {
-    return reject("governance_key_unknown", "Governance signing key could not be resolved");
+    buildGovernanceCommitment(options.actualCommitment.amount, options.actualCommitment.currency);
+  } catch (error) {
+    return reject("governance_token_invalid", error.message);
   }
-  if (!jwk || jwk.adcp_use !== "governance-signing" || jwk.use !== "sig" || !jwk.key_ops?.includes("verify") || jwk.alg !== void 0 && jwk.alg !== alg) {
-    return reject("governance_key_unknown", "Governance signing key is unknown or not authorized");
+  const parsed = parseGovernanceJws(options.token, options.expectedIssuer);
+  if (!parsed.ok) return parsed;
+  const { protectedHeader, decodedClaims, canonicalIssuer, alg } = parsed;
+  const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
+  if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
+  let profile;
+  if (options.webBotAuth) {
+    try {
+      profile = await selectJwsArtifactProfile(options.expectedIssuer, options.webBotAuth.trust);
+    } catch {
+      return { ...reject("governance_key_unknown", "Governance issuer trust record is unavailable"), retryable: true };
+    }
   }
-  try {
-    const key = await importJWK(jwk, alg);
-    await compactVerify(options.token, key, {
-      algorithms: [alg],
-      crit: {
-        authorized_commitment: true,
-        authorized_task: true,
-        authorized_payload_hash: true
+  if (profile?.profile === "web-bot-auth") {
+    if (options.buyerIdentity) {
+      try {
+        const record = relyingPartyAgentRecord(options.buyerIdentity.brandJson, options.buyerIdentity.brandDomain);
+        selectAgentByUrl(record, canonicalIssuer, { agentType: "governance" });
+      } catch {
+        return reject("governance_key_unknown", "Governance issuer is not the buyer's governance agent");
       }
-    });
-  } catch {
-    return reject("governance_token_invalid", "Governance token signature verification failed");
+    }
+    const failure = await verifyGovernanceJwsOnWebBotAuth(options.token, profile.origin, options.webBotAuth);
+    if (failure) return failure;
+  } else {
+    let jwk;
+    try {
+      const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
+      if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
+      jwk = await resolver.resolve(kid);
+    } catch {
+      return reject("governance_key_unknown", "Governance signing key could not be resolved");
+    }
+    if (!jwk || jwk.adcp_use !== "governance-signing" || jwk.use !== "sig" || !jwk.key_ops?.includes("verify") || jwk.alg !== void 0 && jwk.alg !== alg) {
+      return reject("governance_key_unknown", "Governance signing key is unknown or not authorized");
+    }
+    try {
+      const key = await importJWK(jwk, alg);
+      await compactVerify(options.token, key, {
+        algorithms: [alg],
+        crit: GOVERNANCE_CRIT
+      });
+    } catch {
+      return reject("governance_token_invalid", "Governance token signature verification failed");
+    }
   }
   try {
     if (options.revocationStore && await options.revocationStore.isRevoked(kid)) {
@@ -494,6 +533,113 @@ async function verifyGovernanceAuthorization(options) {
     payloadHash
   };
 }
+function governanceFailureFromJwsArtifact(error) {
+  if (!(error instanceof JwsArtifactError))
+    return {
+      ok: false,
+      error: "governance_key_unknown",
+      message: "Governance signing key could not be resolved",
+      retryable: true
+    };
+  switch (error.code) {
+    case "jws_key_revoked":
+      return { ok: false, error: "governance_token_revoked", message: "Governance signing key is revoked" };
+    case "jws_revocation_unavailable":
+      return {
+        ok: false,
+        error: "governance_token_revoked",
+        message: "Governance revocation status could not be established",
+        retryable: true
+      };
+    case "jws_invalid":
+      return {
+        ok: false,
+        error: "governance_token_invalid",
+        message: `Governance token verification failed: ${error.message}`
+      };
+    case "jws_key_unavailable":
+      return {
+        ok: false,
+        error: "governance_key_unknown",
+        message: "Governance signing key could not be resolved",
+        retryable: true
+      };
+    default:
+      return { ok: false, error: "governance_key_unknown", message: "Governance signing key could not be resolved" };
+  }
+}
+const NO_ORIGIN_REVOCATION = Object.freeze({
+  ok: false,
+  error: "governance_token_revoked",
+  message: "No origin revocation source is configured for the Web Bot Auth path"
+});
+async function verifyGovernanceJwsOnWebBotAuth(token, origin, webBotAuth) {
+  if (!webBotAuth.revocation) return { ...NO_ORIGIN_REVOCATION };
+  try {
+    await verifyWebBotAuthJwsArtifact(token, origin, {
+      typ: GOVERNANCE_JWS_TYP,
+      directory: webBotAuth.directory,
+      revocation: webBotAuth.revocation,
+      // A governance context authorizes spend: an origin that serves no list fails closed.
+      revocationAbsent: "reject",
+      crit: GOVERNANCE_CRIT
+    });
+    return void 0;
+  } catch (error) {
+    return governanceFailureFromJwsArtifact(error);
+  }
+}
+async function verifyHistoricalGovernanceContext(options) {
+  const parsed = parseGovernanceJws(options.token, options.expectedIssuer);
+  if (!parsed.ok) return parsed;
+  if (parsed.alg !== "EdDSA")
+    return {
+      ok: false,
+      error: "governance_token_invalid",
+      message: "A Web Bot Auth governance context uses alg EdDSA"
+    };
+  if (!options.webBotAuth.revocation) return { ...NO_ORIGIN_REVOCATION };
+  let profile;
+  try {
+    profile = await selectJwsArtifactProfile(options.expectedIssuer, options.webBotAuth.trust);
+  } catch {
+    return {
+      ok: false,
+      error: "governance_key_unknown",
+      message: "Governance issuer trust record is unavailable",
+      retryable: true
+    };
+  }
+  if (profile.profile !== "web-bot-auth")
+    return {
+      ok: false,
+      error: "governance_key_unknown",
+      message: "Governance issuer is on the 3.2 profile; its trust record does not list its origin",
+      profile: "3.2"
+    };
+  try {
+    const verified = await verifyWebBotAuthJwsArtifact(parsed.token, profile.origin, {
+      typ: GOVERNANCE_JWS_TYP,
+      directory: options.webBotAuth.directory,
+      archive: options.webBotAuth.archive,
+      revocation: options.webBotAuth.revocation,
+      // No spend rides on an audit: an origin that serves no list has revoked nothing.
+      revocationAbsent: "accept",
+      revokedKey: "report",
+      crit: GOVERNANCE_CRIT
+    });
+    return {
+      ok: true,
+      claims: parsed.decodedClaims,
+      protectedHeader: parsed.protectedHeader,
+      keySource: verified.keySource,
+      revocation: verified.revocation,
+      ...verified.revocationDetail ? { revocationDetail: verified.revocationDetail } : {}
+    };
+  } catch (error) {
+    return governanceFailureFromJwsArtifact(error);
+  }
+}
 class GovernanceAuthorizationError extends Error {
   code;
   constructor(result) {
@@ -549,5 +695,6 @@ export {
   governanceTaskRequiresProposedCommitment,
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
-  verifyGovernanceAuthorization
+  verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext
 };

package/dist/lib/governance/index.d.mts

@@ -13,8 +13,8 @@
  * advisory — the authoritative check happens in the governance agent, which
  * resolves category synonyms and custom policies server-side.
  */
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from './authorization.mjs';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './authorization.mjs';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, verifyHistoricalGovernanceContext, createGovernanceAgentJwksResolver, } from './authorization.mjs';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, VerifyHistoricalGovernanceContextOptions, HistoricalGovernanceContextResult, GovernanceBuyerIdentity, } from './authorization.mjs';
 /**
  * `policy_categories` values that MUST set `human_review_required: true`
  * under GDPR Art 22 / EU AI Act Annex III. Matches the schema's `if/then`

package/dist/lib/governance/index.d.ts

@@ -13,8 +13,8 @@
  * advisory — the authoritative check happens in the governance agent, which
  * resolves category synonyms and custom policies server-side.
  */
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from './authorization';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './authorization';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, verifyHistoricalGovernanceContext, createGovernanceAgentJwksResolver, } from './authorization';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, VerifyHistoricalGovernanceContextOptions, HistoricalGovernanceContextResult, GovernanceBuyerIdentity, } from './authorization';
 /**
  * `policy_categories` values that MUST set `human_review_required: true`
  * under GDPR Art 22 / EU AI Act Annex III. Matches the schema's `if/then`

package/dist/lib/governance/index.js

@@ -40,7 +40,8 @@ __export(governance_exports, {
   targetDeclaresGovernanceEnforcement: () => import_authorization.targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness: () => import_authorization.targetDeclaresLegacyGovernanceAwareness,
   validateGovernancePlan: () => validateGovernancePlan,
-  verifyGovernanceAuthorization: () => import_authorization.verifyGovernanceAuthorization
+  verifyGovernanceAuthorization: () => import_authorization.verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext: () => import_authorization.verifyHistoricalGovernanceContext
 });
 module.exports = __toCommonJS(governance_exports);
 var import_authorization = require('./authorization.js');
@@ -165,5 +166,6 @@ function validateGovernancePlan(plan) {
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
   validateGovernancePlan,
-  verifyGovernanceAuthorization
+  verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext
 });

package/dist/lib/governance/index.mjs

@@ -16,6 +16,7 @@ import {
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
   verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext,
   createGovernanceAgentJwksResolver
 } from "./authorization.mjs";
 const REGULATED_HUMAN_REVIEW_CATEGORIES = Object.freeze([
@@ -138,5 +139,6 @@ export {
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
   validateGovernancePlan,
-  verifyGovernanceAuthorization
+  verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext
 };

package/dist/lib/identity-3.3/index.d.mts

@@ -2,6 +2,7 @@ export * from './types.mjs';
 export * from './trust.mjs';
 export * from './lifecycle.mjs';
 export * from './revocation.mjs';
+export * from './jws-artifacts.mjs';
 export { WEB_BOT_AUTH_DRAFT_REVISION, verifyWebBotAuth, signWebBotAuth, createWebBotAuthFetch, createSignedSignatureDirectory, SignatureDirectoryResolver, verifySignatureDirectory, verifyKeyDirectory, selectSignatureProfile, jwkThumbprint, WebBotAuthError, WebBotAuthUnavailableError, } from '../signing/web-bot-auth.mjs';
 export type { WebBotSigningKey, WebBotSigningOptions, VerifiedWebBotSigner, VerifyWebBotAuthOptions, VerifiedSignatureDirectory, SignatureDirectoryResolverOptions, } from '../signing/web-bot-auth.mjs';
 export { validateIdentity33Payload } from './validation.mjs';

package/dist/lib/identity-3.3/index.d.ts

@@ -2,6 +2,7 @@ export * from './types';
 export * from './trust';
 export * from './lifecycle';
 export * from './revocation';
+export * from './jws-artifacts';
 export { WEB_BOT_AUTH_DRAFT_REVISION, verifyWebBotAuth, signWebBotAuth, createWebBotAuthFetch, createSignedSignatureDirectory, SignatureDirectoryResolver, verifySignatureDirectory, verifyKeyDirectory, selectSignatureProfile, jwkThumbprint, WebBotAuthError, WebBotAuthUnavailableError, } from '../signing/web-bot-auth';
 export type { WebBotSigningKey, WebBotSigningOptions, VerifiedWebBotSigner, VerifyWebBotAuthOptions, VerifiedSignatureDirectory, SignatureDirectoryResolverOptions, } from '../signing/web-bot-auth';
 export { validateIdentity33Payload } from './validation';