@adcp/sdk 16.1.0 → 16.2.0

package/dist/lib/governance/authorization.mjs

@@ -9,11 +9,22 @@ import {
   canonicalAgentUrl
 } from "../signing/agent-resolver/select-agent.mjs";
 import { parseStrictJson } from "../signing/agent-resolver/strict-json.mjs";
+import {
+  JwsArtifactError,
+  selectJwsArtifactProfile,
+  verifyWebBotAuthJwsArtifact
+} from "../identity-3.3/jws-artifacts.mjs";
 const GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS = Object.freeze([
   "authorized_commitment",
   "authorized_task",
   "authorized_payload_hash"
 ]);
+const GOVERNANCE_JWS_TYP = "adcp-gov+jws";
+const GOVERNANCE_CRIT = {
+  authorized_commitment: true,
+  authorized_task: true,
+  authorized_payload_hash: true
+};
 class GovernanceReplayStoreAdapter {
   constructor(replayStore) {
     this.replayStore = replayStore;
@@ -247,27 +258,19 @@ function targetDeclaresLegacyGovernanceAwareness(capabilities, task) {
   const mediaBuy = isRecord(root?.media_buy) ? root.media_buy : void 0;
   return mediaBuy?.governance_aware === true;
 }
-async function verifyGovernanceAuthorization(options) {
+function parseGovernanceJws(token, expectedIssuer) {
   const reject = (error, message) => ({
     ok: false,
     error,
     message
   });
-  if (!options.authenticatedCaller) {
-    return reject("governance_token_invalid", "Authenticated caller is required");
-  }
-  try {
-    buildGovernanceCommitment(options.actualCommitment.amount, options.actualCommitment.currency);
-  } catch (error) {
-    return reject("governance_token_invalid", error.message);
-  }
-  if (typeof options.token !== "string" || options.token.length === 0) {
+  if (typeof token !== "string" || token.length === 0) {
     return reject("governance_token_invalid", "governance_context is required");
   }
-  if (options.token.length > 4096) {
+  if (token.length > 4096) {
     return reject("governance_token_invalid", "governance_context exceeds the protocol size limit");
   }
-  const parts = options.token.split(".");
+  const parts = token.split(".");
   if (parts.length !== 3 || parts.some((part) => !part || !/^[A-Za-z0-9_-]+$/.test(part))) {
     return reject("governance_token_invalid", "governance_context is not a compact JWS");
   }
@@ -280,7 +283,7 @@ async function verifyGovernanceAuthorization(options) {
   if (alg !== "EdDSA" && alg !== "ES256") {
     return reject("governance_token_invalid", "Unsupported governance JWS algorithm");
   }
-  if (protectedHeader.typ !== "adcp-gov+jws") {
+  if (protectedHeader.typ !== GOVERNANCE_JWS_TYP) {
     return reject("governance_token_invalid", "Invalid governance JWS typ");
   }
   const critical = protectedHeader.crit;
@@ -308,35 +311,71 @@ async function verifyGovernanceAuthorization(options) {
   try {
     if (typeof decodedClaims.iss !== "string") throw new TypeError("Missing issuer");
     canonicalIssuer = canonicalAgentUrl(decodedClaims.iss);
-    if (canonicalIssuer !== canonicalAgentUrl(options.expectedIssuer)) throw new TypeError("Issuer mismatch");
+    if (canonicalIssuer !== canonicalAgentUrl(expectedIssuer)) throw new TypeError("Issuer mismatch");
   } catch {
     return reject("governance_token_invalid", "Governance token issuer mismatch");
   }
-  const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
-  if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
-  let jwk;
+  return { ok: true, token, protectedHeader, decodedClaims, canonicalIssuer, alg };
+}
+async function verifyGovernanceAuthorization(options) {
+  const reject = (error, message) => ({
+    ok: false,
+    error,
+    message
+  });
+  if (!options.authenticatedCaller) {
+    return reject("governance_token_invalid", "Authenticated caller is required");
+  }
   try {
-    const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
-    if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
-    jwk = await resolver.resolve(kid);
-  } catch {
-    return reject("governance_key_unknown", "Governance signing key could not be resolved");
+    buildGovernanceCommitment(options.actualCommitment.amount, options.actualCommitment.currency);
+  } catch (error) {
+    return reject("governance_token_invalid", error.message);
   }
-  if (!jwk || jwk.adcp_use !== "governance-signing" || jwk.use !== "sig" || !jwk.key_ops?.includes("verify") || jwk.alg !== void 0 && jwk.alg !== alg) {
-    return reject("governance_key_unknown", "Governance signing key is unknown or not authorized");
+  const parsed = parseGovernanceJws(options.token, options.expectedIssuer);
+  if (!parsed.ok) return parsed;
+  const { protectedHeader, decodedClaims, canonicalIssuer, alg } = parsed;
+  const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
+  if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
+  let profile;
+  if (options.webBotAuth) {
+    try {
+      profile = await selectJwsArtifactProfile(options.expectedIssuer, options.webBotAuth.trust);
+    } catch {
+      return { ...reject("governance_key_unknown", "Governance issuer trust record is unavailable"), retryable: true };
+    }
   }
-  try {
-    const key = await importJWK(jwk, alg);
-    await compactVerify(options.token, key, {
-      algorithms: [alg],
-      crit: {
-        authorized_commitment: true,
-        authorized_task: true,
-        authorized_payload_hash: true
+  if (profile?.profile === "web-bot-auth") {
+    if (options.buyerIdentity) {
+      try {
+        const record = relyingPartyAgentRecord(options.buyerIdentity.brandJson, options.buyerIdentity.brandDomain);
+        selectAgentByUrl(record, canonicalIssuer, { agentType: "governance" });
+      } catch {
+        return reject("governance_key_unknown", "Governance issuer is not the buyer's governance agent");
       }
-    });
-  } catch {
-    return reject("governance_token_invalid", "Governance token signature verification failed");
+    }
+    const failure = await verifyGovernanceJwsOnWebBotAuth(options.token, profile.origin, options.webBotAuth);
+    if (failure) return failure;
+  } else {
+    let jwk;
+    try {
+      const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
+      if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
+      jwk = await resolver.resolve(kid);
+    } catch {
+      return reject("governance_key_unknown", "Governance signing key could not be resolved");
+    }
+    if (!jwk || jwk.adcp_use !== "governance-signing" || jwk.use !== "sig" || !jwk.key_ops?.includes("verify") || jwk.alg !== void 0 && jwk.alg !== alg) {
+      return reject("governance_key_unknown", "Governance signing key is unknown or not authorized");
+    }
+    try {
+      const key = await importJWK(jwk, alg);
+      await compactVerify(options.token, key, {
+        algorithms: [alg],
+        crit: GOVERNANCE_CRIT
+      });
+    } catch {
+      return reject("governance_token_invalid", "Governance token signature verification failed");
+    }
   }
   try {
     if (options.revocationStore && await options.revocationStore.isRevoked(kid)) {
@@ -494,6 +533,113 @@ async function verifyGovernanceAuthorization(options) {
     payloadHash
   };
 }
+function governanceFailureFromJwsArtifact(error) {
+  if (!(error instanceof JwsArtifactError))
+    return {
+      ok: false,
+      error: "governance_key_unknown",
+      message: "Governance signing key could not be resolved",
+      retryable: true
+    };
+  switch (error.code) {
+    case "jws_key_revoked":
+      return { ok: false, error: "governance_token_revoked", message: "Governance signing key is revoked" };
+    case "jws_revocation_unavailable":
+      return {
+        ok: false,
+        error: "governance_token_revoked",
+        message: "Governance revocation status could not be established",
+        retryable: true
+      };
+    case "jws_invalid":
+      return {
+        ok: false,
+        error: "governance_token_invalid",
+        message: `Governance token verification failed: ${error.message}`
+      };
+    case "jws_key_unavailable":
+      return {
+        ok: false,
+        error: "governance_key_unknown",
+        message: "Governance signing key could not be resolved",
+        retryable: true
+      };
+    default:
+      return { ok: false, error: "governance_key_unknown", message: "Governance signing key could not be resolved" };
+  }
+}
+const NO_ORIGIN_REVOCATION = Object.freeze({
+  ok: false,
+  error: "governance_token_revoked",
+  message: "No origin revocation source is configured for the Web Bot Auth path"
+});
+async function verifyGovernanceJwsOnWebBotAuth(token, origin, webBotAuth) {
+  if (!webBotAuth.revocation) return { ...NO_ORIGIN_REVOCATION };
+  try {
+    await verifyWebBotAuthJwsArtifact(token, origin, {
+      typ: GOVERNANCE_JWS_TYP,
+      directory: webBotAuth.directory,
+      revocation: webBotAuth.revocation,
+      // A governance context authorizes spend: an origin that serves no list fails closed.
+      revocationAbsent: "reject",
+      crit: GOVERNANCE_CRIT
+    });
+    return void 0;
+  } catch (error) {
+    return governanceFailureFromJwsArtifact(error);
+  }
+}
+async function verifyHistoricalGovernanceContext(options) {
+  const parsed = parseGovernanceJws(options.token, options.expectedIssuer);
+  if (!parsed.ok) return parsed;
+  if (parsed.alg !== "EdDSA")
+    return {
+      ok: false,
+      error: "governance_token_invalid",
+      message: "A Web Bot Auth governance context uses alg EdDSA"
+    };
+  if (!options.webBotAuth.revocation) return { ...NO_ORIGIN_REVOCATION };
+  let profile;
+  try {
+    profile = await selectJwsArtifactProfile(options.expectedIssuer, options.webBotAuth.trust);
+  } catch {
+    return {
+      ok: false,
+      error: "governance_key_unknown",
+      message: "Governance issuer trust record is unavailable",
+      retryable: true
+    };
+  }
+  if (profile.profile !== "web-bot-auth")
+    return {
+      ok: false,
+      error: "governance_key_unknown",
+      message: "Governance issuer is on the 3.2 profile; its trust record does not list its origin",
+      profile: "3.2"
+    };
+  try {
+    const verified = await verifyWebBotAuthJwsArtifact(parsed.token, profile.origin, {
+      typ: GOVERNANCE_JWS_TYP,
+      directory: options.webBotAuth.directory,
+      archive: options.webBotAuth.archive,
+      revocation: options.webBotAuth.revocation,
+      // No spend rides on an audit: an origin that serves no list has revoked nothing.
+      revocationAbsent: "accept",
+      revokedKey: "report",
+      crit: GOVERNANCE_CRIT
+    });
+    return {
+      ok: true,
+      claims: parsed.decodedClaims,
+      protectedHeader: parsed.protectedHeader,
+      keySource: verified.keySource,
+      revocation: verified.revocation,
+      ...verified.revocationDetail ? { revocationDetail: verified.revocationDetail } : {}
+    };
+  } catch (error) {
+    return governanceFailureFromJwsArtifact(error);
+  }
+}
 class GovernanceAuthorizationError extends Error {
   code;
   constructor(result) {
@@ -549,5 +695,6 @@ export {
   governanceTaskRequiresProposedCommitment,
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
-  verifyGovernanceAuthorization
+  verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext
 };

package/dist/lib/governance/index.d.mts

@@ -13,8 +13,8 @@
  * advisory — the authoritative check happens in the governance agent, which
  * resolves category synonyms and custom policies server-side.
  */
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from './authorization.mjs';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './authorization.mjs';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, verifyHistoricalGovernanceContext, createGovernanceAgentJwksResolver, } from './authorization.mjs';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, VerifyHistoricalGovernanceContextOptions, HistoricalGovernanceContextResult, GovernanceBuyerIdentity, } from './authorization.mjs';
 /**
  * `policy_categories` values that MUST set `human_review_required: true`
  * under GDPR Art 22 / EU AI Act Annex III. Matches the schema's `if/then`

package/dist/lib/governance/index.d.ts

@@ -13,8 +13,8 @@
  * advisory — the authoritative check happens in the governance agent, which
  * resolves category synonyms and custom policies server-side.
  */
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from './authorization';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './authorization';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, verifyHistoricalGovernanceContext, createGovernanceAgentJwksResolver, } from './authorization';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, VerifyHistoricalGovernanceContextOptions, HistoricalGovernanceContextResult, GovernanceBuyerIdentity, } from './authorization';
 /**
  * `policy_categories` values that MUST set `human_review_required: true`
  * under GDPR Art 22 / EU AI Act Annex III. Matches the schema's `if/then`

package/dist/lib/governance/index.js

@@ -40,7 +40,8 @@ __export(governance_exports, {
   targetDeclaresGovernanceEnforcement: () => import_authorization.targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness: () => import_authorization.targetDeclaresLegacyGovernanceAwareness,
   validateGovernancePlan: () => validateGovernancePlan,
-  verifyGovernanceAuthorization: () => import_authorization.verifyGovernanceAuthorization
+  verifyGovernanceAuthorization: () => import_authorization.verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext: () => import_authorization.verifyHistoricalGovernanceContext
 });
 module.exports = __toCommonJS(governance_exports);
 var import_authorization = require('./authorization.js');
@@ -165,5 +166,6 @@ function validateGovernancePlan(plan) {
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
   validateGovernancePlan,
-  verifyGovernanceAuthorization
+  verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext
 });

package/dist/lib/governance/index.mjs

@@ -16,6 +16,7 @@ import {
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
   verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext,
   createGovernanceAgentJwksResolver
 } from "./authorization.mjs";
 const REGULATED_HUMAN_REVIEW_CATEGORIES = Object.freeze([
@@ -138,5 +139,6 @@ export {
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
   validateGovernancePlan,
-  verifyGovernanceAuthorization
+  verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext
 };

package/dist/lib/identity-3.3/index.d.mts

@@ -2,6 +2,7 @@ export * from './types.mjs';
 export * from './trust.mjs';
 export * from './lifecycle.mjs';
 export * from './revocation.mjs';
+export * from './jws-artifacts.mjs';
 export { WEB_BOT_AUTH_DRAFT_REVISION, verifyWebBotAuth, signWebBotAuth, createWebBotAuthFetch, createSignedSignatureDirectory, SignatureDirectoryResolver, verifySignatureDirectory, verifyKeyDirectory, selectSignatureProfile, jwkThumbprint, WebBotAuthError, WebBotAuthUnavailableError, } from '../signing/web-bot-auth.mjs';
 export type { WebBotSigningKey, WebBotSigningOptions, VerifiedWebBotSigner, VerifyWebBotAuthOptions, VerifiedSignatureDirectory, SignatureDirectoryResolverOptions, } from '../signing/web-bot-auth.mjs';
 export { validateIdentity33Payload } from './validation.mjs';

package/dist/lib/identity-3.3/index.d.ts

@@ -2,6 +2,7 @@ export * from './types';
 export * from './trust';
 export * from './lifecycle';
 export * from './revocation';
+export * from './jws-artifacts';
 export { WEB_BOT_AUTH_DRAFT_REVISION, verifyWebBotAuth, signWebBotAuth, createWebBotAuthFetch, createSignedSignatureDirectory, SignatureDirectoryResolver, verifySignatureDirectory, verifyKeyDirectory, selectSignatureProfile, jwkThumbprint, WebBotAuthError, WebBotAuthUnavailableError, } from '../signing/web-bot-auth';
 export type { WebBotSigningKey, WebBotSigningOptions, VerifiedWebBotSigner, VerifyWebBotAuthOptions, VerifiedSignatureDirectory, SignatureDirectoryResolverOptions, } from '../signing/web-bot-auth';
 export { validateIdentity33Payload } from './validation';

package/dist/lib/identity-3.3/index.js

@@ -45,6 +45,7 @@ __reExport(identity_3_exports, require('./types.js'), module.exports);
 __reExport(identity_3_exports, require('./trust.js'), module.exports);
 __reExport(identity_3_exports, require('./lifecycle.js'), module.exports);
 __reExport(identity_3_exports, require('./revocation.js'), module.exports);
+__reExport(identity_3_exports, require('./jws-artifacts.js'), module.exports);
 var import_web_bot_auth = require('../signing/web-bot-auth.js');
 var import_validation = require('./validation.js');
 var import_server = require('./server.js');
@@ -75,5 +76,6 @@ var import_webhook_registration = require('../core/webhook-registration.js');
   ...require('./types.js'),
   ...require('./trust.js'),
   ...require('./lifecycle.js'),
-  ...require('./revocation.js')
+  ...require('./revocation.js'),
+  ...require('./jws-artifacts.js')
 });

package/dist/lib/identity-3.3/index.mjs

@@ -2,6 +2,7 @@ export * from "./types.mjs";
 export * from "./trust.mjs";
 export * from "./lifecycle.mjs";
 export * from "./revocation.mjs";
+export * from "./jws-artifacts.mjs";
 import {
   WEB_BOT_AUTH_DRAFT_REVISION,
   verifyWebBotAuth,

package/dist/lib/identity-3.3/jws-artifacts.d.mts

@@ -0,0 +1,147 @@
+import { type SsrfFetchOptions } from '../net/index.mjs';
+import type { AdcpJsonWebKey } from '../signing/types.mjs';
+import { type SignatureDirectoryResolver } from '../signing/web-bot-auth.mjs';
+import type { OriginRevocationResolver, OriginRevocationStatus } from './revocation.mjs';
+import type { TrustEvaluator } from './trust.mjs';
+import type { RevocationDetail } from './types.mjs';
+/** Which profile verifies a JWS artifact from origin `O`. */
+export type JwsArtifactProfile = {
+    profile: 'web-bot-auth';
+    /** `O`, the canonical origin of the signing agent's URL. */
+    origin: string;
+    /** The registrable domain whose trust record lists `O`. */
+    operator: string;
+} | {
+    profile: '3.2';
+    origin: string;
+    /**
+     * `no_trust_record`: `O` has no registrable domain (IP literal, public
+     * suffix, no PSL match), or its operator has not published a trust
+     * record (404/410 with no remembered 200). `unlisted`: the record does
+     * not list `O`.
+     */
+    reason: 'no_trust_record' | 'unlisted';
+};
+export type JwsArtifactErrorCode = 
+/** A trust record, key directory or archive could not be read. Retryable. */
+'jws_key_unavailable'
+/** No key at `O` (directory, or archive for history) carries the `kid`. */
+ | 'jws_key_unknown'
+/** Wrong `typ`, `alg` not `EdDSA`, `kid` not the key's thumbprint, or a signature that does not verify. */
+ | 'jws_invalid'
+/** `O`'s revocation list revokes the `kid`. */
+ | 'jws_key_revoked'
+/** `O`'s revocation status is unknown, or (by default) `O` serves no list. Retryable. */
+ | 'jws_revocation_unavailable';
+export declare class JwsArtifactError extends Error {
+    readonly code: JwsArtifactErrorCode;
+    constructor(code: JwsArtifactErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+    /** True for outages: retry later, never treat as absence or as a verdict on the artifact. */
+    get transient(): boolean;
+}
+/** Components the WBA path reuses. */
+export interface JwsArtifactWebBotAuthOptions {
+    /**
+     * Derives the trust record from `O` (R3a step 1) to select the profile.
+     * Configure durable `authorityHistory` on it for public, multi-replica or
+     * serverless verifiers: without it, the rule that a 404/410 after a 200 is an
+     * outage (never a return to 3.2) holds only within one process.
+     */
+    trust: TrustEvaluator;
+    /** `O`'s Web Bot Auth key directory. */
+    directory: SignatureDirectoryResolver;
+    /** `O`'s revocation list (R3). Required: the WBA path never skips revocation. */
+    revocation: OriginRevocationResolver;
+}
+/**
+ * Select the profile for a JWS artifact whose signing agent URL is
+ * `signingAgentUrl` (R4). Throws {@link JwsArtifactError}
+ * `jws_key_unavailable` when the trust record cannot be read: a fetch failure
+ * is never absence and never selects the 3.2 profile. An unparseable
+ * `signingAgentUrl` is a caller error (`TypeError` from canonicalization).
+ */
+export declare function selectJwsArtifactProfile(signingAgentUrl: string, trust: TrustEvaluator): Promise<JwsArtifactProfile>;
+export interface VerifyWebBotAuthJwsArtifactOptions {
+    /** The protected-header `typ` this surface accepts, e.g. `adcp-gov+jws`. Any other is refused. */
+    typ: string;
+    directory: SignatureDirectoryResolver;
+    /**
+     * `O`'s revocation list (R3). Pass `false` only when the caller checks the
+     * returned `kid` against `O`'s list itself.
+     */
+    revocation: OriginRevocationResolver | false;
+    /**
+     * `O`'s revocation status `absent` (the origin serves no list). `reject`
+     * (default) fails closed, as a WBA identity without a list cannot be bound
+     * for spend. `accept` treats it as nothing revoked.
+     */
+    revocationAbsent?: 'reject' | 'accept';
+    /**
+     * A key `O`'s list revokes. `reject` (default) refuses the artifact, as
+     * online verification must (R9: a revoked key is rejected whatever its
+     * detail). `report` verifies it and returns the revocation and its detail,
+     * for audit of retained artifacts.
+     */
+    revokedKey?: 'reject' | 'report';
+    /**
+     * Historical verification: also look the `kid` up in the governance key
+     * archive at `O` when the directory does not carry it or cannot be read.
+     * Governance contexts only; only governance agents publish an archive.
+     */
+    archive?: GovernanceKeyArchiveResolver;
+    /** Critical header parameters the surface understands (jose `crit`). */
+    crit?: Record<string, boolean>;
+}
+export interface VerifiedWebBotAuthJwsArtifact {
+    origin: string;
+    kid: string;
+    key: AdcpJsonWebKey;
+    /** Where the key came from: `O`'s key directory, or (history) its archive. */
+    keySource: 'directory' | 'archive';
+    protectedHeader: Record<string, unknown>;
+    payload: Uint8Array;
+    /** `O`'s revocation status for `kid`, when a resolver was supplied. Never `unknown`. */
+    revocation?: Exclude<OriginRevocationStatus, 'unknown'>;
+    /** The most severe revocation detail recorded for `kid` (R9), when it is revoked. */
+    revocationDetail?: RevocationDetail;
+}
+/**
+ * Verify a compact JWS with a key from `origin`'s WBA key directory (R4):
+ * `typ` as the surface requires, `alg` `EdDSA`, `kid` the key's JWK
+ * thumbprint, no `use`/`key_ops`/`adcp_use` checks, and revocation from
+ * `origin`'s list. Signature and key only: every other check of the surface
+ * (claims, audience, freshness, replay) stays with the surface. Throws
+ * {@link JwsArtifactError}.
+ */
+export declare function verifyWebBotAuthJwsArtifact(token: string, origin: string, options: VerifyWebBotAuthJwsArtifactOptions): Promise<VerifiedWebBotAuthJwsArtifact>;
+export declare const GOVERNANCE_KEY_ARCHIVE_PATH = "/.well-known/jwks-archive.json";
+export interface GovernanceKeyArchiveResolverOptions {
+    now?: () => number;
+    fetchOptions?: Pick<SsrfFetchOptions, 'lookup' | 'trustedFetchFn'>;
+    /** Seconds an archive read stays cached. Default 300. */
+    maxAgeSeconds?: number;
+    /** Origins cached at once. Default 256. */
+    maxOrigins?: number;
+    /** Published fixture keys are read only outside production, as for the key directory. */
+    allowTestKeys?: boolean;
+}
+/**
+ * The governance key archive at an origin (`security.mdx` §Revocation):
+ * `{origin}/.well-known/jwks-archive.json`, a JWKS of retired governance keys
+ * kept discoverable for audit. On the WBA path only Ed25519 keys whose `kid`
+ * (when present) is their JWK thumbprint are read; other keys are ignored. A
+ * 404/410 is an origin with no archive. Any other failure is
+ * `jws_key_unavailable`, never absence, and is retried after a cooldown.
+ */
+export declare class GovernanceKeyArchiveResolver {
+    private readonly options;
+    private readonly cache;
+    private readonly failures;
+    private readonly pending;
+    private readonly maxOrigins;
+    constructor(options?: GovernanceKeyArchiveResolverOptions);
+    resolve(origin: string, kid: string): Promise<AdcpJsonWebKey | null>;
+    private fetch;
+}