@adcp/sdk 6.5.0 → 6.7.0

package/dist/lib/signing/agent-resolver/consistency.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Step 7 of the brand_json_url discovery algorithm — `identity.key_origins`
+ * consistency check (security.mdx §"Discovering an agent's signing keys via
+ * `brand_json_url`" step 7). Two distinct rejections:
+ *
+ *   `request_signature_key_origin_mismatch` — the resolved `jwks_uri` host
+ *     does not match the operator's declared `identity.key_origins.{purpose}`
+ *     value. Skipped only for the specific (agent, purpose, role) tuple
+ *     whose JWKS source was a publisher `adagents.json signing_keys` pin —
+ *     operator-side use of the same purpose is still checked.
+ *
+ *   `request_signature_key_origin_missing` — the agent's capabilities
+ *     declare a signing posture for a purpose (e.g. `request_signing.supported_for`
+ *     non-empty, `webhook_signing.supported === true`) but the corresponding
+ *     `identity.key_origins.{purpose}` entry is absent.
+ *
+ * Both checks are pure: the caller supplies the inputs (which purposes are
+ * declared, the declared origins, the resolved jwksUri, whether the resolution
+ * came from a publisher pin), the function returns a typed result. No I/O.
+ */
+import type { IdentityKeyOrigins, IdentityKeyOriginPurpose } from './capabilities-types';
+export type ConsistencyErrorCode = 'key_origin_mismatch' | 'key_origin_missing';
+export interface KeyOriginMismatch {
+    ok: false;
+    code: 'key_origin_mismatch';
+    purpose: IdentityKeyOriginPurpose;
+    expected_origin: string;
+    actual_origin: string;
+}
+export interface KeyOriginMissing {
+    ok: false;
+    code: 'key_origin_missing';
+    purpose: IdentityKeyOriginPurpose;
+    posture: 'request_signing' | 'webhook_signing' | 'governance_signing' | 'tmp_signing';
+}
+export type ConsistencyResult = {
+    ok: true;
+} | KeyOriginMismatch | KeyOriginMissing;
+/**
+ * Inputs for the per-purpose origin check. The caller is responsible for
+ * deciding whether `publisherPinned` is true — the carve-out applies only
+ * to (agent, webhook-signing, sell-side) tuples whose JWKS came from an
+ * `adagents.json signing_keys` pin. For request-signing, governance-signing,
+ * TMP-signing, and buyer-side webhook receivers, `publisherPinned` MUST
+ * always be false.
+ */
+export interface OriginCheckInput {
+    purpose: IdentityKeyOriginPurpose;
+    declaredOrigin: string | undefined;
+    resolvedJwksUri: string;
+    publisherPinned: boolean;
+}
+/**
+ * Check origin consistency for a single (purpose, jwksUri) pair against the
+ * declared `identity.key_origins.{purpose}` value. Returns `{ ok: true }`
+ * when the check passes or is skipped (publisher pin); a typed mismatch
+ * result on failure. `key_origin_missing` is NOT raised here — that is a
+ * separate check (`checkRequiredOrigins`) because it depends on which
+ * purposes the agent has declared signing for.
+ */
+export declare function checkOriginConsistency(input: OriginCheckInput): ConsistencyResult;
+/**
+ * Determine which signing purposes the capabilities response declares.
+ * Any of the following signal a declared purpose, per security.mdx
+ * §"Discovering an agent's signing keys via `brand_json_url`" step 2:
+ *
+ *   - `request_signing.supported_for` non-empty            → `request_signing`
+ *   - `request_signing.required_for` non-empty             → `request_signing`
+ *   - `webhook_signing.supported === true`                 → `webhook_signing`
+ *   - any field present under `identity.key_origins`       → that purpose
+ *
+ * Governance-signing and TMP-signing declarations are agent-protocol-specific
+ * and not reliably detectable from a generic capabilities walk; callers may
+ * pass `extraDeclaredPurposes` for purposes they have detected externally.
+ */
+export declare function declaredSigningPurposes(capabilities: unknown, extraDeclaredPurposes?: readonly IdentityKeyOriginPurpose[]): Set<IdentityKeyOriginPurpose>;
+/**
+ * For every purpose the agent has declared signing for, confirm an
+ * `identity.key_origins.{purpose}` entry is present. Returns the set of
+ * missing purposes; the caller maps each onto `request_signature_key_origin_missing`
+ * with `posture` set to the corresponding signing field name.
+ */
+export declare function checkRequiredOrigins(declaredPurposes: ReadonlySet<IdentityKeyOriginPurpose>, keyOrigins: IdentityKeyOrigins | undefined): KeyOriginMissing[];
+//# sourceMappingURL=consistency.d.ts.map

package/dist/lib/signing/agent-resolver/consistency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consistency.d.ts","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/consistency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,wBAAwB,EAAmB,MAAM,sBAAsB,CAAC;AAE1G,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAEhF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,wBAAwB,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,aAAa,CAAC;CACvF;AAED,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,wBAAwB,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,GAAG,iBAAiB,CA2BjF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,OAAO,EACrB,qBAAqB,GAAE,SAAS,wBAAwB,EAAO,GAC9D,GAAG,CAAC,wBAAwB,CAAC,CAsB/B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,gBAAgB,EAAE,WAAW,CAAC,wBAAwB,CAAC,EACvD,UAAU,EAAE,kBAAkB,GAAG,SAAS,GACzC,gBAAgB,EAAE,CASpB"}

package/dist/lib/signing/agent-resolver/consistency.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Step 7 of the brand_json_url discovery algorithm — `identity.key_origins`
+ * consistency check (security.mdx §"Discovering an agent's signing keys via
+ * `brand_json_url`" step 7). Two distinct rejections:
+ *
+ *   `request_signature_key_origin_mismatch` — the resolved `jwks_uri` host
+ *     does not match the operator's declared `identity.key_origins.{purpose}`
+ *     value. Skipped only for the specific (agent, purpose, role) tuple
+ *     whose JWKS source was a publisher `adagents.json signing_keys` pin —
+ *     operator-side use of the same purpose is still checked.
+ *
+ *   `request_signature_key_origin_missing` — the agent's capabilities
+ *     declare a signing posture for a purpose (e.g. `request_signing.supported_for`
+ *     non-empty, `webhook_signing.supported === true`) but the corresponding
+ *     `identity.key_origins.{purpose}` entry is absent.
+ *
+ * Both checks are pure: the caller supplies the inputs (which purposes are
+ * declared, the declared origins, the resolved jwksUri, whether the resolution
+ * came from a publisher pin), the function returns a typed result. No I/O.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkOriginConsistency = checkOriginConsistency;
+exports.declaredSigningPurposes = declaredSigningPurposes;
+exports.checkRequiredOrigins = checkRequiredOrigins;
+const canonicalize_1 = require("./canonicalize");
+/**
+ * Check origin consistency for a single (purpose, jwksUri) pair against the
+ * declared `identity.key_origins.{purpose}` value. Returns `{ ok: true }`
+ * when the check passes or is skipped (publisher pin); a typed mismatch
+ * result on failure. `key_origin_missing` is NOT raised here — that is a
+ * separate check (`checkRequiredOrigins`) because it depends on which
+ * purposes the agent has declared signing for.
+ */
+function checkOriginConsistency(input) {
+    if (input.publisherPinned)
+        return { ok: true };
+    if (!input.declaredOrigin)
+        return { ok: true };
+    let expected;
+    let actual;
+    try {
+        expected = (0, canonicalize_1.canonicalizeOrigin)(input.declaredOrigin);
+        actual = (0, canonicalize_1.canonicalizeOrigin)(input.resolvedJwksUri);
+    }
+    catch {
+        return {
+            ok: false,
+            code: 'key_origin_mismatch',
+            purpose: input.purpose,
+            expected_origin: input.declaredOrigin,
+            actual_origin: input.resolvedJwksUri,
+        };
+    }
+    if (expected !== actual) {
+        return {
+            ok: false,
+            code: 'key_origin_mismatch',
+            purpose: input.purpose,
+            expected_origin: expected,
+            actual_origin: actual,
+        };
+    }
+    return { ok: true };
+}
+/**
+ * Determine which signing purposes the capabilities response declares.
+ * Any of the following signal a declared purpose, per security.mdx
+ * §"Discovering an agent's signing keys via `brand_json_url`" step 2:
+ *
+ *   - `request_signing.supported_for` non-empty            → `request_signing`
+ *   - `request_signing.required_for` non-empty             → `request_signing`
+ *   - `webhook_signing.supported === true`                 → `webhook_signing`
+ *   - any field present under `identity.key_origins`       → that purpose
+ *
+ * Governance-signing and TMP-signing declarations are agent-protocol-specific
+ * and not reliably detectable from a generic capabilities walk; callers may
+ * pass `extraDeclaredPurposes` for purposes they have detected externally.
+ */
+function declaredSigningPurposes(capabilities, extraDeclaredPurposes = []) {
+    const out = new Set(extraDeclaredPurposes);
+    if (!capabilities || typeof capabilities !== 'object')
+        return out;
+    const caps = capabilities;
+    const requestSigning = caps.request_signing;
+    if (Array.isArray(requestSigning?.supported_for) && requestSigning.supported_for.length > 0) {
+        out.add('request_signing');
+    }
+    if (Array.isArray(requestSigning?.required_for) && requestSigning.required_for.length > 0) {
+        out.add('request_signing');
+    }
+    const webhookSigning = caps.webhook_signing;
+    if (webhookSigning?.supported === true) {
+        out.add('webhook_signing');
+    }
+    const identity = caps.identity;
+    if (identity?.key_origins) {
+        for (const purpose of Object.keys(identity.key_origins)) {
+            if (identity.key_origins[purpose] !== undefined)
+                out.add(purpose);
+        }
+    }
+    return out;
+}
+/**
+ * For every purpose the agent has declared signing for, confirm an
+ * `identity.key_origins.{purpose}` entry is present. Returns the set of
+ * missing purposes; the caller maps each onto `request_signature_key_origin_missing`
+ * with `posture` set to the corresponding signing field name.
+ */
+function checkRequiredOrigins(declaredPurposes, keyOrigins) {
+    const missing = [];
+    for (const purpose of declaredPurposes) {
+        const value = keyOrigins?.[purpose];
+        if (typeof value !== 'string' || value.length === 0) {
+            missing.push({ ok: false, code: 'key_origin_missing', purpose, posture: purpose });
+        }
+    }
+    return missing;
+}
+//# sourceMappingURL=consistency.js.map

package/dist/lib/signing/agent-resolver/consistency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consistency.js","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/consistency.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AA+CH,wDA2BC;AAgBD,0DAyBC;AAQD,oDAYC;AArID,iDAAoD;AAqCpD;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CAAC,KAAuB;IAC5D,IAAI,KAAK,CAAC,eAAe;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,QAAgB,CAAC;IACrB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,iCAAkB,EAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,IAAA,iCAAkB,EAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,KAAK,CAAC,cAAc;YACrC,aAAa,EAAE,KAAK,CAAC,eAAe;SACrC,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,eAAe,EAAE,QAAQ;YACzB,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,uBAAuB,CACrC,YAAqB,EACrB,wBAA6D,EAAE;IAE/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAA2B,qBAAqB,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAClE,MAAM,IAAI,GAAG,YAAuC,CAAC;IACrD,MAAM,cAAc,GAAG,IAAI,CAAC,eAAkF,CAAC;IAC/G,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,aAAa,CAAC,IAAI,cAAc,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,IAAI,cAAc,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,eAAsD,CAAC;IACnF,IAAI,cAAc,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7B,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAuC,CAAC;IAC9D,IAAI,QAAQ,EAAE,WAAW,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAA+B,EAAE,CAAC;YACtF,IAAI,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,gBAAuD,EACvD,UAA0C;IAE1C,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/signing/agent-resolver/errors.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Typed errors surfaced by `resolveAgent`. Codes mirror the
+ * `request_signature_*` taxonomy from security.mdx §"Discovering an
+ * agent's signing keys via `brand_json_url`" so a verifier consuming the
+ * resolver's output can short-circuit to the same wire-rejection code
+ * without rewriting the mapping.
+ *
+ * Detail-field discipline:
+ *   - Counterparty-influenceable strings (`agent_url`, `brand_json_url`,
+ *     `matched_entries`, `parse_error`, etc.) MUST be HTML-escaped before
+ *     rendering in admin UIs. The `attackerInfluenced` symbol marks fields
+ *     that came from the wire so downstream renderers can detect them.
+ *   - Internal network topology (resolved IPs, DNS state) MUST NOT be
+ *     copied onto detail fields. If `ssrfSafeFetch` throws, the resolver
+ *     translates the `SsrfRefusedError` into a `request_signature_*_unreachable`
+ *     code with `dns_error` set to the error class name only — never the
+ *     `address` or `hostname` fields the underlying error carries.
+ */
+export declare const ATTACKER_INFLUENCED: unique symbol;
+export type AgentResolverErrorCode = 'request_signature_brand_json_url_missing' | 'request_signature_capabilities_unreachable' | 'request_signature_brand_json_unreachable' | 'request_signature_brand_json_malformed' | 'request_signature_brand_origin_mismatch' | 'request_signature_agent_not_in_brand_json' | 'request_signature_brand_json_ambiguous' | 'request_signature_key_origin_mismatch' | 'request_signature_key_origin_missing'
+/**
+ * SDK-side codes — not in the spec's `request_signature_*` rejection
+ * table but distinct conditions a verifier needs to surface separately.
+ * The spec hands JWKS-fetch failures off to the verifier checklist
+ * (`request_signature_key_unknown`), but that code only applies once a
+ * `kid` lookup has been attempted; the bootstrap chain needs a code
+ * before we have a kid in hand. Likewise, an alg-allowlist rejection at
+ * import time is a distinct trust failure, not a fetch failure.
+ */
+ | 'request_signature_jwks_unreachable' | 'request_signature_jwks_alg_disallowed';
+export interface AgentResolverErrorDetail {
+    agent_url?: string;
+    brand_json_url?: string;
+    jwks_uri?: string;
+    agent_etld1?: string;
+    brand_json_url_etld1?: string;
+    http_status?: number;
+    /**
+     * Coarse classification of a transport error class — `'fetch_failed'`,
+     * `'timeout'`, `'dns_error'`, `'ssrf_refused'`. NEVER includes a resolved
+     * IP, hostname-to-address mapping, or any other internal-topology hint.
+     */
+    dns_error?: string;
+    last_attempt_at?: number;
+    parse_error?: string;
+    matched_count?: number;
+    matched_entries?: ReadonlyArray<{
+        url: string;
+        jwks_uri?: string;
+    }>;
+    purpose?: string;
+    expected_origin?: string;
+    actual_origin?: string;
+    posture?: string;
+}
+export declare class AgentResolverError extends Error {
+    readonly code: AgentResolverErrorCode;
+    readonly detail: AgentResolverErrorDetail;
+    readonly [ATTACKER_INFLUENCED]: ReadonlyArray<keyof AgentResolverErrorDetail>;
+    constructor(code: AgentResolverErrorCode, message: string, detail?: AgentResolverErrorDetail, attackerInfluencedFields?: ReadonlyArray<keyof AgentResolverErrorDetail>);
+}
+/**
+ * Field names on `AgentResolverError.detail` that carry counterparty-controlled
+ * strings. Renderers (admin UIs, log aggregators) MUST HTML-escape these
+ * before display.
+ */
+export declare function attackerInfluencedFields(err: AgentResolverError): ReadonlyArray<keyof AgentResolverErrorDetail>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/lib/signing/agent-resolver/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,mBAAmB,eAAyC,CAAC;AAE1E,MAAM,MAAM,sBAAsB,GAC9B,0CAA0C,GAC1C,4CAA4C,GAC5C,0CAA0C,GAC1C,wCAAwC,GACxC,yCAAyC,GACzC,2CAA2C,GAC3C,wCAAwC,GACxC,uCAAuC,GACvC,sCAAsC;AACxC;;;;;;;;GAQG;GACD,oCAAoC,GACpC,uCAAuC,CAAC;AAE5C,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,aAAa,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,wBAAwB,CAAC,CAAC;gBAG5E,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,wBAA6B,EACrC,wBAAwB,GAAE,aAAa,CAAC,MAAM,wBAAwB,CAAM;CAQ/E;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,aAAa,CAAC,MAAM,wBAAwB,CAAC,CAE/G"}

package/dist/lib/signing/agent-resolver/errors.js

@@ -0,0 +1,45 @@
+"use strict";
+/**
+ * Typed errors surfaced by `resolveAgent`. Codes mirror the
+ * `request_signature_*` taxonomy from security.mdx §"Discovering an
+ * agent's signing keys via `brand_json_url`" so a verifier consuming the
+ * resolver's output can short-circuit to the same wire-rejection code
+ * without rewriting the mapping.
+ *
+ * Detail-field discipline:
+ *   - Counterparty-influenceable strings (`agent_url`, `brand_json_url`,
+ *     `matched_entries`, `parse_error`, etc.) MUST be HTML-escaped before
+ *     rendering in admin UIs. The `attackerInfluenced` symbol marks fields
+ *     that came from the wire so downstream renderers can detect them.
+ *   - Internal network topology (resolved IPs, DNS state) MUST NOT be
+ *     copied onto detail fields. If `ssrfSafeFetch` throws, the resolver
+ *     translates the `SsrfRefusedError` into a `request_signature_*_unreachable`
+ *     code with `dns_error` set to the error class name only — never the
+ *     `address` or `hostname` fields the underlying error carries.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentResolverError = exports.ATTACKER_INFLUENCED = void 0;
+exports.attackerInfluencedFields = attackerInfluencedFields;
+exports.ATTACKER_INFLUENCED = Symbol.for('adcp.attacker-influenced');
+class AgentResolverError extends Error {
+    code;
+    detail;
+    [exports.ATTACKER_INFLUENCED];
+    constructor(code, message, detail = {}, attackerInfluencedFields = []) {
+        super(message);
+        this.name = 'AgentResolverError';
+        this.code = code;
+        this.detail = detail;
+        this[exports.ATTACKER_INFLUENCED] = attackerInfluencedFields;
+    }
+}
+exports.AgentResolverError = AgentResolverError;
+/**
+ * Field names on `AgentResolverError.detail` that carry counterparty-controlled
+ * strings. Renderers (admin UIs, log aggregators) MUST HTML-escape these
+ * before display.
+ */
+function attackerInfluencedFields(err) {
+    return err[exports.ATTACKER_INFLUENCED];
+}
+//# sourceMappingURL=errors.js.map

package/dist/lib/signing/agent-resolver/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAyEH,4DAEC;AAzEY,QAAA,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AA+C1E,MAAa,kBAAmB,SAAQ,KAAK;IAClC,IAAI,CAAyB;IAC7B,MAAM,CAA2B;IACjC,CAAC,2BAAmB,CAAC,CAAgD;IAE9E,YACE,IAA4B,EAC5B,OAAe,EACf,SAAmC,EAAE,EACrC,2BAA0E,EAAE;QAE5E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,2BAAmB,CAAC,GAAG,wBAAwB,CAAC;IACvD,CAAC;CACF;AAjBD,gDAiBC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,GAAuB;IAC9D,OAAO,GAAG,CAAC,2BAAmB,CAAC,CAAC;AAClC,CAAC"}

package/dist/lib/signing/agent-resolver/etld.d.ts

@@ -0,0 +1,25 @@
+export declare const PSL_SNAPSHOT_VERSION = "tldts@7";
+export declare class EtldComputationError extends Error {
+    readonly meta: {
+        hostOrUrl?: string;
+    };
+    constructor(message: string, meta: {
+        hostOrUrl?: string;
+    });
+}
+/**
+ * Compute eTLD+1 for a hostname or URL. Caller should pass either a bare
+ * hostname (`buyer.example.com`) or a full URL (`https://buyer.example.com/mcp`).
+ *
+ * Returns the registrable domain in canonical form (ASCII-lowercased, IDNA-2008
+ * A-label). Throws when the input has no PSL match — typically because the host
+ * is an IP literal or a single-label name.
+ */
+export declare function eTldPlusOne(hostOrUrl: string): string;
+/**
+ * Convenience: do two hostnames share an eTLD+1? Returns false when either
+ * input has no PSL match (rather than throwing) — callers comparing two
+ * hostnames typically want a non-match boolean, not an exception.
+ */
+export declare function sameEtldPlusOne(a: string, b: string): boolean;
+//# sourceMappingURL=etld.d.ts.map

package/dist/lib/signing/agent-resolver/etld.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"etld.d.ts","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/etld.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,qBAAa,oBAAqB,SAAQ,KAAK;IAG3C,QAAQ,CAAC,IAAI,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;gBADrC,OAAO,EAAE,MAAM,EACN,IAAI,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;CAKxC;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAUrD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAU7D"}

package/dist/lib/signing/agent-resolver/etld.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EtldComputationError = exports.PSL_SNAPSHOT_VERSION = void 0;
+exports.eTldPlusOne = eTldPlusOne;
+exports.sameEtldPlusOne = sameEtldPlusOne;
+/**
+ * eTLD+1 computation against a pinned, dated PSL snapshot. Backed by
+ * `tldts`, which ships its PSL bundled into the published package — pinning
+ * the dependency in `package.json` pins the snapshot. Runtime PSL fetches are
+ * never performed: a runtime fetch creates both a denial-of-service oracle
+ * (PSL host outage stalls verification) and a non-deterministic eTLD+1
+ * across deployments running on different snapshot ages
+ * (security.mdx §"Quickstart: implement a `brand_json_url`-based verifier"
+ * step 3).
+ *
+ * Both ICANN and PRIVATE PSL sections are in scope: platforms like
+ * `vercel.app`, `pages.dev`, `github.io` MUST be treated as suffixes so an
+ * attacker on `attacker.vercel.app` cannot pretend to share an eTLD+1 with
+ * a legitimate publisher on `legit.vercel.app`.
+ */
+const tldts_1 = require("tldts");
+const canonicalize_1 = require("./canonicalize");
+exports.PSL_SNAPSHOT_VERSION = 'tldts@7';
+class EtldComputationError extends Error {
+    meta;
+    constructor(message, meta) {
+        super(message);
+        this.meta = meta;
+        this.name = 'EtldComputationError';
+    }
+}
+exports.EtldComputationError = EtldComputationError;
+/**
+ * Compute eTLD+1 for a hostname or URL. Caller should pass either a bare
+ * hostname (`buyer.example.com`) or a full URL (`https://buyer.example.com/mcp`).
+ *
+ * Returns the registrable domain in canonical form (ASCII-lowercased, IDNA-2008
+ * A-label). Throws when the input has no PSL match — typically because the host
+ * is an IP literal or a single-label name.
+ */
+function eTldPlusOne(hostOrUrl) {
+    const host = (0, canonicalize_1.canonicalizeHost)(extractHost(hostOrUrl));
+    const result = (0, tldts_1.parse)(host, { allowPrivateDomains: true });
+    if (result.isIp) {
+        throw new EtldComputationError(`Cannot compute eTLD+1 for IP literal`, { hostOrUrl });
+    }
+    if (!result.domain) {
+        throw new EtldComputationError(`No PSL match for hostname`, { hostOrUrl });
+    }
+    return (0, canonicalize_1.canonicalizeHost)(result.domain);
+}
+/**
+ * Convenience: do two hostnames share an eTLD+1? Returns false when either
+ * input has no PSL match (rather than throwing) — callers comparing two
+ * hostnames typically want a non-match boolean, not an exception.
+ */
+function sameEtldPlusOne(a, b) {
+    let aEtld;
+    let bEtld;
+    try {
+        aEtld = eTldPlusOne(a);
+        bEtld = eTldPlusOne(b);
+    }
+    catch {
+        return false;
+    }
+    return aEtld === bEtld;
+}
+function extractHost(hostOrUrl) {
+    if (hostOrUrl.includes('://')) {
+        return new URL(hostOrUrl).hostname;
+    }
+    return hostOrUrl;
+}
+//# sourceMappingURL=etld.js.map

package/dist/lib/signing/agent-resolver/etld.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"etld.js","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/etld.ts"],"names":[],"mappings":";;;AAuCA,kCAUC;AAOD,0CAUC;AAlED;;;;;;;;;;;;;;GAcG;AACH,iCAA0C;AAE1C,iDAAkD;AAErC,QAAA,oBAAoB,GAAG,SAAS,CAAC;AAE9C,MAAa,oBAAqB,SAAQ,KAAK;IAGlC;IAFX,YACE,OAAe,EACN,IAA4B;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,SAAI,GAAJ,IAAI,CAAwB;QAGrC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AARD,oDAQC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,SAAiB;IAC3C,MAAM,IAAI,GAAG,IAAA,+BAAgB,EAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAA,aAAQ,EAAC,IAAI,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAA,+BAAgB,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,IAAI,KAAa,CAAC;IAClB,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,KAAK,KAAK,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB;IACpC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/signing/agent-resolver/fetch-helpers.d.ts

@@ -0,0 +1,41 @@
+/**
+ * SSRF-safe HTTPS fetches for the brand_json_url discovery chain. Wraps
+ * `ssrfSafeFetch` with the spec's body caps and the strict-JSON parser.
+ * No redirects, no caching here — that's the resolver's responsibility
+ * one layer up.
+ *
+ * Error translation lives here too: `SsrfRefusedError`'s `address` /
+ * `hostname` fields MUST NOT propagate onto `AgentResolverError.detail`
+ * (internal-topology leak). We surface the `code` only.
+ */
+export declare const MAX_CAPABILITIES_BYTES = 65536;
+export declare const MAX_BRAND_JSON_BYTES = 262144;
+export declare const MAX_JWKS_BYTES = 65536;
+export declare const DEFAULT_CONNECT_TIMEOUT_MS = 5000;
+export declare const DEFAULT_TOTAL_TIMEOUT_MS = 10000;
+export type FetchKind = 'capabilities' | 'brand.json' | 'jwks';
+export declare class SafeFetchError extends Error {
+    readonly kind: FetchKind;
+    readonly httpStatus: number | undefined;
+    readonly transport: 'fetch_failed' | 'timeout' | 'dns_error' | 'ssrf_refused' | 'body_cap';
+    constructor(kind: FetchKind, transport: SafeFetchError['transport'], message: string, httpStatus?: number);
+}
+export interface SafeFetchJsonResult {
+    body: unknown;
+    status: number;
+    headers: Record<string, string>;
+    fetchedAt: number;
+}
+/**
+ * Fetch a JSON document under the spec's SSRF rules with a hard body cap and
+ * the strict-JSON parser. Network errors, body-cap overruns, and JSON parse
+ * errors are translated to a typed `SafeFetchError` so the resolver can map
+ * each onto a `request_signature_*` code without inspecting the underlying
+ * cause.
+ */
+export declare function safeFetchJson(url: string, kind: FetchKind, options: {
+    allowPrivateIp?: boolean;
+    timeoutMs?: number;
+    maxBodyBytes: number;
+}): Promise<SafeFetchJsonResult>;
+//# sourceMappingURL=fetch-helpers.d.ts.map

package/dist/lib/signing/agent-resolver/fetch-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-helpers.d.ts","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/fetch-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,oBAAoB,SAAU,CAAC;AAC5C,eAAO,MAAM,cAAc,QAAS,CAAC;AACrC,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAChD,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,YAAY,GAAG,MAAM,CAAC;AAE/D,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,GAAG,UAAU,CAAC;gBAC/E,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAO1G;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,EACf,OAAO,EAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E,OAAO,CAAC,mBAAmB,CAAC,CA4C9B"}

package/dist/lib/signing/agent-resolver/fetch-helpers.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * SSRF-safe HTTPS fetches for the brand_json_url discovery chain. Wraps
+ * `ssrfSafeFetch` with the spec's body caps and the strict-JSON parser.
+ * No redirects, no caching here — that's the resolver's responsibility
+ * one layer up.
+ *
+ * Error translation lives here too: `SsrfRefusedError`'s `address` /
+ * `hostname` fields MUST NOT propagate onto `AgentResolverError.detail`
+ * (internal-topology leak). We surface the `code` only.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SafeFetchError = exports.DEFAULT_TOTAL_TIMEOUT_MS = exports.DEFAULT_CONNECT_TIMEOUT_MS = exports.MAX_JWKS_BYTES = exports.MAX_BRAND_JSON_BYTES = exports.MAX_CAPABILITIES_BYTES = void 0;
+exports.safeFetchJson = safeFetchJson;
+const net_1 = require("../../net");
+const strict_json_1 = require("./strict-json");
+exports.MAX_CAPABILITIES_BYTES = 65_536;
+exports.MAX_BRAND_JSON_BYTES = 262_144;
+exports.MAX_JWKS_BYTES = 65_536;
+exports.DEFAULT_CONNECT_TIMEOUT_MS = 5_000;
+exports.DEFAULT_TOTAL_TIMEOUT_MS = 10_000;
+class SafeFetchError extends Error {
+    kind;
+    httpStatus;
+    transport;
+    constructor(kind, transport, message, httpStatus) {
+        super(message);
+        this.name = 'SafeFetchError';
+        this.kind = kind;
+        this.transport = transport;
+        this.httpStatus = httpStatus;
+    }
+}
+exports.SafeFetchError = SafeFetchError;
+/**
+ * Fetch a JSON document under the spec's SSRF rules with a hard body cap and
+ * the strict-JSON parser. Network errors, body-cap overruns, and JSON parse
+ * errors are translated to a typed `SafeFetchError` so the resolver can map
+ * each onto a `request_signature_*` code without inspecting the underlying
+ * cause.
+ */
+async function safeFetchJson(url, kind, options) {
+    const fetchOpts = {
+        method: 'GET',
+        headers: { accept: 'application/json' },
+        allowPrivateIp: options.allowPrivateIp === true,
+        timeoutMs: options.timeoutMs ?? exports.DEFAULT_TOTAL_TIMEOUT_MS,
+        maxBodyBytes: options.maxBodyBytes,
+    };
+    let res;
+    try {
+        res = await (0, net_1.ssrfSafeFetch)(url, fetchOpts);
+    }
+    catch (err) {
+        if (err instanceof net_1.SsrfRefusedError) {
+            throw new SafeFetchError(kind, 'ssrf_refused', `${kind} fetch refused: ${err.code}`);
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        if (/abort|timed?\s*out/i.test(message)) {
+            throw new SafeFetchError(kind, 'timeout', `${kind} fetch timed out`);
+        }
+        throw new SafeFetchError(kind, 'fetch_failed', `${kind} fetch failed`);
+    }
+    if (res.status < 200 || res.status >= 300) {
+        throw new SafeFetchError(kind, 'fetch_failed', `${kind} fetch returned HTTP ${res.status}`, res.status);
+    }
+    let parsed;
+    try {
+        const text = Buffer.from(res.body).toString('utf8');
+        parsed = (0, strict_json_1.parseStrictJson)(text);
+    }
+    catch (err) {
+        if (err instanceof strict_json_1.StrictJsonError) {
+            throw new SafeFetchError(kind, 'fetch_failed', `${kind} body failed strict-JSON parse: ${err.code}`);
+        }
+        throw new SafeFetchError(kind, 'fetch_failed', `${kind} body parse failed`);
+    }
+    return {
+        body: parsed,
+        status: res.status,
+        headers: res.headers,
+        fetchedAt: Math.floor(Date.now() / 1000),
+    };
+}
+//# sourceMappingURL=fetch-helpers.js.map

package/dist/lib/signing/agent-resolver/fetch-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-helpers.js","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/fetch-helpers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAyCH,sCAgDC;AAvFD,mCAAmF;AAEnF,+CAAiE;AAEpD,QAAA,sBAAsB,GAAG,MAAM,CAAC;AAChC,QAAA,oBAAoB,GAAG,OAAO,CAAC;AAC/B,QAAA,cAAc,GAAG,MAAM,CAAC;AACxB,QAAA,0BAA0B,GAAG,KAAK,CAAC;AACnC,QAAA,wBAAwB,GAAG,MAAM,CAAC;AAI/C,MAAa,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAY;IAChB,UAAU,CAAqB;IAC/B,SAAS,CAAyE;IAC3F,YAAY,IAAe,EAAE,SAAsC,EAAE,OAAe,EAAE,UAAmB;QACvG,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAXD,wCAWC;AASD;;;;;;GAMG;AACI,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAe,EACf,OAA+E;IAE/E,MAAM,SAAS,GAAqB;QAClC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,cAAc,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;QAC/C,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,gCAAwB;QACxD,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;IAEF,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,mBAAa,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAgB,EAAE,CAAC;YACpC,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,mBAAmB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,kBAAkB,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC1C,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,wBAAwB,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1G,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,GAAG,IAAA,6BAAe,EAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,6BAAe,EAAE,CAAC;YACnC,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,mCAAmC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/lib/signing/agent-resolver/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Brand-JSON-URL agent resolver — bootstraps from an agent URL to its
+ * signing keys via the 8-step algorithm in `security.mdx` §"Discovering
+ * an agent's signing keys via `brand_json_url`".
+ *
+ * Public exports for `@adcp/client`:
+ *
+ *   - `resolveAgent(url, opts)`       — full chain + per-step trace
+ *   - `getAgentJwks(url, opts)`       — JWKS-only fast path (stage 4)
+ *   - `createAgentJwksSet(url, opts)` — JOSE-compatible JWTVerifyGetKey factory (stage 4)
+ *   - `AgentResolverError`            — typed error with `request_signature_*` codes
+ *   - `attackerInfluencedFields`      — names of `detail` fields admin UIs MUST escape
+ *
+ * Pure-function primitives (`eTldPlusOne`, `canonicalizeOrigin`,
+ * `selectAgentByUrl`, etc.) are exported under `agent-resolver/primitives`
+ * for callers building bespoke verification flows on top of this module.
+ */
+export { resolveAgent } from './resolve-agent';
+export type { AgentResolution, AgentProtocol, FetchCapabilitiesFn, ResolveAgentOptions, TraceStep, } from './resolve-agent';
+export { getAgentJwks, createAgentJwksSet } from './jwks-set';
+export type { AgentJwksResult, GetAgentJwksOptions, CreateAgentJwksSetOptions } from './jwks-set';
+export { AgentResolverError, ATTACKER_INFLUENCED, attackerInfluencedFields, type AgentResolverErrorCode, type AgentResolverErrorDetail, } from './errors';
+export type { AgentEntry } from './select-agent';
+export type { CapabilitiesWithBrandJsonUrl, IdentityKeyOriginPurpose, IdentityKeyOrigins, IdentityPosture, } from './capabilities-types';
+export { readBrandJsonUrl, readIdentityPosture } from './capabilities-types';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/signing/agent-resolver/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/signing/agent-resolver/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EACV,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,SAAS,GACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAClG,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EACV,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC"}