@authorizedretailers/spec 0.1.0 → 0.1.1

package/dist/schemas.d.ts

@@ -201,6 +201,9 @@ export declare const common: {
                     items: {
                         $ref: string;
                     };
+                    contains: {
+                        $ref: string;
+                    };
                 };
                 scope: {
                     $ref: string;

package/dist/schemas.js

@@ -245,11 +245,14 @@ export const common = {
                     "$ref": "#/$defs/party"
                 },
                 "channels": {
-                    "description": "Section 6: every authorization MUST name at least one channel identifier.",
+                    "description": "Section 6: every authorization MUST name at least one online channel identifier (amazon, walmart, ebay or web). A physical identifier alone does not authorize anything.",
                     "type": "array",
                     "minItems": 1,
                     "items": {
                         "$ref": "#/$defs/channel"
+                    },
+                    "contains": {
+                        "$ref": "#/$defs/verifiableChannel"
                     }
                 },
                 "scope": {

package/dist/validate.d.ts

@@ -1,5 +1,5 @@
 import type { AuthorizedRetailersFile, Channel, Scope, FullFile, PointerFile, PrivateFile, VerifyRequest, VerifyResponse } from "./types.js";
-export type ErrorCode = "schema" | "invalid_timestamp" | "expires_not_after_issued" | "file_expiry_exceeds_max" | "authorization_expires_after_file" | "duplicate_authorization_id" | "valid_until_not_after_checked" | "valid_until_exceeds_max";
+export type ErrorCode = "schema" | "no_online_channel" | "invalid_timestamp" | "expires_not_after_issued" | "file_expiry_exceeds_max" | "authorization_expires_after_file" | "duplicate_authorization_id" | "valid_until_not_after_checked" | "valid_until_exceeds_max";
 export interface ValidationError {
     code: ErrorCode;
     /** JSON Pointer into the instance, e.g. "/authorizations/0/expires". */

package/dist/validate.js

@@ -48,6 +48,32 @@ function ts(errors, path, value) {
         errors.push({ code: "invalid_timestamp", path, message: `not a valid UTC timestamp: ${value}` });
     return ms;
 }
+const ONLINE_CHANNEL_TYPES = new Set(["amazon", "walmart", "ebay", "web"]);
+/**
+ * Section 6: every authorization MUST name at least one online channel identifier. The schema
+ * enforces this too (`contains`), but its error is buried in generic output, so name it plainly.
+ * Runs on unvalidated input, so it checks shapes defensively.
+ */
+function onlineChannelErrors(input) {
+    const auths = input?.authorizations;
+    if (!Array.isArray(auths))
+        return [];
+    const errors = [];
+    auths.forEach((a, i) => {
+        const channels = a?.channels;
+        if (!Array.isArray(channels) || channels.length === 0)
+            return;
+        const online = channels.some((c) => ONLINE_CHANNEL_TYPES.has(c?.type));
+        if (!online) {
+            errors.push({
+                code: "no_online_channel",
+                path: `/authorizations/${i}/channels`,
+                message: "an authorization MUST name at least one online channel identifier (amazon, walmart, ebay or web); a physical identifier alone does not authorize anything (section 6)",
+            });
+        }
+    });
+    return errors;
+}
 /** Rules the JSON Schema cannot express (sections 5 and 10). Assumes the file already passed the schema. */
 function fullFileRules(f) {
     const errors = [];
@@ -109,14 +135,15 @@ function verifyResponseRules(r) {
 }
 /** Validates an authorized-retailers.json file of any form. */
 export function validateFile(input) {
-    const errors = schemaErrors(file, input);
+    const isFull = input?.form === "full";
+    const errors = [...(isFull ? onlineChannelErrors(input) : []), ...schemaErrors(file, input)];
     if (errors.length === 0 && input.form === "full") {
         errors.push(...fullFileRules(input));
     }
     return done(errors, input);
 }
 export function validateFullFile(input) {
-    const errors = schemaErrors(fileFull, input);
+    const errors = [...onlineChannelErrors(input), ...schemaErrors(fileFull, input)];
     if (errors.length === 0)
         errors.push(...fullFileRules(input));
     return done(errors, input);

package/fixtures/file/invalid/full-physical-only.json

@@ -0,0 +1,37 @@
+{
+  "spec": "authorized-retailers/0.1",
+  "form": "full",
+  "brand": {
+    "name": "Example Brand",
+    "domain": "brand.example"
+  },
+  "issued": "2026-09-23T00:00:00Z",
+  "expires": "2026-12-22T00:00:00Z",
+  "authorizations": [
+    {
+      "id": "auth_01J9X2",
+      "retailer": {
+        "name": "Example Retail LLC",
+        "entity_id": "ent_7Q4M"
+      },
+      "channels": [
+        {
+          "type": "physical",
+          "address": "1 High St, London",
+          "country": "GB"
+        }
+      ],
+      "scope": {
+        "territories": [
+          "US",
+          "CA"
+        ],
+        "product_lines": [
+          "all"
+        ]
+      },
+      "proposed_by": null,
+      "expires": "2026-12-22T00:00:00Z"
+    }
+  ]
+}

package/fixtures/manifest.json

@@ -145,6 +145,13 @@
     "expect": "schema",
     "note": "Domains are bare hostnames"
   },
+  {
+    "path": "file/invalid/full-physical-only.json",
+    "kind": "file",
+    "valid": false,
+    "expect": "no_online_channel",
+    "note": "Section 6: physical alone does not authorize"
+  },
   {
     "path": "file/invalid/full-physical-missing-country.json",
     "kind": "file",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authorizedretailers/spec",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Authorized Retailers v0.1: JSON Schemas, types, validator, identifier matching, RFC 8785 canonicalization and detached-JWS reference verifier",
   "license": "Apache-2.0 AND CC-BY-4.0",
   "author": "Authorized Retailers",

package/schemas/common.json

@@ -140,10 +140,11 @@
         "id": { "$ref": "#/$defs/id" },
         "retailer": { "$ref": "#/$defs/party" },
         "channels": {
-          "description": "Section 6: every authorization MUST name at least one channel identifier.",
+          "description": "Section 6: every authorization MUST name at least one online channel identifier (amazon, walmart, ebay or web). A physical identifier alone does not authorize anything.",
           "type": "array",
           "minItems": 1,
-          "items": { "$ref": "#/$defs/channel" }
+          "items": { "$ref": "#/$defs/channel" },
+          "contains": { "$ref": "#/$defs/verifiableChannel" }
         },
         "scope": { "$ref": "#/$defs/scope" },
         "proposed_by": {

package/spec/spec-v0.1.md

@@ -1,6 +1,6 @@
 # Authorized Retailers Specification v0.1
 
-Draft v0.1 · 23 September 2026, updated 25 September 2026  
+Draft v0.1 · 23 September 2026, updated 26 September 2026  
 Editor: Ed Jacobs
 
 Licensed under [CC BY 4.0](https://github.com/authorizedretailers/spec/blob/main/LICENSE-SPEC). JSON Schemas and reference code: Apache-2.0.
@@ -13,6 +13,8 @@ Status: draft v0.1, for discussion with brands, retailers and agent developers.
 
 The spec asserts one thing: whether a brand has authorized a given seller, on a given channel, in a given territory, for a given product scope, as of a given date.
 
+Scope: the spec covers consumer-facing online channels: marketplaces and web stores, including omnichannel retailers, which are identified by their web domain. Trade, wholesale and practitioner-only channels are out of scope. Sellers there are not listed, so their resale on consumer channels verifies as unlisted.
+
 It does not assert:
 
 - **Authenticity.** An authorized seller can still sell counterfeit goods or have its account compromised. Authorization and authenticity are separate questions.
@@ -123,7 +125,7 @@ An individual authorization's `expires` MUST NOT be later than the file's `expir
 
 ## 6. Seller identity and channel identifiers
 
-Agents see sellers as channel identifiers, not company names, so every authorization MUST name at least one channel identifier. A name alone is not verifiable.
+Agents see sellers as channel identifiers, not company names, so every authorization MUST name at least one online channel identifier (`amazon`, `walmart`, `ebay` or `web`). A name alone is not verifiable, and a `physical` identifier alone does not authorize anything.
 
 | Channel type | Required fields | Identifier |
 | --- | --- | --- |
@@ -131,7 +133,7 @@ Agents see sellers as channel identifiers, not company names, so every authoriza
 | `walmart` | `marketplace`, `seller_id` | Walmart Marketplace partner ID |
 | `ebay` | `marketplace`, `seller_id` | eBay user ID |
 | `web` | `domain` | The retailer's store domain |
-| `physical` | `address`, `country` | Store location, for completeness; not verifiable by agents |
+| `physical` | `address`, `country` | Optional storefront detail. Not a channel agents can verify, and never sufficient on its own |
 
 New channel types are added by registry proposal and published in the spec changelog.
 
@@ -260,6 +262,8 @@ The registry's liability position, dispute timelines and data handling are set o
 - [ ] Observation on channels beyond Amazon: Walmart and retailer web domains first?
 - [ ] Alignment with UCP and ACP: an extension field that points agents to a brand's authorized-retailers file.
 - [ ] Brand-declared `unauthorized`: a status for sellers the brand has explicitly said are not authorized, as distinct from `unlisted`, with a dispute path for the seller.
+- [ ] Dispensary and multi-seller platforms (e.g. practitioner dispensaries hosted on one platform domain): how to authorize individual sellers when agents only see the platform domain.
+- [ ] Channel audience: whether a channel needs an `audience` field (consumer, trade, practitioner) or whether consumer-only scope is enough.
 
 ## 14. Changelog
 
@@ -280,3 +284,7 @@ The registry's liability position, dispute timelines and data handling are set o
   - A registry MAY warn brands about sellers at PO boxes or commercial mailboxes. Verify answers don't change (section 12).
   - Corrected: the reference registry doesn't observe sellers yet (section 7).
   - Examples use reserved `.example` domains.
+- **2026-09-26**
+  - Scope: the spec covers consumer-facing online channels, including omnichannel retailers identified by their web domain. Trade, wholesale and practitioner-only channels are out of scope (section 1).
+  - Every authorization MUST name at least one online channel identifier (`amazon`, `walmart`, `ebay` or `web`). A `physical` identifier alone no longer authorizes anything (section 6).
+  - Two open questions: dispensary and multi-seller platforms, and a channel `audience` field (section 13).