web-agent-bridge 3.3.0 → 3.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (312) hide show
  1. package/LICENSE +84 -72
  2. package/README.ar.md +1563 -1286
  3. package/README.md +137 -1764
  4. package/bin/agent-runner.js +474 -474
  5. package/bin/cli.js +237 -237
  6. package/bin/wab-init.js +244 -0
  7. package/bin/wab.js +80 -80
  8. package/examples/azure-dns-wab.js +83 -0
  9. package/examples/bidi-agent.js +119 -119
  10. package/examples/cloudflare-wab-dns.js +121 -0
  11. package/examples/cpanel-wab-dns.js +114 -0
  12. package/examples/cross-site-agent.js +91 -91
  13. package/examples/dns-discovery-agent.js +166 -0
  14. package/examples/gcp-dns-wab.js +76 -0
  15. package/examples/governance-agent.js +169 -0
  16. package/examples/mcp-agent.js +94 -94
  17. package/examples/next-app-router/README.md +44 -44
  18. package/examples/plesk-wab-dns.js +103 -0
  19. package/examples/puppeteer-agent.js +108 -108
  20. package/examples/route53-wab-dns.js +144 -0
  21. package/examples/saas-dashboard/README.md +55 -55
  22. package/examples/safe-mode-agent.js +96 -0
  23. package/examples/self-discovery.js +106 -0
  24. package/examples/shopify-hydrogen/README.md +74 -74
  25. package/examples/vision-agent.js +171 -171
  26. package/examples/wab-sign.js +74 -0
  27. package/examples/wab-verify.js +60 -0
  28. package/examples/wordpress-elementor/README.md +77 -77
  29. package/package.json +93 -93
  30. package/public/.well-known/agent-tools.json +180 -180
  31. package/public/.well-known/ai-assets.json +59 -59
  32. package/public/.well-known/security.txt +8 -8
  33. package/public/.well-known/wab.json +28 -0
  34. package/public/activate.html +448 -0
  35. package/public/adopt.html +236 -0
  36. package/public/adoption-metrics.html +188 -0
  37. package/public/agent-workspace.html +359 -349
  38. package/public/ai.html +198 -198
  39. package/public/api.html +397 -413
  40. package/public/azure-dns-integration.html +289 -0
  41. package/public/browser.html +486 -486
  42. package/public/cloudflare-integration.html +380 -0
  43. package/public/commander-dashboard.html +243 -243
  44. package/public/cookies.html +210 -210
  45. package/public/cpanel-integration.html +398 -0
  46. package/public/css/agent-workspace.css +1713 -1713
  47. package/public/css/premium.css +317 -317
  48. package/public/css/styles.css +1401 -1235
  49. package/public/dashboard-shieldlink.html +295 -0
  50. package/public/dashboard.html +711 -706
  51. package/public/dns.html +436 -507
  52. package/public/docs.html +588 -587
  53. package/public/enterprise-mesh.ar.html +80 -0
  54. package/public/enterprise-mesh.html +81 -0
  55. package/public/feed.xml +89 -89
  56. package/public/gcp-dns-integration.html +318 -0
  57. package/public/governance.ar.html +70 -0
  58. package/public/governance.html +69 -0
  59. package/public/growth.html +465 -463
  60. package/public/index.html +1372 -1070
  61. package/public/integrations.html +556 -556
  62. package/public/js/activate.js +449 -0
  63. package/public/js/agent-workspace.js +1740 -1740
  64. package/public/js/auth-nav.js +117 -31
  65. package/public/js/auth-redirect.js +12 -12
  66. package/public/js/cookie-consent.js +56 -56
  67. package/public/js/dns.js +438 -0
  68. package/public/js/wab-demo-page.js +721 -721
  69. package/public/js/ws-client.js +74 -74
  70. package/public/l-preview.html +242 -0
  71. package/public/llms-full.txt +360 -360
  72. package/public/llms.txt +125 -125
  73. package/public/login.html +85 -85
  74. package/public/mesh-dashboard.html +328 -328
  75. package/public/milestones.html +346 -0
  76. package/public/one-click.html +779 -0
  77. package/public/openapi.json +669 -580
  78. package/public/partners.ar.html +145 -0
  79. package/public/partners.html +143 -0
  80. package/public/phone-shield.html +281 -281
  81. package/public/plesk-integration.html +375 -0
  82. package/public/premium-dashboard.html +2489 -2489
  83. package/public/premium.html +793 -793
  84. package/public/privacy.html +297 -297
  85. package/public/provider-onboarding.html +172 -0
  86. package/public/provider-sandbox.html +134 -0
  87. package/public/providers.html +359 -0
  88. package/public/refusals.html +172 -0
  89. package/public/register.html +105 -105
  90. package/public/registrar-integrations.html +141 -0
  91. package/public/ring4.html +292 -0
  92. package/public/robots.txt +99 -87
  93. package/public/route53-integration.html +531 -0
  94. package/public/score.html +263 -0
  95. package/public/script/wab-consent.d.ts +36 -36
  96. package/public/script/wab-consent.js +104 -104
  97. package/public/script/wab-schema.js +131 -131
  98. package/public/script/wab.d.ts +108 -108
  99. package/public/script/wab.min.js +580 -580
  100. package/public/security.txt +8 -8
  101. package/public/shieldlink.html +244 -0
  102. package/public/shieldqr.html +231 -0
  103. package/public/sitemap.xml +19 -1
  104. package/public/terms.html +256 -256
  105. package/public/trust-graph-api.ar.html +92 -0
  106. package/public/trust-graph-api.html +91 -0
  107. package/public/wab-features.html +560 -0
  108. package/public/wab-trust.html +200 -0
  109. package/public/wab-truth.html +375 -0
  110. package/public/wab-vs-protocols.html +210 -0
  111. package/public/whitepaper.html +449 -0
  112. package/script/ai-agent-bridge.js +1754 -1754
  113. package/sdk/README.md +99 -99
  114. package/sdk/agent-mesh.js +449 -449
  115. package/sdk/auto-discovery.js +301 -0
  116. package/sdk/commander.js +262 -262
  117. package/sdk/governance.js +262 -0
  118. package/sdk/index.d.ts +464 -464
  119. package/sdk/index.js +649 -636
  120. package/sdk/multi-agent.js +318 -318
  121. package/sdk/package.json +2 -2
  122. package/sdk/safe-mode.js +221 -0
  123. package/sdk/safety-shield.js +219 -219
  124. package/sdk/schema-discovery.js +83 -83
  125. package/server/adapters/index.js +520 -520
  126. package/server/config/plans.js +412 -367
  127. package/server/config/secrets.js +102 -102
  128. package/server/control-plane/index.js +301 -301
  129. package/server/data-plane/index.js +354 -354
  130. package/server/index.js +790 -531
  131. package/server/llm/index.js +404 -404
  132. package/server/middleware/adminAuth.js +35 -35
  133. package/server/middleware/api-tier.js +170 -0
  134. package/server/middleware/auth.js +50 -50
  135. package/server/middleware/featureGate.js +88 -88
  136. package/server/middleware/rateLimits.js +100 -100
  137. package/server/middleware/sensitiveAction.js +157 -157
  138. package/server/middleware/wab-trust.js +141 -0
  139. package/server/migrations/001_add_analytics_indexes.sql +7 -7
  140. package/server/migrations/002_premium_features.sql +418 -418
  141. package/server/migrations/003_ads_integer_cents.sql +33 -33
  142. package/server/migrations/004_agent_os.sql +158 -158
  143. package/server/migrations/005_marketplace_metering.sql +126 -126
  144. package/server/migrations/006_growth_suite.sql +138 -0
  145. package/server/migrations/007_governance.sql +106 -0
  146. package/server/migrations/008_plans.sql +144 -0
  147. package/server/migrations/009_shieldqr.sql +30 -0
  148. package/server/migrations/010_extended_trust.sql +33 -0
  149. package/server/migrations/011_outreach.sql +47 -0
  150. package/server/migrations/012_shieldlink.sql +116 -0
  151. package/server/migrations/013_ct_monitor.sql +13 -0
  152. package/server/migrations/014_wab_advanced_features.sql +128 -0
  153. package/server/migrations/015_wab_truth_layer.sql +101 -0
  154. package/server/migrations/016_ring4_external_trust.sql +84 -0
  155. package/server/migrations/017_ring4_extensions.sql +69 -0
  156. package/server/migrations/018_commercial_foundations.sql +167 -0
  157. package/server/migrations/019_unify_tier_constraints.sql +133 -0
  158. package/server/models/adapters/index.js +33 -33
  159. package/server/models/adapters/mysql.js +183 -183
  160. package/server/models/adapters/postgresql.js +172 -172
  161. package/server/models/adapters/sqlite.js +7 -7
  162. package/server/models/db.js +740 -681
  163. package/server/observability/failure-analysis.js +337 -337
  164. package/server/observability/index.js +394 -394
  165. package/server/protocol/capabilities.js +223 -223
  166. package/server/protocol/index.js +243 -243
  167. package/server/protocol/schema.js +584 -584
  168. package/server/registry/certification.js +271 -271
  169. package/server/registry/index.js +326 -326
  170. package/server/routes/activate.js +478 -0
  171. package/server/routes/admin-outreach.js +239 -0
  172. package/server/routes/admin-plans.js +76 -0
  173. package/server/routes/admin-premium.js +674 -671
  174. package/server/routes/admin-shieldlink.js +137 -0
  175. package/server/routes/admin-shieldqr.js +90 -0
  176. package/server/routes/admin-trust-monitor.js +139 -0
  177. package/server/routes/admin.js +550 -261
  178. package/server/routes/adopt.js +61 -0
  179. package/server/routes/ads.js +130 -130
  180. package/server/routes/agent-workspace.js +540 -540
  181. package/server/routes/api-keys.js +127 -0
  182. package/server/routes/api.js +150 -150
  183. package/server/routes/auth.js +71 -71
  184. package/server/routes/billing.js +57 -45
  185. package/server/routes/commander.js +316 -316
  186. package/server/routes/customer-shieldlink.js +133 -0
  187. package/server/routes/demo-showcase.js +332 -332
  188. package/server/routes/demo-store.js +154 -154
  189. package/server/routes/diagnose.js +373 -0
  190. package/server/routes/discovery.js +2348 -417
  191. package/server/routes/enterprise-mesh.js +170 -0
  192. package/server/routes/gateway.js +173 -173
  193. package/server/routes/governance-saas.js +203 -0
  194. package/server/routes/governance.js +208 -0
  195. package/server/routes/growth.js +1048 -0
  196. package/server/routes/intent.js +328 -0
  197. package/server/routes/license.js +251 -251
  198. package/server/routes/mesh.js +469 -469
  199. package/server/routes/noscript.js +543 -543
  200. package/server/routes/partners.js +201 -0
  201. package/server/routes/plans.js +33 -0
  202. package/server/routes/premium-v2.js +686 -686
  203. package/server/routes/premium.js +724 -724
  204. package/server/routes/providers.js +650 -0
  205. package/server/routes/reputation.js +411 -0
  206. package/server/routes/ring4.js +885 -0
  207. package/server/routes/runtime.js +2148 -2148
  208. package/server/routes/shieldlink.js +70 -0
  209. package/server/routes/shieldqr.js +88 -0
  210. package/server/routes/sovereign.js +465 -465
  211. package/server/routes/truth-layer.js +670 -0
  212. package/server/routes/universal.js +200 -200
  213. package/server/routes/unsubscribe.js +51 -0
  214. package/server/routes/wab-api.js +850 -850
  215. package/server/routes/wab-cache.js +282 -0
  216. package/server/runtime/container-worker.js +111 -111
  217. package/server/runtime/container.js +448 -448
  218. package/server/runtime/distributed-worker.js +362 -362
  219. package/server/runtime/event-bus.js +210 -210
  220. package/server/runtime/index.js +253 -253
  221. package/server/runtime/queue.js +599 -599
  222. package/server/runtime/replay.js +666 -666
  223. package/server/runtime/sandbox.js +266 -266
  224. package/server/runtime/scheduler.js +534 -534
  225. package/server/runtime/session-engine.js +293 -293
  226. package/server/runtime/state-manager.js +188 -188
  227. package/server/secrets/wab-signing-key.pem +3 -0
  228. package/server/secrets/wab-signing-pub.pem +3 -0
  229. package/server/security/cross-site-redactor.js +196 -196
  230. package/server/security/dry-run.js +180 -180
  231. package/server/security/human-gate-rate-limit.js +147 -147
  232. package/server/security/human-gate-transports.js +178 -178
  233. package/server/security/human-gate.js +281 -281
  234. package/server/security/index.js +368 -368
  235. package/server/security/intent-engine.js +245 -245
  236. package/server/security/reward-guard.js +171 -171
  237. package/server/security/rollback-store.js +239 -239
  238. package/server/security/token-scope.js +404 -404
  239. package/server/security/url-policy.js +139 -139
  240. package/server/services/adoption-agent.js +182 -0
  241. package/server/services/agent-chat.js +506 -506
  242. package/server/services/agent-learning.js +601 -601
  243. package/server/services/agent-memory.js +625 -625
  244. package/server/services/agent-mesh.js +555 -555
  245. package/server/services/agent-symphony.js +717 -717
  246. package/server/services/agent-tasks.js +1807 -1807
  247. package/server/services/api-key-engine.js +292 -292
  248. package/server/services/cluster.js +894 -894
  249. package/server/services/commander.js +738 -738
  250. package/server/services/edge-compute.js +440 -440
  251. package/server/services/email.js +233 -204
  252. package/server/services/fairness-engine.js +409 -0
  253. package/server/services/fairness.js +420 -0
  254. package/server/services/governance.js +466 -0
  255. package/server/services/hosted-runtime.js +205 -205
  256. package/server/services/lfd.js +635 -635
  257. package/server/services/local-ai.js +389 -389
  258. package/server/services/marketplace.js +270 -270
  259. package/server/services/metering.js +182 -182
  260. package/server/services/modules/affiliate-intelligence.js +93 -93
  261. package/server/services/modules/agent-firewall.js +90 -90
  262. package/server/services/modules/bounty.js +89 -89
  263. package/server/services/modules/collective-bargaining.js +92 -92
  264. package/server/services/modules/dark-pattern.js +66 -66
  265. package/server/services/modules/gov-intelligence.js +45 -45
  266. package/server/services/modules/neural.js +55 -55
  267. package/server/services/modules/notary.js +49 -49
  268. package/server/services/modules/price-time-machine.js +86 -86
  269. package/server/services/modules/protocol.js +104 -104
  270. package/server/services/negotiation.js +439 -439
  271. package/server/services/outreach-agent.js +312 -0
  272. package/server/services/plans.js +214 -0
  273. package/server/services/plugins.js +771 -771
  274. package/server/services/premium.js +1 -1
  275. package/server/services/price-intelligence.js +566 -566
  276. package/server/services/price-shield.js +1137 -1137
  277. package/server/services/provider-clients.js +740 -0
  278. package/server/services/reputation.js +465 -465
  279. package/server/services/search-engine.js +357 -357
  280. package/server/services/security.js +513 -513
  281. package/server/services/self-healing.js +843 -843
  282. package/server/services/shieldlink.js +492 -0
  283. package/server/services/shieldqr.js +322 -0
  284. package/server/services/sovereign-shield.js +542 -542
  285. package/server/services/ssl-ct-monitor.js +224 -0
  286. package/server/services/ssl-inspector.js +42 -0
  287. package/server/services/ssl-monitor.js +167 -0
  288. package/server/services/stripe.js +206 -192
  289. package/server/services/swarm.js +788 -788
  290. package/server/services/universal-scraper.js +662 -662
  291. package/server/services/verification.js +481 -481
  292. package/server/services/vision.js +1163 -1163
  293. package/server/services/wab-crypto.js +178 -0
  294. package/server/utils/cache.js +125 -125
  295. package/server/utils/migrate.js +81 -81
  296. package/server/utils/safe-fetch.js +228 -228
  297. package/server/utils/secureFields.js +50 -50
  298. package/server/ws.js +161 -161
  299. package/templates/artisan-marketplace.yaml +104 -104
  300. package/templates/book-price-scout.yaml +98 -98
  301. package/templates/electronics-price-tracker.yaml +108 -108
  302. package/templates/flight-deal-hunter.yaml +113 -113
  303. package/templates/freelancer-direct.yaml +116 -116
  304. package/templates/grocery-price-compare.yaml +93 -93
  305. package/templates/hotel-direct-booking.yaml +113 -113
  306. package/templates/local-services.yaml +98 -98
  307. package/templates/olive-oil-tunisia.yaml +88 -88
  308. package/templates/organic-farm-fresh.yaml +101 -101
  309. package/templates/restaurant-direct.yaml +97 -97
  310. package/templates/ring4/banking-sovereign.yaml +55 -0
  311. package/templates/ring4/ecommerce-sovereign.yaml +58 -0
  312. package/templates/ring4/healthcare-sovereign.yaml +60 -0
package/public/whitepaper.html ADDED
@@ -0,0 +1,449 @@
1
+ <!DOCTYPE html>
2
+ <html lang="en" dir="ltr">
3
+ <head>
4
+ <meta charset="UTF-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
+ <title>WAB DNS Discovery Whitepaper — Web Agent Bridge</title>
7
+ <meta name="description" content="Web Agent Bridge (WAB) DNS Discovery Protocol — A Zero-Probe, Cryptographically Verified Infrastructure Layer for AI Agents. Whitepaper v1.3.0." />
8
+ <meta name="robots" content="index, follow, noarchive, nosnippet, noimageindex" />
9
+ <link rel="canonical" href="https://webagentbridge.com/whitepaper" />
10
+ <meta property="og:title" content="WAB DNS Discovery Whitepaper" />
11
+ <meta property="og:description" content="Zero-probe, cryptographically verified discovery protocol for AI agents." />
12
+ <meta property="og:url" content="https://webagentbridge.com/whitepaper" />
13
+ <meta property="og:type" content="article" />
14
+
15
+ <!-- Anti-embedding / clickjacking defense -->
16
+ <meta http-equiv="X-Content-Type-Options" content="nosniff" />
17
+ <meta http-equiv="Referrer-Policy" content="strict-origin-when-cross-origin" />
18
+ <meta name="copyright" content="© 2026 Web Agent Bridge — All Rights Reserved" />
19
+ <meta name="rights" content="All Rights Reserved. Reproduction prohibited without written consent." />
20
+
21
+ <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
22
+ <style>
23
+ /* === RESET / BASE === */
24
+ *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
25
+ html, body {
26
+ background: #0b1020;
27
+ color: #e7ecf5;
28
+ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
29
+ line-height: 1.7;
30
+ min-height: 100vh;
31
+ overflow-x: hidden;
32
+ }
33
+
34
+ /* === ANTI-COPY DEFENSE LAYER === */
35
+ /* Disable text selection across the document (best-effort browser deterrent) */
36
+ .wp-protect, .wp-protect * {
37
+ -webkit-user-select: none !important;
38
+ -moz-user-select: none !important;
39
+ -ms-user-select: none !important;
40
+ user-select: none !important;
41
+ -webkit-touch-callout: none !important;
42
+ -webkit-tap-highlight-color: transparent;
43
+ }
44
+ /* Block image dragging */
45
+ .wp-protect img { -webkit-user-drag: none; user-drag: none; pointer-events: none; }
46
+
47
+ /* === LAYOUT === */
48
+ .topbar {
49
+ position: sticky; top: 0; z-index: 50;
50
+ background: rgba(11, 16, 32, 0.92);
51
+ backdrop-filter: blur(10px);
52
+ border-bottom: 1px solid rgba(255,255,255,0.08);
53
+ padding: 14px 24px;
54
+ display: flex; align-items: center; justify-content: space-between;
55
+ }
56
+ .topbar a.brand { color: #4ea3ff; text-decoration: none; font-weight: 600; font-size: 1rem; }
57
+ .topbar .meta { font-size: 0.8rem; color: #8b96ad; }
58
+ .topbar .badge {
59
+ display: inline-block;
60
+ background: linear-gradient(135deg, #f97316, #ef4444);
61
+ color: white;
62
+ padding: 3px 10px;
63
+ border-radius: 999px;
64
+ font-size: 0.72rem;
65
+ font-weight: 600;
66
+ letter-spacing: 0.5px;
67
+ margin-left: 8px;
68
+ vertical-align: middle;
69
+ }
70
+
71
+ .container {
72
+ max-width: 820px;
73
+ margin: 0 auto;
74
+ padding: 48px 28px 96px;
75
+ position: relative;
76
+ }
77
+
78
+ /* === DIAGONAL WATERMARK === */
79
+ .watermark {
80
+ position: fixed;
81
+ top: 0; left: 0; right: 0; bottom: 0;
82
+ pointer-events: none;
83
+ z-index: 1;
84
+ opacity: 0.06;
85
+ background-image:
86
+ repeating-linear-gradient(
87
+ -45deg,
88
+ transparent 0,
89
+ transparent 180px,
90
+ rgba(78, 163, 255, 0.0) 180px,
91
+ rgba(78, 163, 255, 0.0) 200px
92
+ );
93
+ overflow: hidden;
94
+ }
95
+ .watermark::before {
96
+ content: "WEBAGENTBRIDGE.COM • © 2026 • CONFIDENTIAL READ-ONLY • WEBAGENTBRIDGE.COM • © 2026 • CONFIDENTIAL READ-ONLY • WEBAGENTBRIDGE.COM • © 2026";
97
+ position: absolute;
98
+ top: -50%; left: -50%; right: -50%; bottom: -50%;
99
+ transform: rotate(-30deg);
100
+ font-size: 28px;
101
+ font-weight: 700;
102
+ color: #4ea3ff;
103
+ white-space: pre-wrap;
104
+ word-spacing: 18px;
105
+ line-height: 220px;
106
+ letter-spacing: 4px;
107
+ text-align: center;
108
+ opacity: 0.65;
109
+ }
110
+
111
+ /* === CONTENT === */
112
+ .doc { position: relative; z-index: 2; }
113
+ h1 {
114
+ font-size: 2.1rem;
115
+ line-height: 1.3;
116
+ margin-bottom: 8px;
117
+ background: linear-gradient(135deg, #4ea3ff, #8b5cf6);
118
+ -webkit-background-clip: text;
119
+ background-clip: text;
120
+ -webkit-text-fill-color: transparent;
121
+ letter-spacing: -0.5px;
122
+ }
123
+ h2 {
124
+ font-size: 1.5rem;
125
+ margin: 36px 0 14px;
126
+ color: #ffffff;
127
+ border-left: 3px solid #4ea3ff;
128
+ padding-left: 12px;
129
+ }
130
+ h3 {
131
+ font-size: 1.15rem;
132
+ margin: 26px 0 10px;
133
+ color: #cdd6e3;
134
+ }
135
+ p { margin: 0 0 14px; color: #cdd6e3; }
136
+ ul, ol { margin: 0 0 16px 22px; color: #cdd6e3; }
137
+ li { margin-bottom: 6px; }
138
+ code, pre {
139
+ font-family: "JetBrains Mono", "SF Mono", Menlo, Consolas, monospace;
140
+ font-size: 0.88rem;
141
+ }
142
+ code {
143
+ background: rgba(78, 163, 255, 0.12);
144
+ color: #b8d4ff;
145
+ padding: 2px 6px;
146
+ border-radius: 4px;
147
+ }
148
+ pre {
149
+ background: #060914;
150
+ border: 1px solid rgba(255,255,255,0.08);
151
+ border-radius: 8px;
152
+ padding: 16px 18px;
153
+ overflow-x: auto;
154
+ margin: 12px 0 18px;
155
+ }
156
+ pre code { background: transparent; padding: 0; color: #b8d4ff; }
157
+ blockquote {
158
+ border-left: 3px solid #f97316;
159
+ background: rgba(249, 115, 22, 0.08);
160
+ padding: 14px 18px;
161
+ margin: 18px 0;
162
+ border-radius: 0 6px 6px 0;
163
+ font-size: 0.95rem;
164
+ }
165
+ table {
166
+ width: 100%; border-collapse: collapse;
167
+ margin: 14px 0;
168
+ background: rgba(255,255,255,0.02);
169
+ border-radius: 6px;
170
+ overflow: hidden;
171
+ }
172
+ th, td {
173
+ padding: 10px 14px;
174
+ text-align: left;
175
+ border-bottom: 1px solid rgba(255,255,255,0.06);
176
+ font-size: 0.92rem;
177
+ }
178
+ th { background: rgba(78,163,255,0.08); color: #ffffff; font-weight: 600; }
179
+ hr {
180
+ border: none;
181
+ height: 1px;
182
+ background: linear-gradient(90deg, transparent, rgba(255,255,255,0.15), transparent);
183
+ margin: 32px 0;
184
+ }
185
+ .lead-card {
186
+ background: linear-gradient(135deg, rgba(78,163,255,0.08), rgba(139,92,246,0.06));
187
+ border: 1px solid rgba(78,163,255,0.2);
188
+ border-radius: 12px;
189
+ padding: 22px 26px;
190
+ margin: 24px 0;
191
+ }
192
+ .lead-card .meta-grid {
193
+ display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
194
+ gap: 12px;
195
+ margin-top: 12px;
196
+ font-size: 0.86rem;
197
+ }
198
+ .lead-card .meta-grid div { color: #8b96ad; }
199
+ .lead-card .meta-grid b { color: #ffffff; }
200
+ .footnote {
201
+ margin-top: 48px;
202
+ padding-top: 24px;
203
+ border-top: 1px solid rgba(255,255,255,0.08);
204
+ font-size: 0.82rem;
205
+ color: #8b96ad;
206
+ text-align: center;
207
+ }
208
+ .footnote a { color: #4ea3ff; text-decoration: none; }
209
+
210
+ /* Print suppression */
211
+ @media print {
212
+ html, body { display: none !important; visibility: hidden !important; }
213
+ body::after {
214
+ content: "Printing of this document is not authorized. Visit https://webagentbridge.com/whitepaper to view.";
215
+ display: block !important;
216
+ visibility: visible !important;
217
+ position: fixed; top: 50%; left: 50%; transform: translate(-50%, -50%);
218
+ font-size: 18px; color: #000;
219
+ }
220
+ }
221
+ </style>
222
+ </head>
223
+ <body class="wp-protect" oncontextmenu="return false;" oncopy="return false;" oncut="return false;" onpaste="return false;" ondragstart="return false;" onselectstart="return false;">
224
+
225
+ <div class="watermark" aria-hidden="true"></div>
226
+
227
+ <header class="topbar">
228
+ <a href="/" class="brand">← Web Agent Bridge</a>
229
+ <div class="meta">
230
+ Whitepaper v1.3.0 <span class="badge">READ-ONLY</span>
231
+ </div>
232
+ </header>
233
+
234
+ <main class="container">
235
+ <article class="doc" id="whitepaper">
236
+
237
+ <h1>Web Agent Bridge (WAB) DNS Discovery Protocol</h1>
238
+ <p style="font-size: 1.1rem; color: #cdd6e3; margin-top: 6px;">
239
+ A Zero-Probe, Cryptographically Verified Infrastructure Layer for AI Agents
240
+ </p>
241
+
242
+ <div class="lead-card">
243
+ <div><b>© 2026 Web Agent Bridge.</b> All Rights Reserved.</div>
244
+ <p style="margin: 8px 0 0; font-size: 0.9rem;">
245
+ This whitepaper is the intellectual property of the Web Agent Bridge project.
246
+ Reproduction, redistribution, or modification — in whole or in part — is <b>prohibited</b>
247
+ without prior written permission. The canonical, authoritative version is published at
248
+ <code>webagentbridge.com/whitepaper</code>.
249
+ </p>
250
+ <div class="meta-grid">
251
+ <div><b>Version</b><br>1.3.0</div>
252
+ <div><b>Status</b><br>Published</div>
253
+ <div><b>Date</b><br>May 2026</div>
254
+ <div><b>License</b><br>All Rights Reserved</div>
255
+ </div>
256
+ </div>
257
+
258
+ <h2>Abstract</h2>
259
+ <p>As artificial intelligence agents transition from isolated chatbots to autonomous web navigators, the absence of a standardized, machine-readable discovery mechanism creates significant friction. Agents currently rely on heuristic DOM scraping, trial-and-error HTTP probing, and reverse-engineered APIs, leading to excessive server load, brittle integrations, and privacy risks. This paper introduces the <b>Web Agent Bridge (WAB) DNS Discovery Protocol</b>, a lightweight, infrastructure-first mechanism that allows AI agents to instantly discover a domain's AI capabilities and cryptographic trust attestations without prior HTTP interaction. Modeled after email authentication standards like SPF, DKIM, and DMARC, the WAB DNS Discovery Protocol utilizes DNS TXT records resolved over DNS over HTTPS (DoH) to advertise protocol support and endpoint locations. Furthermore, we detail the <b>WAB Cryptographic Trust Layer (v1.3)</b>, which employs Ed25519 signatures to ensure the integrity and authenticity of the discovery document, mitigating man-in-the-middle attacks and establishing a robust foundation for autonomous agent-web interactions.</p>
260
+
261
+ <h2>1. Introduction</h2>
262
+ <p>The proliferation of Large Language Models (LLMs) and autonomous AI agents has fundamentally altered how digital information is accessed and processed. Unlike human users who rely on visual interfaces and HTML/CSS rendering, AI agents require structured, deterministic access to web capabilities. However, the current web architecture lacks a native discovery layer for machine-to-machine interactions.</p>
263
+ <p>Currently, agents attempting to interact with a website face a "blind fetch" problem. They must either parse complex HTML structures, guess API endpoints, or probe for well-known files (e.g., <code>/.well-known/ai-plugin.json</code>), often resulting in HTTP 404 errors, increased latency, and unnecessary server overhead. Furthermore, the rise of "cookie-wall taxes" and aggressive bot mitigation strategies disproportionately penalize legitimate, beneficial AI traffic.</p>
264
+ <p>To address these challenges, we propose the <b>Web Agent Bridge (WAB) DNS Discovery Protocol</b>. By shifting the discovery phase to the Domain Name System (DNS) infrastructure, WAB enables <b>zero-probe discovery</b>. Agents can resolve a single DNS record to ascertain AI readiness, locate the capabilities document (<code>wab.json</code>), and verify the cryptographic signature of the provider, all before initiating an HTTP connection.</p>
265
+
266
+ <h2>2. The WAB DNS Discovery Protocol (DDP)</h2>
267
+ <p>The DNS Discovery Protocol (DDP) is an infrastructure-layer mechanism that allows domains to advertise their WAB endpoint and trust parameters. It is designed to be highly cacheable, universally supported, and easily verifiable.</p>
268
+
269
+ <h3>2.1 Protocol Mechanics</h3>
270
+ <p>The core of the DDP is a DNS TXT record placed at the <code>_wab</code> subdomain of the apex domain (e.g., <code>_wab.example.com</code>). This approach mirrors established email authentication protocols such as the Sender Policy Framework (SPF) [1] and DomainKeys Identified Mail (DKIM) [2].</p>
271
+ <p>When an AI agent intends to interact with a domain, it MUST first query the <code>_wab.{apex}</code> TXT record. If the DNS query returns <code>NXDOMAIN</code>, the agent concludes that the domain does not explicitly support the WAB protocol and falls back to traditional, heuristic methods. If the record exists, the agent parses the key-value pairs to locate the discovery document.</p>
272
+
273
+ <h3>2.2 Record Format and Syntax</h3>
274
+ <p>The WAB TXT record utilizes a semicolon-separated key-value format. The primary fields are defined as follows:</p>
275
+ <table>
276
+ <thead>
277
+ <tr><th>Field</th><th>Value Type</th><th>Requirement</th><th>Description</th></tr>
278
+ </thead>
279
+ <tbody>
280
+ <tr><td><code>v</code></td><td>string</td><td>REQUIRED</td><td>Protocol version identifier. Current standard is <code>wab1</code>.</td></tr>
281
+ <tr><td><code>endpoint</code></td><td>URL</td><td>REQUIRED</td><td>The absolute HTTPS URL of the <code>wab.json</code> discovery document.</td></tr>
282
+ <tr><td><code>pk</code></td><td>string</td><td>OPTIONAL</td><td>The public key for cryptographic verification, prefixed with the algorithm (e.g., <code>ed25519:&lt;base64&gt;</code>).</td></tr>
283
+ </tbody>
284
+ </table>
285
+ <p><b>Example TXT Record:</b></p>
286
+ <pre><code>_wab.example.com. 3600 IN TXT "v=wab1; endpoint=https://example.com/.well-known/wab.json; pk=ed25519:PkQ7aq1E3jvMI2oL0rvYtTgOplWd+USw26Y/D4JzPxo="</code></pre>
287
+
288
+ <h3>2.3 DNS over HTTPS (DoH) Requirement</h3>
289
+ <p>To prevent ISP-level interception, manipulation, and tracking of discovery queries, WAB-aware agents SHOULD resolve the <code>_wab</code> records using DNS over HTTPS (DoH) [3]. DoH encrypts the DNS query, shifting the trust boundary from the local network to a trusted DoH resolver (e.g., Cloudflare 1.1.1.1 or Google 8.8.8.8).</p>
290
+
291
+ <h2>3. The Discovery Document (<code>wab.json</code>)</h2>
292
+ <p>The discovery document, typically hosted at <code>/.well-known/wab.json</code>, is a structured JSON file that defines the domain's capabilities, permitted actions, and transport mechanisms.</p>
293
+
294
+ <h3>3.1 Schema Overview (v1.3)</h3>
295
+ <p>The <code>wab.json</code> schema is designed for extensibility and strict typing. Key components include:</p>
296
+ <ul>
297
+ <li><code>wab_version</code> — Specifies the schema version (e.g., <code>"1.3.0"</code>).</li>
298
+ <li><code>provider</code> — Metadata regarding the domain owner, including name, category, and URL.</li>
299
+ <li><code>capabilities</code> — Defines the permitted actions (<code>commands</code>) and granular access rights (<code>permissions</code>).</li>
300
+ <li><code>endpoints</code> — Specifies the API endpoints for agent interaction (e.g., <code>/api/wab/discover</code>, <code>/api/wab/ping</code>).</li>
301
+ <li><code>signature</code> — The cryptographic signature block (detailed in Section 4).</li>
302
+ </ul>
303
+
304
+ <h3>3.2 Action Definitions</h3>
305
+ <p>Actions (or commands) are explicitly defined within the <code>capabilities.commands</code> array. This eliminates the need for agents to infer functionality. Each command specifies its trigger mechanism (e.g., <code>api</code>, <code>navigate</code>), required parameters, and authentication prerequisites, providing a deterministic execution path.</p>
306
+
307
+ <h2>4. Cryptographic Trust Layer (v1.3)</h2>
308
+ <p>While DNS discovery provides routing, it does not inherently guarantee the integrity of the fetched <code>wab.json</code> document, especially if the HTTPS connection is compromised or misconfigured. To establish a robust chain of trust, WAB v1.3 introduces a <b>Cryptographic Trust Layer</b> based on Ed25519 signatures.</p>
309
+
310
+ <h3>4.1 Ed25519 Signatures</h3>
311
+ <p>Ed25519 [4] is a public-key signature system utilizing the Edwards-curve Digital Signature Algorithm (EdDSA). It was selected for WAB due to its high performance, small key size (32 bytes), and resilience against side-channel attacks.</p>
312
+
313
+ <h3>4.2 Signature Generation and Verification</h3>
314
+ <p>The trust layer operates through a deterministic canonicalization and signing process:</p>
315
+ <ol>
316
+ <li><b>Key Generation</b> — The domain owner generates an Ed25519 keypair. The private key is securely stored offline or within a secure enclave.</li>
317
+ <li><b>DNS Publication</b> — The public key is published in the <code>_wab</code> DNS TXT record using the <code>pk=</code> parameter (e.g., <code>pk=ed25519:&lt;base64_public_key&gt;</code>).</li>
318
+ <li><b>Canonicalization</b> — Before signing, the <code>wab.json</code> document undergoes RFC 8785-style JSON canonicalization [5]. This process sorts object keys lexicographically, removes insignificant whitespace, and excludes the top-level <code>signature</code> field to ensure a consistent byte representation.</li>
319
+ <li><b>Signing</b> — The canonicalized JSON string is signed using the Ed25519 private key.</li>
320
+ <li><b>Manifest Embedding</b> — The resulting signature is embedded back into the <code>wab.json</code> document under the <code>signature</code> object.</li>
321
+ </ol>
322
+ <p><b>Signature Block Example:</b></p>
323
+ <pre><code>"signature": {
324
+ "algorithm": "ed25519",
325
+ "value": "base64_encoded_signature_string...",
326
+ "key_id": "pYu7X5PF/HoE2yDx",
327
+ "signed_at": "2026-05-02T10:00:00Z"
328
+ }</code></pre>
329
+
330
+ <h3>4.3 Agent Verification Flow</h3>
331
+ <p>Upon fetching the <code>wab.json</code> document, a WAB-compliant agent performs the following verification steps:</p>
332
+ <ol>
333
+ <li>Extracts the <code>pk</code> value from the previously resolved <code>_wab</code> DNS TXT record.</li>
334
+ <li>Extracts the <code>signature</code> object from the <code>wab.json</code> document.</li>
335
+ <li>Verifies that <code>signature.algorithm</code> is <code>ed25519</code>.</li>
336
+ <li>Canonicalizes the <code>wab.json</code> document (excluding the <code>signature</code> field).</li>
337
+ <li>Verifies the canonicalized string against the <code>signature.value</code> using the extracted public key.</li>
338
+ </ol>
339
+ <p>If the verification succeeds, the agent possesses cryptographic proof that the capabilities document was authorized by the entity controlling the domain's DNS records, effectively neutralizing unauthorized modifications.</p>
340
+
341
+ <h2>5. Implementation and Adoption</h2>
342
+ <p>The WAB protocol is designed for frictionless adoption by both site owners and agent developers.</p>
343
+
344
+ <h3>5.1 Zero-Code Infrastructure Onboarding</h3>
345
+ <p>Site owners can enable WAB discovery without deploying new code. By simply adding the <code>_wab</code> TXT record and hosting a static <code>wab.json</code> file, a domain becomes "Agent-Ready." This infrastructure-first approach lowers the barrier to entry compared to complex API integrations.</p>
346
+
347
+ <h3>5.2 The Proof Lab and Live Verification</h3>
348
+ <p>To facilitate adoption and ensure compliance, the Web Agent Bridge provides a <b>"Proof Lab."</b> This tool performs a live, end-to-end verification of the integration:</p>
349
+ <ol>
350
+ <li><b>DNS Resolution</b> — Verifies the presence and syntax of the <code>_wab</code> TXT record via DoH.</li>
351
+ <li><b>Document Fetch</b> — Retrieves and parses the <code>wab.json</code> file.</li>
352
+ <li><b>Agent Execution</b> — Simulates an agent flow by calling the defined endpoints (e.g., <code>/api/wab/discover</code>, <code>/api/wab/ping</code>) to confirm execution readiness (<code>execution_ok=true</code>).</li>
353
+ </ol>
354
+
355
+ <h2>6. Conclusion</h2>
356
+ <p>The Web Agent Bridge (WAB) DNS Discovery Protocol and its Cryptographic Trust Layer provide a critical missing piece in the architecture of the autonomous web. By leveraging proven DNS infrastructure and Ed25519 cryptography, WAB enables zero-probe, secure, and deterministic discovery of AI capabilities. This protocol reduces server overhead, enhances privacy through DoH, and establishes a verifiable chain of trust, paving the way for scalable and secure machine-to-machine interactions on the internet.</p>
357
+
358
+ <h2>References</h2>
359
+ <ol>
360
+ <li>S. Kitterman, <i>"Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1,"</i> RFC 7208, April 2014.</li>
361
+ <li>D. Crocker, T. Hansen, and M. Kucherawy, <i>"DomainKeys Identified Mail (DKIM) Signatures,"</i> RFC 6376, September 2011.</li>
362
+ <li>P. Hoffman and P. McManus, <i>"DNS Queries over HTTPS (DoH),"</i> RFC 8484, October 2018.</li>
363
+ <li>S. Josefsson and I. Liusvaara, <i>"Edwards-Curve Digital Signature Algorithm (EdDSA),"</i> RFC 8032, January 2017.</li>
364
+ <li>A. Rundgren, B. Jordan, and S. Erdtman, <i>"JSON Canonicalization Scheme (JCS),"</i> RFC 8785, June 2020.</li>
365
+ </ol>
366
+
367
+ <hr />
368
+
369
+ <div class="footnote">
370
+ <p>This document is read-only reference material.<br>
371
+ The canonical version lives at <a href="https://webagentbridge.com/whitepaper">webagentbridge.com/whitepaper</a>.<br>
372
+ <b>All rights reserved © 2026 Web Agent Bridge.</b> Reproduction, redistribution, or modification — in whole or in part — is prohibited without prior written permission.</p>
373
+ </div>
374
+
375
+ </article>
376
+ </main>
377
+
378
+ <script>
379
+ /* === Anti-copy / anti-extraction defense ===
380
+ Browser-side defenses are deterrents; they cannot defeat a determined attacker.
381
+ Combined with server-side rights notice, this discourages casual copying. */
382
+ (function () {
383
+ var doc = document;
384
+
385
+ // Block context menu
386
+ doc.addEventListener('contextmenu', function (e) { e.preventDefault(); return false; }, { capture: true });
387
+
388
+ // Block copy / cut / paste / select-all
389
+ ['copy', 'cut', 'paste'].forEach(function (evt) {
390
+ doc.addEventListener(evt, function (e) {
391
+ e.preventDefault();
392
+ if (e.clipboardData) {
393
+ try { e.clipboardData.setData('text/plain', '© Web Agent Bridge — copying this whitepaper is not permitted. See https://webagentbridge.com/whitepaper'); } catch (_) {}
394
+ }
395
+ return false;
396
+ }, { capture: true });
397
+ });
398
+
399
+ // Block drag and selection
400
+ doc.addEventListener('dragstart', function (e) { e.preventDefault(); return false; }, { capture: true });
401
+ doc.addEventListener('selectstart', function (e) { e.preventDefault(); return false; }, { capture: true });
402
+
403
+ // Block common keyboard shortcuts: Ctrl+C/X/A/S/P/U, F12, Ctrl+Shift+I/J/C, Cmd equivalents
404
+ doc.addEventListener('keydown', function (e) {
405
+ var k = (e.key || '').toLowerCase();
406
+ var meta = e.ctrlKey || e.metaKey;
407
+ if (e.key === 'F12') { e.preventDefault(); return false; }
408
+ if (meta && e.shiftKey && (k === 'i' || k === 'j' || k === 'c')) { e.preventDefault(); return false; }
409
+ if (meta && (k === 'c' || k === 'x' || k === 'a' || k === 's' || k === 'p' || k === 'u')) {
410
+ e.preventDefault();
411
+ return false;
412
+ }
413
+ }, { capture: true });
414
+
415
+ // Detect and discourage devtools (best effort — shows a notice; cannot truly block)
416
+ var devtoolsOpen = false;
417
+ var threshold = 160;
418
+ setInterval(function () {
419
+ var widthDelta = window.outerWidth - window.innerWidth;
420
+ var heightDelta = window.outerHeight - window.innerHeight;
421
+ if (widthDelta > threshold || heightDelta > threshold) {
422
+ if (!devtoolsOpen) {
423
+ devtoolsOpen = true;
424
+ console.clear && console.clear();
425
+ console.log('%c⚠ Web Agent Bridge — Read-Only Whitepaper',
426
+ 'color:#f97316;font-size:18px;font-weight:bold;');
427
+ console.log('%cThis document is © 2026 Web Agent Bridge. Reproduction prohibited.\nSee https://webagentbridge.com/whitepaper for the canonical version.',
428
+ 'color:#cdd6e3;font-size:12px;');
429
+ }
430
+ } else {
431
+ devtoolsOpen = false;
432
+ }
433
+ }, 1000);
434
+
435
+ // Block iframe embedding (frame-busting)
436
+ try {
437
+ if (window.top !== window.self) {
438
+ window.top.location = window.self.location;
439
+ }
440
+ } catch (_) {
441
+ document.body.innerHTML = '<p style="padding:40px;text-align:center;color:#fff;background:#0b1020;">This whitepaper cannot be embedded. Visit <a style="color:#4ea3ff" href="https://webagentbridge.com/whitepaper">webagentbridge.com/whitepaper</a>.</p>';
442
+ }
443
+
444
+ // Sign-of-life log
445
+ console.log('%cWAB Whitepaper v1.3.0 — Read-Only', 'color:#4ea3ff;font-weight:bold;');
446
+ })();
447
+ </script>
448
+ </body>
449
+ </html>