web-agent-bridge 3.4.0 → 3.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (310) hide show
  1. package/LICENSE +84 -84
  2. package/README.ar.md +1563 -1304
  3. package/README.md +137 -298
  4. package/bin/agent-runner.js +474 -474
  5. package/bin/cli.js +237 -237
  6. package/bin/wab-init.js +244 -223
  7. package/bin/wab.js +80 -80
  8. package/examples/azure-dns-wab.js +83 -83
  9. package/examples/bidi-agent.js +119 -119
  10. package/examples/cloudflare-wab-dns.js +121 -121
  11. package/examples/cpanel-wab-dns.js +114 -114
  12. package/examples/cross-site-agent.js +91 -91
  13. package/examples/dns-discovery-agent.js +166 -166
  14. package/examples/gcp-dns-wab.js +76 -76
  15. package/examples/governance-agent.js +169 -169
  16. package/examples/mcp-agent.js +94 -94
  17. package/examples/next-app-router/README.md +44 -44
  18. package/examples/plesk-wab-dns.js +103 -103
  19. package/examples/puppeteer-agent.js +108 -108
  20. package/examples/route53-wab-dns.js +144 -144
  21. package/examples/saas-dashboard/README.md +55 -55
  22. package/examples/safe-mode-agent.js +96 -96
  23. package/examples/self-discovery.js +106 -0
  24. package/examples/shopify-hydrogen/README.md +74 -74
  25. package/examples/vision-agent.js +171 -171
  26. package/examples/wab-sign.js +74 -74
  27. package/examples/wab-verify.js +60 -60
  28. package/examples/wordpress-elementor/README.md +77 -77
  29. package/package.json +93 -93
  30. package/public/.well-known/agent-tools.json +180 -180
  31. package/public/.well-known/ai-assets.json +59 -59
  32. package/public/.well-known/security.txt +8 -8
  33. package/public/.well-known/wab.json +28 -28
  34. package/public/activate.html +448 -368
  35. package/public/adopt.html +236 -0
  36. package/public/adoption-metrics.html +188 -188
  37. package/public/agent-workspace.html +359 -349
  38. package/public/ai.html +198 -198
  39. package/public/api.html +397 -413
  40. package/public/azure-dns-integration.html +289 -289
  41. package/public/browser.html +486 -486
  42. package/public/cloudflare-integration.html +380 -380
  43. package/public/commander-dashboard.html +243 -243
  44. package/public/cookies.html +210 -210
  45. package/public/cpanel-integration.html +398 -398
  46. package/public/css/agent-workspace.css +1713 -1713
  47. package/public/css/premium.css +317 -317
  48. package/public/css/styles.css +1401 -1263
  49. package/public/dashboard-shieldlink.html +295 -0
  50. package/public/dashboard.html +711 -707
  51. package/public/dns.html +436 -436
  52. package/public/docs.html +588 -588
  53. package/public/enterprise-mesh.ar.html +80 -0
  54. package/public/enterprise-mesh.html +81 -0
  55. package/public/feed.xml +89 -89
  56. package/public/gcp-dns-integration.html +318 -318
  57. package/public/governance.ar.html +70 -0
  58. package/public/governance.html +69 -0
  59. package/public/growth.html +465 -465
  60. package/public/index.html +1372 -1266
  61. package/public/integrations.html +556 -556
  62. package/public/js/activate.js +449 -145
  63. package/public/js/agent-workspace.js +1740 -1740
  64. package/public/js/auth-nav.js +117 -65
  65. package/public/js/auth-redirect.js +12 -12
  66. package/public/js/cookie-consent.js +56 -56
  67. package/public/js/dns.js +438 -438
  68. package/public/js/wab-demo-page.js +721 -721
  69. package/public/js/ws-client.js +74 -74
  70. package/public/l-preview.html +242 -0
  71. package/public/llms-full.txt +360 -360
  72. package/public/llms.txt +125 -125
  73. package/public/login.html +85 -85
  74. package/public/mesh-dashboard.html +328 -328
  75. package/public/milestones.html +346 -0
  76. package/public/one-click.html +779 -0
  77. package/public/openapi.json +669 -669
  78. package/public/partners.ar.html +145 -0
  79. package/public/partners.html +143 -0
  80. package/public/phone-shield.html +281 -281
  81. package/public/plesk-integration.html +375 -375
  82. package/public/premium-dashboard.html +2489 -2489
  83. package/public/premium.html +793 -793
  84. package/public/privacy.html +297 -297
  85. package/public/provider-onboarding.html +172 -172
  86. package/public/provider-sandbox.html +134 -134
  87. package/public/providers.html +359 -359
  88. package/public/refusals.html +172 -0
  89. package/public/register.html +105 -105
  90. package/public/registrar-integrations.html +141 -141
  91. package/public/ring4.html +292 -0
  92. package/public/robots.txt +99 -99
  93. package/public/route53-integration.html +531 -531
  94. package/public/score.html +263 -0
  95. package/public/script/wab-consent.d.ts +36 -36
  96. package/public/script/wab-consent.js +104 -104
  97. package/public/script/wab-schema.js +131 -131
  98. package/public/script/wab.d.ts +108 -108
  99. package/public/script/wab.min.js +580 -580
  100. package/public/security.txt +8 -8
  101. package/public/shieldlink.html +244 -0
  102. package/public/shieldqr.html +231 -231
  103. package/public/sitemap.xml +13 -1
  104. package/public/terms.html +256 -256
  105. package/public/trust-graph-api.ar.html +92 -0
  106. package/public/trust-graph-api.html +91 -0
  107. package/public/wab-features.html +560 -0
  108. package/public/wab-trust.html +200 -200
  109. package/public/wab-truth.html +375 -0
  110. package/public/wab-vs-protocols.html +210 -210
  111. package/public/whitepaper.html +449 -449
  112. package/script/ai-agent-bridge.js +1754 -1754
  113. package/sdk/README.md +99 -99
  114. package/sdk/agent-mesh.js +449 -449
  115. package/sdk/auto-discovery.js +301 -288
  116. package/sdk/commander.js +262 -262
  117. package/sdk/governance.js +262 -262
  118. package/sdk/index.d.ts +464 -464
  119. package/sdk/index.js +649 -649
  120. package/sdk/multi-agent.js +318 -318
  121. package/sdk/safe-mode.js +221 -221
  122. package/sdk/safety-shield.js +219 -219
  123. package/sdk/schema-discovery.js +83 -83
  124. package/server/adapters/index.js +520 -520
  125. package/server/config/plans.js +412 -367
  126. package/server/config/secrets.js +102 -102
  127. package/server/control-plane/index.js +301 -301
  128. package/server/data-plane/index.js +354 -354
  129. package/server/index.js +790 -670
  130. package/server/llm/index.js +404 -404
  131. package/server/middleware/adminAuth.js +35 -35
  132. package/server/middleware/api-tier.js +170 -0
  133. package/server/middleware/auth.js +50 -50
  134. package/server/middleware/featureGate.js +88 -88
  135. package/server/middleware/rateLimits.js +100 -100
  136. package/server/middleware/sensitiveAction.js +157 -157
  137. package/server/middleware/wab-trust.js +141 -0
  138. package/server/migrations/001_add_analytics_indexes.sql +7 -7
  139. package/server/migrations/002_premium_features.sql +418 -418
  140. package/server/migrations/003_ads_integer_cents.sql +33 -33
  141. package/server/migrations/004_agent_os.sql +158 -158
  142. package/server/migrations/005_marketplace_metering.sql +126 -126
  143. package/server/migrations/006_growth_suite.sql +138 -0
  144. package/server/migrations/007_governance.sql +106 -106
  145. package/server/migrations/008_plans.sql +144 -144
  146. package/server/migrations/009_shieldqr.sql +30 -30
  147. package/server/migrations/010_extended_trust.sql +33 -33
  148. package/server/migrations/011_outreach.sql +47 -0
  149. package/server/migrations/012_shieldlink.sql +116 -0
  150. package/server/migrations/013_ct_monitor.sql +13 -0
  151. package/server/migrations/014_wab_advanced_features.sql +128 -0
  152. package/server/migrations/015_wab_truth_layer.sql +101 -0
  153. package/server/migrations/016_ring4_external_trust.sql +84 -0
  154. package/server/migrations/017_ring4_extensions.sql +69 -0
  155. package/server/migrations/018_commercial_foundations.sql +167 -0
  156. package/server/migrations/019_unify_tier_constraints.sql +133 -0
  157. package/server/models/adapters/index.js +33 -33
  158. package/server/models/adapters/mysql.js +183 -183
  159. package/server/models/adapters/postgresql.js +172 -172
  160. package/server/models/adapters/sqlite.js +7 -7
  161. package/server/models/db.js +740 -740
  162. package/server/observability/failure-analysis.js +337 -337
  163. package/server/observability/index.js +394 -394
  164. package/server/protocol/capabilities.js +223 -223
  165. package/server/protocol/index.js +243 -243
  166. package/server/protocol/schema.js +584 -584
  167. package/server/registry/certification.js +271 -271
  168. package/server/registry/index.js +326 -326
  169. package/server/routes/activate.js +478 -0
  170. package/server/routes/admin-outreach.js +239 -0
  171. package/server/routes/admin-plans.js +76 -76
  172. package/server/routes/admin-premium.js +674 -673
  173. package/server/routes/admin-shieldlink.js +137 -0
  174. package/server/routes/admin-shieldqr.js +90 -90
  175. package/server/routes/admin-trust-monitor.js +139 -83
  176. package/server/routes/admin.js +550 -549
  177. package/server/routes/adopt.js +61 -0
  178. package/server/routes/ads.js +130 -130
  179. package/server/routes/agent-workspace.js +540 -540
  180. package/server/routes/api-keys.js +127 -0
  181. package/server/routes/api.js +150 -150
  182. package/server/routes/auth.js +71 -71
  183. package/server/routes/billing.js +57 -57
  184. package/server/routes/commander.js +316 -316
  185. package/server/routes/customer-shieldlink.js +133 -0
  186. package/server/routes/demo-showcase.js +332 -332
  187. package/server/routes/demo-store.js +154 -154
  188. package/server/routes/diagnose.js +373 -0
  189. package/server/routes/discovery.js +2348 -2348
  190. package/server/routes/enterprise-mesh.js +170 -0
  191. package/server/routes/gateway.js +173 -173
  192. package/server/routes/governance-saas.js +203 -0
  193. package/server/routes/governance.js +208 -208
  194. package/server/routes/growth.js +1048 -0
  195. package/server/routes/intent.js +328 -0
  196. package/server/routes/license.js +251 -251
  197. package/server/routes/mesh.js +469 -469
  198. package/server/routes/noscript.js +543 -543
  199. package/server/routes/partners.js +201 -0
  200. package/server/routes/plans.js +33 -33
  201. package/server/routes/premium-v2.js +686 -686
  202. package/server/routes/premium.js +724 -724
  203. package/server/routes/providers.js +650 -650
  204. package/server/routes/reputation.js +411 -0
  205. package/server/routes/ring4.js +885 -0
  206. package/server/routes/runtime.js +2148 -2148
  207. package/server/routes/shieldlink.js +70 -0
  208. package/server/routes/shieldqr.js +88 -88
  209. package/server/routes/sovereign.js +465 -465
  210. package/server/routes/truth-layer.js +670 -0
  211. package/server/routes/universal.js +200 -200
  212. package/server/routes/unsubscribe.js +51 -0
  213. package/server/routes/wab-api.js +850 -850
  214. package/server/routes/wab-cache.js +282 -0
  215. package/server/runtime/container-worker.js +111 -111
  216. package/server/runtime/container.js +448 -448
  217. package/server/runtime/distributed-worker.js +362 -362
  218. package/server/runtime/event-bus.js +210 -210
  219. package/server/runtime/index.js +253 -253
  220. package/server/runtime/queue.js +599 -599
  221. package/server/runtime/replay.js +666 -666
  222. package/server/runtime/sandbox.js +266 -266
  223. package/server/runtime/scheduler.js +534 -534
  224. package/server/runtime/session-engine.js +293 -293
  225. package/server/runtime/state-manager.js +188 -188
  226. package/server/secrets/wab-signing-key.pem +3 -0
  227. package/server/secrets/wab-signing-pub.pem +3 -0
  228. package/server/security/cross-site-redactor.js +196 -196
  229. package/server/security/dry-run.js +180 -180
  230. package/server/security/human-gate-rate-limit.js +147 -147
  231. package/server/security/human-gate-transports.js +178 -178
  232. package/server/security/human-gate.js +281 -281
  233. package/server/security/index.js +368 -368
  234. package/server/security/intent-engine.js +245 -245
  235. package/server/security/reward-guard.js +171 -171
  236. package/server/security/rollback-store.js +239 -239
  237. package/server/security/token-scope.js +404 -404
  238. package/server/security/url-policy.js +139 -139
  239. package/server/services/adoption-agent.js +182 -0
  240. package/server/services/agent-chat.js +506 -506
  241. package/server/services/agent-learning.js +601 -601
  242. package/server/services/agent-memory.js +625 -625
  243. package/server/services/agent-mesh.js +555 -555
  244. package/server/services/agent-symphony.js +717 -717
  245. package/server/services/agent-tasks.js +1807 -1807
  246. package/server/services/api-key-engine.js +292 -292
  247. package/server/services/cluster.js +894 -894
  248. package/server/services/commander.js +738 -738
  249. package/server/services/edge-compute.js +440 -440
  250. package/server/services/email.js +233 -233
  251. package/server/services/fairness-engine.js +409 -0
  252. package/server/services/fairness.js +420 -0
  253. package/server/services/governance.js +466 -466
  254. package/server/services/hosted-runtime.js +205 -205
  255. package/server/services/lfd.js +635 -635
  256. package/server/services/local-ai.js +389 -389
  257. package/server/services/marketplace.js +270 -270
  258. package/server/services/metering.js +182 -182
  259. package/server/services/modules/affiliate-intelligence.js +93 -93
  260. package/server/services/modules/agent-firewall.js +90 -90
  261. package/server/services/modules/bounty.js +89 -89
  262. package/server/services/modules/collective-bargaining.js +92 -92
  263. package/server/services/modules/dark-pattern.js +66 -66
  264. package/server/services/modules/gov-intelligence.js +45 -45
  265. package/server/services/modules/neural.js +55 -55
  266. package/server/services/modules/notary.js +49 -49
  267. package/server/services/modules/price-time-machine.js +86 -86
  268. package/server/services/modules/protocol.js +104 -104
  269. package/server/services/negotiation.js +439 -439
  270. package/server/services/outreach-agent.js +312 -0
  271. package/server/services/plans.js +214 -214
  272. package/server/services/plugins.js +771 -771
  273. package/server/services/price-intelligence.js +566 -566
  274. package/server/services/price-shield.js +1137 -1137
  275. package/server/services/provider-clients.js +740 -740
  276. package/server/services/reputation.js +465 -465
  277. package/server/services/search-engine.js +357 -357
  278. package/server/services/security.js +513 -513
  279. package/server/services/self-healing.js +843 -843
  280. package/server/services/shieldlink.js +492 -0
  281. package/server/services/shieldqr.js +322 -322
  282. package/server/services/sovereign-shield.js +542 -542
  283. package/server/services/ssl-ct-monitor.js +224 -0
  284. package/server/services/ssl-inspector.js +42 -42
  285. package/server/services/ssl-monitor.js +167 -167
  286. package/server/services/stripe.js +206 -205
  287. package/server/services/swarm.js +788 -788
  288. package/server/services/universal-scraper.js +662 -662
  289. package/server/services/verification.js +481 -481
  290. package/server/services/vision.js +1163 -1163
  291. package/server/services/wab-crypto.js +178 -178
  292. package/server/utils/cache.js +125 -125
  293. package/server/utils/migrate.js +81 -81
  294. package/server/utils/safe-fetch.js +228 -228
  295. package/server/utils/secureFields.js +50 -50
  296. package/server/ws.js +161 -161
  297. package/templates/artisan-marketplace.yaml +104 -104
  298. package/templates/book-price-scout.yaml +98 -98
  299. package/templates/electronics-price-tracker.yaml +108 -108
  300. package/templates/flight-deal-hunter.yaml +113 -113
  301. package/templates/freelancer-direct.yaml +116 -116
  302. package/templates/grocery-price-compare.yaml +93 -93
  303. package/templates/hotel-direct-booking.yaml +113 -113
  304. package/templates/local-services.yaml +98 -98
  305. package/templates/olive-oil-tunisia.yaml +88 -88
  306. package/templates/organic-farm-fresh.yaml +101 -101
  307. package/templates/restaurant-direct.yaml +97 -97
  308. package/templates/ring4/banking-sovereign.yaml +55 -0
  309. package/templates/ring4/ecommerce-sovereign.yaml +58 -0
  310. package/templates/ring4/healthcare-sovereign.yaml +60 -0
package/public/whitepaper.html CHANGED
@@ -1,449 +1,449 @@
1
- <!DOCTYPE html>
2
- <html lang="en" dir="ltr">
3
- <head>
4
- <meta charset="UTF-8" />
5
- <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
- <title>WAB DNS Discovery Whitepaper — Web Agent Bridge</title>
7
- <meta name="description" content="Web Agent Bridge (WAB) DNS Discovery Protocol — A Zero-Probe, Cryptographically Verified Infrastructure Layer for AI Agents. Whitepaper v1.3.0." />
8
- <meta name="robots" content="index, follow, noarchive, nosnippet, noimageindex" />
9
- <link rel="canonical" href="https://webagentbridge.com/whitepaper" />
10
- <meta property="og:title" content="WAB DNS Discovery Whitepaper" />
11
- <meta property="og:description" content="Zero-probe, cryptographically verified discovery protocol for AI agents." />
12
- <meta property="og:url" content="https://webagentbridge.com/whitepaper" />
13
- <meta property="og:type" content="article" />
14
-
15
- <!-- Anti-embedding / clickjacking defense -->
16
- <meta http-equiv="X-Content-Type-Options" content="nosniff" />
17
- <meta http-equiv="Referrer-Policy" content="strict-origin-when-cross-origin" />
18
- <meta name="copyright" content="© 2026 Web Agent Bridge — All Rights Reserved" />
19
- <meta name="rights" content="All Rights Reserved. Reproduction prohibited without written consent." />
20
-
21
- <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
22
- <style>
23
- /* === RESET / BASE === */
24
- *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
25
- html, body {
26
- background: #0b1020;
27
- color: #e7ecf5;
28
- font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
29
- line-height: 1.7;
30
- min-height: 100vh;
31
- overflow-x: hidden;
32
- }
33
-
34
- /* === ANTI-COPY DEFENSE LAYER === */
35
- /* Disable text selection across the document (best-effort browser deterrent) */
36
- .wp-protect, .wp-protect * {
37
- -webkit-user-select: none !important;
38
- -moz-user-select: none !important;
39
- -ms-user-select: none !important;
40
- user-select: none !important;
41
- -webkit-touch-callout: none !important;
42
- -webkit-tap-highlight-color: transparent;
43
- }
44
- /* Block image dragging */
45
- .wp-protect img { -webkit-user-drag: none; user-drag: none; pointer-events: none; }
46
-
47
- /* === LAYOUT === */
48
- .topbar {
49
- position: sticky; top: 0; z-index: 50;
50
- background: rgba(11, 16, 32, 0.92);
51
- backdrop-filter: blur(10px);
52
- border-bottom: 1px solid rgba(255,255,255,0.08);
53
- padding: 14px 24px;
54
- display: flex; align-items: center; justify-content: space-between;
55
- }
56
- .topbar a.brand { color: #4ea3ff; text-decoration: none; font-weight: 600; font-size: 1rem; }
57
- .topbar .meta { font-size: 0.8rem; color: #8b96ad; }
58
- .topbar .badge {
59
- display: inline-block;
60
- background: linear-gradient(135deg, #f97316, #ef4444);
61
- color: white;
62
- padding: 3px 10px;
63
- border-radius: 999px;
64
- font-size: 0.72rem;
65
- font-weight: 600;
66
- letter-spacing: 0.5px;
67
- margin-left: 8px;
68
- vertical-align: middle;
69
- }
70
-
71
- .container {
72
- max-width: 820px;
73
- margin: 0 auto;
74
- padding: 48px 28px 96px;
75
- position: relative;
76
- }
77
-
78
- /* === DIAGONAL WATERMARK === */
79
- .watermark {
80
- position: fixed;
81
- top: 0; left: 0; right: 0; bottom: 0;
82
- pointer-events: none;
83
- z-index: 1;
84
- opacity: 0.06;
85
- background-image:
86
- repeating-linear-gradient(
87
- -45deg,
88
- transparent 0,
89
- transparent 180px,
90
- rgba(78, 163, 255, 0.0) 180px,
91
- rgba(78, 163, 255, 0.0) 200px
92
- );
93
- overflow: hidden;
94
- }
95
- .watermark::before {
96
- content: "WEBAGENTBRIDGE.COM • © 2026 • CONFIDENTIAL READ-ONLY • WEBAGENTBRIDGE.COM • © 2026 • CONFIDENTIAL READ-ONLY • WEBAGENTBRIDGE.COM • © 2026";
97
- position: absolute;
98
- top: -50%; left: -50%; right: -50%; bottom: -50%;
99
- transform: rotate(-30deg);
100
- font-size: 28px;
101
- font-weight: 700;
102
- color: #4ea3ff;
103
- white-space: pre-wrap;
104
- word-spacing: 18px;
105
- line-height: 220px;
106
- letter-spacing: 4px;
107
- text-align: center;
108
- opacity: 0.65;
109
- }
110
-
111
- /* === CONTENT === */
112
- .doc { position: relative; z-index: 2; }
113
- h1 {
114
- font-size: 2.1rem;
115
- line-height: 1.3;
116
- margin-bottom: 8px;
117
- background: linear-gradient(135deg, #4ea3ff, #8b5cf6);
118
- -webkit-background-clip: text;
119
- background-clip: text;
120
- -webkit-text-fill-color: transparent;
121
- letter-spacing: -0.5px;
122
- }
123
- h2 {
124
- font-size: 1.5rem;
125
- margin: 36px 0 14px;
126
- color: #ffffff;
127
- border-left: 3px solid #4ea3ff;
128
- padding-left: 12px;
129
- }
130
- h3 {
131
- font-size: 1.15rem;
132
- margin: 26px 0 10px;
133
- color: #cdd6e3;
134
- }
135
- p { margin: 0 0 14px; color: #cdd6e3; }
136
- ul, ol { margin: 0 0 16px 22px; color: #cdd6e3; }
137
- li { margin-bottom: 6px; }
138
- code, pre {
139
- font-family: "JetBrains Mono", "SF Mono", Menlo, Consolas, monospace;
140
- font-size: 0.88rem;
141
- }
142
- code {
143
- background: rgba(78, 163, 255, 0.12);
144
- color: #b8d4ff;
145
- padding: 2px 6px;
146
- border-radius: 4px;
147
- }
148
- pre {
149
- background: #060914;
150
- border: 1px solid rgba(255,255,255,0.08);
151
- border-radius: 8px;
152
- padding: 16px 18px;
153
- overflow-x: auto;
154
- margin: 12px 0 18px;
155
- }
156
- pre code { background: transparent; padding: 0; color: #b8d4ff; }
157
- blockquote {
158
- border-left: 3px solid #f97316;
159
- background: rgba(249, 115, 22, 0.08);
160
- padding: 14px 18px;
161
- margin: 18px 0;
162
- border-radius: 0 6px 6px 0;
163
- font-size: 0.95rem;
164
- }
165
- table {
166
- width: 100%; border-collapse: collapse;
167
- margin: 14px 0;
168
- background: rgba(255,255,255,0.02);
169
- border-radius: 6px;
170
- overflow: hidden;
171
- }
172
- th, td {
173
- padding: 10px 14px;
174
- text-align: left;
175
- border-bottom: 1px solid rgba(255,255,255,0.06);
176
- font-size: 0.92rem;
177
- }
178
- th { background: rgba(78,163,255,0.08); color: #ffffff; font-weight: 600; }
179
- hr {
180
- border: none;
181
- height: 1px;
182
- background: linear-gradient(90deg, transparent, rgba(255,255,255,0.15), transparent);
183
- margin: 32px 0;
184
- }
185
- .lead-card {
186
- background: linear-gradient(135deg, rgba(78,163,255,0.08), rgba(139,92,246,0.06));
187
- border: 1px solid rgba(78,163,255,0.2);
188
- border-radius: 12px;
189
- padding: 22px 26px;
190
- margin: 24px 0;
191
- }
192
- .lead-card .meta-grid {
193
- display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
194
- gap: 12px;
195
- margin-top: 12px;
196
- font-size: 0.86rem;
197
- }
198
- .lead-card .meta-grid div { color: #8b96ad; }
199
- .lead-card .meta-grid b { color: #ffffff; }
200
- .footnote {
201
- margin-top: 48px;
202
- padding-top: 24px;
203
- border-top: 1px solid rgba(255,255,255,0.08);
204
- font-size: 0.82rem;
205
- color: #8b96ad;
206
- text-align: center;
207
- }
208
- .footnote a { color: #4ea3ff; text-decoration: none; }
209
-
210
- /* Print suppression */
211
- @media print {
212
- html, body { display: none !important; visibility: hidden !important; }
213
- body::after {
214
- content: "Printing of this document is not authorized. Visit https://webagentbridge.com/whitepaper to view.";
215
- display: block !important;
216
- visibility: visible !important;
217
- position: fixed; top: 50%; left: 50%; transform: translate(-50%, -50%);
218
- font-size: 18px; color: #000;
219
- }
220
- }
221
- </style>
222
- </head>
223
- <body class="wp-protect" oncontextmenu="return false;" oncopy="return false;" oncut="return false;" onpaste="return false;" ondragstart="return false;" onselectstart="return false;">
224
-
225
- <div class="watermark" aria-hidden="true"></div>
226
-
227
- <header class="topbar">
228
- <a href="/" class="brand">← Web Agent Bridge</a>
229
- <div class="meta">
230
- Whitepaper v1.3.0 <span class="badge">READ-ONLY</span>
231
- </div>
232
- </header>
233
-
234
- <main class="container">
235
- <article class="doc" id="whitepaper">
236
-
237
- <h1>Web Agent Bridge (WAB) DNS Discovery Protocol</h1>
238
- <p style="font-size: 1.1rem; color: #cdd6e3; margin-top: 6px;">
239
- A Zero-Probe, Cryptographically Verified Infrastructure Layer for AI Agents
240
- </p>
241
-
242
- <div class="lead-card">
243
- <div><b>© 2026 Web Agent Bridge.</b> All Rights Reserved.</div>
244
- <p style="margin: 8px 0 0; font-size: 0.9rem;">
245
- This whitepaper is the intellectual property of the Web Agent Bridge project.
246
- Reproduction, redistribution, or modification — in whole or in part — is <b>prohibited</b>
247
- without prior written permission. The canonical, authoritative version is published at
248
- <code>webagentbridge.com/whitepaper</code>.
249
- </p>
250
- <div class="meta-grid">
251
- <div><b>Version</b><br>1.3.0</div>
252
- <div><b>Status</b><br>Published</div>
253
- <div><b>Date</b><br>May 2026</div>
254
- <div><b>License</b><br>All Rights Reserved</div>
255
- </div>
256
- </div>
257
-
258
- <h2>Abstract</h2>
259
- <p>As artificial intelligence agents transition from isolated chatbots to autonomous web navigators, the absence of a standardized, machine-readable discovery mechanism creates significant friction. Agents currently rely on heuristic DOM scraping, trial-and-error HTTP probing, and reverse-engineered APIs, leading to excessive server load, brittle integrations, and privacy risks. This paper introduces the <b>Web Agent Bridge (WAB) DNS Discovery Protocol</b>, a lightweight, infrastructure-first mechanism that allows AI agents to instantly discover a domain's AI capabilities and cryptographic trust attestations without prior HTTP interaction. Modeled after email authentication standards like SPF, DKIM, and DMARC, the WAB DNS Discovery Protocol utilizes DNS TXT records resolved over DNS over HTTPS (DoH) to advertise protocol support and endpoint locations. Furthermore, we detail the <b>WAB Cryptographic Trust Layer (v1.3)</b>, which employs Ed25519 signatures to ensure the integrity and authenticity of the discovery document, mitigating man-in-the-middle attacks and establishing a robust foundation for autonomous agent-web interactions.</p>
260
-
261
- <h2>1. Introduction</h2>
262
- <p>The proliferation of Large Language Models (LLMs) and autonomous AI agents has fundamentally altered how digital information is accessed and processed. Unlike human users who rely on visual interfaces and HTML/CSS rendering, AI agents require structured, deterministic access to web capabilities. However, the current web architecture lacks a native discovery layer for machine-to-machine interactions.</p>
263
- <p>Currently, agents attempting to interact with a website face a "blind fetch" problem. They must either parse complex HTML structures, guess API endpoints, or probe for well-known files (e.g., <code>/.well-known/ai-plugin.json</code>), often resulting in HTTP 404 errors, increased latency, and unnecessary server overhead. Furthermore, the rise of "cookie-wall taxes" and aggressive bot mitigation strategies disproportionately penalize legitimate, beneficial AI traffic.</p>
264
- <p>To address these challenges, we propose the <b>Web Agent Bridge (WAB) DNS Discovery Protocol</b>. By shifting the discovery phase to the Domain Name System (DNS) infrastructure, WAB enables <b>zero-probe discovery</b>. Agents can resolve a single DNS record to ascertain AI readiness, locate the capabilities document (<code>wab.json</code>), and verify the cryptographic signature of the provider, all before initiating an HTTP connection.</p>
265
-
266
- <h2>2. The WAB DNS Discovery Protocol (DDP)</h2>
267
- <p>The DNS Discovery Protocol (DDP) is an infrastructure-layer mechanism that allows domains to advertise their WAB endpoint and trust parameters. It is designed to be highly cacheable, universally supported, and easily verifiable.</p>
268
-
269
- <h3>2.1 Protocol Mechanics</h3>
270
- <p>The core of the DDP is a DNS TXT record placed at the <code>_wab</code> subdomain of the apex domain (e.g., <code>_wab.example.com</code>). This approach mirrors established email authentication protocols such as the Sender Policy Framework (SPF) [1] and DomainKeys Identified Mail (DKIM) [2].</p>
271
- <p>When an AI agent intends to interact with a domain, it MUST first query the <code>_wab.{apex}</code> TXT record. If the DNS query returns <code>NXDOMAIN</code>, the agent concludes that the domain does not explicitly support the WAB protocol and falls back to traditional, heuristic methods. If the record exists, the agent parses the key-value pairs to locate the discovery document.</p>
272
-
273
- <h3>2.2 Record Format and Syntax</h3>
274
- <p>The WAB TXT record utilizes a semicolon-separated key-value format. The primary fields are defined as follows:</p>
275
- <table>
276
- <thead>
277
- <tr><th>Field</th><th>Value Type</th><th>Requirement</th><th>Description</th></tr>
278
- </thead>
279
- <tbody>
280
- <tr><td><code>v</code></td><td>string</td><td>REQUIRED</td><td>Protocol version identifier. Current standard is <code>wab1</code>.</td></tr>
281
- <tr><td><code>endpoint</code></td><td>URL</td><td>REQUIRED</td><td>The absolute HTTPS URL of the <code>wab.json</code> discovery document.</td></tr>
282
- <tr><td><code>pk</code></td><td>string</td><td>OPTIONAL</td><td>The public key for cryptographic verification, prefixed with the algorithm (e.g., <code>ed25519:&lt;base64&gt;</code>).</td></tr>
283
- </tbody>
284
- </table>
285
- <p><b>Example TXT Record:</b></p>
286
- <pre><code>_wab.example.com. 3600 IN TXT "v=wab1; endpoint=https://example.com/.well-known/wab.json; pk=ed25519:PkQ7aq1E3jvMI2oL0rvYtTgOplWd+USw26Y/D4JzPxo="</code></pre>
287
-
288
- <h3>2.3 DNS over HTTPS (DoH) Requirement</h3>
289
- <p>To prevent ISP-level interception, manipulation, and tracking of discovery queries, WAB-aware agents SHOULD resolve the <code>_wab</code> records using DNS over HTTPS (DoH) [3]. DoH encrypts the DNS query, shifting the trust boundary from the local network to a trusted DoH resolver (e.g., Cloudflare 1.1.1.1 or Google 8.8.8.8).</p>
290
-
291
- <h2>3. The Discovery Document (<code>wab.json</code>)</h2>
292
- <p>The discovery document, typically hosted at <code>/.well-known/wab.json</code>, is a structured JSON file that defines the domain's capabilities, permitted actions, and transport mechanisms.</p>
293
-
294
- <h3>3.1 Schema Overview (v1.3)</h3>
295
- <p>The <code>wab.json</code> schema is designed for extensibility and strict typing. Key components include:</p>
296
- <ul>
297
- <li><code>wab_version</code> — Specifies the schema version (e.g., <code>"1.3.0"</code>).</li>
298
- <li><code>provider</code> — Metadata regarding the domain owner, including name, category, and URL.</li>
299
- <li><code>capabilities</code> — Defines the permitted actions (<code>commands</code>) and granular access rights (<code>permissions</code>).</li>
300
- <li><code>endpoints</code> — Specifies the API endpoints for agent interaction (e.g., <code>/api/wab/discover</code>, <code>/api/wab/ping</code>).</li>
301
- <li><code>signature</code> — The cryptographic signature block (detailed in Section 4).</li>
302
- </ul>
303
-
304
- <h3>3.2 Action Definitions</h3>
305
- <p>Actions (or commands) are explicitly defined within the <code>capabilities.commands</code> array. This eliminates the need for agents to infer functionality. Each command specifies its trigger mechanism (e.g., <code>api</code>, <code>navigate</code>), required parameters, and authentication prerequisites, providing a deterministic execution path.</p>
306
-
307
- <h2>4. Cryptographic Trust Layer (v1.3)</h2>
308
- <p>While DNS discovery provides routing, it does not inherently guarantee the integrity of the fetched <code>wab.json</code> document, especially if the HTTPS connection is compromised or misconfigured. To establish a robust chain of trust, WAB v1.3 introduces a <b>Cryptographic Trust Layer</b> based on Ed25519 signatures.</p>
309
-
310
- <h3>4.1 Ed25519 Signatures</h3>
311
- <p>Ed25519 [4] is a public-key signature system utilizing the Edwards-curve Digital Signature Algorithm (EdDSA). It was selected for WAB due to its high performance, small key size (32 bytes), and resilience against side-channel attacks.</p>
312
-
313
- <h3>4.2 Signature Generation and Verification</h3>
314
- <p>The trust layer operates through a deterministic canonicalization and signing process:</p>
315
- <ol>
316
- <li><b>Key Generation</b> — The domain owner generates an Ed25519 keypair. The private key is securely stored offline or within a secure enclave.</li>
317
- <li><b>DNS Publication</b> — The public key is published in the <code>_wab</code> DNS TXT record using the <code>pk=</code> parameter (e.g., <code>pk=ed25519:&lt;base64_public_key&gt;</code>).</li>
318
- <li><b>Canonicalization</b> — Before signing, the <code>wab.json</code> document undergoes RFC 8785-style JSON canonicalization [5]. This process sorts object keys lexicographically, removes insignificant whitespace, and excludes the top-level <code>signature</code> field to ensure a consistent byte representation.</li>
319
- <li><b>Signing</b> — The canonicalized JSON string is signed using the Ed25519 private key.</li>
320
- <li><b>Manifest Embedding</b> — The resulting signature is embedded back into the <code>wab.json</code> document under the <code>signature</code> object.</li>
321
- </ol>
322
- <p><b>Signature Block Example:</b></p>
323
- <pre><code>"signature": {
324
- "algorithm": "ed25519",
325
- "value": "base64_encoded_signature_string...",
326
- "key_id": "pYu7X5PF/HoE2yDx",
327
- "signed_at": "2026-05-02T10:00:00Z"
328
- }</code></pre>
329
-
330
- <h3>4.3 Agent Verification Flow</h3>
331
- <p>Upon fetching the <code>wab.json</code> document, a WAB-compliant agent performs the following verification steps:</p>
332
- <ol>
333
- <li>Extracts the <code>pk</code> value from the previously resolved <code>_wab</code> DNS TXT record.</li>
334
- <li>Extracts the <code>signature</code> object from the <code>wab.json</code> document.</li>
335
- <li>Verifies that <code>signature.algorithm</code> is <code>ed25519</code>.</li>
336
- <li>Canonicalizes the <code>wab.json</code> document (excluding the <code>signature</code> field).</li>
337
- <li>Verifies the canonicalized string against the <code>signature.value</code> using the extracted public key.</li>
338
- </ol>
339
- <p>If the verification succeeds, the agent possesses cryptographic proof that the capabilities document was authorized by the entity controlling the domain's DNS records, effectively neutralizing unauthorized modifications.</p>
340
-
341
- <h2>5. Implementation and Adoption</h2>
342
- <p>The WAB protocol is designed for frictionless adoption by both site owners and agent developers.</p>
343
-
344
- <h3>5.1 Zero-Code Infrastructure Onboarding</h3>
345
- <p>Site owners can enable WAB discovery without deploying new code. By simply adding the <code>_wab</code> TXT record and hosting a static <code>wab.json</code> file, a domain becomes "Agent-Ready." This infrastructure-first approach lowers the barrier to entry compared to complex API integrations.</p>
346
-
347
- <h3>5.2 The Proof Lab and Live Verification</h3>
348
- <p>To facilitate adoption and ensure compliance, the Web Agent Bridge provides a <b>"Proof Lab."</b> This tool performs a live, end-to-end verification of the integration:</p>
349
- <ol>
350
- <li><b>DNS Resolution</b> — Verifies the presence and syntax of the <code>_wab</code> TXT record via DoH.</li>
351
- <li><b>Document Fetch</b> — Retrieves and parses the <code>wab.json</code> file.</li>
352
- <li><b>Agent Execution</b> — Simulates an agent flow by calling the defined endpoints (e.g., <code>/api/wab/discover</code>, <code>/api/wab/ping</code>) to confirm execution readiness (<code>execution_ok=true</code>).</li>
353
- </ol>
354
-
355
- <h2>6. Conclusion</h2>
356
- <p>The Web Agent Bridge (WAB) DNS Discovery Protocol and its Cryptographic Trust Layer provide a critical missing piece in the architecture of the autonomous web. By leveraging proven DNS infrastructure and Ed25519 cryptography, WAB enables zero-probe, secure, and deterministic discovery of AI capabilities. This protocol reduces server overhead, enhances privacy through DoH, and establishes a verifiable chain of trust, paving the way for scalable and secure machine-to-machine interactions on the internet.</p>
357
-
358
- <h2>References</h2>
359
- <ol>
360
- <li>S. Kitterman, <i>"Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1,"</i> RFC 7208, April 2014.</li>
361
- <li>D. Crocker, T. Hansen, and M. Kucherawy, <i>"DomainKeys Identified Mail (DKIM) Signatures,"</i> RFC 6376, September 2011.</li>
362
- <li>P. Hoffman and P. McManus, <i>"DNS Queries over HTTPS (DoH),"</i> RFC 8484, October 2018.</li>
363
- <li>S. Josefsson and I. Liusvaara, <i>"Edwards-Curve Digital Signature Algorithm (EdDSA),"</i> RFC 8032, January 2017.</li>
364
- <li>A. Rundgren, B. Jordan, and S. Erdtman, <i>"JSON Canonicalization Scheme (JCS),"</i> RFC 8785, June 2020.</li>
365
- </ol>
366
-
367
- <hr />
368
-
369
- <div class="footnote">
370
- <p>This document is read-only reference material.<br>
371
- The canonical version lives at <a href="https://webagentbridge.com/whitepaper">webagentbridge.com/whitepaper</a>.<br>
372
- <b>All rights reserved © 2026 Web Agent Bridge.</b> Reproduction, redistribution, or modification — in whole or in part — is prohibited without prior written permission.</p>
373
- </div>
374
-
375
- </article>
376
- </main>
377
-
378
- <script>
379
- /* === Anti-copy / anti-extraction defense ===
380
- Browser-side defenses are deterrents; they cannot defeat a determined attacker.
381
- Combined with server-side rights notice, this discourages casual copying. */
382
- (function () {
383
- var doc = document;
384
-
385
- // Block context menu
386
- doc.addEventListener('contextmenu', function (e) { e.preventDefault(); return false; }, { capture: true });
387
-
388
- // Block copy / cut / paste / select-all
389
- ['copy', 'cut', 'paste'].forEach(function (evt) {
390
- doc.addEventListener(evt, function (e) {
391
- e.preventDefault();
392
- if (e.clipboardData) {
393
- try { e.clipboardData.setData('text/plain', '© Web Agent Bridge — copying this whitepaper is not permitted. See https://webagentbridge.com/whitepaper'); } catch (_) {}
394
- }
395
- return false;
396
- }, { capture: true });
397
- });
398
-
399
- // Block drag and selection
400
- doc.addEventListener('dragstart', function (e) { e.preventDefault(); return false; }, { capture: true });
401
- doc.addEventListener('selectstart', function (e) { e.preventDefault(); return false; }, { capture: true });
402
-
403
- // Block common keyboard shortcuts: Ctrl+C/X/A/S/P/U, F12, Ctrl+Shift+I/J/C, Cmd equivalents
404
- doc.addEventListener('keydown', function (e) {
405
- var k = (e.key || '').toLowerCase();
406
- var meta = e.ctrlKey || e.metaKey;
407
- if (e.key === 'F12') { e.preventDefault(); return false; }
408
- if (meta && e.shiftKey && (k === 'i' || k === 'j' || k === 'c')) { e.preventDefault(); return false; }
409
- if (meta && (k === 'c' || k === 'x' || k === 'a' || k === 's' || k === 'p' || k === 'u')) {
410
- e.preventDefault();
411
- return false;
412
- }
413
- }, { capture: true });
414
-
415
- // Detect and discourage devtools (best effort — shows a notice; cannot truly block)
416
- var devtoolsOpen = false;
417
- var threshold = 160;
418
- setInterval(function () {
419
- var widthDelta = window.outerWidth - window.innerWidth;
420
- var heightDelta = window.outerHeight - window.innerHeight;
421
- if (widthDelta > threshold || heightDelta > threshold) {
422
- if (!devtoolsOpen) {
423
- devtoolsOpen = true;
424
- console.clear && console.clear();
425
- console.log('%c⚠ Web Agent Bridge — Read-Only Whitepaper',
426
- 'color:#f97316;font-size:18px;font-weight:bold;');
427
- console.log('%cThis document is © 2026 Web Agent Bridge. Reproduction prohibited.\nSee https://webagentbridge.com/whitepaper for the canonical version.',
428
- 'color:#cdd6e3;font-size:12px;');
429
- }
430
- } else {
431
- devtoolsOpen = false;
432
- }
433
- }, 1000);
434
-
435
- // Block iframe embedding (frame-busting)
436
- try {
437
- if (window.top !== window.self) {
438
- window.top.location = window.self.location;
439
- }
440
- } catch (_) {
441
- document.body.innerHTML = '<p style="padding:40px;text-align:center;color:#fff;background:#0b1020;">This whitepaper cannot be embedded. Visit <a style="color:#4ea3ff" href="https://webagentbridge.com/whitepaper">webagentbridge.com/whitepaper</a>.</p>';
442
- }
443
-
444
- // Sign-of-life log
445
- console.log('%cWAB Whitepaper v1.3.0 — Read-Only', 'color:#4ea3ff;font-weight:bold;');
446
- })();
447
- </script>
448
- </body>
449
- </html>
1
+ <!DOCTYPE html>
2
+ <html lang="en" dir="ltr">
3
+ <head>
4
+ <meta charset="UTF-8" />
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
+ <title>WAB DNS Discovery Whitepaper — Web Agent Bridge</title>
7
+ <meta name="description" content="Web Agent Bridge (WAB) DNS Discovery Protocol — A Zero-Probe, Cryptographically Verified Infrastructure Layer for AI Agents. Whitepaper v1.3.0." />
8
+ <meta name="robots" content="index, follow, noarchive, nosnippet, noimageindex" />
9
+ <link rel="canonical" href="https://webagentbridge.com/whitepaper" />
10
+ <meta property="og:title" content="WAB DNS Discovery Whitepaper" />
11
+ <meta property="og:description" content="Zero-probe, cryptographically verified discovery protocol for AI agents." />
12
+ <meta property="og:url" content="https://webagentbridge.com/whitepaper" />
13
+ <meta property="og:type" content="article" />
14
+
15
+ <!-- Anti-embedding / clickjacking defense -->
16
+ <meta http-equiv="X-Content-Type-Options" content="nosniff" />
17
+ <meta http-equiv="Referrer-Policy" content="strict-origin-when-cross-origin" />
18
+ <meta name="copyright" content="© 2026 Web Agent Bridge — All Rights Reserved" />
19
+ <meta name="rights" content="All Rights Reserved. Reproduction prohibited without written consent." />
20
+
21
+ <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
22
+ <style>
23
+ /* === RESET / BASE === */
24
+ *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
25
+ html, body {
26
+ background: #0b1020;
27
+ color: #e7ecf5;
28
+ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
29
+ line-height: 1.7;
30
+ min-height: 100vh;
31
+ overflow-x: hidden;
32
+ }
33
+
34
+ /* === ANTI-COPY DEFENSE LAYER === */
35
+ /* Disable text selection across the document (best-effort browser deterrent) */
36
+ .wp-protect, .wp-protect * {
37
+ -webkit-user-select: none !important;
38
+ -moz-user-select: none !important;
39
+ -ms-user-select: none !important;
40
+ user-select: none !important;
41
+ -webkit-touch-callout: none !important;
42
+ -webkit-tap-highlight-color: transparent;
43
+ }
44
+ /* Block image dragging */
45
+ .wp-protect img { -webkit-user-drag: none; user-drag: none; pointer-events: none; }
46
+
47
+ /* === LAYOUT === */
48
+ .topbar {
49
+ position: sticky; top: 0; z-index: 50;
50
+ background: rgba(11, 16, 32, 0.92);
51
+ backdrop-filter: blur(10px);
52
+ border-bottom: 1px solid rgba(255,255,255,0.08);
53
+ padding: 14px 24px;
54
+ display: flex; align-items: center; justify-content: space-between;
55
+ }
56
+ .topbar a.brand { color: #4ea3ff; text-decoration: none; font-weight: 600; font-size: 1rem; }
57
+ .topbar .meta { font-size: 0.8rem; color: #8b96ad; }
58
+ .topbar .badge {
59
+ display: inline-block;
60
+ background: linear-gradient(135deg, #f97316, #ef4444);
61
+ color: white;
62
+ padding: 3px 10px;
63
+ border-radius: 999px;
64
+ font-size: 0.72rem;
65
+ font-weight: 600;
66
+ letter-spacing: 0.5px;
67
+ margin-left: 8px;
68
+ vertical-align: middle;
69
+ }
70
+
71
+ .container {
72
+ max-width: 820px;
73
+ margin: 0 auto;
74
+ padding: 48px 28px 96px;
75
+ position: relative;
76
+ }
77
+
78
+ /* === DIAGONAL WATERMARK === */
79
+ .watermark {
80
+ position: fixed;
81
+ top: 0; left: 0; right: 0; bottom: 0;
82
+ pointer-events: none;
83
+ z-index: 1;
84
+ opacity: 0.06;
85
+ background-image:
86
+ repeating-linear-gradient(
87
+ -45deg,
88
+ transparent 0,
89
+ transparent 180px,
90
+ rgba(78, 163, 255, 0.0) 180px,
91
+ rgba(78, 163, 255, 0.0) 200px
92
+ );
93
+ overflow: hidden;
94
+ }
95
+ .watermark::before {
96
+ content: "WEBAGENTBRIDGE.COM • © 2026 • CONFIDENTIAL READ-ONLY • WEBAGENTBRIDGE.COM • © 2026 • CONFIDENTIAL READ-ONLY • WEBAGENTBRIDGE.COM • © 2026";
97
+ position: absolute;
98
+ top: -50%; left: -50%; right: -50%; bottom: -50%;
99
+ transform: rotate(-30deg);
100
+ font-size: 28px;
101
+ font-weight: 700;
102
+ color: #4ea3ff;
103
+ white-space: pre-wrap;
104
+ word-spacing: 18px;
105
+ line-height: 220px;
106
+ letter-spacing: 4px;
107
+ text-align: center;
108
+ opacity: 0.65;
109
+ }
110
+
111
+ /* === CONTENT === */
112
+ .doc { position: relative; z-index: 2; }
113
+ h1 {
114
+ font-size: 2.1rem;
115
+ line-height: 1.3;
116
+ margin-bottom: 8px;
117
+ background: linear-gradient(135deg, #4ea3ff, #8b5cf6);
118
+ -webkit-background-clip: text;
119
+ background-clip: text;
120
+ -webkit-text-fill-color: transparent;
121
+ letter-spacing: -0.5px;
122
+ }
123
+ h2 {
124
+ font-size: 1.5rem;
125
+ margin: 36px 0 14px;
126
+ color: #ffffff;
127
+ border-left: 3px solid #4ea3ff;
128
+ padding-left: 12px;
129
+ }
130
+ h3 {
131
+ font-size: 1.15rem;
132
+ margin: 26px 0 10px;
133
+ color: #cdd6e3;
134
+ }
135
+ p { margin: 0 0 14px; color: #cdd6e3; }
136
+ ul, ol { margin: 0 0 16px 22px; color: #cdd6e3; }
137
+ li { margin-bottom: 6px; }
138
+ code, pre {
139
+ font-family: "JetBrains Mono", "SF Mono", Menlo, Consolas, monospace;
140
+ font-size: 0.88rem;
141
+ }
142
+ code {
143
+ background: rgba(78, 163, 255, 0.12);
144
+ color: #b8d4ff;
145
+ padding: 2px 6px;
146
+ border-radius: 4px;
147
+ }
148
+ pre {
149
+ background: #060914;
150
+ border: 1px solid rgba(255,255,255,0.08);
151
+ border-radius: 8px;
152
+ padding: 16px 18px;
153
+ overflow-x: auto;
154
+ margin: 12px 0 18px;
155
+ }
156
+ pre code { background: transparent; padding: 0; color: #b8d4ff; }
157
+ blockquote {
158
+ border-left: 3px solid #f97316;
159
+ background: rgba(249, 115, 22, 0.08);
160
+ padding: 14px 18px;
161
+ margin: 18px 0;
162
+ border-radius: 0 6px 6px 0;
163
+ font-size: 0.95rem;
164
+ }
165
+ table {
166
+ width: 100%; border-collapse: collapse;
167
+ margin: 14px 0;
168
+ background: rgba(255,255,255,0.02);
169
+ border-radius: 6px;
170
+ overflow: hidden;
171
+ }
172
+ th, td {
173
+ padding: 10px 14px;
174
+ text-align: left;
175
+ border-bottom: 1px solid rgba(255,255,255,0.06);
176
+ font-size: 0.92rem;
177
+ }
178
+ th { background: rgba(78,163,255,0.08); color: #ffffff; font-weight: 600; }
179
+ hr {
180
+ border: none;
181
+ height: 1px;
182
+ background: linear-gradient(90deg, transparent, rgba(255,255,255,0.15), transparent);
183
+ margin: 32px 0;
184
+ }
185
+ .lead-card {
186
+ background: linear-gradient(135deg, rgba(78,163,255,0.08), rgba(139,92,246,0.06));
187
+ border: 1px solid rgba(78,163,255,0.2);
188
+ border-radius: 12px;
189
+ padding: 22px 26px;
190
+ margin: 24px 0;
191
+ }
192
+ .lead-card .meta-grid {
193
+ display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
194
+ gap: 12px;
195
+ margin-top: 12px;
196
+ font-size: 0.86rem;
197
+ }
198
+ .lead-card .meta-grid div { color: #8b96ad; }
199
+ .lead-card .meta-grid b { color: #ffffff; }
200
+ .footnote {
201
+ margin-top: 48px;
202
+ padding-top: 24px;
203
+ border-top: 1px solid rgba(255,255,255,0.08);
204
+ font-size: 0.82rem;
205
+ color: #8b96ad;
206
+ text-align: center;
207
+ }
208
+ .footnote a { color: #4ea3ff; text-decoration: none; }
209
+
210
+ /* Print suppression */
211
+ @media print {
212
+ html, body { display: none !important; visibility: hidden !important; }
213
+ body::after {
214
+ content: "Printing of this document is not authorized. Visit https://webagentbridge.com/whitepaper to view.";
215
+ display: block !important;
216
+ visibility: visible !important;
217
+ position: fixed; top: 50%; left: 50%; transform: translate(-50%, -50%);
218
+ font-size: 18px; color: #000;
219
+ }
220
+ }
221
+ </style>
222
+ </head>
223
+ <body class="wp-protect" oncontextmenu="return false;" oncopy="return false;" oncut="return false;" onpaste="return false;" ondragstart="return false;" onselectstart="return false;">
224
+
225
+ <div class="watermark" aria-hidden="true"></div>
226
+
227
+ <header class="topbar">
228
+ <a href="/" class="brand">← Web Agent Bridge</a>
229
+ <div class="meta">
230
+ Whitepaper v1.3.0 <span class="badge">READ-ONLY</span>
231
+ </div>
232
+ </header>
233
+
234
+ <main class="container">
235
+ <article class="doc" id="whitepaper">
236
+
237
+ <h1>Web Agent Bridge (WAB) DNS Discovery Protocol</h1>
238
+ <p style="font-size: 1.1rem; color: #cdd6e3; margin-top: 6px;">
239
+ A Zero-Probe, Cryptographically Verified Infrastructure Layer for AI Agents
240
+ </p>
241
+
242
+ <div class="lead-card">
243
+ <div><b>© 2026 Web Agent Bridge.</b> All Rights Reserved.</div>
244
+ <p style="margin: 8px 0 0; font-size: 0.9rem;">
245
+ This whitepaper is the intellectual property of the Web Agent Bridge project.
246
+ Reproduction, redistribution, or modification — in whole or in part — is <b>prohibited</b>
247
+ without prior written permission. The canonical, authoritative version is published at
248
+ <code>webagentbridge.com/whitepaper</code>.
249
+ </p>
250
+ <div class="meta-grid">
251
+ <div><b>Version</b><br>1.3.0</div>
252
+ <div><b>Status</b><br>Published</div>
253
+ <div><b>Date</b><br>May 2026</div>
254
+ <div><b>License</b><br>All Rights Reserved</div>
255
+ </div>
256
+ </div>
257
+
258
+ <h2>Abstract</h2>
259
+ <p>As artificial intelligence agents transition from isolated chatbots to autonomous web navigators, the absence of a standardized, machine-readable discovery mechanism creates significant friction. Agents currently rely on heuristic DOM scraping, trial-and-error HTTP probing, and reverse-engineered APIs, leading to excessive server load, brittle integrations, and privacy risks. This paper introduces the <b>Web Agent Bridge (WAB) DNS Discovery Protocol</b>, a lightweight, infrastructure-first mechanism that allows AI agents to instantly discover a domain's AI capabilities and cryptographic trust attestations without prior HTTP interaction. Modeled after email authentication standards like SPF, DKIM, and DMARC, the WAB DNS Discovery Protocol utilizes DNS TXT records resolved over DNS over HTTPS (DoH) to advertise protocol support and endpoint locations. Furthermore, we detail the <b>WAB Cryptographic Trust Layer (v1.3)</b>, which employs Ed25519 signatures to ensure the integrity and authenticity of the discovery document, mitigating man-in-the-middle attacks and establishing a robust foundation for autonomous agent-web interactions.</p>
260
+
261
+ <h2>1. Introduction</h2>
262
+ <p>The proliferation of Large Language Models (LLMs) and autonomous AI agents has fundamentally altered how digital information is accessed and processed. Unlike human users who rely on visual interfaces and HTML/CSS rendering, AI agents require structured, deterministic access to web capabilities. However, the current web architecture lacks a native discovery layer for machine-to-machine interactions.</p>
263
+ <p>Currently, agents attempting to interact with a website face a "blind fetch" problem. They must either parse complex HTML structures, guess API endpoints, or probe for well-known files (e.g., <code>/.well-known/ai-plugin.json</code>), often resulting in HTTP 404 errors, increased latency, and unnecessary server overhead. Furthermore, the rise of "cookie-wall taxes" and aggressive bot mitigation strategies disproportionately penalize legitimate, beneficial AI traffic.</p>
264
+ <p>To address these challenges, we propose the <b>Web Agent Bridge (WAB) DNS Discovery Protocol</b>. By shifting the discovery phase to the Domain Name System (DNS) infrastructure, WAB enables <b>zero-probe discovery</b>. Agents can resolve a single DNS record to ascertain AI readiness, locate the capabilities document (<code>wab.json</code>), and verify the cryptographic signature of the provider, all before initiating an HTTP connection.</p>
265
+
266
+ <h2>2. The WAB DNS Discovery Protocol (DDP)</h2>
267
+ <p>The DNS Discovery Protocol (DDP) is an infrastructure-layer mechanism that allows domains to advertise their WAB endpoint and trust parameters. It is designed to be highly cacheable, universally supported, and easily verifiable.</p>
268
+
269
+ <h3>2.1 Protocol Mechanics</h3>
270
+ <p>The core of the DDP is a DNS TXT record placed at the <code>_wab</code> subdomain of the apex domain (e.g., <code>_wab.example.com</code>). This approach mirrors established email authentication protocols such as the Sender Policy Framework (SPF) [1] and DomainKeys Identified Mail (DKIM) [2].</p>
271
+ <p>When an AI agent intends to interact with a domain, it MUST first query the <code>_wab.{apex}</code> TXT record. If the DNS query returns <code>NXDOMAIN</code>, the agent concludes that the domain does not explicitly support the WAB protocol and falls back to traditional, heuristic methods. If the record exists, the agent parses the key-value pairs to locate the discovery document.</p>
272
+
273
+ <h3>2.2 Record Format and Syntax</h3>
274
+ <p>The WAB TXT record utilizes a semicolon-separated key-value format. The primary fields are defined as follows:</p>
275
+ <table>
276
+ <thead>
277
+ <tr><th>Field</th><th>Value Type</th><th>Requirement</th><th>Description</th></tr>
278
+ </thead>
279
+ <tbody>
280
+ <tr><td><code>v</code></td><td>string</td><td>REQUIRED</td><td>Protocol version identifier. Current standard is <code>wab1</code>.</td></tr>
281
+ <tr><td><code>endpoint</code></td><td>URL</td><td>REQUIRED</td><td>The absolute HTTPS URL of the <code>wab.json</code> discovery document.</td></tr>
282
+ <tr><td><code>pk</code></td><td>string</td><td>OPTIONAL</td><td>The public key for cryptographic verification, prefixed with the algorithm (e.g., <code>ed25519:&lt;base64&gt;</code>).</td></tr>
283
+ </tbody>
284
+ </table>
285
+ <p><b>Example TXT Record:</b></p>
286
+ <pre><code>_wab.example.com. 3600 IN TXT "v=wab1; endpoint=https://example.com/.well-known/wab.json; pk=ed25519:PkQ7aq1E3jvMI2oL0rvYtTgOplWd+USw26Y/D4JzPxo="</code></pre>
287
+
288
+ <h3>2.3 DNS over HTTPS (DoH) Requirement</h3>
289
+ <p>To prevent ISP-level interception, manipulation, and tracking of discovery queries, WAB-aware agents SHOULD resolve the <code>_wab</code> records using DNS over HTTPS (DoH) [3]. DoH encrypts the DNS query, shifting the trust boundary from the local network to a trusted DoH resolver (e.g., Cloudflare 1.1.1.1 or Google 8.8.8.8).</p>
290
+
291
+ <h2>3. The Discovery Document (<code>wab.json</code>)</h2>
292
+ <p>The discovery document, typically hosted at <code>/.well-known/wab.json</code>, is a structured JSON file that defines the domain's capabilities, permitted actions, and transport mechanisms.</p>
293
+
294
+ <h3>3.1 Schema Overview (v1.3)</h3>
295
+ <p>The <code>wab.json</code> schema is designed for extensibility and strict typing. Key components include:</p>
296
+ <ul>
297
+ <li><code>wab_version</code> — Specifies the schema version (e.g., <code>"1.3.0"</code>).</li>
298
+ <li><code>provider</code> — Metadata regarding the domain owner, including name, category, and URL.</li>
299
+ <li><code>capabilities</code> — Defines the permitted actions (<code>commands</code>) and granular access rights (<code>permissions</code>).</li>
300
+ <li><code>endpoints</code> — Specifies the API endpoints for agent interaction (e.g., <code>/api/wab/discover</code>, <code>/api/wab/ping</code>).</li>
301
+ <li><code>signature</code> — The cryptographic signature block (detailed in Section 4).</li>
302
+ </ul>
303
+
304
+ <h3>3.2 Action Definitions</h3>
305
+ <p>Actions (or commands) are explicitly defined within the <code>capabilities.commands</code> array. This eliminates the need for agents to infer functionality. Each command specifies its trigger mechanism (e.g., <code>api</code>, <code>navigate</code>), required parameters, and authentication prerequisites, providing a deterministic execution path.</p>
306
+
307
+ <h2>4. Cryptographic Trust Layer (v1.3)</h2>
308
+ <p>While DNS discovery provides routing, it does not inherently guarantee the integrity of the fetched <code>wab.json</code> document, especially if the HTTPS connection is compromised or misconfigured. To establish a robust chain of trust, WAB v1.3 introduces a <b>Cryptographic Trust Layer</b> based on Ed25519 signatures.</p>
309
+
310
+ <h3>4.1 Ed25519 Signatures</h3>
311
+ <p>Ed25519 [4] is a public-key signature system utilizing the Edwards-curve Digital Signature Algorithm (EdDSA). It was selected for WAB due to its high performance, small key size (32 bytes), and resilience against side-channel attacks.</p>
312
+
313
+ <h3>4.2 Signature Generation and Verification</h3>
314
+ <p>The trust layer operates through a deterministic canonicalization and signing process:</p>
315
+ <ol>
316
+ <li><b>Key Generation</b> — The domain owner generates an Ed25519 keypair. The private key is securely stored offline or within a secure enclave.</li>
317
+ <li><b>DNS Publication</b> — The public key is published in the <code>_wab</code> DNS TXT record using the <code>pk=</code> parameter (e.g., <code>pk=ed25519:&lt;base64_public_key&gt;</code>).</li>
318
+ <li><b>Canonicalization</b> — Before signing, the <code>wab.json</code> document undergoes RFC 8785-style JSON canonicalization [5]. This process sorts object keys lexicographically, removes insignificant whitespace, and excludes the top-level <code>signature</code> field to ensure a consistent byte representation.</li>
319
+ <li><b>Signing</b> — The canonicalized JSON string is signed using the Ed25519 private key.</li>
320
+ <li><b>Manifest Embedding</b> — The resulting signature is embedded back into the <code>wab.json</code> document under the <code>signature</code> object.</li>
321
+ </ol>
322
+ <p><b>Signature Block Example:</b></p>
323
+ <pre><code>"signature": {
324
+ "algorithm": "ed25519",
325
+ "value": "base64_encoded_signature_string...",
326
+ "key_id": "pYu7X5PF/HoE2yDx",
327
+ "signed_at": "2026-05-02T10:00:00Z"
328
+ }</code></pre>
329
+
330
+ <h3>4.3 Agent Verification Flow</h3>
331
+ <p>Upon fetching the <code>wab.json</code> document, a WAB-compliant agent performs the following verification steps:</p>
332
+ <ol>
333
+ <li>Extracts the <code>pk</code> value from the previously resolved <code>_wab</code> DNS TXT record.</li>
334
+ <li>Extracts the <code>signature</code> object from the <code>wab.json</code> document.</li>
335
+ <li>Verifies that <code>signature.algorithm</code> is <code>ed25519</code>.</li>
336
+ <li>Canonicalizes the <code>wab.json</code> document (excluding the <code>signature</code> field).</li>
337
+ <li>Verifies the canonicalized string against the <code>signature.value</code> using the extracted public key.</li>
338
+ </ol>
339
+ <p>If the verification succeeds, the agent possesses cryptographic proof that the capabilities document was authorized by the entity controlling the domain's DNS records, effectively neutralizing unauthorized modifications.</p>
340
+
341
+ <h2>5. Implementation and Adoption</h2>
342
+ <p>The WAB protocol is designed for frictionless adoption by both site owners and agent developers.</p>
343
+
344
+ <h3>5.1 Zero-Code Infrastructure Onboarding</h3>
345
+ <p>Site owners can enable WAB discovery without deploying new code. By simply adding the <code>_wab</code> TXT record and hosting a static <code>wab.json</code> file, a domain becomes "Agent-Ready." This infrastructure-first approach lowers the barrier to entry compared to complex API integrations.</p>
346
+
347
+ <h3>5.2 The Proof Lab and Live Verification</h3>
348
+ <p>To facilitate adoption and ensure compliance, the Web Agent Bridge provides a <b>"Proof Lab."</b> This tool performs a live, end-to-end verification of the integration:</p>
349
+ <ol>
350
+ <li><b>DNS Resolution</b> — Verifies the presence and syntax of the <code>_wab</code> TXT record via DoH.</li>
351
+ <li><b>Document Fetch</b> — Retrieves and parses the <code>wab.json</code> file.</li>
352
+ <li><b>Agent Execution</b> — Simulates an agent flow by calling the defined endpoints (e.g., <code>/api/wab/discover</code>, <code>/api/wab/ping</code>) to confirm execution readiness (<code>execution_ok=true</code>).</li>
353
+ </ol>
354
+
355
+ <h2>6. Conclusion</h2>
356
+ <p>The Web Agent Bridge (WAB) DNS Discovery Protocol and its Cryptographic Trust Layer provide a critical missing piece in the architecture of the autonomous web. By leveraging proven DNS infrastructure and Ed25519 cryptography, WAB enables zero-probe, secure, and deterministic discovery of AI capabilities. This protocol reduces server overhead, enhances privacy through DoH, and establishes a verifiable chain of trust, paving the way for scalable and secure machine-to-machine interactions on the internet.</p>
357
+
358
+ <h2>References</h2>
359
+ <ol>
360
+ <li>S. Kitterman, <i>"Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1,"</i> RFC 7208, April 2014.</li>
361
+ <li>D. Crocker, T. Hansen, and M. Kucherawy, <i>"DomainKeys Identified Mail (DKIM) Signatures,"</i> RFC 6376, September 2011.</li>
362
+ <li>P. Hoffman and P. McManus, <i>"DNS Queries over HTTPS (DoH),"</i> RFC 8484, October 2018.</li>
363
+ <li>S. Josefsson and I. Liusvaara, <i>"Edwards-Curve Digital Signature Algorithm (EdDSA),"</i> RFC 8032, January 2017.</li>
364
+ <li>A. Rundgren, B. Jordan, and S. Erdtman, <i>"JSON Canonicalization Scheme (JCS),"</i> RFC 8785, June 2020.</li>
365
+ </ol>
366
+
367
+ <hr />
368
+
369
+ <div class="footnote">
370
+ <p>This document is read-only reference material.<br>
371
+ The canonical version lives at <a href="https://webagentbridge.com/whitepaper">webagentbridge.com/whitepaper</a>.<br>
372
+ <b>All rights reserved © 2026 Web Agent Bridge.</b> Reproduction, redistribution, or modification — in whole or in part — is prohibited without prior written permission.</p>
373
+ </div>
374
+
375
+ </article>
376
+ </main>
377
+
378
+ <script>
379
+ /* === Anti-copy / anti-extraction defense ===
380
+ Browser-side defenses are deterrents; they cannot defeat a determined attacker.
381
+ Combined with server-side rights notice, this discourages casual copying. */
382
+ (function () {
383
+ var doc = document;
384
+
385
+ // Block context menu
386
+ doc.addEventListener('contextmenu', function (e) { e.preventDefault(); return false; }, { capture: true });
387
+
388
+ // Block copy / cut / paste / select-all
389
+ ['copy', 'cut', 'paste'].forEach(function (evt) {
390
+ doc.addEventListener(evt, function (e) {
391
+ e.preventDefault();
392
+ if (e.clipboardData) {
393
+ try { e.clipboardData.setData('text/plain', '© Web Agent Bridge — copying this whitepaper is not permitted. See https://webagentbridge.com/whitepaper'); } catch (_) {}
394
+ }
395
+ return false;
396
+ }, { capture: true });
397
+ });
398
+
399
+ // Block drag and selection
400
+ doc.addEventListener('dragstart', function (e) { e.preventDefault(); return false; }, { capture: true });
401
+ doc.addEventListener('selectstart', function (e) { e.preventDefault(); return false; }, { capture: true });
402
+
403
+ // Block common keyboard shortcuts: Ctrl+C/X/A/S/P/U, F12, Ctrl+Shift+I/J/C, Cmd equivalents
404
+ doc.addEventListener('keydown', function (e) {
405
+ var k = (e.key || '').toLowerCase();
406
+ var meta = e.ctrlKey || e.metaKey;
407
+ if (e.key === 'F12') { e.preventDefault(); return false; }
408
+ if (meta && e.shiftKey && (k === 'i' || k === 'j' || k === 'c')) { e.preventDefault(); return false; }
409
+ if (meta && (k === 'c' || k === 'x' || k === 'a' || k === 's' || k === 'p' || k === 'u')) {
410
+ e.preventDefault();
411
+ return false;
412
+ }
413
+ }, { capture: true });
414
+
415
+ // Detect and discourage devtools (best effort — shows a notice; cannot truly block)
416
+ var devtoolsOpen = false;
417
+ var threshold = 160;
418
+ setInterval(function () {
419
+ var widthDelta = window.outerWidth - window.innerWidth;
420
+ var heightDelta = window.outerHeight - window.innerHeight;
421
+ if (widthDelta > threshold || heightDelta > threshold) {
422
+ if (!devtoolsOpen) {
423
+ devtoolsOpen = true;
424
+ console.clear && console.clear();
425
+ console.log('%c⚠ Web Agent Bridge — Read-Only Whitepaper',
426
+ 'color:#f97316;font-size:18px;font-weight:bold;');
427
+ console.log('%cThis document is © 2026 Web Agent Bridge. Reproduction prohibited.\nSee https://webagentbridge.com/whitepaper for the canonical version.',
428
+ 'color:#cdd6e3;font-size:12px;');
429
+ }
430
+ } else {
431
+ devtoolsOpen = false;
432
+ }
433
+ }, 1000);
434
+
435
+ // Block iframe embedding (frame-busting)
436
+ try {
437
+ if (window.top !== window.self) {
438
+ window.top.location = window.self.location;
439
+ }
440
+ } catch (_) {
441
+ document.body.innerHTML = '<p style="padding:40px;text-align:center;color:#fff;background:#0b1020;">This whitepaper cannot be embedded. Visit <a style="color:#4ea3ff" href="https://webagentbridge.com/whitepaper">webagentbridge.com/whitepaper</a>.</p>';
442
+ }
443
+
444
+ // Sign-of-life log
445
+ console.log('%cWAB Whitepaper v1.3.0 — Read-Only', 'color:#4ea3ff;font-weight:bold;');
446
+ })();
447
+ </script>
448
+ </body>
449
+ </html>