web-agent-bridge 3.4.0 → 3.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (315) hide show
  1. package/LICENSE +84 -84
  2. package/README.ar.md +1565 -1304
  3. package/README.md +171 -298
  4. package/bin/agent-runner.js +474 -474
  5. package/bin/cli.js +237 -237
  6. package/bin/wab-init.js +244 -223
  7. package/bin/wab.js +80 -80
  8. package/examples/azure-dns-wab.js +83 -83
  9. package/examples/bidi-agent.js +119 -119
  10. package/examples/cloudflare-wab-dns.js +121 -121
  11. package/examples/cpanel-wab-dns.js +114 -114
  12. package/examples/cross-site-agent.js +91 -91
  13. package/examples/dns-discovery-agent.js +166 -166
  14. package/examples/gcp-dns-wab.js +76 -76
  15. package/examples/governance-agent.js +169 -169
  16. package/examples/mcp-agent.js +94 -94
  17. package/examples/next-app-router/README.md +44 -44
  18. package/examples/plesk-wab-dns.js +103 -103
  19. package/examples/puppeteer-agent.js +108 -108
  20. package/examples/route53-wab-dns.js +144 -144
  21. package/examples/saas-dashboard/README.md +55 -55
  22. package/examples/safe-mode-agent.js +96 -96
  23. package/examples/self-discovery.js +106 -0
  24. package/examples/shopify-hydrogen/README.md +74 -74
  25. package/examples/vision-agent.js +171 -171
  26. package/examples/wab-sign.js +74 -74
  27. package/examples/wab-verify.js +60 -60
  28. package/examples/wordpress-elementor/README.md +77 -77
  29. package/package.json +93 -93
  30. package/public/.well-known/agent-tools.json +180 -180
  31. package/public/.well-known/ai-assets.json +59 -59
  32. package/public/.well-known/security.txt +8 -8
  33. package/public/.well-known/wab.json +28 -28
  34. package/public/activate.html +448 -368
  35. package/public/adopt.html +236 -0
  36. package/public/adoption-metrics.html +188 -188
  37. package/public/agent-workspace.html +359 -349
  38. package/public/ai.html +198 -198
  39. package/public/api.html +397 -413
  40. package/public/atp.html +171 -0
  41. package/public/azure-dns-integration.html +289 -289
  42. package/public/browser.html +486 -486
  43. package/public/cloudflare-integration.html +380 -380
  44. package/public/commander-dashboard.html +243 -243
  45. package/public/cookies.html +210 -210
  46. package/public/cpanel-integration.html +398 -398
  47. package/public/css/agent-workspace.css +1713 -1713
  48. package/public/css/premium.css +317 -317
  49. package/public/css/styles.css +1401 -1263
  50. package/public/dashboard-shieldlink.html +295 -0
  51. package/public/dashboard.html +711 -707
  52. package/public/dns.html +436 -436
  53. package/public/docs.html +588 -588
  54. package/public/enterprise-mesh.ar.html +80 -0
  55. package/public/enterprise-mesh.html +81 -0
  56. package/public/feed.xml +89 -89
  57. package/public/gcp-dns-integration.html +318 -318
  58. package/public/governance.ar.html +70 -0
  59. package/public/governance.html +69 -0
  60. package/public/growth.html +465 -465
  61. package/public/index.html +1372 -1266
  62. package/public/integrations.html +556 -556
  63. package/public/js/activate.js +449 -145
  64. package/public/js/agent-workspace.js +1740 -1740
  65. package/public/js/auth-nav.js +117 -65
  66. package/public/js/auth-redirect.js +12 -12
  67. package/public/js/cookie-consent.js +56 -56
  68. package/public/js/dns.js +438 -438
  69. package/public/js/wab-demo-page.js +721 -721
  70. package/public/js/ws-client.js +74 -74
  71. package/public/l-preview.html +242 -0
  72. package/public/llms-full.txt +360 -360
  73. package/public/llms.txt +125 -125
  74. package/public/login.html +85 -85
  75. package/public/mesh-dashboard.html +328 -328
  76. package/public/milestones.html +346 -0
  77. package/public/one-click.html +779 -0
  78. package/public/openapi.json +669 -669
  79. package/public/partners.ar.html +145 -0
  80. package/public/partners.html +143 -0
  81. package/public/phone-shield.html +281 -281
  82. package/public/plesk-integration.html +375 -375
  83. package/public/premium-dashboard.html +2489 -2489
  84. package/public/premium.html +793 -793
  85. package/public/privacy.html +297 -297
  86. package/public/provider-onboarding.html +172 -172
  87. package/public/provider-sandbox.html +134 -134
  88. package/public/providers.html +359 -359
  89. package/public/refusals.html +172 -0
  90. package/public/register.html +105 -105
  91. package/public/registrar-integrations.html +141 -141
  92. package/public/ring4.html +292 -0
  93. package/public/robots.txt +99 -99
  94. package/public/route53-integration.html +531 -531
  95. package/public/score.html +263 -0
  96. package/public/script/wab-consent.d.ts +36 -36
  97. package/public/script/wab-consent.js +104 -104
  98. package/public/script/wab-schema.js +131 -131
  99. package/public/script/wab.d.ts +108 -108
  100. package/public/script/wab.min.js +580 -580
  101. package/public/security.txt +8 -8
  102. package/public/shieldlink.html +244 -0
  103. package/public/shieldqr.html +231 -231
  104. package/public/sitemap.xml +13 -1
  105. package/public/terms.html +256 -256
  106. package/public/trust-graph-api.ar.html +92 -0
  107. package/public/trust-graph-api.html +91 -0
  108. package/public/wab-features.html +560 -0
  109. package/public/wab-trust.html +200 -200
  110. package/public/wab-truth.html +375 -0
  111. package/public/wab-vs-protocols.html +210 -210
  112. package/public/whitepaper.html +449 -449
  113. package/script/ai-agent-bridge.js +1754 -1754
  114. package/sdk/README.md +99 -99
  115. package/sdk/agent-mesh.js +449 -449
  116. package/sdk/atp.js +103 -0
  117. package/sdk/auto-discovery.js +301 -288
  118. package/sdk/commander.js +262 -262
  119. package/sdk/governance.js +262 -262
  120. package/sdk/index.d.ts +464 -464
  121. package/sdk/index.js +653 -649
  122. package/sdk/multi-agent.js +318 -318
  123. package/sdk/safe-mode.js +221 -221
  124. package/sdk/safety-shield.js +219 -219
  125. package/sdk/schema-discovery.js +83 -83
  126. package/server/adapters/index.js +520 -520
  127. package/server/config/plans.js +412 -367
  128. package/server/config/secrets.js +102 -102
  129. package/server/control-plane/index.js +301 -301
  130. package/server/data-plane/index.js +354 -354
  131. package/server/index.js +793 -670
  132. package/server/llm/index.js +404 -404
  133. package/server/middleware/adminAuth.js +35 -35
  134. package/server/middleware/api-tier.js +170 -0
  135. package/server/middleware/auth.js +50 -50
  136. package/server/middleware/featureGate.js +88 -88
  137. package/server/middleware/rateLimits.js +100 -100
  138. package/server/middleware/sensitiveAction.js +157 -157
  139. package/server/middleware/wab-trust.js +141 -0
  140. package/server/migrations/001_add_analytics_indexes.sql +7 -7
  141. package/server/migrations/002_premium_features.sql +418 -418
  142. package/server/migrations/003_ads_integer_cents.sql +33 -33
  143. package/server/migrations/004_agent_os.sql +158 -158
  144. package/server/migrations/005_marketplace_metering.sql +126 -126
  145. package/server/migrations/006_growth_suite.sql +138 -0
  146. package/server/migrations/007_governance.sql +106 -106
  147. package/server/migrations/008_plans.sql +144 -144
  148. package/server/migrations/009_shieldqr.sql +30 -30
  149. package/server/migrations/010_extended_trust.sql +33 -33
  150. package/server/migrations/011_outreach.sql +47 -0
  151. package/server/migrations/012_shieldlink.sql +116 -0
  152. package/server/migrations/013_ct_monitor.sql +13 -0
  153. package/server/migrations/014_wab_advanced_features.sql +128 -0
  154. package/server/migrations/015_wab_truth_layer.sql +101 -0
  155. package/server/migrations/016_ring4_external_trust.sql +84 -0
  156. package/server/migrations/017_ring4_extensions.sql +69 -0
  157. package/server/migrations/018_commercial_foundations.sql +167 -0
  158. package/server/migrations/019_unify_tier_constraints.sql +133 -0
  159. package/server/migrations/020_agent_transaction_primitive.sql +119 -0
  160. package/server/models/adapters/index.js +33 -33
  161. package/server/models/adapters/mysql.js +183 -183
  162. package/server/models/adapters/postgresql.js +172 -172
  163. package/server/models/adapters/sqlite.js +7 -7
  164. package/server/models/db.js +740 -740
  165. package/server/observability/failure-analysis.js +337 -337
  166. package/server/observability/index.js +394 -394
  167. package/server/protocol/capabilities.js +223 -223
  168. package/server/protocol/index.js +243 -243
  169. package/server/protocol/schema.js +584 -584
  170. package/server/registry/certification.js +271 -271
  171. package/server/registry/index.js +326 -326
  172. package/server/routes/activate.js +478 -0
  173. package/server/routes/admin-outreach.js +239 -0
  174. package/server/routes/admin-plans.js +76 -76
  175. package/server/routes/admin-premium.js +674 -673
  176. package/server/routes/admin-shieldlink.js +137 -0
  177. package/server/routes/admin-shieldqr.js +90 -90
  178. package/server/routes/admin-trust-monitor.js +139 -83
  179. package/server/routes/admin.js +550 -549
  180. package/server/routes/adopt.js +61 -0
  181. package/server/routes/ads.js +130 -130
  182. package/server/routes/agent-workspace.js +540 -540
  183. package/server/routes/api-keys.js +127 -0
  184. package/server/routes/api.js +150 -150
  185. package/server/routes/auth.js +71 -71
  186. package/server/routes/billing.js +57 -57
  187. package/server/routes/commander.js +316 -316
  188. package/server/routes/customer-shieldlink.js +133 -0
  189. package/server/routes/demo-showcase.js +332 -332
  190. package/server/routes/demo-store.js +154 -154
  191. package/server/routes/diagnose.js +373 -0
  192. package/server/routes/discovery.js +2348 -2348
  193. package/server/routes/enterprise-mesh.js +170 -0
  194. package/server/routes/gateway.js +173 -173
  195. package/server/routes/governance-saas.js +203 -0
  196. package/server/routes/governance.js +208 -208
  197. package/server/routes/growth.js +1048 -0
  198. package/server/routes/intent.js +328 -0
  199. package/server/routes/license.js +251 -251
  200. package/server/routes/mesh.js +469 -469
  201. package/server/routes/noscript.js +543 -543
  202. package/server/routes/partners.js +201 -0
  203. package/server/routes/plans.js +33 -33
  204. package/server/routes/premium-v2.js +686 -686
  205. package/server/routes/premium.js +724 -724
  206. package/server/routes/providers.js +650 -650
  207. package/server/routes/reputation.js +411 -0
  208. package/server/routes/ring4.js +885 -0
  209. package/server/routes/runtime.js +2148 -2148
  210. package/server/routes/shieldlink.js +70 -0
  211. package/server/routes/shieldqr.js +88 -88
  212. package/server/routes/sovereign.js +465 -465
  213. package/server/routes/transactions.js +233 -0
  214. package/server/routes/truth-layer.js +670 -0
  215. package/server/routes/universal.js +200 -200
  216. package/server/routes/unsubscribe.js +51 -0
  217. package/server/routes/wab-api.js +850 -850
  218. package/server/routes/wab-cache.js +282 -0
  219. package/server/runtime/container-worker.js +111 -111
  220. package/server/runtime/container.js +448 -448
  221. package/server/runtime/distributed-worker.js +362 -362
  222. package/server/runtime/event-bus.js +210 -210
  223. package/server/runtime/index.js +253 -253
  224. package/server/runtime/queue.js +599 -599
  225. package/server/runtime/replay.js +666 -666
  226. package/server/runtime/sandbox.js +266 -266
  227. package/server/runtime/scheduler.js +534 -534
  228. package/server/runtime/session-engine.js +293 -293
  229. package/server/runtime/state-manager.js +188 -188
  230. package/server/secrets/wab-signing-key.pem +3 -0
  231. package/server/secrets/wab-signing-pub.pem +3 -0
  232. package/server/security/cross-site-redactor.js +196 -196
  233. package/server/security/dry-run.js +180 -180
  234. package/server/security/human-gate-rate-limit.js +147 -147
  235. package/server/security/human-gate-transports.js +178 -178
  236. package/server/security/human-gate.js +281 -281
  237. package/server/security/index.js +368 -368
  238. package/server/security/intent-engine.js +245 -245
  239. package/server/security/reward-guard.js +171 -171
  240. package/server/security/rollback-store.js +239 -239
  241. package/server/security/token-scope.js +404 -404
  242. package/server/security/url-policy.js +139 -139
  243. package/server/services/adoption-agent.js +182 -0
  244. package/server/services/agent-chat.js +506 -506
  245. package/server/services/agent-learning.js +601 -601
  246. package/server/services/agent-memory.js +625 -625
  247. package/server/services/agent-mesh.js +555 -555
  248. package/server/services/agent-symphony.js +717 -717
  249. package/server/services/agent-tasks.js +1807 -1807
  250. package/server/services/api-key-engine.js +292 -292
  251. package/server/services/cluster.js +894 -894
  252. package/server/services/commander.js +738 -738
  253. package/server/services/edge-compute.js +440 -440
  254. package/server/services/email.js +233 -233
  255. package/server/services/fairness-engine.js +409 -0
  256. package/server/services/fairness.js +420 -0
  257. package/server/services/governance.js +466 -466
  258. package/server/services/hosted-runtime.js +205 -205
  259. package/server/services/lfd.js +635 -635
  260. package/server/services/local-ai.js +389 -389
  261. package/server/services/marketplace.js +270 -270
  262. package/server/services/metering.js +182 -182
  263. package/server/services/modules/affiliate-intelligence.js +93 -93
  264. package/server/services/modules/agent-firewall.js +90 -90
  265. package/server/services/modules/bounty.js +89 -89
  266. package/server/services/modules/collective-bargaining.js +92 -92
  267. package/server/services/modules/dark-pattern.js +66 -66
  268. package/server/services/modules/gov-intelligence.js +45 -45
  269. package/server/services/modules/neural.js +55 -55
  270. package/server/services/modules/notary.js +49 -49
  271. package/server/services/modules/price-time-machine.js +86 -86
  272. package/server/services/modules/protocol.js +104 -104
  273. package/server/services/negotiation.js +439 -439
  274. package/server/services/outreach-agent.js +312 -0
  275. package/server/services/plans.js +214 -214
  276. package/server/services/plugins.js +771 -771
  277. package/server/services/price-intelligence.js +566 -566
  278. package/server/services/price-shield.js +1137 -1137
  279. package/server/services/provider-clients.js +740 -740
  280. package/server/services/reputation.js +465 -465
  281. package/server/services/search-engine.js +357 -357
  282. package/server/services/security.js +513 -513
  283. package/server/services/self-healing.js +843 -843
  284. package/server/services/shieldlink.js +492 -0
  285. package/server/services/shieldqr.js +322 -322
  286. package/server/services/sovereign-shield.js +542 -542
  287. package/server/services/ssl-ct-monitor.js +224 -0
  288. package/server/services/ssl-inspector.js +42 -42
  289. package/server/services/ssl-monitor.js +167 -167
  290. package/server/services/stripe.js +206 -205
  291. package/server/services/swarm.js +788 -788
  292. package/server/services/transactions.js +525 -0
  293. package/server/services/universal-scraper.js +662 -662
  294. package/server/services/verification.js +481 -481
  295. package/server/services/vision.js +1163 -1163
  296. package/server/services/wab-crypto.js +178 -178
  297. package/server/utils/cache.js +125 -125
  298. package/server/utils/migrate.js +81 -81
  299. package/server/utils/safe-fetch.js +228 -228
  300. package/server/utils/secureFields.js +50 -50
  301. package/server/ws.js +161 -161
  302. package/templates/artisan-marketplace.yaml +104 -104
  303. package/templates/book-price-scout.yaml +98 -98
  304. package/templates/electronics-price-tracker.yaml +108 -108
  305. package/templates/flight-deal-hunter.yaml +113 -113
  306. package/templates/freelancer-direct.yaml +116 -116
  307. package/templates/grocery-price-compare.yaml +93 -93
  308. package/templates/hotel-direct-booking.yaml +113 -113
  309. package/templates/local-services.yaml +98 -98
  310. package/templates/olive-oil-tunisia.yaml +88 -88
  311. package/templates/organic-farm-fresh.yaml +101 -101
  312. package/templates/restaurant-direct.yaml +97 -97
  313. package/templates/ring4/banking-sovereign.yaml +55 -0
  314. package/templates/ring4/ecommerce-sovereign.yaml +58 -0
  315. package/templates/ring4/healthcare-sovereign.yaml +60 -0
@@ -0,0 +1,420 @@
1
+ /**
2
+ * Fairness Engine — Neutrality layer ensuring AI agents give equal opportunity
3
+ * to all WAB-enabled sites regardless of brand size or SEO ranking.
4
+ */
5
+
6
+ const { db } = require('../models/db');
7
+
8
+ const WAB_VERSION = '1.2.0';
9
+
10
+ // ─── Directory Table (created lazily) ────────────────────────────────
11
+
12
+ db.exec(`
13
+ CREATE TABLE IF NOT EXISTS wab_directory (
14
+ site_id TEXT PRIMARY KEY,
15
+ category TEXT DEFAULT 'general',
16
+ tags TEXT DEFAULT '[]',
17
+ is_independent INTEGER DEFAULT 0,
18
+ commission_rate REAL DEFAULT 0,
19
+ direct_benefit TEXT DEFAULT '',
20
+ trust_signature TEXT,
21
+ listed INTEGER DEFAULT 1,
22
+ neutrality_score REAL DEFAULT 50,
23
+ registered_at TEXT DEFAULT (datetime('now')),
24
+ updated_at TEXT DEFAULT (datetime('now')),
25
+ FOREIGN KEY (site_id) REFERENCES sites(id) ON DELETE CASCADE
26
+ );
27
+
28
+ CREATE INDEX IF NOT EXISTS idx_wab_directory_category ON wab_directory(category);
29
+ CREATE INDEX IF NOT EXISTS idx_wab_directory_score ON wab_directory(neutrality_score);
30
+ `);
31
+
32
+ // ─── Neutrality Score Calculation ────────────────────────────────────
33
+
34
+ /**
35
+ * Score 0-100 based on: config completeness, trust signatures,
36
+ * commission transparency, and responsiveness.
37
+ */
38
+ function calculateNeutralityScore(site) {
39
+ let score = 0;
40
+ const weights = { configCompleteness: 30, trustSignature: 20, commissionTransparency: 25, responsiveness: 25 };
41
+
42
+ let config = {};
43
+ try { config = JSON.parse(site.config || '{}'); } catch (_) {}
44
+
45
+ // Config completeness (0-30): how well the site has configured WAB
46
+ const configFields = [
47
+ config.agentPermissions,
48
+ config.restrictions,
49
+ config.logging,
50
+ config.features
51
+ ];
52
+ const filledFields = configFields.filter(f => f && Object.keys(f).length > 0).length;
53
+ score += (filledFields / configFields.length) * weights.configCompleteness;
54
+
55
+ // Permission granularity bonus
56
+ if (config.agentPermissions) {
57
+ const permCount = Object.keys(config.agentPermissions).length;
58
+ score += Math.min(permCount / 8, 1) * 5;
59
+ }
60
+
61
+ // Trust signature (0-20)
62
+ const dirEntry = db.prepare('SELECT * FROM wab_directory WHERE site_id = ?').get(site.id);
63
+ if (dirEntry && dirEntry.trust_signature) {
64
+ const isValid = validateTrustSignature(dirEntry.trust_signature);
65
+ score += isValid ? weights.trustSignature : weights.trustSignature * 0.3;
66
+ }
67
+
68
+ // Commission transparency (0-25)
69
+ if (dirEntry) {
70
+ if (dirEntry.commission_rate >= 0) score += 10;
71
+ if (dirEntry.direct_benefit && dirEntry.direct_benefit.length > 0) score += 10;
72
+ if (dirEntry.commission_rate === 0) score += 5;
73
+ }
74
+
75
+ // Responsiveness (0-25): based on recent analytics activity
76
+ try {
77
+ const recentActivity = db.prepare(
78
+ 'SELECT COUNT(*) as c FROM analytics WHERE site_id = ? AND created_at >= datetime("now", "-7 days")'
79
+ ).get(site.id);
80
+ if (recentActivity) {
81
+ const activityScore = Math.min(recentActivity.c / 100, 1) * weights.responsiveness;
82
+ score += activityScore;
83
+ }
84
+ } catch (_) {
85
+ // analytics table may not exist yet
86
+ }
87
+
88
+ return Math.round(Math.min(Math.max(score, 0), 100) * 100) / 100;
89
+ }
90
+
91
+ // ─── Fairness-Weighted Search ────────────────────────────────────────
92
+
93
+ /**
94
+ * Search sites with fairness-weighted ranking rather than pure relevance.
95
+ */
96
+ function fairnessWeightedSearch(query, sites) {
97
+ if (!sites || sites.length === 0) return [];
98
+
99
+ const queryLower = (query || '').toLowerCase();
100
+ const terms = queryLower.split(/\s+/).filter(Boolean);
101
+
102
+ const scored = sites.map(site => {
103
+ let config = {};
104
+ try { config = JSON.parse(site.config || '{}'); } catch (_) {}
105
+
106
+ // Base relevance: match query against name, domain, description, category
107
+ let relevance = 0;
108
+ const searchable = [
109
+ site.name,
110
+ site.domain,
111
+ site.description,
112
+ config.category
113
+ ].filter(Boolean).join(' ').toLowerCase();
114
+
115
+ for (const term of terms) {
116
+ if (searchable.includes(term)) relevance += 20;
117
+ }
118
+ if (site.name && site.name.toLowerCase().includes(queryLower)) relevance += 30;
119
+ if (site.domain && site.domain.toLowerCase().includes(queryLower)) relevance += 25;
120
+
121
+ if (!queryLower) relevance = 50;
122
+
123
+ // Fairness adjustments
124
+ const dirEntry = db.prepare('SELECT * FROM wab_directory WHERE site_id = ?').get(site.id);
125
+ let fairnessBoost = 0;
126
+
127
+ // Independent businesses get +15%
128
+ if (dirEntry && dirEntry.is_independent) {
129
+ fairnessBoost += relevance * 0.15;
130
+ }
131
+
132
+ // Transparent commission gets +10%
133
+ if (dirEntry && dirEntry.commission_rate >= 0 && dirEntry.direct_benefit) {
134
+ fairnessBoost += relevance * 0.10;
135
+ }
136
+
137
+ // Neutrality score influence (up to +20%)
138
+ const neutralityScore = dirEntry ? dirEntry.neutrality_score : 50;
139
+ fairnessBoost += (neutralityScore / 100) * relevance * 0.20;
140
+
141
+ // Randomization factor to prevent position lock-in (±5%)
142
+ const jitter = (Math.random() - 0.5) * relevance * 0.10;
143
+
144
+ const finalScore = relevance + fairnessBoost + jitter;
145
+
146
+ return {
147
+ ...site,
148
+ config,
149
+ _relevance: Math.round(relevance * 100) / 100,
150
+ _fairnessBoost: Math.round(fairnessBoost * 100) / 100,
151
+ _finalScore: Math.round(finalScore * 100) / 100,
152
+ _neutralityScore: neutralityScore,
153
+ _isIndependent: dirEntry ? !!dirEntry.is_independent : false
154
+ };
155
+ });
156
+
157
+ scored.sort((a, b) => b._finalScore - a._finalScore);
158
+
159
+ return ensureNeutralDistribution(scored);
160
+ }
161
+
162
+ // ─── Directory Registration ──────────────────────────────────────────
163
+
164
+ function registerInDirectory(siteId, metadata = {}) {
165
+ const site = db.prepare('SELECT * FROM sites WHERE id = ? AND active = 1').get(siteId);
166
+ if (!site) return { success: false, error: 'Site not found or inactive' };
167
+
168
+ const neutralityScore = calculateNeutralityScore(site);
169
+
170
+ const existing = db.prepare('SELECT * FROM wab_directory WHERE site_id = ?').get(siteId);
171
+ if (existing) {
172
+ db.prepare(`
173
+ UPDATE wab_directory SET
174
+ category = ?, tags = ?, is_independent = ?, commission_rate = ?,
175
+ direct_benefit = ?, trust_signature = ?, neutrality_score = ?,
176
+ updated_at = datetime('now')
177
+ WHERE site_id = ?
178
+ `).run(
179
+ metadata.category || existing.category || 'general',
180
+ JSON.stringify(metadata.tags || JSON.parse(existing.tags || '[]')),
181
+ metadata.is_independent !== undefined ? (metadata.is_independent ? 1 : 0) : existing.is_independent,
182
+ metadata.commission_rate !== undefined ? metadata.commission_rate : existing.commission_rate,
183
+ metadata.direct_benefit || existing.direct_benefit || '',
184
+ metadata.trust_signature || existing.trust_signature || null,
185
+ neutralityScore,
186
+ siteId
187
+ );
188
+ } else {
189
+ db.prepare(`
190
+ INSERT INTO wab_directory (site_id, category, tags, is_independent, commission_rate, direct_benefit, trust_signature, neutrality_score)
191
+ VALUES (?, ?, ?, ?, ?, ?, ?, ?)
192
+ `).run(
193
+ siteId,
194
+ metadata.category || 'general',
195
+ JSON.stringify(metadata.tags || []),
196
+ metadata.is_independent ? 1 : 0,
197
+ metadata.commission_rate || 0,
198
+ metadata.direct_benefit || '',
199
+ metadata.trust_signature || null,
200
+ neutralityScore
201
+ );
202
+ }
203
+
204
+ return {
205
+ success: true,
206
+ siteId,
207
+ neutralityScore,
208
+ category: metadata.category || 'general'
209
+ };
210
+ }
211
+
212
+ // ─── Directory Listings ──────────────────────────────────────────────
213
+
214
+ function getDirectoryListings(category, options = {}) {
215
+ const { limit = 50, offset = 0, includeUnlisted = false } = options;
216
+
217
+ let query = `
218
+ SELECT s.*, d.category, d.tags, d.is_independent, d.commission_rate,
219
+ d.direct_benefit, d.neutrality_score, d.trust_signature, d.registered_at as directory_registered_at
220
+ FROM wab_directory d
221
+ JOIN sites s ON d.site_id = s.id AND s.active = 1
222
+ `;
223
+ const params = [];
224
+
225
+ const conditions = [];
226
+ if (!includeUnlisted) conditions.push('d.listed = 1');
227
+ if (category && category !== 'all') {
228
+ conditions.push('d.category = ?');
229
+ params.push(category);
230
+ }
231
+
232
+ if (conditions.length > 0) {
233
+ query += ' WHERE ' + conditions.join(' AND ');
234
+ }
235
+
236
+ query += ' ORDER BY d.neutrality_score DESC, s.name ASC';
237
+ query += ' LIMIT ? OFFSET ?';
238
+ params.push(limit, offset);
239
+
240
+ const listings = db.prepare(query).all(...params);
241
+
242
+ // Apply fairness shuffling to the top results
243
+ return shuffleTopResults(listings);
244
+ }
245
+
246
+ // ─── Trust Signature Validation ──────────────────────────────────────
247
+
248
+ /**
249
+ * Validate a trust signature. Signatures are opaque tokens that
250
+ * indicate the site owner has verified their identity through
251
+ * an external trust provider.
252
+ *
253
+ * Format: "wab-trust-v1:<hex-payload>" (min 32 char payload)
254
+ */
255
+ function validateTrustSignature(signature) {
256
+ if (!signature || typeof signature !== 'string') return false;
257
+
258
+ if (!signature.startsWith('wab-trust-v1:')) return false;
259
+
260
+ const payload = signature.slice('wab-trust-v1:'.length);
261
+ if (payload.length < 32) return false;
262
+ if (!/^[a-f0-9]+$/i.test(payload)) return false;
263
+
264
+ return true;
265
+ }
266
+
267
+ // ─── Fairness Report ─────────────────────────────────────────────────
268
+
269
+ function generateFairnessReport(siteId) {
270
+ const site = db.prepare('SELECT * FROM sites WHERE id = ?').get(siteId);
271
+ if (!site) return null;
272
+
273
+ const dirEntry = db.prepare('SELECT * FROM wab_directory WHERE site_id = ?').get(siteId);
274
+ const neutralityScore = calculateNeutralityScore(site);
275
+
276
+ let config = {};
277
+ try { config = JSON.parse(site.config || '{}'); } catch (_) {}
278
+
279
+ const configFields = [config.agentPermissions, config.restrictions, config.logging, config.features];
280
+ const filledFields = configFields.filter(f => f && Object.keys(f).length > 0).length;
281
+
282
+ let recentActivity = { c: 0 };
283
+ try {
284
+ recentActivity = db.prepare(
285
+ 'SELECT COUNT(*) as c FROM analytics WHERE site_id = ? AND created_at >= datetime("now", "-7 days")'
286
+ ).get(siteId) || { c: 0 };
287
+ } catch (_) {}
288
+
289
+ const factors = {
290
+ config_completeness: {
291
+ score: Math.round((filledFields / configFields.length) * 30),
292
+ max: 30,
293
+ details: `${filledFields}/${configFields.length} config sections populated`
294
+ },
295
+ trust_verification: {
296
+ score: dirEntry && dirEntry.trust_signature && validateTrustSignature(dirEntry.trust_signature) ? 20 : 0,
297
+ max: 20,
298
+ details: dirEntry && dirEntry.trust_signature ? 'Trust signature present' : 'No trust signature'
299
+ },
300
+ commission_transparency: {
301
+ score: dirEntry ? ((dirEntry.commission_rate >= 0 ? 10 : 0) + (dirEntry.direct_benefit ? 10 : 0) + (dirEntry.commission_rate === 0 ? 5 : 0)) : 0,
302
+ max: 25,
303
+ details: dirEntry ? `Commission: ${dirEntry.commission_rate}%, Benefit: ${dirEntry.direct_benefit || 'not specified'}` : 'Not registered in directory'
304
+ },
305
+ responsiveness: {
306
+ score: recentActivity ? Math.round(Math.min(recentActivity.c / 100, 1) * 25) : 0,
307
+ max: 25,
308
+ details: `${recentActivity ? recentActivity.c : 0} events in last 7 days`
309
+ }
310
+ };
311
+
312
+ return {
313
+ siteId,
314
+ domain: site.domain,
315
+ name: site.name,
316
+ tier: site.tier,
317
+ neutrality_score: neutralityScore,
318
+ is_independent: dirEntry ? !!dirEntry.is_independent : false,
319
+ registered_in_directory: !!dirEntry,
320
+ factors,
321
+ recommendations: generateRecommendations(factors, dirEntry),
322
+ generated_at: new Date().toISOString()
323
+ };
324
+ }
325
+
326
+ function generateRecommendations(factors, dirEntry) {
327
+ const recs = [];
328
+
329
+ if (factors.config_completeness.score < factors.config_completeness.max * 0.7) {
330
+ recs.push('Complete all configuration sections (agentPermissions, restrictions, logging, features) for a higher score.');
331
+ }
332
+ if (factors.trust_verification.score === 0) {
333
+ recs.push('Add a trust signature to verify your site identity and boost your neutrality score.');
334
+ }
335
+ if (!dirEntry) {
336
+ recs.push('Register in the WAB directory to appear in discovery searches.');
337
+ }
338
+ if (factors.commission_transparency.score < factors.commission_transparency.max * 0.5) {
339
+ recs.push('Specify your commission rate and direct benefit to increase transparency scoring.');
340
+ }
341
+ if (factors.responsiveness.score < factors.responsiveness.max * 0.3) {
342
+ recs.push('Increase site activity (agent interactions) to improve responsiveness score.');
343
+ }
344
+
345
+ return recs;
346
+ }
347
+
348
+ // ─── Neutral Distribution ────────────────────────────────────────────
349
+
350
+ /**
351
+ * Re-rank results so no single provider dominates more than 30%
352
+ * of the top results. Applies fairness rotation.
353
+ */
354
+ function ensureNeutralDistribution(results) {
355
+ if (results.length <= 3) return results;
356
+
357
+ const topCount = Math.max(Math.ceil(results.length * 0.3), 3);
358
+ const topSlice = results.slice(0, topCount);
359
+ const rest = results.slice(topCount);
360
+
361
+ // Count how many results come from each domain owner (user_id)
362
+ const ownerCounts = {};
363
+ for (const r of topSlice) {
364
+ const owner = r.user_id || r.domain || 'unknown';
365
+ ownerCounts[owner] = (ownerCounts[owner] || 0) + 1;
366
+ }
367
+
368
+ const maxAllowed = Math.max(Math.ceil(topCount * 0.3), 1);
369
+ const redistributed = [];
370
+ const demoted = [];
371
+
372
+ for (const r of topSlice) {
373
+ const owner = r.user_id || r.domain || 'unknown';
374
+ const currentCount = redistributed.filter(x => (x.user_id || x.domain) === owner).length;
375
+ if (currentCount < maxAllowed) {
376
+ redistributed.push(r);
377
+ } else {
378
+ demoted.push(r);
379
+ }
380
+ }
381
+
382
+ // Shuffle the top results slightly to prevent position lock-in
383
+ for (let i = redistributed.length - 1; i > 0; i--) {
384
+ const swapRange = Math.min(3, i);
385
+ const j = i - Math.floor(Math.random() * swapRange);
386
+ if (j !== i) {
387
+ [redistributed[i], redistributed[j]] = [redistributed[j], redistributed[i]];
388
+ }
389
+ }
390
+
391
+ return [...redistributed, ...demoted, ...rest];
392
+ }
393
+
394
+ // ─── Helper: Shuffle Top Results ─────────────────────────────────────
395
+
396
+ function shuffleTopResults(listings) {
397
+ if (listings.length <= 2) return listings;
398
+
399
+ const rotateCount = Math.min(5, Math.ceil(listings.length * 0.2));
400
+ const top = listings.slice(0, rotateCount);
401
+ const rest = listings.slice(rotateCount);
402
+
403
+ // Fisher-Yates on the top segment only
404
+ for (let i = top.length - 1; i > 0; i--) {
405
+ const j = Math.floor(Math.random() * (i + 1));
406
+ [top[i], top[j]] = [top[j], top[i]];
407
+ }
408
+
409
+ return [...top, ...rest];
410
+ }
411
+
412
+ module.exports = {
413
+ calculateNeutralityScore,
414
+ fairnessWeightedSearch,
415
+ registerInDirectory,
416
+ getDirectoryListings,
417
+ validateTrustSignature,
418
+ generateFairnessReport,
419
+ ensureNeutralDistribution
420
+ };