@adcp/sdk 12.0.0 → 12.0.1

package/dist/lib/adapters/content-standards-adapter.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 const ContentStandardsErrorCodes = {
   NOT_SUPPORTED: "UNSUPPORTED_FEATURE",
   STANDARDS_NOT_FOUND: "REFERENCE_NOT_FOUND",

package/dist/lib/adapters/content-standards-adapter.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/adapters/content-standards-adapter.ts"],"sourcesContent":["/**\n * Content Standards Adapter\n *\n * Server-side adapter for implementing content standards evaluation logic.\n * Publishers use this to plug in their brand safety/suitability evaluation systems.\n *\n * This is a stub implementation that returns not-supported responses.\n * Publishers should extend or replace this with their actual evaluation logic.\n */\n\nimport type {\n  ListContentStandardsRequest,\n  ListContentStandardsResponse,\n  GetContentStandardsRequest,\n  GetContentStandardsResponse,\n  CreateContentStandardsRequest,\n  CreateContentStandardsResponse,\n  UpdateContentStandardsRequest,\n  UpdateContentStandardsResponse,\n  CalibrateContentRequest,\n  CalibrateContentResponse,\n  ValidateContentDeliveryRequest,\n  ValidateContentDeliveryResponse,\n  ContentStandards,\n  Artifact,\n} from '../types/tools.generated';\n\n/**\n * Content evaluation result from the adapter\n */\nexport interface ContentEvaluationResult {\n  verdict: 'pass' | 'fail';\n  confidence?: number;\n  explanation?: string;\n  features?: {\n    feature_id: string;\n    status: 'passed' | 'failed' | 'warning' | 'unevaluated';\n    explanation?: string;\n  }[];\n}\n\n/**\n * Abstract interface for content standards adapters.\n * Publishers implement this to provide their evaluation logic.\n */\nexport interface IContentStandardsAdapter {\n  /**\n   * Check if content standards are supported by this server\n   */\n  isSupported(): boolean;\n\n  /**\n   * List available content standards configurations\n   */\n  listStandards(request: ListContentStandardsRequest): Promise<ListContentStandardsResponse>;\n\n  /**\n   * Get a specific content standards configuration\n   */\n  getStandards(request: GetContentStandardsRequest): Promise<GetContentStandardsResponse>;\n\n  /**\n   * Create a new content standards configuration\n   */\n  createStandards(request: CreateContentStandardsRequest): Promise<CreateContentStandardsResponse>;\n\n  /**\n   * Update an existing content standards configuration\n   */\n  updateStandards(request: UpdateContentStandardsRequest): Promise<UpdateContentStandardsResponse>;\n\n  /**\n   * Calibrate content against standards (interactive feedback loop)\n   */\n  calibrateContent(request: CalibrateContentRequest): Promise<CalibrateContentResponse>;\n\n  /**\n   * Validate delivery records against content standards (batch validation)\n   */\n  validateContentDelivery(request: ValidateContentDeliveryRequest): Promise<ValidateContentDeliveryResponse>;\n\n  /**\n   * Evaluate a single artifact against standards.\n   * Used internally by get_products and create_media_buy to filter content.\n   */\n  evaluateArtifact(standardsId: string, artifact: Artifact): Promise<ContentEvaluationResult>;\n}\n\n/**\n * Error codes for content standards operations\n */\nexport const ContentStandardsErrorCodes = {\n  NOT_SUPPORTED: 'UNSUPPORTED_FEATURE',\n  STANDARDS_NOT_FOUND: 'REFERENCE_NOT_FOUND',\n  INVALID_STANDARDS: 'INVALID_REQUEST',\n  EVALUATION_FAILED: 'SERVICE_UNAVAILABLE',\n  QUOTA_EXCEEDED: 'QUOTA_EXCEEDED',\n} as const;\n\n/**\n * Stub implementation of ContentStandardsAdapter.\n * Returns not-supported errors for all operations.\n *\n * Publishers should extend this class or provide their own implementation\n * that integrates with their brand safety systems.\n */\nexport class ContentStandardsAdapter implements IContentStandardsAdapter {\n  /**\n   * Check if content standards are supported.\n   * Override this to return true when implementing real logic.\n   */\n  isSupported(): boolean {\n    return false;\n  }\n\n  async listStandards(request: ListContentStandardsRequest): Promise<ListContentStandardsResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards are not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to return actual standards\n    return {\n      status: 'completed',\n      standards: [],\n      context: request.context,\n    };\n  }\n\n  async getStandards(request: GetContentStandardsRequest): Promise<GetContentStandardsResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards are not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to return actual standards\n    return {\n      status: 'failed',\n      errors: [\n        {\n          code: ContentStandardsErrorCodes.STANDARDS_NOT_FOUND,\n          message: `Standards not found: ${request.standards_id}`,\n        },\n      ],\n    };\n  }\n\n  async createStandards(request: CreateContentStandardsRequest): Promise<CreateContentStandardsResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards are not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to implement creation logic\n    return {\n      status: 'failed',\n      errors: [\n        {\n          code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n          message: 'Creating content standards is not implemented',\n        },\n      ],\n    };\n  }\n\n  async updateStandards(request: UpdateContentStandardsRequest): Promise<UpdateContentStandardsResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        success: false as const,\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards are not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to implement update logic\n    return {\n      status: 'failed',\n      success: false as const,\n      errors: [\n        {\n          code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n          message: 'Updating content standards is not implemented',\n        },\n      ],\n    };\n  }\n\n  async calibrateContent(request: CalibrateContentRequest): Promise<CalibrateContentResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards calibration is not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to implement calibration logic\n    return {\n      status: 'failed',\n      errors: [\n        {\n          code: ContentStandardsErrorCodes.EVALUATION_FAILED,\n          message: 'Content calibration is not implemented',\n        },\n      ],\n    };\n  }\n\n  async validateContentDelivery(request: ValidateContentDeliveryRequest): Promise<ValidateContentDeliveryResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content delivery validation is not supported by this server',\n          },\n        ],\n        context: request.context,\n      };\n    }\n\n    // Override in subclass to implement validation logic\n    // Stub returns all records as passed (no filtering)\n    return {\n      status: 'completed',\n      summary: {\n        total_records: request.records.length,\n        passed_records: request.records.length,\n        failed_records: 0,\n      },\n      results: request.records.map(record => ({\n        record_id: record.record_id,\n        verdict: 'pass' as const,\n      })),\n      context: request.context,\n    };\n  }\n\n  /**\n   * Evaluate a single artifact against content standards.\n   * Used by get_products and create_media_buy to filter content.\n   */\n  async evaluateArtifact(standardsId: string, artifact: Artifact): Promise<ContentEvaluationResult> {\n    if (!this.isSupported()) {\n      // When not supported, all content passes (no filtering)\n      return {\n        verdict: 'pass',\n        confidence: 1.0,\n        explanation: 'Content standards evaluation not enabled',\n      };\n    }\n\n    // Override in subclass to implement actual evaluation\n    return {\n      verdict: 'pass',\n      confidence: 1.0,\n      explanation: 'Default pass-through (no evaluation implemented)',\n    };\n  }\n}\n\n/**\n * Helper to check if a response is an error response\n */\nexport function isContentStandardsError(\n  response: ListContentStandardsResponse | GetContentStandardsResponse | CreateContentStandardsResponse\n): boolean {\n  return 'errors' in response && Array.isArray(response.errors) && response.errors.length > 0;\n}\n\n/**\n * Default singleton instance for servers that don't need content standards\n */\nexport const defaultContentStandardsAdapter = new ContentStandardsAdapter();\n"],"mappings":";;;;;;AA2FO,MAAM,6BAA6B;AAAA,EACxC,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,gBAAgB;AAClB;AASO,MAAM,wBAA4D;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvE,cAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,SAA6E;AAC/F,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,CAAC;AAAA,MACZ,SAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAA2E;AAC5F,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,UACE,MAAM,2BAA2B;AAAA,UACjC,SAAS,wBAAwB,QAAQ,YAAY;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAiF;AACrG,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,UACE,MAAM,2BAA2B;AAAA,UACjC,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAiF;AACrG,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ;AAAA,QACN;AAAA,UACE,MAAM,2BAA2B;AAAA,UACjC,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAqE;AAC1F,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,UACE,MAAM,2BAA2B;AAAA,UACjC,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,SAAmF;AAC/G,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA,SAAS,QAAQ;AAAA,MACnB;AAAA,IACF;AAIA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,QAAQ,QAAQ;AAAA,QAC/B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,gBAAgB;AAAA,MAClB;AAAA,MACA,SAAS,QAAQ,QAAQ,IAAI,aAAW;AAAA,QACtC,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,MACX,EAAE;AAAA,MACF,SAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,iBAAiB,aAAqB,UAAsD;AAChG,QAAI,CAAC,KAAK,YAAY,GAAG;AAEvB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,aAAa;AAAA,MACf;AAAA,IACF;AAGA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAKO,SAAS,wBACd,UACS;AACT,SAAO,YAAY,YAAY,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,OAAO,SAAS;AAC5F;AAKO,MAAM,iCAAiC,IAAI,wBAAwB;","names":[]}
+{"version":3,"sources":["../../../src/lib/adapters/content-standards-adapter.ts"],"sourcesContent":["/**\n * Content Standards Adapter\n *\n * Server-side adapter for implementing content standards evaluation logic.\n * Publishers use this to plug in their brand safety/suitability evaluation systems.\n *\n * This is a stub implementation that returns not-supported responses.\n * Publishers should extend or replace this with their actual evaluation logic.\n */\n\nimport type {\n  ListContentStandardsRequest,\n  ListContentStandardsResponse,\n  GetContentStandardsRequest,\n  GetContentStandardsResponse,\n  CreateContentStandardsRequest,\n  CreateContentStandardsResponse,\n  UpdateContentStandardsRequest,\n  UpdateContentStandardsResponse,\n  CalibrateContentRequest,\n  CalibrateContentResponse,\n  ValidateContentDeliveryRequest,\n  ValidateContentDeliveryResponse,\n  ContentStandards,\n  Artifact,\n} from '../types/tools.generated';\n\n/**\n * Content evaluation result from the adapter\n */\nexport interface ContentEvaluationResult {\n  verdict: 'pass' | 'fail';\n  confidence?: number;\n  explanation?: string;\n  features?: {\n    feature_id: string;\n    status: 'passed' | 'failed' | 'warning' | 'unevaluated';\n    explanation?: string;\n  }[];\n}\n\n/**\n * Abstract interface for content standards adapters.\n * Publishers implement this to provide their evaluation logic.\n */\nexport interface IContentStandardsAdapter {\n  /**\n   * Check if content standards are supported by this server\n   */\n  isSupported(): boolean;\n\n  /**\n   * List available content standards configurations\n   */\n  listStandards(request: ListContentStandardsRequest): Promise<ListContentStandardsResponse>;\n\n  /**\n   * Get a specific content standards configuration\n   */\n  getStandards(request: GetContentStandardsRequest): Promise<GetContentStandardsResponse>;\n\n  /**\n   * Create a new content standards configuration\n   */\n  createStandards(request: CreateContentStandardsRequest): Promise<CreateContentStandardsResponse>;\n\n  /**\n   * Update an existing content standards configuration\n   */\n  updateStandards(request: UpdateContentStandardsRequest): Promise<UpdateContentStandardsResponse>;\n\n  /**\n   * Calibrate content against standards (interactive feedback loop)\n   */\n  calibrateContent(request: CalibrateContentRequest): Promise<CalibrateContentResponse>;\n\n  /**\n   * Validate delivery records against content standards (batch validation)\n   */\n  validateContentDelivery(request: ValidateContentDeliveryRequest): Promise<ValidateContentDeliveryResponse>;\n\n  /**\n   * Evaluate a single artifact against standards.\n   * Used internally by get_products and create_media_buy to filter content.\n   */\n  evaluateArtifact(standardsId: string, artifact: Artifact): Promise<ContentEvaluationResult>;\n}\n\n/**\n * Error codes for content standards operations\n */\nexport const ContentStandardsErrorCodes = {\n  NOT_SUPPORTED: 'UNSUPPORTED_FEATURE',\n  STANDARDS_NOT_FOUND: 'REFERENCE_NOT_FOUND',\n  INVALID_STANDARDS: 'INVALID_REQUEST',\n  EVALUATION_FAILED: 'SERVICE_UNAVAILABLE',\n  QUOTA_EXCEEDED: 'QUOTA_EXCEEDED',\n} as const;\n\n/**\n * Stub implementation of ContentStandardsAdapter.\n * Returns not-supported errors for all operations.\n *\n * Publishers should extend this class or provide their own implementation\n * that integrates with their brand safety systems.\n */\nexport class ContentStandardsAdapter implements IContentStandardsAdapter {\n  /**\n   * Check if content standards are supported.\n   * Override this to return true when implementing real logic.\n   */\n  isSupported(): boolean {\n    return false;\n  }\n\n  async listStandards(request: ListContentStandardsRequest): Promise<ListContentStandardsResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards are not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to return actual standards\n    return {\n      status: 'completed',\n      standards: [],\n      context: request.context,\n    };\n  }\n\n  async getStandards(request: GetContentStandardsRequest): Promise<GetContentStandardsResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards are not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to return actual standards\n    return {\n      status: 'failed',\n      errors: [\n        {\n          code: ContentStandardsErrorCodes.STANDARDS_NOT_FOUND,\n          message: `Standards not found: ${request.standards_id}`,\n        },\n      ],\n    };\n  }\n\n  async createStandards(request: CreateContentStandardsRequest): Promise<CreateContentStandardsResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards are not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to implement creation logic\n    return {\n      status: 'failed',\n      errors: [\n        {\n          code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n          message: 'Creating content standards is not implemented',\n        },\n      ],\n    };\n  }\n\n  async updateStandards(request: UpdateContentStandardsRequest): Promise<UpdateContentStandardsResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        success: false as const,\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards are not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to implement update logic\n    return {\n      status: 'failed',\n      success: false as const,\n      errors: [\n        {\n          code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n          message: 'Updating content standards is not implemented',\n        },\n      ],\n    };\n  }\n\n  async calibrateContent(request: CalibrateContentRequest): Promise<CalibrateContentResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content standards calibration is not supported by this server',\n          },\n        ],\n      };\n    }\n\n    // Override in subclass to implement calibration logic\n    return {\n      status: 'failed',\n      errors: [\n        {\n          code: ContentStandardsErrorCodes.EVALUATION_FAILED,\n          message: 'Content calibration is not implemented',\n        },\n      ],\n    };\n  }\n\n  async validateContentDelivery(request: ValidateContentDeliveryRequest): Promise<ValidateContentDeliveryResponse> {\n    if (!this.isSupported()) {\n      return {\n        status: 'failed',\n        errors: [\n          {\n            code: ContentStandardsErrorCodes.NOT_SUPPORTED,\n            message: 'Content delivery validation is not supported by this server',\n          },\n        ],\n        context: request.context,\n      };\n    }\n\n    // Override in subclass to implement validation logic\n    // Stub returns all records as passed (no filtering)\n    return {\n      status: 'completed',\n      summary: {\n        total_records: request.records.length,\n        passed_records: request.records.length,\n        failed_records: 0,\n      },\n      results: request.records.map(record => ({\n        record_id: record.record_id,\n        verdict: 'pass' as const,\n      })),\n      context: request.context,\n    };\n  }\n\n  /**\n   * Evaluate a single artifact against content standards.\n   * Used by get_products and create_media_buy to filter content.\n   */\n  async evaluateArtifact(standardsId: string, artifact: Artifact): Promise<ContentEvaluationResult> {\n    if (!this.isSupported()) {\n      // When not supported, all content passes (no filtering)\n      return {\n        verdict: 'pass',\n        confidence: 1.0,\n        explanation: 'Content standards evaluation not enabled',\n      };\n    }\n\n    // Override in subclass to implement actual evaluation\n    return {\n      verdict: 'pass',\n      confidence: 1.0,\n      explanation: 'Default pass-through (no evaluation implemented)',\n    };\n  }\n}\n\n/**\n * Helper to check if a response is an error response\n */\nexport function isContentStandardsError(\n  response: ListContentStandardsResponse | GetContentStandardsResponse | CreateContentStandardsResponse\n): boolean {\n  return 'errors' in response && Array.isArray(response.errors) && response.errors.length > 0;\n}\n\n/**\n * Default singleton instance for servers that don't need content standards\n */\nexport const defaultContentStandardsAdapter = new ContentStandardsAdapter();\n"],"mappings":"AA2FO,MAAM,6BAA6B;AAAA,EACxC,eAAe;AAAA,EACf,qBAAqB;AAAA,EACrB,mBAAmB;AAAA,EACnB,mBAAmB;AAAA,EACnB,gBAAgB;AAClB;AASO,MAAM,wBAA4D;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvE,cAAuB;AACrB,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,SAA6E;AAC/F,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,CAAC;AAAA,MACZ,SAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAA2E;AAC5F,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,UACE,MAAM,2BAA2B;AAAA,UACjC,SAAS,wBAAwB,QAAQ,YAAY;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAiF;AACrG,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,UACE,MAAM,2BAA2B;AAAA,UACjC,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAiF;AACrG,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,QAAQ;AAAA,QACN;AAAA,UACE,MAAM,2BAA2B;AAAA,UACjC,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAqE;AAC1F,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,QACN;AAAA,UACE,MAAM,2BAA2B;AAAA,UACjC,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,SAAmF;AAC/G,QAAI,CAAC,KAAK,YAAY,GAAG;AACvB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ;AAAA,UACN;AAAA,YACE,MAAM,2BAA2B;AAAA,YACjC,SAAS;AAAA,UACX;AAAA,QACF;AAAA,QACA,SAAS,QAAQ;AAAA,MACnB;AAAA,IACF;AAIA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,QAAQ,QAAQ;AAAA,QAC/B,gBAAgB,QAAQ,QAAQ;AAAA,QAChC,gBAAgB;AAAA,MAClB;AAAA,MACA,SAAS,QAAQ,QAAQ,IAAI,aAAW;AAAA,QACtC,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,MACX,EAAE;AAAA,MACF,SAAS,QAAQ;AAAA,IACnB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,iBAAiB,aAAqB,UAAsD;AAChG,QAAI,CAAC,KAAK,YAAY,GAAG;AAEvB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,aAAa;AAAA,MACf;AAAA,IACF;AAGA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAKO,SAAS,wBACd,UACS;AACT,SAAO,YAAY,YAAY,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,OAAO,SAAS;AAC5F;AAKO,MAAM,iCAAiC,IAAI,wBAAwB;","names":[]}

package/dist/lib/adapters/derived-account-store.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { AdcpError } from "../server/decisioning/async-outcome.mjs";
 function createDerivedAccountStore(options) {
   const skipAuthCheck = options.skipAuthCheck ?? false;

package/dist/lib/adapters/derived-account-store.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/adapters/derived-account-store.ts"],"sourcesContent":["/**\n * Derived `AccountStore` factory for `resolution: 'derived'` single-tenant\n * agents — there is no `account_id` on the wire and the auth principal alone\n * identifies the tenant. Most self-hosted broadcasters, retail-media operators\n * in proxy mode, and creative-only adapters (audiostack, flashtalking) where\n * every API call is scoped by the buyer's per-request credential.\n *\n * Pairs with the existing reference adapters. Pick by asking *who creates the\n * account?*:\n * - **Buyer self-onboards via `sync_accounts`** → {@link InMemoryImplicitAccountStore}\n *   (Shape A, `resolution: 'implicit'`).\n * - **Upstream OAuth API owns the roster** → {@link createOAuthPassthroughResolver}\n *   (Shape B, `resolution: 'explicit'`).\n * - **Publisher ops curates the roster** → {@link createRosterAccountStore}\n *   (Shape C, `resolution: 'explicit'`).\n * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`\n *   (this file, Shape D, `resolution: 'derived'`).\n *\n * Closes adcp-client#1462. Replaces the ~25–30 LOC of `if (!authInfo.token) throw\n * AUTH_REQUIRED; return { id: ..., ctx_metadata: { accessToken } }` boilerplate\n * Shape D adopters write today.\n *\n * @see docs/guides/account-resolution.md\n * @public\n */\n\nimport type { AccountReference } from '../types/tools.generated';\nimport type { Account, AccountStore, ResolveContext } from '../server/decisioning/account';\nimport { AdcpError } from '../server/decisioning/async-outcome';\n\n/**\n * Options for {@link createDerivedAccountStore}.\n *\n * @public\n */\nexport interface DerivedAccountStoreOptions<TCtxMeta = Record<string, unknown>> {\n  /**\n   * Build the singleton account from the request context. Called on every\n   * `resolve()` (no caching — the tenant is per-request because the auth\n   * principal varies). The returned account's `id` is typically a stable\n   * literal (e.g. `'audiostack'`, `'__publisher_wide__'`); single-tenant\n   * adapters have no buyer-supplied account_id to reflect back.\n   *\n   * **DO NOT put credentials in `ctx_metadata`.** See\n   * `docs/guides/CTX-METADATA-SAFETY.md` for the rationale. The wire-strip\n   * protects buyer responses but does NOT protect server-side log lines,\n   * error envelopes, or adopter-generated strings (e.g. `JSON.stringify(account)`\n   * in an error message). Re-derive the bearer from `ctx.authInfo` per\n   * request inside specialism methods instead.\n   *\n   * Adopters MAY omit `authInfo` from the returned `Account` — the framework\n   * auto-attaches the principal from `ctx.authInfo` when absent (matches\n   * Shape A/B/C semantics).\n   */\n  toAccount: (ctx: ResolveContext | undefined) => Account<TCtxMeta>;\n\n  /**\n   * Skip the `AUTH_REQUIRED` precheck. Defaults to `false` — the factory\n   * throws `AdcpError('AUTH_REQUIRED')` when `ctx.authInfo` is absent or\n   * carries no credential, matching the canonical Shape D pattern (every\n   * call must authenticate).\n   *\n   * Set to `true` for genuinely unauthenticated single-tenant agents (rare —\n   * public format catalogs, signed-request-only agents that authenticate\n   * out-of-band). When `true`, `toAccount` runs unconditionally.\n   *\n   * If you're tempted to set this because tests don't carry `authInfo`,\n   * fix the tests instead — `serve({ authenticate })` should populate\n   * `ctx.authInfo` from your test harness (or use `dispatchTestRequest`\n   * which threads a synthetic principal). The escape hatch is for\n   * production agents that legitimately accept unauthenticated traffic,\n   * not for working around fixture gaps.\n   *\n   * @default false\n   */\n  skipAuthCheck?: boolean;\n}\n\n/**\n * Build an `AccountStore<TCtxMeta>` for single-tenant agents whose tenant is\n * derived from the auth principal alone (no `account_id` on the wire).\n *\n * The factory:\n * 1. Sets `resolution: 'derived'`.\n * 2. Throws `AdcpError('AUTH_REQUIRED')` when `ctx.authInfo` carries no\n *    credential (skip with `skipAuthCheck: true`). The check accepts the\n *    discriminated `credential` shape (preferred) AND the deprecated\n *    `token` / `clientId` fields populated by pre-#1269 authenticators —\n *    fail-closed only when none of the three are present.\n * 3. Calls `toAccount(ctx)` and returns the result. Buyer-supplied\n *    `AccountReference` is ignored — single-tenant by definition.\n * 4. Omits `list` / `upsert` — single-tenant adapters have nothing to\n *    enumerate or write. Adopters who want either compose via spread.\n *\n * **When NOT to use this.** If two different auth principals should resolve\n * to two different `account.id` values, you want Shape B\n * ({@link createOAuthPassthroughResolver}) or `createTenantStore` — NOT this\n * factory. Misusing Shape D in a multi-tenant deployment routes every buyer\n * to the same singleton id and breaks tenant isolation silently (no error,\n * no log). The factory is single-tenant by design — `toAccount(ctx)` should\n * return the same `id` for every principal that calls it.\n *\n * @example AudioStack-shaped creative adapter:\n * ```ts\n * import { createDerivedAccountStore } from '@adcp/sdk/server';\n *\n * const accounts = createDerivedAccountStore<AudioStackAccountMeta>({\n *   toAccount: (ctx) => ({\n *     id: 'audiostack',\n *     name: 'AudioStack',\n *     status: 'active',\n *     ctx_metadata: {},                     // tokens stay on ctx.authInfo, not here\n *   }),\n * });\n * ```\n *\n * @example Single-tenant retail-media proxy with derived display name:\n * ```ts\n * const accounts = createDerivedAccountStore<{ tenantId: string }>({\n *   toAccount: (ctx) => {\n *     const cred = ctx?.authInfo?.credential;\n *     const tenantId = cred?.kind === 'oauth' ? cred.client_id\n *                    : cred?.kind === 'api_key' ? cred.key_id\n *                    : 'public';\n *     return {\n *       id: 'criteo',\n *       name: `Criteo (${tenantId})`,\n *       status: 'active',\n *       ctx_metadata: { tenantId },\n *     };\n *   },\n * });\n * ```\n *\n * @example Compose `upsert` for adapters that ALSO want a buyer-driven\n * write path (rare for Shape D, but possible):\n * ```ts\n * const accounts: AccountStore<MyMeta> = {\n *   ...createDerivedAccountStore({ toAccount }),\n *   upsert: async (refs, ctx) => mySync(refs, ctx),\n * };\n * ```\n *\n * **Buyer-supplied `account_id` is refused at the framework boundary.**\n * Since adcp-client#1468, the framework throws `AdcpError('INVALID_REQUEST',\n * { field: 'account.account_id' })` BEFORE reaching this resolver when a\n * `'derived'`-mode platform receives an inline `account_id` — same shape\n * as `'implicit'`'s long-standing refusal (#1364), with a single-tenant\n * message instead of the `sync_accounts`-first guidance. The factory\n * itself ignores any `account_id` that does reach it (defensive belt +\n * braces), but adopters can rely on the framework refusal as the\n * canonical surface. Hand-rolled `'derived'` stores get the same\n * enforcement automatically.\n *\n * @public\n */\nexport function createDerivedAccountStore<TCtxMeta = Record<string, unknown>>(\n  options: DerivedAccountStoreOptions<TCtxMeta>\n): AccountStore<TCtxMeta> {\n  const skipAuthCheck = options.skipAuthCheck ?? false;\n\n  return {\n    resolution: 'derived',\n\n    async resolve(_ref: AccountReference | undefined, ctx?: ResolveContext): Promise<Account<TCtxMeta> | null> {\n      if (!skipAuthCheck && !hasAuthSignal(ctx)) {\n        throw new AdcpError('AUTH_REQUIRED', {\n          message: 'Single-tenant agent requires an authenticated principal; no credential on ctx.authInfo.',\n          recovery: 'correctable',\n        });\n      }\n      return options.toAccount(ctx);\n    },\n  };\n}\n\n/**\n * True when `ctx.authInfo` carries any usable credential signal — the\n * discriminated `credential` shape (preferred, post-#1269) OR the deprecated\n * `token` / `clientId` fields still populated by pre-Stage-3 authenticators\n * during the N+1 deprecation window. Fail-closed only when none are present.\n */\nfunction hasAuthSignal(ctx: ResolveContext | undefined): boolean {\n  const authInfo = ctx?.authInfo;\n  if (!authInfo) return false;\n  return authInfo.credential !== undefined || authInfo.token !== undefined || authInfo.clientId !== undefined;\n}\n"],"mappings":";;;;;;AA4BA,SAAS,iBAAiB;AAgInB,SAAS,0BACd,SACwB;AACxB,QAAM,gBAAgB,QAAQ,iBAAiB;AAE/C,SAAO;AAAA,IACL,YAAY;AAAA,IAEZ,MAAM,QAAQ,MAAoC,KAAyD;AACzG,UAAI,CAAC,iBAAiB,CAAC,cAAc,GAAG,GAAG;AACzC,cAAM,IAAI,UAAU,iBAAiB;AAAA,UACnC,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AACA,aAAO,QAAQ,UAAU,GAAG;AAAA,IAC9B;AAAA,EACF;AACF;AAQA,SAAS,cAAc,KAA0C;AAC/D,QAAM,WAAW,KAAK;AACtB,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,SAAS,eAAe,UAAa,SAAS,UAAU,UAAa,SAAS,aAAa;AACpG;","names":[]}
+{"version":3,"sources":["../../../src/lib/adapters/derived-account-store.ts"],"sourcesContent":["/**\n * Derived `AccountStore` factory for `resolution: 'derived'` single-tenant\n * agents — there is no `account_id` on the wire and the auth principal alone\n * identifies the tenant. Most self-hosted broadcasters, retail-media operators\n * in proxy mode, and creative-only adapters (audiostack, flashtalking) where\n * every API call is scoped by the buyer's per-request credential.\n *\n * Pairs with the existing reference adapters. Pick by asking *who creates the\n * account?*:\n * - **Buyer self-onboards via `sync_accounts`** → {@link InMemoryImplicitAccountStore}\n *   (Shape A, `resolution: 'implicit'`).\n * - **Upstream OAuth API owns the roster** → {@link createOAuthPassthroughResolver}\n *   (Shape B, `resolution: 'explicit'`).\n * - **Publisher ops curates the roster** → {@link createRosterAccountStore}\n *   (Shape C, `resolution: 'explicit'`).\n * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`\n *   (this file, Shape D, `resolution: 'derived'`).\n *\n * Closes adcp-client#1462. Replaces the ~25–30 LOC of `if (!authInfo.token) throw\n * AUTH_REQUIRED; return { id: ..., ctx_metadata: { accessToken } }` boilerplate\n * Shape D adopters write today.\n *\n * @see docs/guides/account-resolution.md\n * @public\n */\n\nimport type { AccountReference } from '../types/tools.generated';\nimport type { Account, AccountStore, ResolveContext } from '../server/decisioning/account';\nimport { AdcpError } from '../server/decisioning/async-outcome';\n\n/**\n * Options for {@link createDerivedAccountStore}.\n *\n * @public\n */\nexport interface DerivedAccountStoreOptions<TCtxMeta = Record<string, unknown>> {\n  /**\n   * Build the singleton account from the request context. Called on every\n   * `resolve()` (no caching — the tenant is per-request because the auth\n   * principal varies). The returned account's `id` is typically a stable\n   * literal (e.g. `'audiostack'`, `'__publisher_wide__'`); single-tenant\n   * adapters have no buyer-supplied account_id to reflect back.\n   *\n   * **DO NOT put credentials in `ctx_metadata`.** See\n   * `docs/guides/CTX-METADATA-SAFETY.md` for the rationale. The wire-strip\n   * protects buyer responses but does NOT protect server-side log lines,\n   * error envelopes, or adopter-generated strings (e.g. `JSON.stringify(account)`\n   * in an error message). Re-derive the bearer from `ctx.authInfo` per\n   * request inside specialism methods instead.\n   *\n   * Adopters MAY omit `authInfo` from the returned `Account` — the framework\n   * auto-attaches the principal from `ctx.authInfo` when absent (matches\n   * Shape A/B/C semantics).\n   */\n  toAccount: (ctx: ResolveContext | undefined) => Account<TCtxMeta>;\n\n  /**\n   * Skip the `AUTH_REQUIRED` precheck. Defaults to `false` — the factory\n   * throws `AdcpError('AUTH_REQUIRED')` when `ctx.authInfo` is absent or\n   * carries no credential, matching the canonical Shape D pattern (every\n   * call must authenticate).\n   *\n   * Set to `true` for genuinely unauthenticated single-tenant agents (rare —\n   * public format catalogs, signed-request-only agents that authenticate\n   * out-of-band). When `true`, `toAccount` runs unconditionally.\n   *\n   * If you're tempted to set this because tests don't carry `authInfo`,\n   * fix the tests instead — `serve({ authenticate })` should populate\n   * `ctx.authInfo` from your test harness (or use `dispatchTestRequest`\n   * which threads a synthetic principal). The escape hatch is for\n   * production agents that legitimately accept unauthenticated traffic,\n   * not for working around fixture gaps.\n   *\n   * @default false\n   */\n  skipAuthCheck?: boolean;\n}\n\n/**\n * Build an `AccountStore<TCtxMeta>` for single-tenant agents whose tenant is\n * derived from the auth principal alone (no `account_id` on the wire).\n *\n * The factory:\n * 1. Sets `resolution: 'derived'`.\n * 2. Throws `AdcpError('AUTH_REQUIRED')` when `ctx.authInfo` carries no\n *    credential (skip with `skipAuthCheck: true`). The check accepts the\n *    discriminated `credential` shape (preferred) AND the deprecated\n *    `token` / `clientId` fields populated by pre-#1269 authenticators —\n *    fail-closed only when none of the three are present.\n * 3. Calls `toAccount(ctx)` and returns the result. Buyer-supplied\n *    `AccountReference` is ignored — single-tenant by definition.\n * 4. Omits `list` / `upsert` — single-tenant adapters have nothing to\n *    enumerate or write. Adopters who want either compose via spread.\n *\n * **When NOT to use this.** If two different auth principals should resolve\n * to two different `account.id` values, you want Shape B\n * ({@link createOAuthPassthroughResolver}) or `createTenantStore` — NOT this\n * factory. Misusing Shape D in a multi-tenant deployment routes every buyer\n * to the same singleton id and breaks tenant isolation silently (no error,\n * no log). The factory is single-tenant by design — `toAccount(ctx)` should\n * return the same `id` for every principal that calls it.\n *\n * @example AudioStack-shaped creative adapter:\n * ```ts\n * import { createDerivedAccountStore } from '@adcp/sdk/server';\n *\n * const accounts = createDerivedAccountStore<AudioStackAccountMeta>({\n *   toAccount: (ctx) => ({\n *     id: 'audiostack',\n *     name: 'AudioStack',\n *     status: 'active',\n *     ctx_metadata: {},                     // tokens stay on ctx.authInfo, not here\n *   }),\n * });\n * ```\n *\n * @example Single-tenant retail-media proxy with derived display name:\n * ```ts\n * const accounts = createDerivedAccountStore<{ tenantId: string }>({\n *   toAccount: (ctx) => {\n *     const cred = ctx?.authInfo?.credential;\n *     const tenantId = cred?.kind === 'oauth' ? cred.client_id\n *                    : cred?.kind === 'api_key' ? cred.key_id\n *                    : 'public';\n *     return {\n *       id: 'criteo',\n *       name: `Criteo (${tenantId})`,\n *       status: 'active',\n *       ctx_metadata: { tenantId },\n *     };\n *   },\n * });\n * ```\n *\n * @example Compose `upsert` for adapters that ALSO want a buyer-driven\n * write path (rare for Shape D, but possible):\n * ```ts\n * const accounts: AccountStore<MyMeta> = {\n *   ...createDerivedAccountStore({ toAccount }),\n *   upsert: async (refs, ctx) => mySync(refs, ctx),\n * };\n * ```\n *\n * **Buyer-supplied `account_id` is refused at the framework boundary.**\n * Since adcp-client#1468, the framework throws `AdcpError('INVALID_REQUEST',\n * { field: 'account.account_id' })` BEFORE reaching this resolver when a\n * `'derived'`-mode platform receives an inline `account_id` — same shape\n * as `'implicit'`'s long-standing refusal (#1364), with a single-tenant\n * message instead of the `sync_accounts`-first guidance. The factory\n * itself ignores any `account_id` that does reach it (defensive belt +\n * braces), but adopters can rely on the framework refusal as the\n * canonical surface. Hand-rolled `'derived'` stores get the same\n * enforcement automatically.\n *\n * @public\n */\nexport function createDerivedAccountStore<TCtxMeta = Record<string, unknown>>(\n  options: DerivedAccountStoreOptions<TCtxMeta>\n): AccountStore<TCtxMeta> {\n  const skipAuthCheck = options.skipAuthCheck ?? false;\n\n  return {\n    resolution: 'derived',\n\n    async resolve(_ref: AccountReference | undefined, ctx?: ResolveContext): Promise<Account<TCtxMeta> | null> {\n      if (!skipAuthCheck && !hasAuthSignal(ctx)) {\n        throw new AdcpError('AUTH_REQUIRED', {\n          message: 'Single-tenant agent requires an authenticated principal; no credential on ctx.authInfo.',\n          recovery: 'correctable',\n        });\n      }\n      return options.toAccount(ctx);\n    },\n  };\n}\n\n/**\n * True when `ctx.authInfo` carries any usable credential signal — the\n * discriminated `credential` shape (preferred, post-#1269) OR the deprecated\n * `token` / `clientId` fields still populated by pre-Stage-3 authenticators\n * during the N+1 deprecation window. Fail-closed only when none are present.\n */\nfunction hasAuthSignal(ctx: ResolveContext | undefined): boolean {\n  const authInfo = ctx?.authInfo;\n  if (!authInfo) return false;\n  return authInfo.credential !== undefined || authInfo.token !== undefined || authInfo.clientId !== undefined;\n}\n"],"mappings":"AA4BA,SAAS,iBAAiB;AAgInB,SAAS,0BACd,SACwB;AACxB,QAAM,gBAAgB,QAAQ,iBAAiB;AAE/C,SAAO;AAAA,IACL,YAAY;AAAA,IAEZ,MAAM,QAAQ,MAAoC,KAAyD;AACzG,UAAI,CAAC,iBAAiB,CAAC,cAAc,GAAG,GAAG;AACzC,cAAM,IAAI,UAAU,iBAAiB;AAAA,UACnC,SAAS;AAAA,UACT,UAAU;AAAA,QACZ,CAAC;AAAA,MACH;AACA,aAAO,QAAQ,UAAU,GAAG;AAAA,IAC9B;AAAA,EACF;AACF;AAQA,SAAS,cAAc,KAA0C;AAC/D,QAAM,WAAW,KAAK;AACtB,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,SAAS,eAAe,UAAa,SAAS,UAAU,UAAa,SAAS,aAAa;AACpG;","names":[]}

package/dist/lib/adapters/governance-adapter.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { ProtocolClient } from "../protocols/index.mjs";
 import { unwrapProtocolResponse } from "../utils/response-unwrapper.mjs";
 const GovernanceAdapterErrorCodes = {

package/dist/lib/adapters/governance-adapter.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/adapters/governance-adapter.ts"],"sourcesContent":["/**\n * Governance Adapter\n *\n * Server-side adapter for implementing committed governance checks.\n * Sellers use this to check governance before executing media buys.\n *\n * The committed check verifies that the seller's planned delivery\n * parameters comply with the buyer's campaign governance plan.\n */\n\nimport type {\n  CheckGovernanceRequest,\n  CheckGovernanceResponse,\n  PlannedDelivery,\n  GovernancePhase,\n} from '../types/tools.generated';\nimport { ProtocolClient } from '../protocols';\nimport type { AgentConfig } from '../types';\nimport { unwrapProtocolResponse } from '../utils/response-unwrapper';\n\n/**\n * Configuration for the seller-side governance adapter.\n */\nexport interface GovernanceAdapterConfig {\n  /** The governance agent to call for committed checks */\n  agent: AgentConfig;\n  /** The seller's caller URL for governance checks */\n  callerUrl: string;\n  /**\n   * AdCP version pin sent to the governance agent. Should match the\n   * seller's `createAdcpServer({ adcpVersion })` value so the wire-level\n   * `adcp_major_version` field is consistent across the seller's\n   * inbound (buyer-facing) and outbound (governance-agent-facing) traffic.\n   *\n   * Defaults to `undefined`, which `ProtocolClient.callTool` resolves to\n   * the SDK-pinned `ADCP_VERSION`. Pass an explicit value when the seller\n   * pins a non-default version.\n   */\n  adcpVersion?: string;\n}\n\n/**\n * Committed governance check request from the seller's perspective.\n */\nexport interface CommittedCheckRequest {\n  /** Campaign governance plan ID */\n  planId: string;\n  /** @deprecated No longer sent to governance agent — use governanceContext instead */\n  mediaBuyId?: string;\n  /** Opaque governance context from the buyer's protocol envelope. Pass through verbatim. */\n  governanceContext?: string;\n  /** What the seller will actually deliver */\n  plannedDelivery: PlannedDelivery;\n  /** Lifecycle phase of the check */\n  phase?: GovernancePhase;\n  /** Delivery metrics for delivery-phase checks */\n  deliveryMetrics?: CheckGovernanceRequest['delivery_metrics'];\n  /** Summary of changes for modification-phase checks */\n  modificationSummary?: string;\n}\n\n/**\n * Interface for seller-side governance adapters.\n * Sellers implement this to integrate governance checks into their execution path.\n */\nexport interface IGovernanceAdapter {\n  /** Whether governance is supported by this server */\n  isSupported(): boolean;\n  /** Run a committed governance check before executing a media buy */\n  checkCommitted(request: CommittedCheckRequest): Promise<CheckGovernanceResponse>;\n}\n\n/**\n * Error codes for governance adapter responses.\n */\nexport const GovernanceAdapterErrorCodes = {\n  NOT_SUPPORTED: 'governance_not_supported',\n  CHECK_FAILED: 'governance_check_failed',\n  AGENT_UNREACHABLE: 'governance_agent_unreachable',\n} as const;\n\nexport type GovernanceAdapterErrorCode = (typeof GovernanceAdapterErrorCodes)[keyof typeof GovernanceAdapterErrorCodes];\n\n/**\n * Type guard: check if a response is a governance adapter error.\n */\nexport function isGovernanceAdapterError(\n  response: unknown\n): response is { error: { code: GovernanceAdapterErrorCode; message?: string } } {\n  if (!response || typeof response !== 'object') return false;\n  const r = response as Record<string, any>;\n  return r.error?.code && Object.values(GovernanceAdapterErrorCodes).includes(r.error.code);\n}\n\n/**\n * Governance adapter that calls a governance agent via AdCP protocol.\n *\n * Sellers configure this with their governance agent and caller URL,\n * then call checkCommitted() before executing media buys.\n *\n * For custom governance logic, extend this class and override checkCommitted().\n */\nexport class GovernanceAdapter implements IGovernanceAdapter {\n  private agentConfig?: GovernanceAdapterConfig;\n\n  constructor(config?: GovernanceAdapterConfig) {\n    this.agentConfig = config;\n  }\n\n  isSupported(): boolean {\n    return !!this.agentConfig;\n  }\n\n  async checkCommitted(request: CommittedCheckRequest): Promise<CheckGovernanceResponse> {\n    if (!this.agentConfig) {\n      return {\n        status: 'failed',\n        check_id: '',\n        verdict: 'denied',\n        binding: 'committed',\n        plan_id: request.planId,\n        explanation: 'Governance not configured on this server',\n        error_code: GovernanceAdapterErrorCodes.NOT_SUPPORTED,\n      } as unknown as CheckGovernanceResponse;\n    }\n\n    const checkRequest: CheckGovernanceRequest = {\n      plan_id: request.planId,\n      caller: this.agentConfig.callerUrl,\n      governance_context: request.governanceContext,\n      planned_delivery: request.plannedDelivery,\n      phase: request.phase,\n      delivery_metrics: request.deliveryMetrics,\n      ...(request.mediaBuyId && { payload: { media_buy_id: request.mediaBuyId } }),\n      ...(request.modificationSummary && { payload: { modification_summary: request.modificationSummary } }),\n    };\n\n    try {\n      const response = await ProtocolClient.callTool(\n        this.agentConfig.agent,\n        'check_governance',\n        checkRequest as Record<string, any>,\n        { adcpVersion: this.agentConfig.adcpVersion }\n      );\n\n      return unwrapProtocolResponse(response) as unknown as CheckGovernanceResponse;\n    } catch (err) {\n      return {\n        status: 'failed',\n        check_id: '',\n        verdict: 'denied',\n        binding: 'committed',\n        plan_id: request.planId,\n        explanation: `Governance agent unreachable: ${(err as Error).message}`,\n        error_code: GovernanceAdapterErrorCodes.AGENT_UNREACHABLE,\n      } as unknown as CheckGovernanceResponse;\n    }\n  }\n}\n\n/**\n * Pre-configured governance adapter with no agent.\n * isSupported() returns false and checkCommitted() returns a denial.\n * Replace with a configured instance when connecting to a governance agent.\n */\nexport const defaultGovernanceAdapter = new GovernanceAdapter();\n"],"mappings":";;;;;;AAgBA,SAAS,sBAAsB;AAE/B,SAAS,8BAA8B;AAyDhC,MAAM,8BAA8B;AAAA,EACzC,eAAe;AAAA,EACf,cAAc;AAAA,EACd,mBAAmB;AACrB;AAOO,SAAS,yBACd,UAC+E;AAC/E,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO;AACtD,QAAM,IAAI;AACV,SAAO,EAAE,OAAO,QAAQ,OAAO,OAAO,2BAA2B,EAAE,SAAS,EAAE,MAAM,IAAI;AAC1F;AAUO,MAAM,kBAAgD;AAAA,EACnD;AAAA,EAER,YAAY,QAAkC;AAC5C,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,cAAuB;AACrB,WAAO,CAAC,CAAC,KAAK;AAAA,EAChB;AAAA,EAEA,MAAM,eAAe,SAAkE;AACrF,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,QACT,SAAS,QAAQ;AAAA,QACjB,aAAa;AAAA,QACb,YAAY,4BAA4B;AAAA,MAC1C;AAAA,IACF;AAEA,UAAM,eAAuC;AAAA,MAC3C,SAAS,QAAQ;AAAA,MACjB,QAAQ,KAAK,YAAY;AAAA,MACzB,oBAAoB,QAAQ;AAAA,MAC5B,kBAAkB,QAAQ;AAAA,MAC1B,OAAO,QAAQ;AAAA,MACf,kBAAkB,QAAQ;AAAA,MAC1B,GAAI,QAAQ,cAAc,EAAE,SAAS,EAAE,cAAc,QAAQ,WAAW,EAAE;AAAA,MAC1E,GAAI,QAAQ,uBAAuB,EAAE,SAAS,EAAE,sBAAsB,QAAQ,oBAAoB,EAAE;AAAA,IACtG;AAEA,QAAI;AACF,YAAM,WAAW,MAAM,eAAe;AAAA,QACpC,KAAK,YAAY;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,aAAa,KAAK,YAAY,YAAY;AAAA,MAC9C;AAEA,aAAO,uBAAuB,QAAQ;AAAA,IACxC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,QACT,SAAS,QAAQ;AAAA,QACjB,aAAa,iCAAkC,IAAc,OAAO;AAAA,QACpE,YAAY,4BAA4B;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AACF;AAOO,MAAM,2BAA2B,IAAI,kBAAkB;","names":[]}
+{"version":3,"sources":["../../../src/lib/adapters/governance-adapter.ts"],"sourcesContent":["/**\n * Governance Adapter\n *\n * Server-side adapter for implementing committed governance checks.\n * Sellers use this to check governance before executing media buys.\n *\n * The committed check verifies that the seller's planned delivery\n * parameters comply with the buyer's campaign governance plan.\n */\n\nimport type {\n  CheckGovernanceRequest,\n  CheckGovernanceResponse,\n  PlannedDelivery,\n  GovernancePhase,\n} from '../types/tools.generated';\nimport { ProtocolClient } from '../protocols';\nimport type { AgentConfig } from '../types';\nimport { unwrapProtocolResponse } from '../utils/response-unwrapper';\n\n/**\n * Configuration for the seller-side governance adapter.\n */\nexport interface GovernanceAdapterConfig {\n  /** The governance agent to call for committed checks */\n  agent: AgentConfig;\n  /** The seller's caller URL for governance checks */\n  callerUrl: string;\n  /**\n   * AdCP version pin sent to the governance agent. Should match the\n   * seller's `createAdcpServer({ adcpVersion })` value so the wire-level\n   * `adcp_major_version` field is consistent across the seller's\n   * inbound (buyer-facing) and outbound (governance-agent-facing) traffic.\n   *\n   * Defaults to `undefined`, which `ProtocolClient.callTool` resolves to\n   * the SDK-pinned `ADCP_VERSION`. Pass an explicit value when the seller\n   * pins a non-default version.\n   */\n  adcpVersion?: string;\n}\n\n/**\n * Committed governance check request from the seller's perspective.\n */\nexport interface CommittedCheckRequest {\n  /** Campaign governance plan ID */\n  planId: string;\n  /** @deprecated No longer sent to governance agent — use governanceContext instead */\n  mediaBuyId?: string;\n  /** Opaque governance context from the buyer's protocol envelope. Pass through verbatim. */\n  governanceContext?: string;\n  /** What the seller will actually deliver */\n  plannedDelivery: PlannedDelivery;\n  /** Lifecycle phase of the check */\n  phase?: GovernancePhase;\n  /** Delivery metrics for delivery-phase checks */\n  deliveryMetrics?: CheckGovernanceRequest['delivery_metrics'];\n  /** Summary of changes for modification-phase checks */\n  modificationSummary?: string;\n}\n\n/**\n * Interface for seller-side governance adapters.\n * Sellers implement this to integrate governance checks into their execution path.\n */\nexport interface IGovernanceAdapter {\n  /** Whether governance is supported by this server */\n  isSupported(): boolean;\n  /** Run a committed governance check before executing a media buy */\n  checkCommitted(request: CommittedCheckRequest): Promise<CheckGovernanceResponse>;\n}\n\n/**\n * Error codes for governance adapter responses.\n */\nexport const GovernanceAdapterErrorCodes = {\n  NOT_SUPPORTED: 'governance_not_supported',\n  CHECK_FAILED: 'governance_check_failed',\n  AGENT_UNREACHABLE: 'governance_agent_unreachable',\n} as const;\n\nexport type GovernanceAdapterErrorCode = (typeof GovernanceAdapterErrorCodes)[keyof typeof GovernanceAdapterErrorCodes];\n\n/**\n * Type guard: check if a response is a governance adapter error.\n */\nexport function isGovernanceAdapterError(\n  response: unknown\n): response is { error: { code: GovernanceAdapterErrorCode; message?: string } } {\n  if (!response || typeof response !== 'object') return false;\n  const r = response as Record<string, any>;\n  return r.error?.code && Object.values(GovernanceAdapterErrorCodes).includes(r.error.code);\n}\n\n/**\n * Governance adapter that calls a governance agent via AdCP protocol.\n *\n * Sellers configure this with their governance agent and caller URL,\n * then call checkCommitted() before executing media buys.\n *\n * For custom governance logic, extend this class and override checkCommitted().\n */\nexport class GovernanceAdapter implements IGovernanceAdapter {\n  private agentConfig?: GovernanceAdapterConfig;\n\n  constructor(config?: GovernanceAdapterConfig) {\n    this.agentConfig = config;\n  }\n\n  isSupported(): boolean {\n    return !!this.agentConfig;\n  }\n\n  async checkCommitted(request: CommittedCheckRequest): Promise<CheckGovernanceResponse> {\n    if (!this.agentConfig) {\n      return {\n        status: 'failed',\n        check_id: '',\n        verdict: 'denied',\n        binding: 'committed',\n        plan_id: request.planId,\n        explanation: 'Governance not configured on this server',\n        error_code: GovernanceAdapterErrorCodes.NOT_SUPPORTED,\n      } as unknown as CheckGovernanceResponse;\n    }\n\n    const checkRequest: CheckGovernanceRequest = {\n      plan_id: request.planId,\n      caller: this.agentConfig.callerUrl,\n      governance_context: request.governanceContext,\n      planned_delivery: request.plannedDelivery,\n      phase: request.phase,\n      delivery_metrics: request.deliveryMetrics,\n      ...(request.mediaBuyId && { payload: { media_buy_id: request.mediaBuyId } }),\n      ...(request.modificationSummary && { payload: { modification_summary: request.modificationSummary } }),\n    };\n\n    try {\n      const response = await ProtocolClient.callTool(\n        this.agentConfig.agent,\n        'check_governance',\n        checkRequest as Record<string, any>,\n        { adcpVersion: this.agentConfig.adcpVersion }\n      );\n\n      return unwrapProtocolResponse(response) as unknown as CheckGovernanceResponse;\n    } catch (err) {\n      return {\n        status: 'failed',\n        check_id: '',\n        verdict: 'denied',\n        binding: 'committed',\n        plan_id: request.planId,\n        explanation: `Governance agent unreachable: ${(err as Error).message}`,\n        error_code: GovernanceAdapterErrorCodes.AGENT_UNREACHABLE,\n      } as unknown as CheckGovernanceResponse;\n    }\n  }\n}\n\n/**\n * Pre-configured governance adapter with no agent.\n * isSupported() returns false and checkCommitted() returns a denial.\n * Replace with a configured instance when connecting to a governance agent.\n */\nexport const defaultGovernanceAdapter = new GovernanceAdapter();\n"],"mappings":"AAgBA,SAAS,sBAAsB;AAE/B,SAAS,8BAA8B;AAyDhC,MAAM,8BAA8B;AAAA,EACzC,eAAe;AAAA,EACf,cAAc;AAAA,EACd,mBAAmB;AACrB;AAOO,SAAS,yBACd,UAC+E;AAC/E,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO;AACtD,QAAM,IAAI;AACV,SAAO,EAAE,OAAO,QAAQ,OAAO,OAAO,2BAA2B,EAAE,SAAS,EAAE,MAAM,IAAI;AAC1F;AAUO,MAAM,kBAAgD;AAAA,EACnD;AAAA,EAER,YAAY,QAAkC;AAC5C,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,cAAuB;AACrB,WAAO,CAAC,CAAC,KAAK;AAAA,EAChB;AAAA,EAEA,MAAM,eAAe,SAAkE;AACrF,QAAI,CAAC,KAAK,aAAa;AACrB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,QACT,SAAS,QAAQ;AAAA,QACjB,aAAa;AAAA,QACb,YAAY,4BAA4B;AAAA,MAC1C;AAAA,IACF;AAEA,UAAM,eAAuC;AAAA,MAC3C,SAAS,QAAQ;AAAA,MACjB,QAAQ,KAAK,YAAY;AAAA,MACzB,oBAAoB,QAAQ;AAAA,MAC5B,kBAAkB,QAAQ;AAAA,MAC1B,OAAO,QAAQ;AAAA,MACf,kBAAkB,QAAQ;AAAA,MAC1B,GAAI,QAAQ,cAAc,EAAE,SAAS,EAAE,cAAc,QAAQ,WAAW,EAAE;AAAA,MAC1E,GAAI,QAAQ,uBAAuB,EAAE,SAAS,EAAE,sBAAsB,QAAQ,oBAAoB,EAAE;AAAA,IACtG;AAEA,QAAI;AACF,YAAM,WAAW,MAAM,eAAe;AAAA,QACpC,KAAK,YAAY;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,aAAa,KAAK,YAAY,YAAY;AAAA,MAC9C;AAEA,aAAO,uBAAuB,QAAQ;AAAA,IACxC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,SAAS;AAAA,QACT,SAAS;AAAA,QACT,SAAS,QAAQ;AAAA,QACjB,aAAa,iCAAkC,IAAc,OAAO;AAAA,QACpE,YAAY,4BAA4B;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AACF;AAOO,MAAM,2BAA2B,IAAI,kBAAkB;","names":[]}

package/dist/lib/adapters/implicit-account-store.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 function defaultImplicitKeyFn(authInfo) {
   const cred = authInfo.credential;
   if (!cred) return void 0;

package/dist/lib/adapters/implicit-account-store.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/adapters/implicit-account-store.ts"],"sourcesContent":["/**\n * InMemoryImplicitAccountStore\n *\n * Reference implementation of `AccountStore` for `resolution: 'implicit'`\n * platforms. Platforms using this resolution mode require buyers to call\n * `sync_accounts` before any tool that needs tenant context; subsequent\n * requests resolve the account from the caller's auth principal rather\n * than from an inline `ext.account_ref`.\n *\n * Use this in tests and as a copy-and-adapt starting point for durable\n * implementations. See `docs/guides/account-resolution.md` for key\n * derivation guidance, error contracts, and TTL recommendations.\n *\n * **Picking an AccountStore?** Four reference shapes by *who creates the\n * account*:\n * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`\n *   (this file, Shape A).\n * - **Upstream OAuth API owns the roster** → `createOAuthPassthroughResolver`\n *   (Shape B, returns just `resolve`).\n * - **Publisher ops curates the roster** → `createRosterAccountStore`\n *   (Shape C, complete AccountStore).\n * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`\n *   (Shape D, `resolution: 'derived'`).\n *\n * @see docs/guides/account-resolution.md\n * @public\n */\n\nimport type { AccountReference, BrandReference } from '../types/tools.generated';\nimport type {\n  Account,\n  AccountStore,\n  AdcpAccountStatus,\n  ResolvedAuthInfo,\n  ResolveContext,\n  SyncAccountsResultRow,\n} from '../server/decisioning';\n\n// ---------------------------------------------------------------------------\n// Key extraction\n// ---------------------------------------------------------------------------\n\n/**\n * Default key-extraction function for the auth-principal→account mapping.\n *\n * Canonical choices by credential kind:\n * - `'oauth'`   → `oauth:<client_id>`   (OAuth 2.0 client identity; stable across token rotations)\n * - `'api_key'` → `api_key:<key_id>`   (API-key identity; stable until key is revoked)\n * - `'http_sig'`→ `http_sig:<agent_url>` (verified caller URL; the most durable identity)\n *\n * Adopters who key on `authInfo.sub` or `authInfo.extra` instead MUST\n * document that choice — those fields are grant-specific and may not be\n * stable across credential rotations.\n */\nexport function defaultImplicitKeyFn(authInfo: ResolvedAuthInfo): string | undefined {\n  const cred = authInfo.credential;\n  if (!cred) return undefined;\n  switch (cred.kind) {\n    case 'oauth':\n      return `oauth:${cred.client_id}`;\n    case 'api_key':\n      return `api_key:${cred.key_id}`;\n    case 'http_sig':\n      return `http_sig:${cred.agent_url}`;\n  }\n}\n\n// Natural key for a ref — used to detect re-syncs of the same\n// (brand, operator, sandbox) tuple so upsert() can return 'unchanged'\n// without calling buildAccount again (which may be non-deterministic).\nfunction refNaturalKey(ref: AccountReference): string {\n  const r = ref as Record<string, unknown>;\n  const domain = (r['brand'] as Record<string, unknown> | undefined)?.['domain'] as string | undefined;\n  const operator = r['operator'] as string | undefined;\n  const sandbox = Boolean(r['sandbox'] as boolean | undefined);\n  return `${domain ?? ''}|${operator ?? ''}|${sandbox ? '1' : '0'}`;\n}\n\n// ---------------------------------------------------------------------------\n// Store interface\n// ---------------------------------------------------------------------------\n\n/**\n * Constructor options for `InMemoryImplicitAccountStore`.\n * @public\n */\nexport interface ImplicitAccountStoreOptions<TCtxMeta = Record<string, unknown>> {\n  /**\n   * Convert a buyer-supplied `AccountReference` (from `sync_accounts`) to the\n   * seller's `Account<TCtxMeta>`. Called once per ref in `upsert()`.\n   *\n   * **Default:** builds a synthetic account from the ref fields. Suitable\n   * for tests; replace for production (call your platform's account-lookup\n   * or account-creation API here).\n   */\n  buildAccount?: (ref: AccountReference, ctx?: ResolveContext) => Account<TCtxMeta> | Promise<Account<TCtxMeta>>;\n\n  /**\n   * Extract the principal key from `ResolvedAuthInfo`. The returned string\n   * is the lookup key for the `authInfo → accounts` mapping.\n   *\n   * **Default:** `defaultImplicitKeyFn` — uses `credential.client_id`\n   * (oauth), `credential.key_id` (api_key), or `credential.agent_url`\n   * (http_sig). Stable across token rotations within the same credential\n   * kind.\n   *\n   * Override when your platform keys on a custom claim (e.g., a\n   * `sub`-derived tenant ID in `authInfo.extra`).\n   */\n  keyFn?: (authInfo: ResolvedAuthInfo) => string | undefined;\n\n  /**\n   * Sync-linkage TTL in milliseconds. Entries stored by `upsert()` expire\n   * after this duration; `resolve()` returns `null` (→ `ACCOUNT_NOT_FOUND`)\n   * for expired entries, prompting the buyer to call `sync_accounts` again.\n   *\n   * **Default:** `86_400_000` (24 hours). Align with your platform's session\n   * or token lifetime; longer TTLs risk serving stale account state.\n   *\n   * Distinct from `AccountStore.refreshToken` — that refreshes the upstream\n   * OAuth token mid-request. This TTL governs how long the sync-linkage\n   * itself is valid before a fresh `sync_accounts` is required.\n   */\n  ttlMs?: number;\n}\n\n// ---------------------------------------------------------------------------\n// Default buildAccount\n// ---------------------------------------------------------------------------\n\nfunction defaultBuildAccount<TCtxMeta>(\n  ref: AccountReference,\n  _ctx?: ResolveContext\n): Account<TCtxMeta & Record<string, unknown>> {\n  const r = ref as Record<string, unknown>;\n  const brand = r['brand'] as BrandReference | undefined;\n  const operator = (r['operator'] as string | undefined) ?? '';\n  const sandbox = r['sandbox'] === true;\n  const sandboxSuffix = sandbox ? ':sandbox' : '';\n  const account_id =\n    (r['account_id'] as string | undefined) ??\n    (brand && 'domain' in brand\n      ? `${(brand as { domain: string }).domain}:${operator}${sandboxSuffix}`\n      : `ref:${operator}${sandboxSuffix}`);\n  return {\n    id: account_id,\n    name: account_id,\n    status: 'active' as AdcpAccountStatus,\n    ...(brand !== undefined && { brand }),\n    ...(operator !== '' && { operator }),\n    ...(sandbox && { sandbox: true }),\n    ctx_metadata: {} as TCtxMeta & Record<string, unknown>,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// InMemoryImplicitAccountStore\n// ---------------------------------------------------------------------------\n\ninterface StoredEntry<TCtxMeta> {\n  accounts: Account<TCtxMeta>[];\n  refs: AccountReference[];\n  storedAt: number;\n}\n\n/**\n * In-memory `AccountStore` for `resolution: 'implicit'` platforms.\n *\n * Wire contract:\n * 1. Buyer calls `sync_accounts` → framework calls `upsert()` → store records\n *    `authKey → accounts[]`.\n * 2. Buyer calls any tool (e.g. `create_media_buy`) without `ext.account_ref`\n *    → framework calls `resolve(undefined, ctx)` → store looks up by `authKey`.\n * 3. If no prior sync: `resolve()` returns `null` → framework emits\n *    `ACCOUNT_NOT_FOUND`. Do NOT return `AUTH_REQUIRED` — that signals\n *    missing credentials, not a missing pre-sync.\n *\n * This class is intentionally minimal. Copy-and-adapt for durable stores\n * (Postgres, Redis); see `docs/guides/account-resolution.md` for the DDL\n * reference and the key-derivation rationale.\n *\n * @example\n * ```ts\n * import { InMemoryImplicitAccountStore } from '@adcp/sdk/server';\n *\n * const accountStore = new InMemoryImplicitAccountStore({\n *   buildAccount: async (ref, ctx) => {\n *     const upstream = await myPlatform.findOrCreate(ref, ctx?.authInfo);\n *     return {\n *       id: upstream.id,\n *       name: upstream.name,\n *       status: 'active',\n *       ctx_metadata: { upstreamId: upstream.id },\n *     };\n *   },\n * });\n *\n * // Wire into createAdcpServer:\n * createAdcpServer({ accounts: accountStore, ... });\n * ```\n *\n * @public\n */\nexport class InMemoryImplicitAccountStore<TCtxMeta = Record<string, unknown>> implements AccountStore<TCtxMeta> {\n  readonly resolution = 'implicit' as const;\n\n  private _store = new Map<string, StoredEntry<TCtxMeta>>();\n  private _keyFn: (authInfo: ResolvedAuthInfo) => string | undefined;\n  private _ttlMs: number;\n  private _buildAccount: (\n    ref: AccountReference,\n    ctx?: ResolveContext\n  ) => Account<TCtxMeta> | Promise<Account<TCtxMeta>>;\n\n  constructor(options?: ImplicitAccountStoreOptions<TCtxMeta>) {\n    this._buildAccount =\n      options?.buildAccount ??\n      (defaultBuildAccount as unknown as (ref: AccountReference, ctx?: ResolveContext) => Account<TCtxMeta>);\n    this._keyFn = options?.keyFn ?? defaultImplicitKeyFn;\n    this._ttlMs = options?.ttlMs ?? 86_400_000;\n  }\n\n  /**\n   * Resolve the caller's account from the auth-principal→account mapping\n   * populated by a prior `sync_accounts` call.\n   *\n   * Returns `null` (→ `ACCOUNT_NOT_FOUND`) when:\n   * - No prior `sync_accounts` was called for this principal\n   * - The stored entry has exceeded `ttlMs`\n   * - `ctx.authInfo` is absent or carries no extractable key\n   *\n   * **Multi-account note.** When a buyer synced multiple refs in one\n   * `sync_accounts` call, this implementation returns the _first_ stored\n   * account. If your platform requires per-request account disambiguation\n   * (e.g., different brands on the same buyer), switch to `'explicit'` mode\n   * so buyers pass `ext.account_ref` on each request, or override `keyFn`\n   * to encode the brand into the key.\n   */\n  async resolve(_ref: AccountReference | undefined, ctx?: ResolveContext): Promise<Account<TCtxMeta> | null> {\n    const authInfo = ctx?.authInfo;\n    if (!authInfo) return null;\n    const key = this._keyFn(authInfo);\n    if (key === undefined) return null;\n    const entry = this._store.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.storedAt > this._ttlMs) {\n      this._store.delete(key);\n      return null;\n    }\n    return entry.accounts[0] ?? null;\n  }\n\n  /**\n   * Process a `sync_accounts` payload: build accounts from refs and store\n   * them under the caller's auth key.\n   *\n   * The auth key is extracted from `ctx.authInfo` via `keyFn`. When the\n   * key cannot be derived (no credential or unrecognized credential kind),\n   * all refs are returned as `SYNC_FAILED` rows — a silent-success-then-\n   * mystery-failure sequence is worse than an explicit error. Check your\n   * `authenticate` callback and `keyFn` if you see this error.\n   *\n   * When `ctx.authInfo` is absent (unauthenticated call), all refs fail\n   * with `UNAUTHENTICATED`. Your `authenticate` callback in\n   * `serve({ authenticate })` should reject unauthenticated requests before\n   * reaching this method.\n   */\n  async upsert(refs: AccountReference[], ctx?: ResolveContext): Promise<SyncAccountsResultRow[]> {\n    const authInfo = ctx?.authInfo;\n\n    // Derive the key before building any accounts. If the key cannot be\n    // extracted, fail all rows explicitly — returning success rows here\n    // would cause a mysterious ACCOUNT_NOT_FOUND on the next tool call.\n    const key = authInfo !== undefined ? this._keyFn(authInfo) : undefined;\n    if (key === undefined) {\n      return refs.map(ref => {\n        const r = ref as Record<string, unknown>;\n        return {\n          brand: (r['brand'] as BrandReference | undefined) ?? ({ domain: 'unknown' } as BrandReference),\n          operator: (r['operator'] as string | undefined) ?? '',\n          action: 'failed' as const,\n          status: 'rejected' as AdcpAccountStatus,\n          errors: [\n            {\n              code: 'SYNC_FAILED',\n              message:\n                authInfo === undefined\n                  ? 'Unauthenticated: no authInfo on ctx — check authenticate configuration'\n                  : 'Could not derive principal key from auth credential — check keyFn or credential kind',\n            },\n          ],\n        };\n      });\n    }\n\n    // Build a natural-key index from any existing stored entry so we can\n    // detect re-syncs of the same (brand, operator, sandbox) tuple.\n    const existing = this._store.get(key);\n    const existingByNk = new Map<string, { account: Account<TCtxMeta>; ref: AccountReference }>();\n    if (existing) {\n      for (let i = 0; i < existing.refs.length; i++) {\n        existingByNk.set(refNaturalKey(existing.refs[i]!), {\n          account: existing.accounts[i]!,\n          ref: existing.refs[i]!,\n        });\n      }\n    }\n\n    const newAccounts: Account<TCtxMeta>[] = [];\n    const newRefs: AccountReference[] = [];\n    const rows: SyncAccountsResultRow[] = [];\n\n    for (const ref of refs) {\n      const nk = refNaturalKey(ref);\n      const hit = existingByNk.get(nk);\n      if (hit) {\n        // Re-sync of the same (brand, operator, sandbox) — preserve the\n        // original account_id without calling buildAccount again so adopters\n        // with non-deterministic resolvers (upstream API calls, DB writes)\n        // don't accumulate duplicate ids on replay.\n        newAccounts.push(hit.account);\n        newRefs.push(hit.ref);\n        const r = ref as Record<string, unknown>;\n        const brand: BrandReference =\n          hit.account.brand ??\n          (r['brand'] as BrandReference | undefined) ??\n          ({ domain: hit.account.id } as BrandReference);\n        const operator = hit.account.operator ?? (r['operator'] as string | undefined) ?? '';\n        rows.push({\n          account_id: hit.account.id,\n          brand,\n          operator,\n          name: hit.account.name,\n          action: 'unchanged',\n          status: hit.account.status,\n        });\n        continue;\n      }\n\n      try {\n        const account = await this._buildAccount(ref, ctx);\n        newAccounts.push(account);\n        newRefs.push(ref);\n        const r = ref as Record<string, unknown>;\n        const brand: BrandReference =\n          account.brand ?? (r['brand'] as BrandReference | undefined) ?? ({ domain: account.id } as BrandReference);\n        const operator = account.operator ?? (r['operator'] as string | undefined) ?? '';\n        rows.push({\n          account_id: account.id,\n          brand,\n          operator,\n          name: account.name,\n          action: 'created',\n          status: account.status,\n        });\n      } catch (err) {\n        // Suppress adopter-originated error details from the wire response —\n        // buildAccount exceptions may include upstream credentials, SQL text,\n        // or internal identifiers. Log server-side; emit a fixed string.\n        console.error('[InMemoryImplicitAccountStore] buildAccount threw:', err);\n        const r = ref as Record<string, unknown>;\n        rows.push({\n          brand: (r['brand'] as BrandReference | undefined) ?? ({ domain: 'unknown' } as BrandReference),\n          operator: (r['operator'] as string | undefined) ?? '',\n          action: 'failed',\n          status: 'rejected' as AdcpAccountStatus,\n          errors: [{ code: 'SYNC_FAILED', message: 'Account sync failed — check server logs' }],\n        });\n      }\n    }\n\n    // Only update the stored entry when at least one ref resolved successfully\n    // (either 'unchanged' or 'created'). An all-fail batch leaves the prior\n    // sync linkage intact so the buyer can retry without losing their mapping.\n    if (newAccounts.length > 0) {\n      this._store.set(key, { accounts: newAccounts, refs: newRefs, storedAt: Date.now() });\n    }\n    return rows;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Test helpers\n  // ---------------------------------------------------------------------------\n\n  /** Remove all stored sync linkages. */\n  clear(): void {\n    this._store.clear();\n  }\n\n  /**\n   * Return the auth key that would be derived from `authInfo`.\n   * Useful in tests to assert that a specific principal's linkage was stored.\n   */\n  authKey(authInfo: ResolvedAuthInfo): string | undefined {\n    return this._keyFn(authInfo);\n  }\n\n  /** Return the number of principal → accounts linkages currently stored. */\n  get size(): number {\n    return this._store.size;\n  }\n}\n"],"mappings":";;;;;;AAsDO,SAAS,qBAAqB,UAAgD;AACnF,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC,KAAM,QAAO;AAClB,UAAQ,KAAK,MAAM;AAAA,IACjB,KAAK;AACH,aAAO,SAAS,KAAK,SAAS;AAAA,IAChC,KAAK;AACH,aAAO,WAAW,KAAK,MAAM;AAAA,IAC/B,KAAK;AACH,aAAO,YAAY,KAAK,SAAS;AAAA,EACrC;AACF;AAKA,SAAS,cAAc,KAA+B;AACpD,QAAM,IAAI;AACV,QAAM,SAAU,EAAE,OAAO,IAA4C,QAAQ;AAC7E,QAAM,WAAW,EAAE,UAAU;AAC7B,QAAM,UAAU,QAAQ,EAAE,SAAS,CAAwB;AAC3D,SAAO,GAAG,UAAU,EAAE,IAAI,YAAY,EAAE,IAAI,UAAU,MAAM,GAAG;AACjE;AAsDA,SAAS,oBACP,KACA,MAC6C;AAC7C,QAAM,IAAI;AACV,QAAM,QAAQ,EAAE,OAAO;AACvB,QAAM,WAAY,EAAE,UAAU,KAA4B;AAC1D,QAAM,UAAU,EAAE,SAAS,MAAM;AACjC,QAAM,gBAAgB,UAAU,aAAa;AAC7C,QAAM,aACH,EAAE,YAAY,MACd,SAAS,YAAY,QAClB,GAAI,MAA6B,MAAM,IAAI,QAAQ,GAAG,aAAa,KACnE,OAAO,QAAQ,GAAG,aAAa;AACrC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,GAAI,UAAU,UAAa,EAAE,MAAM;AAAA,IACnC,GAAI,aAAa,MAAM,EAAE,SAAS;AAAA,IAClC,GAAI,WAAW,EAAE,SAAS,KAAK;AAAA,IAC/B,cAAc,CAAC;AAAA,EACjB;AACF;AAkDO,MAAM,6BAAmG;AAAA,EACrG,aAAa;AAAA,EAEd,SAAS,oBAAI,IAAmC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EAKR,YAAY,SAAiD;AAC3D,SAAK,gBACH,SAAS,gBACR;AACH,SAAK,SAAS,SAAS,SAAS;AAChC,SAAK,SAAS,SAAS,SAAS;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,QAAQ,MAAoC,KAAyD;AACzG,UAAM,WAAW,KAAK;AACtB,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,QAAI,QAAQ,OAAW,QAAO;AAC9B,UAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AACjC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,WAAW,KAAK,QAAQ;AAC7C,WAAK,OAAO,OAAO,GAAG;AACtB,aAAO;AAAA,IACT;AACA,WAAO,MAAM,SAAS,CAAC,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,OAAO,MAA0B,KAAwD;AAC7F,UAAM,WAAW,KAAK;AAKtB,UAAM,MAAM,aAAa,SAAY,KAAK,OAAO,QAAQ,IAAI;AAC7D,QAAI,QAAQ,QAAW;AACrB,aAAO,KAAK,IAAI,SAAO;AACrB,cAAM,IAAI;AACV,eAAO;AAAA,UACL,OAAQ,EAAE,OAAO,KAAqC,EAAE,QAAQ,UAAU;AAAA,UAC1E,UAAW,EAAE,UAAU,KAA4B;AAAA,UACnD,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,YACN;AAAA,cACE,MAAM;AAAA,cACN,SACE,aAAa,SACT,gFACA;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAIA,UAAM,WAAW,KAAK,OAAO,IAAI,GAAG;AACpC,UAAM,eAAe,oBAAI,IAAmE;AAC5F,QAAI,UAAU;AACZ,eAAS,IAAI,GAAG,IAAI,SAAS,KAAK,QAAQ,KAAK;AAC7C,qBAAa,IAAI,cAAc,SAAS,KAAK,CAAC,CAAE,GAAG;AAAA,UACjD,SAAS,SAAS,SAAS,CAAC;AAAA,UAC5B,KAAK,SAAS,KAAK,CAAC;AAAA,QACtB,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,cAAmC,CAAC;AAC1C,UAAM,UAA8B,CAAC;AACrC,UAAM,OAAgC,CAAC;AAEvC,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,cAAc,GAAG;AAC5B,YAAM,MAAM,aAAa,IAAI,EAAE;AAC/B,UAAI,KAAK;AAKP,oBAAY,KAAK,IAAI,OAAO;AAC5B,gBAAQ,KAAK,IAAI,GAAG;AACpB,cAAM,IAAI;AACV,cAAM,QACJ,IAAI,QAAQ,SACX,EAAE,OAAO,KACT,EAAE,QAAQ,IAAI,QAAQ,GAAG;AAC5B,cAAM,WAAW,IAAI,QAAQ,YAAa,EAAE,UAAU,KAA4B;AAClF,aAAK,KAAK;AAAA,UACR,YAAY,IAAI,QAAQ;AAAA,UACxB;AAAA,UACA;AAAA,UACA,MAAM,IAAI,QAAQ;AAAA,UAClB,QAAQ;AAAA,UACR,QAAQ,IAAI,QAAQ;AAAA,QACtB,CAAC;AACD;AAAA,MACF;AAEA,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,cAAc,KAAK,GAAG;AACjD,oBAAY,KAAK,OAAO;AACxB,gBAAQ,KAAK,GAAG;AAChB,cAAM,IAAI;AACV,cAAM,QACJ,QAAQ,SAAU,EAAE,OAAO,KAAqC,EAAE,QAAQ,QAAQ,GAAG;AACvF,cAAM,WAAW,QAAQ,YAAa,EAAE,UAAU,KAA4B;AAC9E,aAAK,KAAK;AAAA,UACR,YAAY,QAAQ;AAAA,UACpB;AAAA,UACA;AAAA,UACA,MAAM,QAAQ;AAAA,UACd,QAAQ;AAAA,UACR,QAAQ,QAAQ;AAAA,QAClB,CAAC;AAAA,MACH,SAAS,KAAK;AAIZ,gBAAQ,MAAM,sDAAsD,GAAG;AACvE,cAAM,IAAI;AACV,aAAK,KAAK;AAAA,UACR,OAAQ,EAAE,OAAO,KAAqC,EAAE,QAAQ,UAAU;AAAA,UAC1E,UAAW,EAAE,UAAU,KAA4B;AAAA,UACnD,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ,CAAC,EAAE,MAAM,eAAe,SAAS,+CAA0C,CAAC;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AAKA,QAAI,YAAY,SAAS,GAAG;AAC1B,WAAK,OAAO,IAAI,KAAK,EAAE,UAAU,aAAa,MAAM,SAAS,UAAU,KAAK,IAAI,EAAE,CAAC;AAAA,IACrF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAc;AACZ,SAAK,OAAO,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,UAAgD;AACtD,WAAO,KAAK,OAAO,QAAQ;AAAA,EAC7B;AAAA;AAAA,EAGA,IAAI,OAAe;AACjB,WAAO,KAAK,OAAO;AAAA,EACrB;AACF;","names":[]}
+{"version":3,"sources":["../../../src/lib/adapters/implicit-account-store.ts"],"sourcesContent":["/**\n * InMemoryImplicitAccountStore\n *\n * Reference implementation of `AccountStore` for `resolution: 'implicit'`\n * platforms. Platforms using this resolution mode require buyers to call\n * `sync_accounts` before any tool that needs tenant context; subsequent\n * requests resolve the account from the caller's auth principal rather\n * than from an inline `ext.account_ref`.\n *\n * Use this in tests and as a copy-and-adapt starting point for durable\n * implementations. See `docs/guides/account-resolution.md` for key\n * derivation guidance, error contracts, and TTL recommendations.\n *\n * **Picking an AccountStore?** Four reference shapes by *who creates the\n * account*:\n * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`\n *   (this file, Shape A).\n * - **Upstream OAuth API owns the roster** → `createOAuthPassthroughResolver`\n *   (Shape B, returns just `resolve`).\n * - **Publisher ops curates the roster** → `createRosterAccountStore`\n *   (Shape C, complete AccountStore).\n * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`\n *   (Shape D, `resolution: 'derived'`).\n *\n * @see docs/guides/account-resolution.md\n * @public\n */\n\nimport type { AccountReference, BrandReference } from '../types/tools.generated';\nimport type {\n  Account,\n  AccountStore,\n  AdcpAccountStatus,\n  ResolvedAuthInfo,\n  ResolveContext,\n  SyncAccountsResultRow,\n} from '../server/decisioning';\n\n// ---------------------------------------------------------------------------\n// Key extraction\n// ---------------------------------------------------------------------------\n\n/**\n * Default key-extraction function for the auth-principal→account mapping.\n *\n * Canonical choices by credential kind:\n * - `'oauth'`   → `oauth:<client_id>`   (OAuth 2.0 client identity; stable across token rotations)\n * - `'api_key'` → `api_key:<key_id>`   (API-key identity; stable until key is revoked)\n * - `'http_sig'`→ `http_sig:<agent_url>` (verified caller URL; the most durable identity)\n *\n * Adopters who key on `authInfo.sub` or `authInfo.extra` instead MUST\n * document that choice — those fields are grant-specific and may not be\n * stable across credential rotations.\n */\nexport function defaultImplicitKeyFn(authInfo: ResolvedAuthInfo): string | undefined {\n  const cred = authInfo.credential;\n  if (!cred) return undefined;\n  switch (cred.kind) {\n    case 'oauth':\n      return `oauth:${cred.client_id}`;\n    case 'api_key':\n      return `api_key:${cred.key_id}`;\n    case 'http_sig':\n      return `http_sig:${cred.agent_url}`;\n  }\n}\n\n// Natural key for a ref — used to detect re-syncs of the same\n// (brand, operator, sandbox) tuple so upsert() can return 'unchanged'\n// without calling buildAccount again (which may be non-deterministic).\nfunction refNaturalKey(ref: AccountReference): string {\n  const r = ref as Record<string, unknown>;\n  const domain = (r['brand'] as Record<string, unknown> | undefined)?.['domain'] as string | undefined;\n  const operator = r['operator'] as string | undefined;\n  const sandbox = Boolean(r['sandbox'] as boolean | undefined);\n  return `${domain ?? ''}|${operator ?? ''}|${sandbox ? '1' : '0'}`;\n}\n\n// ---------------------------------------------------------------------------\n// Store interface\n// ---------------------------------------------------------------------------\n\n/**\n * Constructor options for `InMemoryImplicitAccountStore`.\n * @public\n */\nexport interface ImplicitAccountStoreOptions<TCtxMeta = Record<string, unknown>> {\n  /**\n   * Convert a buyer-supplied `AccountReference` (from `sync_accounts`) to the\n   * seller's `Account<TCtxMeta>`. Called once per ref in `upsert()`.\n   *\n   * **Default:** builds a synthetic account from the ref fields. Suitable\n   * for tests; replace for production (call your platform's account-lookup\n   * or account-creation API here).\n   */\n  buildAccount?: (ref: AccountReference, ctx?: ResolveContext) => Account<TCtxMeta> | Promise<Account<TCtxMeta>>;\n\n  /**\n   * Extract the principal key from `ResolvedAuthInfo`. The returned string\n   * is the lookup key for the `authInfo → accounts` mapping.\n   *\n   * **Default:** `defaultImplicitKeyFn` — uses `credential.client_id`\n   * (oauth), `credential.key_id` (api_key), or `credential.agent_url`\n   * (http_sig). Stable across token rotations within the same credential\n   * kind.\n   *\n   * Override when your platform keys on a custom claim (e.g., a\n   * `sub`-derived tenant ID in `authInfo.extra`).\n   */\n  keyFn?: (authInfo: ResolvedAuthInfo) => string | undefined;\n\n  /**\n   * Sync-linkage TTL in milliseconds. Entries stored by `upsert()` expire\n   * after this duration; `resolve()` returns `null` (→ `ACCOUNT_NOT_FOUND`)\n   * for expired entries, prompting the buyer to call `sync_accounts` again.\n   *\n   * **Default:** `86_400_000` (24 hours). Align with your platform's session\n   * or token lifetime; longer TTLs risk serving stale account state.\n   *\n   * Distinct from `AccountStore.refreshToken` — that refreshes the upstream\n   * OAuth token mid-request. This TTL governs how long the sync-linkage\n   * itself is valid before a fresh `sync_accounts` is required.\n   */\n  ttlMs?: number;\n}\n\n// ---------------------------------------------------------------------------\n// Default buildAccount\n// ---------------------------------------------------------------------------\n\nfunction defaultBuildAccount<TCtxMeta>(\n  ref: AccountReference,\n  _ctx?: ResolveContext\n): Account<TCtxMeta & Record<string, unknown>> {\n  const r = ref as Record<string, unknown>;\n  const brand = r['brand'] as BrandReference | undefined;\n  const operator = (r['operator'] as string | undefined) ?? '';\n  const sandbox = r['sandbox'] === true;\n  const sandboxSuffix = sandbox ? ':sandbox' : '';\n  const account_id =\n    (r['account_id'] as string | undefined) ??\n    (brand && 'domain' in brand\n      ? `${(brand as { domain: string }).domain}:${operator}${sandboxSuffix}`\n      : `ref:${operator}${sandboxSuffix}`);\n  return {\n    id: account_id,\n    name: account_id,\n    status: 'active' as AdcpAccountStatus,\n    ...(brand !== undefined && { brand }),\n    ...(operator !== '' && { operator }),\n    ...(sandbox && { sandbox: true }),\n    ctx_metadata: {} as TCtxMeta & Record<string, unknown>,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// InMemoryImplicitAccountStore\n// ---------------------------------------------------------------------------\n\ninterface StoredEntry<TCtxMeta> {\n  accounts: Account<TCtxMeta>[];\n  refs: AccountReference[];\n  storedAt: number;\n}\n\n/**\n * In-memory `AccountStore` for `resolution: 'implicit'` platforms.\n *\n * Wire contract:\n * 1. Buyer calls `sync_accounts` → framework calls `upsert()` → store records\n *    `authKey → accounts[]`.\n * 2. Buyer calls any tool (e.g. `create_media_buy`) without `ext.account_ref`\n *    → framework calls `resolve(undefined, ctx)` → store looks up by `authKey`.\n * 3. If no prior sync: `resolve()` returns `null` → framework emits\n *    `ACCOUNT_NOT_FOUND`. Do NOT return `AUTH_REQUIRED` — that signals\n *    missing credentials, not a missing pre-sync.\n *\n * This class is intentionally minimal. Copy-and-adapt for durable stores\n * (Postgres, Redis); see `docs/guides/account-resolution.md` for the DDL\n * reference and the key-derivation rationale.\n *\n * @example\n * ```ts\n * import { InMemoryImplicitAccountStore } from '@adcp/sdk/server';\n *\n * const accountStore = new InMemoryImplicitAccountStore({\n *   buildAccount: async (ref, ctx) => {\n *     const upstream = await myPlatform.findOrCreate(ref, ctx?.authInfo);\n *     return {\n *       id: upstream.id,\n *       name: upstream.name,\n *       status: 'active',\n *       ctx_metadata: { upstreamId: upstream.id },\n *     };\n *   },\n * });\n *\n * // Wire into createAdcpServer:\n * createAdcpServer({ accounts: accountStore, ... });\n * ```\n *\n * @public\n */\nexport class InMemoryImplicitAccountStore<TCtxMeta = Record<string, unknown>> implements AccountStore<TCtxMeta> {\n  readonly resolution = 'implicit' as const;\n\n  private _store = new Map<string, StoredEntry<TCtxMeta>>();\n  private _keyFn: (authInfo: ResolvedAuthInfo) => string | undefined;\n  private _ttlMs: number;\n  private _buildAccount: (\n    ref: AccountReference,\n    ctx?: ResolveContext\n  ) => Account<TCtxMeta> | Promise<Account<TCtxMeta>>;\n\n  constructor(options?: ImplicitAccountStoreOptions<TCtxMeta>) {\n    this._buildAccount =\n      options?.buildAccount ??\n      (defaultBuildAccount as unknown as (ref: AccountReference, ctx?: ResolveContext) => Account<TCtxMeta>);\n    this._keyFn = options?.keyFn ?? defaultImplicitKeyFn;\n    this._ttlMs = options?.ttlMs ?? 86_400_000;\n  }\n\n  /**\n   * Resolve the caller's account from the auth-principal→account mapping\n   * populated by a prior `sync_accounts` call.\n   *\n   * Returns `null` (→ `ACCOUNT_NOT_FOUND`) when:\n   * - No prior `sync_accounts` was called for this principal\n   * - The stored entry has exceeded `ttlMs`\n   * - `ctx.authInfo` is absent or carries no extractable key\n   *\n   * **Multi-account note.** When a buyer synced multiple refs in one\n   * `sync_accounts` call, this implementation returns the _first_ stored\n   * account. If your platform requires per-request account disambiguation\n   * (e.g., different brands on the same buyer), switch to `'explicit'` mode\n   * so buyers pass `ext.account_ref` on each request, or override `keyFn`\n   * to encode the brand into the key.\n   */\n  async resolve(_ref: AccountReference | undefined, ctx?: ResolveContext): Promise<Account<TCtxMeta> | null> {\n    const authInfo = ctx?.authInfo;\n    if (!authInfo) return null;\n    const key = this._keyFn(authInfo);\n    if (key === undefined) return null;\n    const entry = this._store.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.storedAt > this._ttlMs) {\n      this._store.delete(key);\n      return null;\n    }\n    return entry.accounts[0] ?? null;\n  }\n\n  /**\n   * Process a `sync_accounts` payload: build accounts from refs and store\n   * them under the caller's auth key.\n   *\n   * The auth key is extracted from `ctx.authInfo` via `keyFn`. When the\n   * key cannot be derived (no credential or unrecognized credential kind),\n   * all refs are returned as `SYNC_FAILED` rows — a silent-success-then-\n   * mystery-failure sequence is worse than an explicit error. Check your\n   * `authenticate` callback and `keyFn` if you see this error.\n   *\n   * When `ctx.authInfo` is absent (unauthenticated call), all refs fail\n   * with `UNAUTHENTICATED`. Your `authenticate` callback in\n   * `serve({ authenticate })` should reject unauthenticated requests before\n   * reaching this method.\n   */\n  async upsert(refs: AccountReference[], ctx?: ResolveContext): Promise<SyncAccountsResultRow[]> {\n    const authInfo = ctx?.authInfo;\n\n    // Derive the key before building any accounts. If the key cannot be\n    // extracted, fail all rows explicitly — returning success rows here\n    // would cause a mysterious ACCOUNT_NOT_FOUND on the next tool call.\n    const key = authInfo !== undefined ? this._keyFn(authInfo) : undefined;\n    if (key === undefined) {\n      return refs.map(ref => {\n        const r = ref as Record<string, unknown>;\n        return {\n          brand: (r['brand'] as BrandReference | undefined) ?? ({ domain: 'unknown' } as BrandReference),\n          operator: (r['operator'] as string | undefined) ?? '',\n          action: 'failed' as const,\n          status: 'rejected' as AdcpAccountStatus,\n          errors: [\n            {\n              code: 'SYNC_FAILED',\n              message:\n                authInfo === undefined\n                  ? 'Unauthenticated: no authInfo on ctx — check authenticate configuration'\n                  : 'Could not derive principal key from auth credential — check keyFn or credential kind',\n            },\n          ],\n        };\n      });\n    }\n\n    // Build a natural-key index from any existing stored entry so we can\n    // detect re-syncs of the same (brand, operator, sandbox) tuple.\n    const existing = this._store.get(key);\n    const existingByNk = new Map<string, { account: Account<TCtxMeta>; ref: AccountReference }>();\n    if (existing) {\n      for (let i = 0; i < existing.refs.length; i++) {\n        existingByNk.set(refNaturalKey(existing.refs[i]!), {\n          account: existing.accounts[i]!,\n          ref: existing.refs[i]!,\n        });\n      }\n    }\n\n    const newAccounts: Account<TCtxMeta>[] = [];\n    const newRefs: AccountReference[] = [];\n    const rows: SyncAccountsResultRow[] = [];\n\n    for (const ref of refs) {\n      const nk = refNaturalKey(ref);\n      const hit = existingByNk.get(nk);\n      if (hit) {\n        // Re-sync of the same (brand, operator, sandbox) — preserve the\n        // original account_id without calling buildAccount again so adopters\n        // with non-deterministic resolvers (upstream API calls, DB writes)\n        // don't accumulate duplicate ids on replay.\n        newAccounts.push(hit.account);\n        newRefs.push(hit.ref);\n        const r = ref as Record<string, unknown>;\n        const brand: BrandReference =\n          hit.account.brand ??\n          (r['brand'] as BrandReference | undefined) ??\n          ({ domain: hit.account.id } as BrandReference);\n        const operator = hit.account.operator ?? (r['operator'] as string | undefined) ?? '';\n        rows.push({\n          account_id: hit.account.id,\n          brand,\n          operator,\n          name: hit.account.name,\n          action: 'unchanged',\n          status: hit.account.status,\n        });\n        continue;\n      }\n\n      try {\n        const account = await this._buildAccount(ref, ctx);\n        newAccounts.push(account);\n        newRefs.push(ref);\n        const r = ref as Record<string, unknown>;\n        const brand: BrandReference =\n          account.brand ?? (r['brand'] as BrandReference | undefined) ?? ({ domain: account.id } as BrandReference);\n        const operator = account.operator ?? (r['operator'] as string | undefined) ?? '';\n        rows.push({\n          account_id: account.id,\n          brand,\n          operator,\n          name: account.name,\n          action: 'created',\n          status: account.status,\n        });\n      } catch (err) {\n        // Suppress adopter-originated error details from the wire response —\n        // buildAccount exceptions may include upstream credentials, SQL text,\n        // or internal identifiers. Log server-side; emit a fixed string.\n        console.error('[InMemoryImplicitAccountStore] buildAccount threw:', err);\n        const r = ref as Record<string, unknown>;\n        rows.push({\n          brand: (r['brand'] as BrandReference | undefined) ?? ({ domain: 'unknown' } as BrandReference),\n          operator: (r['operator'] as string | undefined) ?? '',\n          action: 'failed',\n          status: 'rejected' as AdcpAccountStatus,\n          errors: [{ code: 'SYNC_FAILED', message: 'Account sync failed — check server logs' }],\n        });\n      }\n    }\n\n    // Only update the stored entry when at least one ref resolved successfully\n    // (either 'unchanged' or 'created'). An all-fail batch leaves the prior\n    // sync linkage intact so the buyer can retry without losing their mapping.\n    if (newAccounts.length > 0) {\n      this._store.set(key, { accounts: newAccounts, refs: newRefs, storedAt: Date.now() });\n    }\n    return rows;\n  }\n\n  // ---------------------------------------------------------------------------\n  // Test helpers\n  // ---------------------------------------------------------------------------\n\n  /** Remove all stored sync linkages. */\n  clear(): void {\n    this._store.clear();\n  }\n\n  /**\n   * Return the auth key that would be derived from `authInfo`.\n   * Useful in tests to assert that a specific principal's linkage was stored.\n   */\n  authKey(authInfo: ResolvedAuthInfo): string | undefined {\n    return this._keyFn(authInfo);\n  }\n\n  /** Return the number of principal → accounts linkages currently stored. */\n  get size(): number {\n    return this._store.size;\n  }\n}\n"],"mappings":"AAsDO,SAAS,qBAAqB,UAAgD;AACnF,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC,KAAM,QAAO;AAClB,UAAQ,KAAK,MAAM;AAAA,IACjB,KAAK;AACH,aAAO,SAAS,KAAK,SAAS;AAAA,IAChC,KAAK;AACH,aAAO,WAAW,KAAK,MAAM;AAAA,IAC/B,KAAK;AACH,aAAO,YAAY,KAAK,SAAS;AAAA,EACrC;AACF;AAKA,SAAS,cAAc,KAA+B;AACpD,QAAM,IAAI;AACV,QAAM,SAAU,EAAE,OAAO,IAA4C,QAAQ;AAC7E,QAAM,WAAW,EAAE,UAAU;AAC7B,QAAM,UAAU,QAAQ,EAAE,SAAS,CAAwB;AAC3D,SAAO,GAAG,UAAU,EAAE,IAAI,YAAY,EAAE,IAAI,UAAU,MAAM,GAAG;AACjE;AAsDA,SAAS,oBACP,KACA,MAC6C;AAC7C,QAAM,IAAI;AACV,QAAM,QAAQ,EAAE,OAAO;AACvB,QAAM,WAAY,EAAE,UAAU,KAA4B;AAC1D,QAAM,UAAU,EAAE,SAAS,MAAM;AACjC,QAAM,gBAAgB,UAAU,aAAa;AAC7C,QAAM,aACH,EAAE,YAAY,MACd,SAAS,YAAY,QAClB,GAAI,MAA6B,MAAM,IAAI,QAAQ,GAAG,aAAa,KACnE,OAAO,QAAQ,GAAG,aAAa;AACrC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,GAAI,UAAU,UAAa,EAAE,MAAM;AAAA,IACnC,GAAI,aAAa,MAAM,EAAE,SAAS;AAAA,IAClC,GAAI,WAAW,EAAE,SAAS,KAAK;AAAA,IAC/B,cAAc,CAAC;AAAA,EACjB;AACF;AAkDO,MAAM,6BAAmG;AAAA,EACrG,aAAa;AAAA,EAEd,SAAS,oBAAI,IAAmC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EAKR,YAAY,SAAiD;AAC3D,SAAK,gBACH,SAAS,gBACR;AACH,SAAK,SAAS,SAAS,SAAS;AAChC,SAAK,SAAS,SAAS,SAAS;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkBA,MAAM,QAAQ,MAAoC,KAAyD;AACzG,UAAM,WAAW,KAAK;AACtB,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,QAAI,QAAQ,OAAW,QAAO;AAC9B,UAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AACjC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,WAAW,KAAK,QAAQ;AAC7C,WAAK,OAAO,OAAO,GAAG;AACtB,aAAO;AAAA,IACT;AACA,WAAO,MAAM,SAAS,CAAC,KAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,OAAO,MAA0B,KAAwD;AAC7F,UAAM,WAAW,KAAK;AAKtB,UAAM,MAAM,aAAa,SAAY,KAAK,OAAO,QAAQ,IAAI;AAC7D,QAAI,QAAQ,QAAW;AACrB,aAAO,KAAK,IAAI,SAAO;AACrB,cAAM,IAAI;AACV,eAAO;AAAA,UACL,OAAQ,EAAE,OAAO,KAAqC,EAAE,QAAQ,UAAU;AAAA,UAC1E,UAAW,EAAE,UAAU,KAA4B;AAAA,UACnD,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ;AAAA,YACN;AAAA,cACE,MAAM;AAAA,cACN,SACE,aAAa,SACT,gFACA;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAIA,UAAM,WAAW,KAAK,OAAO,IAAI,GAAG;AACpC,UAAM,eAAe,oBAAI,IAAmE;AAC5F,QAAI,UAAU;AACZ,eAAS,IAAI,GAAG,IAAI,SAAS,KAAK,QAAQ,KAAK;AAC7C,qBAAa,IAAI,cAAc,SAAS,KAAK,CAAC,CAAE,GAAG;AAAA,UACjD,SAAS,SAAS,SAAS,CAAC;AAAA,UAC5B,KAAK,SAAS,KAAK,CAAC;AAAA,QACtB,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,cAAmC,CAAC;AAC1C,UAAM,UAA8B,CAAC;AACrC,UAAM,OAAgC,CAAC;AAEvC,eAAW,OAAO,MAAM;AACtB,YAAM,KAAK,cAAc,GAAG;AAC5B,YAAM,MAAM,aAAa,IAAI,EAAE;AAC/B,UAAI,KAAK;AAKP,oBAAY,KAAK,IAAI,OAAO;AAC5B,gBAAQ,KAAK,IAAI,GAAG;AACpB,cAAM,IAAI;AACV,cAAM,QACJ,IAAI,QAAQ,SACX,EAAE,OAAO,KACT,EAAE,QAAQ,IAAI,QAAQ,GAAG;AAC5B,cAAM,WAAW,IAAI,QAAQ,YAAa,EAAE,UAAU,KAA4B;AAClF,aAAK,KAAK;AAAA,UACR,YAAY,IAAI,QAAQ;AAAA,UACxB;AAAA,UACA;AAAA,UACA,MAAM,IAAI,QAAQ;AAAA,UAClB,QAAQ;AAAA,UACR,QAAQ,IAAI,QAAQ;AAAA,QACtB,CAAC;AACD;AAAA,MACF;AAEA,UAAI;AACF,cAAM,UAAU,MAAM,KAAK,cAAc,KAAK,GAAG;AACjD,oBAAY,KAAK,OAAO;AACxB,gBAAQ,KAAK,GAAG;AAChB,cAAM,IAAI;AACV,cAAM,QACJ,QAAQ,SAAU,EAAE,OAAO,KAAqC,EAAE,QAAQ,QAAQ,GAAG;AACvF,cAAM,WAAW,QAAQ,YAAa,EAAE,UAAU,KAA4B;AAC9E,aAAK,KAAK;AAAA,UACR,YAAY,QAAQ;AAAA,UACpB;AAAA,UACA;AAAA,UACA,MAAM,QAAQ;AAAA,UACd,QAAQ;AAAA,UACR,QAAQ,QAAQ;AAAA,QAClB,CAAC;AAAA,MACH,SAAS,KAAK;AAIZ,gBAAQ,MAAM,sDAAsD,GAAG;AACvE,cAAM,IAAI;AACV,aAAK,KAAK;AAAA,UACR,OAAQ,EAAE,OAAO,KAAqC,EAAE,QAAQ,UAAU;AAAA,UAC1E,UAAW,EAAE,UAAU,KAA4B;AAAA,UACnD,QAAQ;AAAA,UACR,QAAQ;AAAA,UACR,QAAQ,CAAC,EAAE,MAAM,eAAe,SAAS,+CAA0C,CAAC;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AAKA,QAAI,YAAY,SAAS,GAAG;AAC1B,WAAK,OAAO,IAAI,KAAK,EAAE,UAAU,aAAa,MAAM,SAAS,UAAU,KAAK,IAAI,EAAE,CAAC;AAAA,IACrF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAc;AACZ,SAAK,OAAO,MAAM;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ,UAAgD;AACtD,WAAO,KAAK,OAAO,QAAQ;AAAA,EAC7B;AAAA;AAAA,EAGA,IAAI,OAAe;AACjB,WAAO,KAAK,OAAO;AAAA,EACrB;AACF;","names":[]}

package/dist/lib/adapters/index.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import {
   ContentStandardsAdapter,
   ContentStandardsErrorCodes,

package/dist/lib/adapters/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/adapters/index.ts"],"sourcesContent":["/**\n * Server-Side Adapters\n *\n * These adapters allow publishers/brands to plug in their business logic\n * when implementing AdCP servers. Each adapter provides a stub implementation\n * that can be extended or replaced.\n *\n * Usage:\n * - ContentStandardsAdapter: Implement brand safety/suitability evaluation\n * - PropertyListAdapter: Manage buyer-defined property lists\n * - SISessionManager: Handle Sponsored Intelligence conversational sessions\n * - InMemoryImplicitAccountStore: AccountStore for resolution: 'implicit' platforms\n */\n\n// Content Standards\nexport {\n  ContentStandardsAdapter,\n  type IContentStandardsAdapter,\n  type ContentEvaluationResult,\n  ContentStandardsErrorCodes,\n  isContentStandardsError,\n  defaultContentStandardsAdapter,\n} from './content-standards-adapter';\n\n// Property Lists\nexport {\n  PropertyListAdapter,\n  type IPropertyListAdapter,\n  type ResolvedProperty,\n  PropertyListErrorCodes,\n  isPropertyListError,\n  defaultPropertyListAdapter,\n} from './property-list-adapter';\n\n// Governance (seller-side committed checks)\nexport {\n  GovernanceAdapter,\n  defaultGovernanceAdapter,\n  type IGovernanceAdapter,\n  type GovernanceAdapterConfig,\n  type GovernanceAdapterErrorCode,\n  type CommittedCheckRequest,\n  GovernanceAdapterErrorCodes,\n  isGovernanceAdapterError,\n} from './governance-adapter';\n\n// Sponsored Intelligence Sessions\nexport {\n  SISessionManager,\n  AISISessionManager,\n  type ISISessionManager,\n  type SISession,\n  SIErrorCodes,\n  defaultSISessionManager,\n} from './si-session-manager';\n\n// Implicit Account Store (resolution: 'implicit') — Shape A reference adapter.\nexport {\n  InMemoryImplicitAccountStore,\n  defaultImplicitKeyFn,\n  type ImplicitAccountStoreOptions,\n} from './implicit-account-store';\n\n// OAuth pass-through resolver — closes adcp-client#1363. Shape B factory\n// for adapters wrapping a vendor OAuth + ad-account API; replaces the ~30\n// LOC of bearer-extract + listing-fetch + match-by-id boilerplate every\n// such adapter re-derives by hand.\nexport { createOAuthPassthroughResolver, type OAuthPassthroughResolverOptions } from './oauth-passthrough-resolver';\n\n// Roster-backed AccountStore — Shape C factory for `resolution: 'explicit'`\n// publisher-curated platforms. Adopters bring their own roster source (admin-UI\n// managed DB row, in-memory map, file); the helper provides AccountStore\n// plumbing (resolve dispatch, optional list, ctx threading) with no opinion on\n// where the roster lives.\nexport { createRosterAccountStore, type RosterAccountStoreOptions } from './roster-account-store';\n\n// Derived AccountStore — Shape D factory for `resolution: 'derived'` single-\n// tenant agents (no account_id on the wire; auth principal alone identifies\n// the tenant). Closes adcp-client#1462. Replaces ~25–30 LOC of bearer-extract +\n// throw-AUTH_REQUIRED + return-singleton boilerplate Shape D adopters write today.\nexport { createDerivedAccountStore, type DerivedAccountStoreOptions } from './derived-account-store';\n"],"mappings":";;;;;;AAeA;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EAKA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAMP,SAAS,sCAA4E;AAOrF,SAAS,gCAAgE;AAMzE,SAAS,iCAAkE;","names":[]}
+{"version":3,"sources":["../../../src/lib/adapters/index.ts"],"sourcesContent":["/**\n * Server-Side Adapters\n *\n * These adapters allow publishers/brands to plug in their business logic\n * when implementing AdCP servers. Each adapter provides a stub implementation\n * that can be extended or replaced.\n *\n * Usage:\n * - ContentStandardsAdapter: Implement brand safety/suitability evaluation\n * - PropertyListAdapter: Manage buyer-defined property lists\n * - SISessionManager: Handle Sponsored Intelligence conversational sessions\n * - InMemoryImplicitAccountStore: AccountStore for resolution: 'implicit' platforms\n */\n\n// Content Standards\nexport {\n  ContentStandardsAdapter,\n  type IContentStandardsAdapter,\n  type ContentEvaluationResult,\n  ContentStandardsErrorCodes,\n  isContentStandardsError,\n  defaultContentStandardsAdapter,\n} from './content-standards-adapter';\n\n// Property Lists\nexport {\n  PropertyListAdapter,\n  type IPropertyListAdapter,\n  type ResolvedProperty,\n  PropertyListErrorCodes,\n  isPropertyListError,\n  defaultPropertyListAdapter,\n} from './property-list-adapter';\n\n// Governance (seller-side committed checks)\nexport {\n  GovernanceAdapter,\n  defaultGovernanceAdapter,\n  type IGovernanceAdapter,\n  type GovernanceAdapterConfig,\n  type GovernanceAdapterErrorCode,\n  type CommittedCheckRequest,\n  GovernanceAdapterErrorCodes,\n  isGovernanceAdapterError,\n} from './governance-adapter';\n\n// Sponsored Intelligence Sessions\nexport {\n  SISessionManager,\n  AISISessionManager,\n  type ISISessionManager,\n  type SISession,\n  SIErrorCodes,\n  defaultSISessionManager,\n} from './si-session-manager';\n\n// Implicit Account Store (resolution: 'implicit') — Shape A reference adapter.\nexport {\n  InMemoryImplicitAccountStore,\n  defaultImplicitKeyFn,\n  type ImplicitAccountStoreOptions,\n} from './implicit-account-store';\n\n// OAuth pass-through resolver — closes adcp-client#1363. Shape B factory\n// for adapters wrapping a vendor OAuth + ad-account API; replaces the ~30\n// LOC of bearer-extract + listing-fetch + match-by-id boilerplate every\n// such adapter re-derives by hand.\nexport { createOAuthPassthroughResolver, type OAuthPassthroughResolverOptions } from './oauth-passthrough-resolver';\n\n// Roster-backed AccountStore — Shape C factory for `resolution: 'explicit'`\n// publisher-curated platforms. Adopters bring their own roster source (admin-UI\n// managed DB row, in-memory map, file); the helper provides AccountStore\n// plumbing (resolve dispatch, optional list, ctx threading) with no opinion on\n// where the roster lives.\nexport { createRosterAccountStore, type RosterAccountStoreOptions } from './roster-account-store';\n\n// Derived AccountStore — Shape D factory for `resolution: 'derived'` single-\n// tenant agents (no account_id on the wire; auth principal alone identifies\n// the tenant). Closes adcp-client#1462. Replaces ~25–30 LOC of bearer-extract +\n// throw-AUTH_REQUIRED + return-singleton boilerplate Shape D adopters write today.\nexport { createDerivedAccountStore, type DerivedAccountStoreOptions } from './derived-account-store';\n"],"mappings":"AAeA;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EAKA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,EAGA;AAAA,EACA;AAAA,OACK;AAGP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAMP,SAAS,sCAA4E;AAOrF,SAAS,gCAAgE;AAMzE,SAAS,iCAAkE;","names":[]}

package/dist/lib/adapters/legacy/v2-5/create_media_buy.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { adaptCreateMediaBuyRequestForV2, normalizeMediaBuyResponse } from "../../../utils/creative-adapter.mjs";
 const createMediaBuyAdapter = {
   toolName: "create_media_buy",

package/dist/lib/adapters/legacy/v2-5/create_media_buy.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/create_media_buy.ts"],"sourcesContent":["import { adaptCreateMediaBuyRequestForV2, normalizeMediaBuyResponse } from '../../../utils/creative-adapter';\nimport type { CreateMediaBuyRequest, CreateMediaBuyResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\nexport const createMediaBuyAdapter: AdapterPair<unknown, CreateMediaBuyRequest, CreateMediaBuyResponse, unknown> = {\n  toolName: 'create_media_buy',\n  adaptRequest: adaptCreateMediaBuyRequestForV2,\n  normalizeResponse: normalizeMediaBuyResponse,\n};\n"],"mappings":";;;;;;AAAA,SAAS,iCAAiC,iCAAiC;AAIpE,MAAM,wBAAsG;AAAA,EACjH,UAAU;AAAA,EACV,cAAc;AAAA,EACd,mBAAmB;AACrB;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/create_media_buy.ts"],"sourcesContent":["import { adaptCreateMediaBuyRequestForV2, normalizeMediaBuyResponse } from '../../../utils/creative-adapter';\nimport type { CreateMediaBuyRequest, CreateMediaBuyResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\nexport const createMediaBuyAdapter: AdapterPair<unknown, CreateMediaBuyRequest, CreateMediaBuyResponse, unknown> = {\n  toolName: 'create_media_buy',\n  adaptRequest: adaptCreateMediaBuyRequestForV2,\n  normalizeResponse: normalizeMediaBuyResponse,\n};\n"],"mappings":"AAAA,SAAS,iCAAiC,iCAAiC;AAIpE,MAAM,wBAAsG;AAAA,EACjH,UAAU;AAAA,EACV,cAAc;AAAA,EACd,mBAAmB;AACrB;","names":[]}

package/dist/lib/adapters/legacy/v2-5/get_products.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { adaptGetProductsRequestForV2, normalizeGetProductsResponse } from "../../../utils/pricing-adapter.mjs";
 const getProductsAdapter = {
   toolName: "get_products",

package/dist/lib/adapters/legacy/v2-5/get_products.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/get_products.ts"],"sourcesContent":["import { adaptGetProductsRequestForV2, normalizeGetProductsResponse } from '../../../utils/pricing-adapter';\nimport type { GetProductsRequest, GetProductsResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/**\n * v3 ↔ v2.5 adapter pair for `get_products`. Wraps the existing scattered\n * adapter helpers so the registry pattern lands without behavior change;\n * a focused refactor of the underlying implementation can follow.\n */\nexport const getProductsAdapter: AdapterPair<unknown, GetProductsRequest, GetProductsResponse, unknown> = {\n  toolName: 'get_products',\n  adaptRequest: adaptGetProductsRequestForV2,\n  normalizeResponse: normalizeGetProductsResponse,\n};\n"],"mappings":";;;;;;AAAA,SAAS,8BAA8B,oCAAoC;AASpE,MAAM,qBAA6F;AAAA,EACxG,UAAU;AAAA,EACV,cAAc;AAAA,EACd,mBAAmB;AACrB;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/get_products.ts"],"sourcesContent":["import { adaptGetProductsRequestForV2, normalizeGetProductsResponse } from '../../../utils/pricing-adapter';\nimport type { GetProductsRequest, GetProductsResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/**\n * v3 ↔ v2.5 adapter pair for `get_products`. Wraps the existing scattered\n * adapter helpers so the registry pattern lands without behavior change;\n * a focused refactor of the underlying implementation can follow.\n */\nexport const getProductsAdapter: AdapterPair<unknown, GetProductsRequest, GetProductsResponse, unknown> = {\n  toolName: 'get_products',\n  adaptRequest: adaptGetProductsRequestForV2,\n  normalizeResponse: normalizeGetProductsResponse,\n};\n"],"mappings":"AAAA,SAAS,8BAA8B,oCAAoC;AASpE,MAAM,qBAA6F;AAAA,EACxG,UAAU;AAAA,EACV,cAAc;AAAA,EACd,mBAAmB;AACrB;","names":[]}

package/dist/lib/adapters/legacy/v2-5/index.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { getProductsAdapter } from "./get_products.mjs";
 import { createMediaBuyAdapter } from "./create_media_buy.mjs";
 import { updateMediaBuyAdapter } from "./update_media_buy.mjs";

package/dist/lib/adapters/legacy/v2-5/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/index.ts"],"sourcesContent":["/**\n * Registry of legacy v2.5 adapter pairs, one per AdCP tool.\n *\n * The SDK's current pin (v3 today) is implicit — this module describes\n * what the buyer sends to and receives from a v2.5 seller, regardless of\n * which v3.x patch the SDK itself speaks. When the SDK pin moves to v4,\n * this directory continues to hold the v2.5 compat shim and a sibling\n * `legacy/v3/` would join for v3 sellers.\n *\n * Add a new tool by:\n *   1. Drop a per-tool module in this directory exporting an\n *      `AdapterPair<V3Req, V25Req, V25Res, V3Res>`.\n *   2. Register it below.\n *   3. Add a fixture to `test/lib/adapter-v2-5-conformance.test.js`.\n *\n * Naming intentionally matches `legacy/<seller-version>/`, NOT\n * `<sdk-version>-to-<seller-version>/`. Real ad-tech compat layers carry\n * N=1 active legacy shim with a deprecation runway (OpenRTB, Prebid, GAM\n * all behave this way) — the directory tree should reflect \"exceptional,\n * time-boxed\" rather than encoding a matrix nobody will staff.\n */\n\nimport type { AdapterPair } from './types';\nimport { getProductsAdapter } from './get_products';\nimport { createMediaBuyAdapter } from './create_media_buy';\nimport { updateMediaBuyAdapter } from './update_media_buy';\nimport { syncCreativesAdapter } from './sync_creatives';\nimport { listCreativeFormatsAdapter } from './list_creative_formats';\nimport { previewCreativeAdapter } from './preview_creative';\n\nexport type { AdapterPair } from './types';\n\nconst PAIRS: ReadonlyArray<AdapterPair> = [\n  getProductsAdapter,\n  createMediaBuyAdapter,\n  updateMediaBuyAdapter,\n  syncCreativesAdapter,\n  listCreativeFormatsAdapter,\n  previewCreativeAdapter,\n];\n\nconst REGISTRY: ReadonlyMap<string, AdapterPair> = new Map(PAIRS.map(p => [p.toolName, p]));\n\n/**\n * Look up the legacy adapter pair for a given AdCP tool when targeting\n * a v2.5 seller. Returns `undefined` for tools without a registered pair\n * — caller should pass the request through unchanged.\n */\nexport function getV25Adapter(toolName: string): AdapterPair | undefined {\n  return REGISTRY.get(toolName);\n}\n\n/**\n * Names of tools registered for v2.5 adaptation. Used by the conformance\n * test suite as the authoritative list.\n */\nexport function listV25AdapterTools(): string[] {\n  return [...REGISTRY.keys()];\n}\n"],"mappings":";;;;;;AAuBA,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AAIvC,MAAM,QAAoC;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,WAA6C,IAAI,IAAI,MAAM,IAAI,OAAK,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AAOnF,SAAS,cAAc,UAA2C;AACvE,SAAO,SAAS,IAAI,QAAQ;AAC9B;AAMO,SAAS,sBAAgC;AAC9C,SAAO,CAAC,GAAG,SAAS,KAAK,CAAC;AAC5B;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/index.ts"],"sourcesContent":["/**\n * Registry of legacy v2.5 adapter pairs, one per AdCP tool.\n *\n * The SDK's current pin (v3 today) is implicit — this module describes\n * what the buyer sends to and receives from a v2.5 seller, regardless of\n * which v3.x patch the SDK itself speaks. When the SDK pin moves to v4,\n * this directory continues to hold the v2.5 compat shim and a sibling\n * `legacy/v3/` would join for v3 sellers.\n *\n * Add a new tool by:\n *   1. Drop a per-tool module in this directory exporting an\n *      `AdapterPair<V3Req, V25Req, V25Res, V3Res>`.\n *   2. Register it below.\n *   3. Add a fixture to `test/lib/adapter-v2-5-conformance.test.js`.\n *\n * Naming intentionally matches `legacy/<seller-version>/`, NOT\n * `<sdk-version>-to-<seller-version>/`. Real ad-tech compat layers carry\n * N=1 active legacy shim with a deprecation runway (OpenRTB, Prebid, GAM\n * all behave this way) — the directory tree should reflect \"exceptional,\n * time-boxed\" rather than encoding a matrix nobody will staff.\n */\n\nimport type { AdapterPair } from './types';\nimport { getProductsAdapter } from './get_products';\nimport { createMediaBuyAdapter } from './create_media_buy';\nimport { updateMediaBuyAdapter } from './update_media_buy';\nimport { syncCreativesAdapter } from './sync_creatives';\nimport { listCreativeFormatsAdapter } from './list_creative_formats';\nimport { previewCreativeAdapter } from './preview_creative';\n\nexport type { AdapterPair } from './types';\n\nconst PAIRS: ReadonlyArray<AdapterPair> = [\n  getProductsAdapter,\n  createMediaBuyAdapter,\n  updateMediaBuyAdapter,\n  syncCreativesAdapter,\n  listCreativeFormatsAdapter,\n  previewCreativeAdapter,\n];\n\nconst REGISTRY: ReadonlyMap<string, AdapterPair> = new Map(PAIRS.map(p => [p.toolName, p]));\n\n/**\n * Look up the legacy adapter pair for a given AdCP tool when targeting\n * a v2.5 seller. Returns `undefined` for tools without a registered pair\n * — caller should pass the request through unchanged.\n */\nexport function getV25Adapter(toolName: string): AdapterPair | undefined {\n  return REGISTRY.get(toolName);\n}\n\n/**\n * Names of tools registered for v2.5 adaptation. Used by the conformance\n * test suite as the authoritative list.\n */\nexport function listV25AdapterTools(): string[] {\n  return [...REGISTRY.keys()];\n}\n"],"mappings":"AAuBA,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AAIvC,MAAM,QAAoC;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,WAA6C,IAAI,IAAI,MAAM,IAAI,OAAK,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AAOnF,SAAS,cAAc,UAA2C;AACvE,SAAO,SAAS,IAAI,QAAQ;AAC9B;AAMO,SAAS,sBAAgC;AAC9C,SAAO,CAAC,GAAG,SAAS,KAAK,CAAC;AAC5B;","names":[]}

package/dist/lib/adapters/legacy/v2-5/list_creative_formats.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { normalizeFormatsResponse } from "../../../utils/format-renders.mjs";
 const listCreativeFormatsAdapter = {
   toolName: "list_creative_formats",

package/dist/lib/adapters/legacy/v2-5/list_creative_formats.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/list_creative_formats.ts"],"sourcesContent":["import { normalizeFormatsResponse } from '../../../utils/format-renders';\nimport type { ListCreativeFormatsRequest, ListCreativeFormatsResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/**\n * `list_creative_formats` has no v2.5 wire-shape divergence on the request\n * side (pass-through). The response normalizer maps v2.5's older format\n * shape (`format_id` strings, etc.) to the v3 surface.\n */\nexport const listCreativeFormatsAdapter: AdapterPair<\n  ListCreativeFormatsRequest,\n  ListCreativeFormatsRequest,\n  ListCreativeFormatsResponse,\n  unknown\n> = {\n  toolName: 'list_creative_formats',\n  adaptRequest: req => req,\n  normalizeResponse: normalizeFormatsResponse,\n};\n"],"mappings":";;;;;;AAAA,SAAS,gCAAgC;AASlC,MAAM,6BAKT;AAAA,EACF,UAAU;AAAA,EACV,cAAc,SAAO;AAAA,EACrB,mBAAmB;AACrB;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/list_creative_formats.ts"],"sourcesContent":["import { normalizeFormatsResponse } from '../../../utils/format-renders';\nimport type { ListCreativeFormatsRequest, ListCreativeFormatsResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/**\n * `list_creative_formats` has no v2.5 wire-shape divergence on the request\n * side (pass-through). The response normalizer maps v2.5's older format\n * shape (`format_id` strings, etc.) to the v3 surface.\n */\nexport const listCreativeFormatsAdapter: AdapterPair<\n  ListCreativeFormatsRequest,\n  ListCreativeFormatsRequest,\n  ListCreativeFormatsResponse,\n  unknown\n> = {\n  toolName: 'list_creative_formats',\n  adaptRequest: req => req,\n  normalizeResponse: normalizeFormatsResponse,\n};\n"],"mappings":"AAAA,SAAS,gCAAgC;AASlC,MAAM,6BAKT;AAAA,EACF,UAAU;AAAA,EACV,cAAc,SAAO;AAAA,EACrB,mBAAmB;AACrB;","names":[]}

package/dist/lib/adapters/legacy/v2-5/preview_creative.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { normalizePreviewCreativeResponse } from "../../../utils/preview-normalizer.mjs";
 const previewCreativeAdapter = {
   toolName: "preview_creative",

package/dist/lib/adapters/legacy/v2-5/preview_creative.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/preview_creative.ts"],"sourcesContent":["import { normalizePreviewCreativeResponse } from '../../../utils/preview-normalizer';\nimport type { PreviewCreativeRequest, PreviewCreativeResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\nexport const previewCreativeAdapter: AdapterPair<\n  PreviewCreativeRequest,\n  PreviewCreativeRequest,\n  PreviewCreativeResponse,\n  unknown\n> = {\n  toolName: 'preview_creative',\n  adaptRequest: req => req,\n  normalizeResponse: normalizePreviewCreativeResponse,\n};\n"],"mappings":";;;;;;AAAA,SAAS,wCAAwC;AAI1C,MAAM,yBAKT;AAAA,EACF,UAAU;AAAA,EACV,cAAc,SAAO;AAAA,EACrB,mBAAmB;AACrB;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/preview_creative.ts"],"sourcesContent":["import { normalizePreviewCreativeResponse } from '../../../utils/preview-normalizer';\nimport type { PreviewCreativeRequest, PreviewCreativeResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\nexport const previewCreativeAdapter: AdapterPair<\n  PreviewCreativeRequest,\n  PreviewCreativeRequest,\n  PreviewCreativeResponse,\n  unknown\n> = {\n  toolName: 'preview_creative',\n  adaptRequest: req => req,\n  normalizeResponse: normalizePreviewCreativeResponse,\n};\n"],"mappings":"AAAA,SAAS,wCAAwC;AAI1C,MAAM,yBAKT;AAAA,EACF,UAAU;AAAA,EACV,cAAc,SAAO;AAAA,EACrB,mBAAmB;AACrB;","names":[]}

package/dist/lib/adapters/legacy/v2-5/sync_creatives.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { adaptSyncCreativesRequestForV2 } from "../../../utils/sync-creatives-adapter.mjs";
 const syncCreativesAdapter = {
   toolName: "sync_creatives",

package/dist/lib/adapters/legacy/v2-5/sync_creatives.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/sync_creatives.ts"],"sourcesContent":["import { adaptSyncCreativesRequestForV2 } from '../../../utils/sync-creatives-adapter';\nimport type { SyncCreativesRequest, SyncCreativesResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/**\n * `sync_creatives` adapter pair. Currently has no v2.5 → v3 response\n * normalizer — sync responses are pass-through. The request adapter strips\n * v3-only fields and converts `status` enum → `approved` boolean; `assets`\n * passes through verbatim because v2.5 uses the same role-keyed manifest\n * shape as v3.\n */\nexport const syncCreativesAdapter: AdapterPair<unknown, SyncCreativesRequest, SyncCreativesResponse, unknown> = {\n  toolName: 'sync_creatives',\n  adaptRequest: adaptSyncCreativesRequestForV2,\n};\n"],"mappings":";;;;;;AAAA,SAAS,sCAAsC;AAWxC,MAAM,uBAAmG;AAAA,EAC9G,UAAU;AAAA,EACV,cAAc;AAChB;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/sync_creatives.ts"],"sourcesContent":["import { adaptSyncCreativesRequestForV2 } from '../../../utils/sync-creatives-adapter';\nimport type { SyncCreativesRequest, SyncCreativesResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\n/**\n * `sync_creatives` adapter pair. Currently has no v2.5 → v3 response\n * normalizer — sync responses are pass-through. The request adapter strips\n * v3-only fields and converts `status` enum → `approved` boolean; `assets`\n * passes through verbatim because v2.5 uses the same role-keyed manifest\n * shape as v3.\n */\nexport const syncCreativesAdapter: AdapterPair<unknown, SyncCreativesRequest, SyncCreativesResponse, unknown> = {\n  toolName: 'sync_creatives',\n  adaptRequest: adaptSyncCreativesRequestForV2,\n};\n"],"mappings":"AAAA,SAAS,sCAAsC;AAWxC,MAAM,uBAAmG;AAAA,EAC9G,UAAU;AAAA,EACV,cAAc;AAChB;","names":[]}

package/dist/lib/adapters/legacy/v2-5/types.mjs

@@ -1,7 +1 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 //# sourceMappingURL=types.mjs.map

package/dist/lib/adapters/legacy/v2-5/update_media_buy.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { adaptUpdateMediaBuyRequestForV2, normalizeMediaBuyResponse } from "../../../utils/creative-adapter.mjs";
 const updateMediaBuyAdapter = {
   toolName: "update_media_buy",

package/dist/lib/adapters/legacy/v2-5/update_media_buy.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/update_media_buy.ts"],"sourcesContent":["import { adaptUpdateMediaBuyRequestForV2, normalizeMediaBuyResponse } from '../../../utils/creative-adapter';\nimport type { UpdateMediaBuyRequest, UpdateMediaBuyResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\nexport const updateMediaBuyAdapter: AdapterPair<unknown, UpdateMediaBuyRequest, UpdateMediaBuyResponse, unknown> = {\n  toolName: 'update_media_buy',\n  adaptRequest: adaptUpdateMediaBuyRequestForV2,\n  // Update responses share the media-buy normalizer (creative_ids ↔\n  // creative_assignments + null-array coercion).\n  normalizeResponse: normalizeMediaBuyResponse,\n};\n"],"mappings":";;;;;;AAAA,SAAS,iCAAiC,iCAAiC;AAIpE,MAAM,wBAAsG;AAAA,EACjH,UAAU;AAAA,EACV,cAAc;AAAA;AAAA;AAAA,EAGd,mBAAmB;AACrB;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/adapters/legacy/v2-5/update_media_buy.ts"],"sourcesContent":["import { adaptUpdateMediaBuyRequestForV2, normalizeMediaBuyResponse } from '../../../utils/creative-adapter';\nimport type { UpdateMediaBuyRequest, UpdateMediaBuyResponse } from '../../../types/v2-5';\nimport type { AdapterPair } from './types';\n\nexport const updateMediaBuyAdapter: AdapterPair<unknown, UpdateMediaBuyRequest, UpdateMediaBuyResponse, unknown> = {\n  toolName: 'update_media_buy',\n  adaptRequest: adaptUpdateMediaBuyRequestForV2,\n  // Update responses share the media-buy normalizer (creative_ids ↔\n  // creative_assignments + null-array coercion).\n  normalizeResponse: normalizeMediaBuyResponse,\n};\n"],"mappings":"AAAA,SAAS,iCAAiC,iCAAiC;AAIpE,MAAM,wBAAsG;AAAA,EACjH,UAAU;AAAA,EACV,cAAc;AAAA;AAAA;AAAA,EAGd,mBAAmB;AACrB;","names":[]}

package/dist/lib/adapters/oauth-passthrough-resolver.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { createHash } from "node:crypto";
 import { refAccountId } from "../server/decisioning/account.mjs";
 function createOAuthPassthroughResolver(options) {

package/dist/lib/adapters/oauth-passthrough-resolver.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/adapters/oauth-passthrough-resolver.ts"],"sourcesContent":["/**\n * OAuth pass-through `accounts.resolve` factory. Standardizes the canonical\n * \"Shape B\" account-resolution pattern: an adapter wraps a vendor OAuth +\n * ad-account API (Snap, Meta, TikTok, LinkedIn, Reddit, Pinterest, etc.) and\n * resolves the buyer's `AccountReference` by hitting the upstream's\n * \"list-my-accounts\" endpoint with the buyer's bearer.\n *\n * Without this factory, every Shape B adapter rolls the same ~30 LOC:\n * extract bearer from `ctx.authInfo`, GET `/me/adaccounts`, match by id,\n * return tenant with `ctx_metadata` populated. This factory handles the\n * boilerplate; the adapter supplies the upstream specifics\n * (`listEndpoint`, `toAccount` mapper) and the auth shape via\n * {@link createUpstreamHttpClient}'s `dynamic_bearer.getToken`.\n *\n * Closes adcp-client#1363.\n *\n * **Picking an AccountStore?** Four reference shapes by *who creates the\n * account*:\n * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`\n *   (Shape A).\n * - **Upstream OAuth API owns the roster** → `createOAuthPassthroughResolver`\n *   (this file, Shape B, returns just `resolve`).\n * - **Publisher ops curates the roster** → `createRosterAccountStore`\n *   (Shape C, complete AccountStore).\n * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`\n *   (Shape D, `resolution: 'derived'`).\n *\n * @public\n */\n\nimport { createHash } from 'node:crypto';\nimport type { Account, ResolveContext } from '../server/decisioning/account';\nimport { refAccountId } from '../server/decisioning/account';\nimport type { AccountReference } from '../types/tools.generated';\nimport type { AuthContext, UpstreamHttpClient } from '../server/upstream-helpers';\n\n/**\n * Options for {@link createOAuthPassthroughResolver}.\n *\n * @public\n */\nexport interface OAuthPassthroughResolverOptions<TUpstreamRow, TCtxMeta = Record<string, unknown>> {\n  /**\n   * Pre-configured upstream HTTP client (typically from\n   * {@link createUpstreamHttpClient}). Should be configured with\n   * `auth: { kind: 'dynamic_bearer', getToken: (ctx) => ... }` so the\n   * factory's `getAuthContext` output flows through to bearer selection.\n   */\n  httpClient: UpstreamHttpClient;\n\n  /**\n   * Path on the upstream API that returns the buyer's accounts. Common\n   * shapes: `/v1/adaccounts`, `/me/adaccounts`, `/customers`.\n   */\n  listEndpoint: string;\n\n  /**\n   * Property on each upstream row matching the wire `AccountReference.account_id`.\n   * Defaults to `'id'`.\n   *\n   * **Footgun:** when the generic `TUpstreamRow` is inferred (no explicit\n   * type argument), `keyof TUpstreamRow & string` collapses to `string` and\n   * a typo in `idField` compiles fine but silently always returns `null`.\n   * Pass an explicit `TUpstreamRow` (or a dummy interface with the upstream's\n   * field names) to get compile-time field validation.\n   */\n  idField?: keyof TUpstreamRow & string;\n\n  /**\n   * Property on the upstream response body that contains the array of rows.\n   * Defaults to `'data'` (Snap, Meta envelope shape). Set to `null` when the\n   * response body itself is the array (some flat-list APIs).\n   *\n   * Single-segment only. APIs with deeper nesting (TikTok's `data.list`,\n   * for example) need a custom response transform — wrap the upstream client\n   * with a fetch override that flattens, or use this factory only for the\n   * 70%-fit upstream shape and write a hand-rolled resolver for the rest.\n   * Google Ads' `customers:listAccessibleCustomers` returns string resource\n   * names (not row objects) and is not a fit for this factory.\n   */\n  rowsPath?: string | null;\n\n  /**\n   * Extract the auth context to forward to the upstream's\n   * `dynamic_bearer.getToken(ctx)` resolver. The return value flows through\n   * as the `authContext` per-call option on `httpClient.get`.\n   *\n   * Defaults to forwarding `ctx?.authInfo` verbatim — works when the http\n   * client's `getToken` resolver reads `ctx.authInfo.token` /\n   * `ctx.authInfo.credential.token`.\n   */\n  getAuthContext?: (ctx: ResolveContext | undefined) => AuthContext | undefined;\n\n  /**\n   * Map an upstream row to a framework `Account<TCtxMeta>`. Adapters\n   * typically embed the raw row (or distilled fields) in `ctx_metadata` so\n   * downstream specialism methods can read upstream IDs, tokens, etc.\n   * without re-resolving.\n   *\n   * **Treat `ctx_metadata.accessToken` (or any embedded credential) as a\n   * secret.** The framework strips `ctx_metadata` from the wire response,\n   * but adopter code that throws an error containing `JSON.stringify(account)`\n   * or logs `ctx.account` at info level WILL leak the token. Either don't\n   * embed the bearer (re-derive from `ctx.authInfo` on each downstream\n   * method), or audit your error projections.\n   */\n  toAccount: (row: TUpstreamRow, ctx: ResolveContext | undefined) => Account<TCtxMeta>;\n\n  /**\n   * Optional in-memory listing cache. Caches the full row array per buyer\n   * (keyed on the auth context); resolves `account_id` matches in-memory\n   * within the TTL window. One upstream hit per buyer per TTL period\n   * regardless of how many account_ids that buyer queries.\n   *\n   * Set `ttlMs` to enable (default: no cache, every resolve hits upstream).\n   *\n   * **TTL guidance:**\n   * - **Read tools** (`get_products`, `list_creative_formats`): 60–300s.\n   *   Buyer-side latency dominates; longer TTL absorbs bursts.\n   * - **Mutating tools** (`create_media_buy`, `update_media_buy`,\n   *   `sync_creatives`): 0–30s, or compose `composeMethod` to skip cache\n   *   on these paths. A revoked-but-not-yet-expired bearer would otherwise\n   *   continue authorizing mutations for the full TTL window.\n   *\n   * `getCacheKey` defaults to a SHA-256 hash of the JSON-serialized auth\n   * context. Hashing (vs raw stringification) keeps the bearer token out\n   * of Map keys — heap dumps and `util.inspect(cache)` no longer surface\n   * plaintext credentials. Provide a custom key when the auth context\n   * contains noise (timestamps, request ids) that would defeat caching.\n   *\n   * Cache size is naturally bounded by the number of distinct buyers\n   * times one entry each. Adopters with token-rotation churn can cap with\n   * `maxEntries` (LRU eviction).\n   */\n  cache?: {\n    ttlMs: number;\n    getCacheKey?: (authContext: AuthContext | undefined) => string;\n    /** LRU eviction cap. Defaults to 1024 — enough for most multi-tenant deployments. */\n    maxEntries?: number;\n  };\n}\n\ninterface ListingCacheEntry<TUpstreamRow> {\n  rows: TUpstreamRow[];\n  expiresAt: number;\n}\n\n/**\n * Create an `accounts.resolve` implementation that resolves buyer-supplied\n * `AccountReference` against an upstream OAuth-protected listing endpoint.\n * Returns just the resolve function — adapters compose it into their own\n * `AccountStore` (typically alongside a no-op `upsert` since Shape B\n * adapters don't manage account lifecycle).\n *\n * @example\n * ```ts\n * import {\n *   createUpstreamHttpClient,\n *   createOAuthPassthroughResolver,\n *   defineSalesPlatform,\n * } from '@adcp/sdk/server';\n *\n * const snap = createUpstreamHttpClient({\n *   baseUrl: 'https://adsapi.snapchat.com',\n *   auth: {\n *     kind: 'dynamic_bearer',\n *     getToken: async (ctx) => (ctx as any)?.authInfo?.credential?.token,\n *   },\n * });\n *\n * const resolve = createOAuthPassthroughResolver({\n *   httpClient: snap,\n *   listEndpoint: '/v1/me/adaccounts',\n *   idField: 'id',\n *   rowsPath: 'adaccounts',\n *   toAccount: (row, ctx) => ({\n *     id: row.id,\n *     name: row.name,\n *     status: 'active',\n *     advertiser: row.advertiser_url,\n *     ctx_metadata: {\n *       upstreamId: row.id,\n *       // Treat as secret — see `toAccount` JSDoc above.\n *       accessToken: (ctx as any)?.authInfo?.credential?.token,\n *     },\n *   }),\n *   cache: { ttlMs: 60_000 },\n * });\n *\n * defineSalesPlatform({\n *   accounts: { resolve },\n *   ...\n * });\n * ```\n *\n * Behavior:\n * - The factory only handles the `{ account_id }` discriminated-union arm.\n *   Other arms (`{ brand, operator }`) and `undefined` ref return `null`\n *   without calling upstream.\n * - Upstream throws (4xx/5xx other than 404) propagate verbatim — adopters\n *   compose `composeMethod` over the result if they want to catch and map\n *   to a typed envelope (e.g. throw `AdcpError('AUTH_REQUIRED')` on 401).\n * - Cache is opt-in and listing-keyed: one upstream hit per buyer per TTL\n *   window regardless of how many `account_id`s that buyer queries.\n *\n * @public\n */\nexport function createOAuthPassthroughResolver<\n  TUpstreamRow extends Record<string, unknown>,\n  TCtxMeta = Record<string, unknown>,\n>(\n  options: OAuthPassthroughResolverOptions<TUpstreamRow, TCtxMeta>\n): (ref: AccountReference | undefined, ctx?: ResolveContext) => Promise<Account<TCtxMeta> | null> {\n  const idField = (options.idField ?? 'id') as keyof TUpstreamRow & string;\n  const rowsPath = options.rowsPath === undefined ? 'data' : options.rowsPath;\n  const getAuthContext =\n    options.getAuthContext ??\n    ((ctx: ResolveContext | undefined) => ctx?.authInfo as unknown as AuthContext | undefined);\n\n  const cacheTtlMs = options.cache?.ttlMs;\n  const getCacheKey = options.cache?.getCacheKey ?? defaultGetCacheKey;\n  const maxEntries = options.cache?.maxEntries ?? 1024;\n  const cache = cacheTtlMs !== undefined ? new Map<string, ListingCacheEntry<TUpstreamRow>>() : undefined;\n\n  return async (ref, ctx) => {\n    const accountId = refAccountId(ref);\n    if (accountId === undefined) return null;\n\n    const authContext = getAuthContext(ctx);\n    let cacheKey: string | undefined;\n    let rows: TUpstreamRow[] | null = null;\n\n    if (cache !== undefined) {\n      cacheKey = getCacheKey(authContext);\n      const hit = cache.get(cacheKey);\n      if (hit !== undefined && hit.expiresAt > Date.now()) {\n        // Refresh LRU position on hit.\n        cache.delete(cacheKey);\n        cache.set(cacheKey, hit);\n        rows = hit.rows;\n      } else if (hit !== undefined) {\n        cache.delete(cacheKey);\n      }\n    }\n\n    if (rows === null) {\n      const result = await options.httpClient.get<unknown>(\n        options.listEndpoint,\n        undefined,\n        undefined,\n        authContext !== undefined ? { authContext } : undefined\n      );\n      if (result.body == null) return null;\n      rows = extractRows<TUpstreamRow>(result.body, rowsPath);\n      if (rows === null) return null;\n      if (cache !== undefined && cacheKey !== undefined) {\n        // Evict oldest entry first when at capacity. Map iteration order is\n        // insertion order, so the first key is the LRU-coldest after the\n        // hit-side refresh above.\n        if (cache.size >= maxEntries) {\n          const oldest = cache.keys().next().value;\n          if (oldest !== undefined) cache.delete(oldest);\n        }\n        cache.set(cacheKey, { rows, expiresAt: Date.now() + cacheTtlMs! });\n      }\n    }\n\n    const match = rows.find(row => row[idField] === accountId);\n    if (match === undefined) return null;\n    return options.toAccount(match, ctx);\n  };\n}\n\n/**\n * Default cache-key derivation: SHA-256 of the JSON-serialized auth context.\n * Hashing keeps the bearer token out of Map keys (no plaintext credential\n * surfaces in heap dumps or `util.inspect(cache)` output).\n *\n * Falls back to a literal `<none>` key when the auth context is undefined,\n * and to the truncated stringified value when JSON serialization throws\n * (circular refs, BigInt, etc.) — adopters with non-serializable auth\n * contexts should provide their own `getCacheKey`.\n */\nfunction defaultGetCacheKey(authContext: AuthContext | undefined): string {\n  if (authContext === undefined) return '<none>';\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(authContext);\n  } catch {\n    return `<unserializable:${String(authContext).slice(0, 64)}>`;\n  }\n  return createHash('sha256').update(serialized).digest('hex');\n}\n\nfunction extractRows<TUpstreamRow>(body: unknown, rowsPath: string | null): TUpstreamRow[] | null {\n  if (rowsPath === null) {\n    return Array.isArray(body) ? (body as TUpstreamRow[]) : null;\n  }\n  if (body === null || typeof body !== 'object') return null;\n  const rows = (body as Record<string, unknown>)[rowsPath];\n  return Array.isArray(rows) ? (rows as TUpstreamRow[]) : null;\n}\n"],"mappings":";;;;;;AA8BA,SAAS,kBAAkB;AAE3B,SAAS,oBAAoB;AA+KtB,SAAS,+BAId,SACgG;AAChG,QAAM,UAAW,QAAQ,WAAW;AACpC,QAAM,WAAW,QAAQ,aAAa,SAAY,SAAS,QAAQ;AACnE,QAAM,iBACJ,QAAQ,mBACP,CAAC,QAAoC,KAAK;AAE7C,QAAM,aAAa,QAAQ,OAAO;AAClC,QAAM,cAAc,QAAQ,OAAO,eAAe;AAClD,QAAM,aAAa,QAAQ,OAAO,cAAc;AAChD,QAAM,QAAQ,eAAe,SAAY,oBAAI,IAA6C,IAAI;AAE9F,SAAO,OAAO,KAAK,QAAQ;AACzB,UAAM,YAAY,aAAa,GAAG;AAClC,QAAI,cAAc,OAAW,QAAO;AAEpC,UAAM,cAAc,eAAe,GAAG;AACtC,QAAI;AACJ,QAAI,OAA8B;AAElC,QAAI,UAAU,QAAW;AACvB,iBAAW,YAAY,WAAW;AAClC,YAAM,MAAM,MAAM,IAAI,QAAQ;AAC9B,UAAI,QAAQ,UAAa,IAAI,YAAY,KAAK,IAAI,GAAG;AAEnD,cAAM,OAAO,QAAQ;AACrB,cAAM,IAAI,UAAU,GAAG;AACvB,eAAO,IAAI;AAAA,MACb,WAAW,QAAQ,QAAW;AAC5B,cAAM,OAAO,QAAQ;AAAA,MACvB;AAAA,IACF;AAEA,QAAI,SAAS,MAAM;AACjB,YAAM,SAAS,MAAM,QAAQ,WAAW;AAAA,QACtC,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,gBAAgB,SAAY,EAAE,YAAY,IAAI;AAAA,MAChD;AACA,UAAI,OAAO,QAAQ,KAAM,QAAO;AAChC,aAAO,YAA0B,OAAO,MAAM,QAAQ;AACtD,UAAI,SAAS,KAAM,QAAO;AAC1B,UAAI,UAAU,UAAa,aAAa,QAAW;AAIjD,YAAI,MAAM,QAAQ,YAAY;AAC5B,gBAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;AACnC,cAAI,WAAW,OAAW,OAAM,OAAO,MAAM;AAAA,QAC/C;AACA,cAAM,IAAI,UAAU,EAAE,MAAM,WAAW,KAAK,IAAI,IAAI,WAAY,CAAC;AAAA,MACnE;AAAA,IACF;AAEA,UAAM,QAAQ,KAAK,KAAK,SAAO,IAAI,OAAO,MAAM,SAAS;AACzD,QAAI,UAAU,OAAW,QAAO;AAChC,WAAO,QAAQ,UAAU,OAAO,GAAG;AAAA,EACrC;AACF;AAYA,SAAS,mBAAmB,aAA8C;AACxE,MAAI,gBAAgB,OAAW,QAAO;AACtC,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,UAAU,WAAW;AAAA,EACzC,QAAQ;AACN,WAAO,mBAAmB,OAAO,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,EAC5D;AACA,SAAO,WAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO,KAAK;AAC7D;AAEA,SAAS,YAA0B,MAAe,UAAgD;AAChG,MAAI,aAAa,MAAM;AACrB,WAAO,MAAM,QAAQ,IAAI,IAAK,OAA0B;AAAA,EAC1D;AACA,MAAI,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AACtD,QAAM,OAAQ,KAAiC,QAAQ;AACvD,SAAO,MAAM,QAAQ,IAAI,IAAK,OAA0B;AAC1D;","names":[]}
+{"version":3,"sources":["../../../src/lib/adapters/oauth-passthrough-resolver.ts"],"sourcesContent":["/**\n * OAuth pass-through `accounts.resolve` factory. Standardizes the canonical\n * \"Shape B\" account-resolution pattern: an adapter wraps a vendor OAuth +\n * ad-account API (Snap, Meta, TikTok, LinkedIn, Reddit, Pinterest, etc.) and\n * resolves the buyer's `AccountReference` by hitting the upstream's\n * \"list-my-accounts\" endpoint with the buyer's bearer.\n *\n * Without this factory, every Shape B adapter rolls the same ~30 LOC:\n * extract bearer from `ctx.authInfo`, GET `/me/adaccounts`, match by id,\n * return tenant with `ctx_metadata` populated. This factory handles the\n * boilerplate; the adapter supplies the upstream specifics\n * (`listEndpoint`, `toAccount` mapper) and the auth shape via\n * {@link createUpstreamHttpClient}'s `dynamic_bearer.getToken`.\n *\n * Closes adcp-client#1363.\n *\n * **Picking an AccountStore?** Four reference shapes by *who creates the\n * account*:\n * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`\n *   (Shape A).\n * - **Upstream OAuth API owns the roster** → `createOAuthPassthroughResolver`\n *   (this file, Shape B, returns just `resolve`).\n * - **Publisher ops curates the roster** → `createRosterAccountStore`\n *   (Shape C, complete AccountStore).\n * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`\n *   (Shape D, `resolution: 'derived'`).\n *\n * @public\n */\n\nimport { createHash } from 'node:crypto';\nimport type { Account, ResolveContext } from '../server/decisioning/account';\nimport { refAccountId } from '../server/decisioning/account';\nimport type { AccountReference } from '../types/tools.generated';\nimport type { AuthContext, UpstreamHttpClient } from '../server/upstream-helpers';\n\n/**\n * Options for {@link createOAuthPassthroughResolver}.\n *\n * @public\n */\nexport interface OAuthPassthroughResolverOptions<TUpstreamRow, TCtxMeta = Record<string, unknown>> {\n  /**\n   * Pre-configured upstream HTTP client (typically from\n   * {@link createUpstreamHttpClient}). Should be configured with\n   * `auth: { kind: 'dynamic_bearer', getToken: (ctx) => ... }` so the\n   * factory's `getAuthContext` output flows through to bearer selection.\n   */\n  httpClient: UpstreamHttpClient;\n\n  /**\n   * Path on the upstream API that returns the buyer's accounts. Common\n   * shapes: `/v1/adaccounts`, `/me/adaccounts`, `/customers`.\n   */\n  listEndpoint: string;\n\n  /**\n   * Property on each upstream row matching the wire `AccountReference.account_id`.\n   * Defaults to `'id'`.\n   *\n   * **Footgun:** when the generic `TUpstreamRow` is inferred (no explicit\n   * type argument), `keyof TUpstreamRow & string` collapses to `string` and\n   * a typo in `idField` compiles fine but silently always returns `null`.\n   * Pass an explicit `TUpstreamRow` (or a dummy interface with the upstream's\n   * field names) to get compile-time field validation.\n   */\n  idField?: keyof TUpstreamRow & string;\n\n  /**\n   * Property on the upstream response body that contains the array of rows.\n   * Defaults to `'data'` (Snap, Meta envelope shape). Set to `null` when the\n   * response body itself is the array (some flat-list APIs).\n   *\n   * Single-segment only. APIs with deeper nesting (TikTok's `data.list`,\n   * for example) need a custom response transform — wrap the upstream client\n   * with a fetch override that flattens, or use this factory only for the\n   * 70%-fit upstream shape and write a hand-rolled resolver for the rest.\n   * Google Ads' `customers:listAccessibleCustomers` returns string resource\n   * names (not row objects) and is not a fit for this factory.\n   */\n  rowsPath?: string | null;\n\n  /**\n   * Extract the auth context to forward to the upstream's\n   * `dynamic_bearer.getToken(ctx)` resolver. The return value flows through\n   * as the `authContext` per-call option on `httpClient.get`.\n   *\n   * Defaults to forwarding `ctx?.authInfo` verbatim — works when the http\n   * client's `getToken` resolver reads `ctx.authInfo.token` /\n   * `ctx.authInfo.credential.token`.\n   */\n  getAuthContext?: (ctx: ResolveContext | undefined) => AuthContext | undefined;\n\n  /**\n   * Map an upstream row to a framework `Account<TCtxMeta>`. Adapters\n   * typically embed the raw row (or distilled fields) in `ctx_metadata` so\n   * downstream specialism methods can read upstream IDs, tokens, etc.\n   * without re-resolving.\n   *\n   * **Treat `ctx_metadata.accessToken` (or any embedded credential) as a\n   * secret.** The framework strips `ctx_metadata` from the wire response,\n   * but adopter code that throws an error containing `JSON.stringify(account)`\n   * or logs `ctx.account` at info level WILL leak the token. Either don't\n   * embed the bearer (re-derive from `ctx.authInfo` on each downstream\n   * method), or audit your error projections.\n   */\n  toAccount: (row: TUpstreamRow, ctx: ResolveContext | undefined) => Account<TCtxMeta>;\n\n  /**\n   * Optional in-memory listing cache. Caches the full row array per buyer\n   * (keyed on the auth context); resolves `account_id` matches in-memory\n   * within the TTL window. One upstream hit per buyer per TTL period\n   * regardless of how many account_ids that buyer queries.\n   *\n   * Set `ttlMs` to enable (default: no cache, every resolve hits upstream).\n   *\n   * **TTL guidance:**\n   * - **Read tools** (`get_products`, `list_creative_formats`): 60–300s.\n   *   Buyer-side latency dominates; longer TTL absorbs bursts.\n   * - **Mutating tools** (`create_media_buy`, `update_media_buy`,\n   *   `sync_creatives`): 0–30s, or compose `composeMethod` to skip cache\n   *   on these paths. A revoked-but-not-yet-expired bearer would otherwise\n   *   continue authorizing mutations for the full TTL window.\n   *\n   * `getCacheKey` defaults to a SHA-256 hash of the JSON-serialized auth\n   * context. Hashing (vs raw stringification) keeps the bearer token out\n   * of Map keys — heap dumps and `util.inspect(cache)` no longer surface\n   * plaintext credentials. Provide a custom key when the auth context\n   * contains noise (timestamps, request ids) that would defeat caching.\n   *\n   * Cache size is naturally bounded by the number of distinct buyers\n   * times one entry each. Adopters with token-rotation churn can cap with\n   * `maxEntries` (LRU eviction).\n   */\n  cache?: {\n    ttlMs: number;\n    getCacheKey?: (authContext: AuthContext | undefined) => string;\n    /** LRU eviction cap. Defaults to 1024 — enough for most multi-tenant deployments. */\n    maxEntries?: number;\n  };\n}\n\ninterface ListingCacheEntry<TUpstreamRow> {\n  rows: TUpstreamRow[];\n  expiresAt: number;\n}\n\n/**\n * Create an `accounts.resolve` implementation that resolves buyer-supplied\n * `AccountReference` against an upstream OAuth-protected listing endpoint.\n * Returns just the resolve function — adapters compose it into their own\n * `AccountStore` (typically alongside a no-op `upsert` since Shape B\n * adapters don't manage account lifecycle).\n *\n * @example\n * ```ts\n * import {\n *   createUpstreamHttpClient,\n *   createOAuthPassthroughResolver,\n *   defineSalesPlatform,\n * } from '@adcp/sdk/server';\n *\n * const snap = createUpstreamHttpClient({\n *   baseUrl: 'https://adsapi.snapchat.com',\n *   auth: {\n *     kind: 'dynamic_bearer',\n *     getToken: async (ctx) => (ctx as any)?.authInfo?.credential?.token,\n *   },\n * });\n *\n * const resolve = createOAuthPassthroughResolver({\n *   httpClient: snap,\n *   listEndpoint: '/v1/me/adaccounts',\n *   idField: 'id',\n *   rowsPath: 'adaccounts',\n *   toAccount: (row, ctx) => ({\n *     id: row.id,\n *     name: row.name,\n *     status: 'active',\n *     advertiser: row.advertiser_url,\n *     ctx_metadata: {\n *       upstreamId: row.id,\n *       // Treat as secret — see `toAccount` JSDoc above.\n *       accessToken: (ctx as any)?.authInfo?.credential?.token,\n *     },\n *   }),\n *   cache: { ttlMs: 60_000 },\n * });\n *\n * defineSalesPlatform({\n *   accounts: { resolve },\n *   ...\n * });\n * ```\n *\n * Behavior:\n * - The factory only handles the `{ account_id }` discriminated-union arm.\n *   Other arms (`{ brand, operator }`) and `undefined` ref return `null`\n *   without calling upstream.\n * - Upstream throws (4xx/5xx other than 404) propagate verbatim — adopters\n *   compose `composeMethod` over the result if they want to catch and map\n *   to a typed envelope (e.g. throw `AdcpError('AUTH_REQUIRED')` on 401).\n * - Cache is opt-in and listing-keyed: one upstream hit per buyer per TTL\n *   window regardless of how many `account_id`s that buyer queries.\n *\n * @public\n */\nexport function createOAuthPassthroughResolver<\n  TUpstreamRow extends Record<string, unknown>,\n  TCtxMeta = Record<string, unknown>,\n>(\n  options: OAuthPassthroughResolverOptions<TUpstreamRow, TCtxMeta>\n): (ref: AccountReference | undefined, ctx?: ResolveContext) => Promise<Account<TCtxMeta> | null> {\n  const idField = (options.idField ?? 'id') as keyof TUpstreamRow & string;\n  const rowsPath = options.rowsPath === undefined ? 'data' : options.rowsPath;\n  const getAuthContext =\n    options.getAuthContext ??\n    ((ctx: ResolveContext | undefined) => ctx?.authInfo as unknown as AuthContext | undefined);\n\n  const cacheTtlMs = options.cache?.ttlMs;\n  const getCacheKey = options.cache?.getCacheKey ?? defaultGetCacheKey;\n  const maxEntries = options.cache?.maxEntries ?? 1024;\n  const cache = cacheTtlMs !== undefined ? new Map<string, ListingCacheEntry<TUpstreamRow>>() : undefined;\n\n  return async (ref, ctx) => {\n    const accountId = refAccountId(ref);\n    if (accountId === undefined) return null;\n\n    const authContext = getAuthContext(ctx);\n    let cacheKey: string | undefined;\n    let rows: TUpstreamRow[] | null = null;\n\n    if (cache !== undefined) {\n      cacheKey = getCacheKey(authContext);\n      const hit = cache.get(cacheKey);\n      if (hit !== undefined && hit.expiresAt > Date.now()) {\n        // Refresh LRU position on hit.\n        cache.delete(cacheKey);\n        cache.set(cacheKey, hit);\n        rows = hit.rows;\n      } else if (hit !== undefined) {\n        cache.delete(cacheKey);\n      }\n    }\n\n    if (rows === null) {\n      const result = await options.httpClient.get<unknown>(\n        options.listEndpoint,\n        undefined,\n        undefined,\n        authContext !== undefined ? { authContext } : undefined\n      );\n      if (result.body == null) return null;\n      rows = extractRows<TUpstreamRow>(result.body, rowsPath);\n      if (rows === null) return null;\n      if (cache !== undefined && cacheKey !== undefined) {\n        // Evict oldest entry first when at capacity. Map iteration order is\n        // insertion order, so the first key is the LRU-coldest after the\n        // hit-side refresh above.\n        if (cache.size >= maxEntries) {\n          const oldest = cache.keys().next().value;\n          if (oldest !== undefined) cache.delete(oldest);\n        }\n        cache.set(cacheKey, { rows, expiresAt: Date.now() + cacheTtlMs! });\n      }\n    }\n\n    const match = rows.find(row => row[idField] === accountId);\n    if (match === undefined) return null;\n    return options.toAccount(match, ctx);\n  };\n}\n\n/**\n * Default cache-key derivation: SHA-256 of the JSON-serialized auth context.\n * Hashing keeps the bearer token out of Map keys (no plaintext credential\n * surfaces in heap dumps or `util.inspect(cache)` output).\n *\n * Falls back to a literal `<none>` key when the auth context is undefined,\n * and to the truncated stringified value when JSON serialization throws\n * (circular refs, BigInt, etc.) — adopters with non-serializable auth\n * contexts should provide their own `getCacheKey`.\n */\nfunction defaultGetCacheKey(authContext: AuthContext | undefined): string {\n  if (authContext === undefined) return '<none>';\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(authContext);\n  } catch {\n    return `<unserializable:${String(authContext).slice(0, 64)}>`;\n  }\n  return createHash('sha256').update(serialized).digest('hex');\n}\n\nfunction extractRows<TUpstreamRow>(body: unknown, rowsPath: string | null): TUpstreamRow[] | null {\n  if (rowsPath === null) {\n    return Array.isArray(body) ? (body as TUpstreamRow[]) : null;\n  }\n  if (body === null || typeof body !== 'object') return null;\n  const rows = (body as Record<string, unknown>)[rowsPath];\n  return Array.isArray(rows) ? (rows as TUpstreamRow[]) : null;\n}\n"],"mappings":"AA8BA,SAAS,kBAAkB;AAE3B,SAAS,oBAAoB;AA+KtB,SAAS,+BAId,SACgG;AAChG,QAAM,UAAW,QAAQ,WAAW;AACpC,QAAM,WAAW,QAAQ,aAAa,SAAY,SAAS,QAAQ;AACnE,QAAM,iBACJ,QAAQ,mBACP,CAAC,QAAoC,KAAK;AAE7C,QAAM,aAAa,QAAQ,OAAO;AAClC,QAAM,cAAc,QAAQ,OAAO,eAAe;AAClD,QAAM,aAAa,QAAQ,OAAO,cAAc;AAChD,QAAM,QAAQ,eAAe,SAAY,oBAAI,IAA6C,IAAI;AAE9F,SAAO,OAAO,KAAK,QAAQ;AACzB,UAAM,YAAY,aAAa,GAAG;AAClC,QAAI,cAAc,OAAW,QAAO;AAEpC,UAAM,cAAc,eAAe,GAAG;AACtC,QAAI;AACJ,QAAI,OAA8B;AAElC,QAAI,UAAU,QAAW;AACvB,iBAAW,YAAY,WAAW;AAClC,YAAM,MAAM,MAAM,IAAI,QAAQ;AAC9B,UAAI,QAAQ,UAAa,IAAI,YAAY,KAAK,IAAI,GAAG;AAEnD,cAAM,OAAO,QAAQ;AACrB,cAAM,IAAI,UAAU,GAAG;AACvB,eAAO,IAAI;AAAA,MACb,WAAW,QAAQ,QAAW;AAC5B,cAAM,OAAO,QAAQ;AAAA,MACvB;AAAA,IACF;AAEA,QAAI,SAAS,MAAM;AACjB,YAAM,SAAS,MAAM,QAAQ,WAAW;AAAA,QACtC,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,gBAAgB,SAAY,EAAE,YAAY,IAAI;AAAA,MAChD;AACA,UAAI,OAAO,QAAQ,KAAM,QAAO;AAChC,aAAO,YAA0B,OAAO,MAAM,QAAQ;AACtD,UAAI,SAAS,KAAM,QAAO;AAC1B,UAAI,UAAU,UAAa,aAAa,QAAW;AAIjD,YAAI,MAAM,QAAQ,YAAY;AAC5B,gBAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;AACnC,cAAI,WAAW,OAAW,OAAM,OAAO,MAAM;AAAA,QAC/C;AACA,cAAM,IAAI,UAAU,EAAE,MAAM,WAAW,KAAK,IAAI,IAAI,WAAY,CAAC;AAAA,MACnE;AAAA,IACF;AAEA,UAAM,QAAQ,KAAK,KAAK,SAAO,IAAI,OAAO,MAAM,SAAS;AACzD,QAAI,UAAU,OAAW,QAAO;AAChC,WAAO,QAAQ,UAAU,OAAO,GAAG;AAAA,EACrC;AACF;AAYA,SAAS,mBAAmB,aAA8C;AACxE,MAAI,gBAAgB,OAAW,QAAO;AACtC,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,UAAU,WAAW;AAAA,EACzC,QAAQ;AACN,WAAO,mBAAmB,OAAO,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC;AAAA,EAC5D;AACA,SAAO,WAAW,QAAQ,EAAE,OAAO,UAAU,EAAE,OAAO,KAAK;AAC7D;AAEA,SAAS,YAA0B,MAAe,UAAgD;AAChG,MAAI,aAAa,MAAM;AACrB,WAAO,MAAM,QAAQ,IAAI,IAAK,OAA0B;AAAA,EAC1D;AACA,MAAI,SAAS,QAAQ,OAAO,SAAS,SAAU,QAAO;AACtD,QAAM,OAAQ,KAAiC,QAAQ;AACvD,SAAO,MAAM,QAAQ,IAAI,IAAK,OAA0B;AAC1D;","names":[]}

package/dist/lib/adapters/property-list-adapter.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 class PropertyListError extends Error {
   constructor(code, message) {
     super(message);