@adcp/sdk 12.0.0 → 12.0.1

package/dist/lib/server/media-buy-actions.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/media-buy-actions.ts"],"sourcesContent":["/**\n * Server/adopter helpers for enforcing the update_media_buy action surface.\n *\n * The media-buy module owns pure decomposition and preflight. This wrapper\n * converts denied preflights into the canonical server-side `AdcpError` shape\n * so DecisioningPlatform implementations can reject unavailable mutations\n * without hand-building ACTION_NOT_ALLOWED envelopes.\n */\n\nimport { ValidationError } from '../errors';\nimport {\n  getAvailableActions,\n  preflightUpdateMediaBuy,\n  type ActionNotAllowedReason,\n  type MediaBuyActionContext,\n  type MediaBuyActionMode,\n  type MediaBuyAvailableAction,\n  type MediaBuyValidAction,\n  type PreflightAllowed,\n  type PreflightDenied,\n  type PreflightDenial,\n  type UpdateMediaBuyRequestLike,\n} from '../media-buy';\nimport { AdcpError } from './decisioning/async-outcome';\n\nexport interface AssertUpdateMediaBuyAllowedOptions {\n  /**\n   * Restrict the modes this call path may execute directly. Omit to enforce\n   * availability only. Pass `['self_serve']` when the handler cannot queue\n   * proposal / approval flows and should reject those as `mode_mismatch`.\n   */\n  allowedModes?: readonly MediaBuyActionMode[];\n  /**\n   * Override the reason used for missing actions. Defaults to the preflight\n   * denial reason (`not_supported_on_buy` for buyer-side preflight misses).\n   */\n  reason?: ActionNotAllowedReason | ((denial: PreflightDenial, result: PreflightDenied) => ActionNotAllowedReason);\n}\n\n/**\n * Assert that an `update_media_buy` patch only requests actions currently\n * available on the supplied media buy. On success, returns the same enriched\n * preflight result callers can use to dispatch `result.mutations`.\n *\n * Throws:\n * - `AdcpError('INVALID_REQUEST')` when the patch contains no recognized\n *   update mutation.\n * - `AdcpError('ACTION_NOT_ALLOWED')` with spec details when at least one\n *   requested action is unavailable or disallowed by `allowedModes`.\n */\nexport function assertUpdateMediaBuyAllowed(\n  currentBuy: MediaBuyActionContext,\n  request: UpdateMediaBuyRequestLike,\n  options: AssertUpdateMediaBuyAllowedOptions = {}\n): PreflightAllowed {\n  let result: ReturnType<typeof preflightUpdateMediaBuy>;\n  try {\n    result = preflightUpdateMediaBuy(currentBuy, request);\n  } catch (err) {\n    if (err instanceof ValidationError) {\n      throw new AdcpError('INVALID_REQUEST', {\n        message: err.message,\n        recovery: 'correctable',\n        field: 'request',\n      });\n    }\n    throw err;\n  }\n\n  const currentlyAvailable = getAvailableActions(currentBuy, { silent: true }).actions;\n\n  if (!result.ok) {\n    throw actionNotAllowedFromDenied(result, currentlyAvailable, options);\n  }\n\n  if (options.allowedModes && options.allowedModes.length > 0) {\n    const modeMismatch = result.matched.findIndex(match => !options.allowedModes!.includes(match.mode));\n    if (modeMismatch >= 0) {\n      const action = result.actions[modeMismatch]?.action ?? result.matched[modeMismatch]!.action;\n      throw actionNotAllowed(action, 'mode_mismatch', currentlyAvailable);\n    }\n  }\n\n  return result;\n}\n\nfunction actionNotAllowedFromDenied(\n  result: PreflightDenied,\n  currentlyAvailable: MediaBuyAvailableAction[],\n  options: AssertUpdateMediaBuyAllowedOptions\n): AdcpError {\n  const denial = result.denials[0];\n  if (!denial) {\n    return new AdcpError('INVALID_REQUEST', {\n      message: 'update_media_buy request could not be mapped to an allowed action',\n      recovery: 'correctable',\n      field: 'request',\n    });\n  }\n\n  const reason =\n    typeof options.reason === 'function' ? options.reason(denial, result) : (options.reason ?? denial.reason);\n\n  return actionNotAllowed(denial.action, reason, currentlyAvailable);\n}\n\nfunction actionNotAllowed(\n  attemptedAction: MediaBuyValidAction,\n  reason: ActionNotAllowedReason,\n  currentlyAvailable: MediaBuyAvailableAction[]\n): AdcpError {\n  const details = {\n    attempted_action: attemptedAction,\n    reason,\n    currently_available_actions: currentlyAvailable,\n  };\n\n  return new AdcpError('ACTION_NOT_ALLOWED', {\n    message: buildActionNotAllowedMessage(attemptedAction, reason),\n    recovery: 'correctable',\n    field: 'update_media_buy',\n    details,\n  });\n}\n\nfunction buildActionNotAllowedMessage(action: MediaBuyValidAction, reason: ActionNotAllowedReason): string {\n  return `update_media_buy rejected: \\`${action}\\` not allowed (${reason}).`;\n}\n"],"mappings":";;;;;;AASA,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OAUK;AACP,SAAS,iBAAiB;AA2BnB,SAAS,4BACd,YACA,SACA,UAA8C,CAAC,GAC7B;AAClB,MAAI;AACJ,MAAI;AACF,aAAS,wBAAwB,YAAY,OAAO;AAAA,EACtD,SAAS,KAAK;AACZ,QAAI,eAAe,iBAAiB;AAClC,YAAM,IAAI,UAAU,mBAAmB;AAAA,QACrC,SAAS,IAAI;AAAA,QACb,UAAU;AAAA,QACV,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AAEA,QAAM,qBAAqB,oBAAoB,YAAY,EAAE,QAAQ,KAAK,CAAC,EAAE;AAE7E,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,2BAA2B,QAAQ,oBAAoB,OAAO;AAAA,EACtE;AAEA,MAAI,QAAQ,gBAAgB,QAAQ,aAAa,SAAS,GAAG;AAC3D,UAAM,eAAe,OAAO,QAAQ,UAAU,WAAS,CAAC,QAAQ,aAAc,SAAS,MAAM,IAAI,CAAC;AAClG,QAAI,gBAAgB,GAAG;AACrB,YAAM,SAAS,OAAO,QAAQ,YAAY,GAAG,UAAU,OAAO,QAAQ,YAAY,EAAG;AACrF,YAAM,iBAAiB,QAAQ,iBAAiB,kBAAkB;AAAA,IACpE;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,2BACP,QACA,oBACA,SACW;AACX,QAAM,SAAS,OAAO,QAAQ,CAAC;AAC/B,MAAI,CAAC,QAAQ;AACX,WAAO,IAAI,UAAU,mBAAmB;AAAA,MACtC,SAAS;AAAA,MACT,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,SACJ,OAAO,QAAQ,WAAW,aAAa,QAAQ,OAAO,QAAQ,MAAM,IAAK,QAAQ,UAAU,OAAO;AAEpG,SAAO,iBAAiB,OAAO,QAAQ,QAAQ,kBAAkB;AACnE;AAEA,SAAS,iBACP,iBACA,QACA,oBACW;AACX,QAAM,UAAU;AAAA,IACd,kBAAkB;AAAA,IAClB;AAAA,IACA,6BAA6B;AAAA,EAC/B;AAEA,SAAO,IAAI,UAAU,sBAAsB;AAAA,IACzC,SAAS,6BAA6B,iBAAiB,MAAM;AAAA,IAC7D,UAAU;AAAA,IACV,OAAO;AAAA,IACP;AAAA,EACF,CAAC;AACH;AAEA,SAAS,6BAA6B,QAA6B,QAAwC;AACzG,SAAO,gCAAgC,MAAM,mBAAmB,MAAM;AACxE;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/media-buy-actions.ts"],"sourcesContent":["/**\n * Server/adopter helpers for enforcing the update_media_buy action surface.\n *\n * The media-buy module owns pure decomposition and preflight. This wrapper\n * converts denied preflights into the canonical server-side `AdcpError` shape\n * so DecisioningPlatform implementations can reject unavailable mutations\n * without hand-building ACTION_NOT_ALLOWED envelopes.\n */\n\nimport { ValidationError } from '../errors';\nimport {\n  getAvailableActions,\n  preflightUpdateMediaBuy,\n  type ActionNotAllowedReason,\n  type MediaBuyActionContext,\n  type MediaBuyActionMode,\n  type MediaBuyAvailableAction,\n  type MediaBuyValidAction,\n  type PreflightAllowed,\n  type PreflightDenied,\n  type PreflightDenial,\n  type UpdateMediaBuyRequestLike,\n} from '../media-buy';\nimport { AdcpError } from './decisioning/async-outcome';\n\nexport interface AssertUpdateMediaBuyAllowedOptions {\n  /**\n   * Restrict the modes this call path may execute directly. Omit to enforce\n   * availability only. Pass `['self_serve']` when the handler cannot queue\n   * proposal / approval flows and should reject those as `mode_mismatch`.\n   */\n  allowedModes?: readonly MediaBuyActionMode[];\n  /**\n   * Override the reason used for missing actions. Defaults to the preflight\n   * denial reason (`not_supported_on_buy` for buyer-side preflight misses).\n   */\n  reason?: ActionNotAllowedReason | ((denial: PreflightDenial, result: PreflightDenied) => ActionNotAllowedReason);\n}\n\n/**\n * Assert that an `update_media_buy` patch only requests actions currently\n * available on the supplied media buy. On success, returns the same enriched\n * preflight result callers can use to dispatch `result.mutations`.\n *\n * Throws:\n * - `AdcpError('INVALID_REQUEST')` when the patch contains no recognized\n *   update mutation.\n * - `AdcpError('ACTION_NOT_ALLOWED')` with spec details when at least one\n *   requested action is unavailable or disallowed by `allowedModes`.\n */\nexport function assertUpdateMediaBuyAllowed(\n  currentBuy: MediaBuyActionContext,\n  request: UpdateMediaBuyRequestLike,\n  options: AssertUpdateMediaBuyAllowedOptions = {}\n): PreflightAllowed {\n  let result: ReturnType<typeof preflightUpdateMediaBuy>;\n  try {\n    result = preflightUpdateMediaBuy(currentBuy, request);\n  } catch (err) {\n    if (err instanceof ValidationError) {\n      throw new AdcpError('INVALID_REQUEST', {\n        message: err.message,\n        recovery: 'correctable',\n        field: 'request',\n      });\n    }\n    throw err;\n  }\n\n  const currentlyAvailable = getAvailableActions(currentBuy, { silent: true }).actions;\n\n  if (!result.ok) {\n    throw actionNotAllowedFromDenied(result, currentlyAvailable, options);\n  }\n\n  if (options.allowedModes && options.allowedModes.length > 0) {\n    const modeMismatch = result.matched.findIndex(match => !options.allowedModes!.includes(match.mode));\n    if (modeMismatch >= 0) {\n      const action = result.actions[modeMismatch]?.action ?? result.matched[modeMismatch]!.action;\n      throw actionNotAllowed(action, 'mode_mismatch', currentlyAvailable);\n    }\n  }\n\n  return result;\n}\n\nfunction actionNotAllowedFromDenied(\n  result: PreflightDenied,\n  currentlyAvailable: MediaBuyAvailableAction[],\n  options: AssertUpdateMediaBuyAllowedOptions\n): AdcpError {\n  const denial = result.denials[0];\n  if (!denial) {\n    return new AdcpError('INVALID_REQUEST', {\n      message: 'update_media_buy request could not be mapped to an allowed action',\n      recovery: 'correctable',\n      field: 'request',\n    });\n  }\n\n  const reason =\n    typeof options.reason === 'function' ? options.reason(denial, result) : (options.reason ?? denial.reason);\n\n  return actionNotAllowed(denial.action, reason, currentlyAvailable);\n}\n\nfunction actionNotAllowed(\n  attemptedAction: MediaBuyValidAction,\n  reason: ActionNotAllowedReason,\n  currentlyAvailable: MediaBuyAvailableAction[]\n): AdcpError {\n  const details = {\n    attempted_action: attemptedAction,\n    reason,\n    currently_available_actions: currentlyAvailable,\n  };\n\n  return new AdcpError('ACTION_NOT_ALLOWED', {\n    message: buildActionNotAllowedMessage(attemptedAction, reason),\n    recovery: 'correctable',\n    field: 'update_media_buy',\n    details,\n  });\n}\n\nfunction buildActionNotAllowedMessage(action: MediaBuyValidAction, reason: ActionNotAllowedReason): string {\n  return `update_media_buy rejected: \\`${action}\\` not allowed (${reason}).`;\n}\n"],"mappings":"AASA,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OAUK;AACP,SAAS,iBAAiB;AA2BnB,SAAS,4BACd,YACA,SACA,UAA8C,CAAC,GAC7B;AAClB,MAAI;AACJ,MAAI;AACF,aAAS,wBAAwB,YAAY,OAAO;AAAA,EACtD,SAAS,KAAK;AACZ,QAAI,eAAe,iBAAiB;AAClC,YAAM,IAAI,UAAU,mBAAmB;AAAA,QACrC,SAAS,IAAI;AAAA,QACb,UAAU;AAAA,QACV,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AAEA,QAAM,qBAAqB,oBAAoB,YAAY,EAAE,QAAQ,KAAK,CAAC,EAAE;AAE7E,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,2BAA2B,QAAQ,oBAAoB,OAAO;AAAA,EACtE;AAEA,MAAI,QAAQ,gBAAgB,QAAQ,aAAa,SAAS,GAAG;AAC3D,UAAM,eAAe,OAAO,QAAQ,UAAU,WAAS,CAAC,QAAQ,aAAc,SAAS,MAAM,IAAI,CAAC;AAClG,QAAI,gBAAgB,GAAG;AACrB,YAAM,SAAS,OAAO,QAAQ,YAAY,GAAG,UAAU,OAAO,QAAQ,YAAY,EAAG;AACrF,YAAM,iBAAiB,QAAQ,iBAAiB,kBAAkB;AAAA,IACpE;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,2BACP,QACA,oBACA,SACW;AACX,QAAM,SAAS,OAAO,QAAQ,CAAC;AAC/B,MAAI,CAAC,QAAQ;AACX,WAAO,IAAI,UAAU,mBAAmB;AAAA,MACtC,SAAS;AAAA,MACT,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,SACJ,OAAO,QAAQ,WAAW,aAAa,QAAQ,OAAO,QAAQ,MAAM,IAAK,QAAQ,UAAU,OAAO;AAEpG,SAAO,iBAAiB,OAAO,QAAQ,QAAQ,kBAAkB;AACnE;AAEA,SAAS,iBACP,iBACA,QACA,oBACW;AACX,QAAM,UAAU;AAAA,IACd,kBAAkB;AAAA,IAClB;AAAA,IACA,6BAA6B;AAAA,EAC/B;AAEA,SAAO,IAAI,UAAU,sBAAsB;AAAA,IACzC,SAAS,6BAA6B,iBAAiB,MAAM;AAAA,IAC7D,UAAU;AAAA,IACV,OAAO;AAAA,IACP;AAAA,EACF,CAAC;AACH;AAEA,SAAS,6BAA6B,QAA6B,QAAwC;AACzG,SAAO,gCAAgC,MAAM,mBAAmB,MAAM;AACxE;","names":[]}

package/dist/lib/server/media-buy-helpers.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 function validActionsForStatus(status) {
   switch (status) {
     case "pending_creatives":

package/dist/lib/server/media-buy-helpers.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/media-buy-helpers.ts"],"sourcesContent":["/**\n * Media buy response helpers that eliminate common implementation traps.\n *\n * These helpers encode protocol rules (status→valid_actions mapping,\n * required cancellation metadata, initial revision numbers) so agent\n * builders get the right shape by default.\n */\n\nimport type { MediaBuyStatus, CanceledBy, CreateMediaBuySuccess, Package } from '../types/core.generated';\n\n/**\n * Actions a buyer can perform on a media buy.\n * Derived from the generated schema to stay in sync automatically.\n */\nexport type ValidAction = NonNullable<CreateMediaBuySuccess['valid_actions']>[number];\n\n/**\n * Returns the default set of valid buyer actions for a given media buy status.\n *\n * Terminal statuses (completed, rejected, canceled) return an empty array.\n * Active statuses return the full set of actions; paused restricts to\n * resume, cancel, and budget/date updates.\n *\n * Both pending statuses allow full modification — the protocol permits\n * restructuring a buy (packages, budget, dates) while awaiting creatives\n * or start date.\n *\n * Sellers with restricted capabilities can filter the result:\n * ```typescript\n * const actions = validActionsForStatus('active')\n *   .filter(a => a !== 'sync_creatives'); // no creative management\n * ```\n */\nexport function validActionsForStatus(status: MediaBuyStatus): ValidAction[] {\n  switch (status) {\n    case 'pending_creatives':\n    case 'pending_start':\n      return ['cancel', 'update_budget', 'update_dates', 'update_packages', 'add_packages', 'sync_creatives'];\n    case 'active':\n      return ['pause', 'cancel', 'update_budget', 'update_dates', 'update_packages', 'add_packages', 'sync_creatives'];\n    case 'paused':\n      return ['resume', 'cancel', 'update_budget', 'update_dates'];\n    case 'completed':\n    case 'rejected':\n    case 'canceled':\n      return [];\n  }\n}\n\n/**\n * Input for cancelMediaBuyResponse(). Requires the fields that agent builders\n * commonly forget — canceled_by and revision are mandatory,\n * canceled_at defaults to now.\n */\nexport interface CancelMediaBuyInput {\n  media_buy_id: string;\n  canceled_by: CanceledBy;\n  /** Current revision after the cancellation update. */\n  revision: number;\n  reason?: string;\n  canceled_at?: string;\n  affected_packages?: Package[];\n  sandbox?: boolean;\n}\n"],"mappings":";;;;;;AAiCO,SAAS,sBAAsB,QAAuC;AAC3E,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC,UAAU,iBAAiB,gBAAgB,mBAAmB,gBAAgB,gBAAgB;AAAA,IACxG,KAAK;AACH,aAAO,CAAC,SAAS,UAAU,iBAAiB,gBAAgB,mBAAmB,gBAAgB,gBAAgB;AAAA,IACjH,KAAK;AACH,aAAO,CAAC,UAAU,UAAU,iBAAiB,cAAc;AAAA,IAC7D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC;AAAA,EACZ;AACF;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/media-buy-helpers.ts"],"sourcesContent":["/**\n * Media buy response helpers that eliminate common implementation traps.\n *\n * These helpers encode protocol rules (status→valid_actions mapping,\n * required cancellation metadata, initial revision numbers) so agent\n * builders get the right shape by default.\n */\n\nimport type { MediaBuyStatus, CanceledBy, CreateMediaBuySuccess, Package } from '../types/core.generated';\n\n/**\n * Actions a buyer can perform on a media buy.\n * Derived from the generated schema to stay in sync automatically.\n */\nexport type ValidAction = NonNullable<CreateMediaBuySuccess['valid_actions']>[number];\n\n/**\n * Returns the default set of valid buyer actions for a given media buy status.\n *\n * Terminal statuses (completed, rejected, canceled) return an empty array.\n * Active statuses return the full set of actions; paused restricts to\n * resume, cancel, and budget/date updates.\n *\n * Both pending statuses allow full modification — the protocol permits\n * restructuring a buy (packages, budget, dates) while awaiting creatives\n * or start date.\n *\n * Sellers with restricted capabilities can filter the result:\n * ```typescript\n * const actions = validActionsForStatus('active')\n *   .filter(a => a !== 'sync_creatives'); // no creative management\n * ```\n */\nexport function validActionsForStatus(status: MediaBuyStatus): ValidAction[] {\n  switch (status) {\n    case 'pending_creatives':\n    case 'pending_start':\n      return ['cancel', 'update_budget', 'update_dates', 'update_packages', 'add_packages', 'sync_creatives'];\n    case 'active':\n      return ['pause', 'cancel', 'update_budget', 'update_dates', 'update_packages', 'add_packages', 'sync_creatives'];\n    case 'paused':\n      return ['resume', 'cancel', 'update_budget', 'update_dates'];\n    case 'completed':\n    case 'rejected':\n    case 'canceled':\n      return [];\n  }\n}\n\n/**\n * Input for cancelMediaBuyResponse(). Requires the fields that agent builders\n * commonly forget — canceled_by and revision are mandatory,\n * canceled_at defaults to now.\n */\nexport interface CancelMediaBuyInput {\n  media_buy_id: string;\n  canceled_by: CanceledBy;\n  /** Current revision after the cancellation update. */\n  revision: number;\n  reason?: string;\n  canceled_at?: string;\n  affected_packages?: Package[];\n  sandbox?: boolean;\n}\n"],"mappings":"AAiCO,SAAS,sBAAsB,QAAuC;AAC3E,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC,UAAU,iBAAiB,gBAAgB,mBAAmB,gBAAgB,gBAAgB;AAAA,IACxG,KAAK;AACH,aAAO,CAAC,SAAS,UAAU,iBAAiB,gBAAgB,mBAAmB,gBAAgB,gBAAgB;AAAA,IACjH,KAAK;AACH,aAAO,CAAC,UAAU,UAAU,iBAAiB,cAAc;AAAA,IAC7D,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO,CAAC;AAAA,EACZ;AACF;","names":[]}

package/dist/lib/server/media-buy-store.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { scopedStore } from "./state-store.mjs";
 const DEFAULT_MEDIA_BUY_STORE_COLLECTION = "media_buys_targeting";
 function createMediaBuyStore(options) {

package/dist/lib/server/media-buy-store.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/media-buy-store.ts"],"sourcesContent":["/**\n * Opinionated media-buy store that satisfies the seller's spec contract:\n * persist `packages[].targeting_overlay` from `create_media_buy`, echo it on\n * `get_media_buys`, and deep-merge updates without dropping prior\n * `property_list` / `collection_list` references.\n *\n * Per `schemas/cache/<v>/media-buy/get-media-buys-response.json` the seller\n * SHOULD echo persisted targeting; sellers claiming `property-lists` or\n * `collection-lists` MUST include the persisted references inside the\n * echoed `targeting_overlay`. Wiring this store is the framework-side\n * way to honor that contract without each adapter persisting + merging\n * by hand.\n *\n * Adopters opt in by passing `mediaBuyStore` to\n * `createAdcpServerFromPlatform`. Backed by any `AdcpStateStore` —\n * `InMemoryStateStore` for development, `PostgresStateStore` for\n * production.\n *\n * @example\n * ```ts\n * import {\n *   createAdcpServerFromPlatform,\n *   createMediaBuyStore,\n *   InMemoryStateStore,\n * } from '@adcp/sdk/server';\n *\n * const stateStore = new InMemoryStateStore();\n *\n * createAdcpServerFromPlatform(platform, {\n *   mediaBuyStore: createMediaBuyStore({ store: stateStore }),\n * });\n * ```\n */\n\nimport type { TargetingOverlay } from '../types/core.generated';\nimport type { AdcpStateStore } from './state-store';\nimport { scopedStore } from './state-store';\n\n/** Default state-store collection name. Adopters can override per-store. */\nexport const DEFAULT_MEDIA_BUY_STORE_COLLECTION = 'media_buys_targeting';\n\ninterface PersistedPackage {\n  package_id: string;\n  targeting_overlay: TargetingOverlay;\n}\n\ninterface PersistedRecord extends Record<string, unknown> {\n  media_buy_id: string;\n  packages: PersistedPackage[];\n}\n\n/**\n * Subset of `CreateMediaBuyRequest` the store cares about. Typed loosely\n * so the wrapper code in `from-platform.ts` doesn't have to upcast the\n * request to the full generated type just to thread it through.\n */\nexport interface CreateMediaBuyInputForStore {\n  packages?: Array<{\n    package_id?: string;\n    buyer_ref?: string;\n    targeting_overlay?: TargetingOverlay;\n  }>;\n}\n\n/**\n * Subset of `CreateMediaBuyResponse` (the success arm) the store needs to\n * pin persisted-from-request packages to seller-assigned `package_id`s.\n */\nexport interface CreateMediaBuyResultForStore {\n  media_buy_id: string;\n  packages?: Array<{\n    package_id?: string;\n    buyer_ref?: string;\n    targeting_overlay?: TargetingOverlay;\n  }>;\n}\n\nexport interface UpdateMediaBuyInputForStore {\n  packages?: Array<{\n    package_id?: string;\n    targeting_overlay?: TargetingOverlay | null;\n  }>;\n  new_packages?: Array<{\n    package_id?: string;\n    buyer_ref?: string;\n    targeting_overlay?: TargetingOverlay;\n  }>;\n}\n\n/**\n * Subset of `GetMediaBuysResponse` mirroring the fields the store reads\n * + writes. Echoing is non-mutating from the buyer's perspective: every\n * package the seller already returned with `targeting_overlay` is left\n * alone.\n */\nexport interface GetMediaBuysResultForStore {\n  media_buys?: Array<{\n    media_buy_id?: string;\n    packages?: Array<{\n      package_id?: string;\n      targeting_overlay?: TargetingOverlay;\n    }>;\n  }>;\n}\n\nexport interface MediaBuyStore {\n  /**\n   * Persist `packages[].targeting_overlay` from a successful\n   * `create_media_buy`. Joins the request's per-package targeting\n   * overlay with the response's seller-assigned `package_id` (or\n   * `buyer_ref` when the request used buyer-supplied refs).\n   */\n  persistFromCreate(\n    accountId: string,\n    request: CreateMediaBuyInputForStore,\n    result: CreateMediaBuyResultForStore\n  ): Promise<void>;\n\n  /**\n   * Apply an `update_media_buy` patch to the persisted record.\n   *\n   * Per-field merge semantics inside `targeting_overlay`:\n   * - field omitted from the patch → keep prior value\n   * - field present with a non-null value → replace\n   * - field present and `null` → clear (drop the field)\n   *\n   * `new_packages` from the patch are persisted as fresh entries when\n   * they declare `targeting_overlay`. Entries that omit it are\n   * intentionally NOT tracked — this store is overlay-only, and a\n   * later patch can still seed an overlay onto the package_id when\n   * one becomes relevant.\n   */\n  mergeFromUpdate(accountId: string, mediaBuyId: string, patch: UpdateMediaBuyInputForStore): Promise<void>;\n\n  /**\n   * Fill in missing `packages[].targeting_overlay` on the seller's\n   * `get_media_buys` response from the persisted store. **Mutates the\n   * response in place** (and returns it for fluent chaining). Packages\n   * the seller already echoed are left untouched.\n   */\n  backfill<T extends GetMediaBuysResultForStore>(accountId: string, result: T): Promise<T>;\n}\n\nexport interface CreateMediaBuyStoreOptions {\n  /** Backing state store. Reuses your existing `InMemoryStateStore` / `PostgresStateStore`. */\n  store: AdcpStateStore;\n  /** Override the logical collection name. Defaults to {@link DEFAULT_MEDIA_BUY_STORE_COLLECTION}. */\n  collection?: string;\n}\n\nexport function createMediaBuyStore(options: CreateMediaBuyStoreOptions): MediaBuyStore {\n  const collection = options.collection ?? DEFAULT_MEDIA_BUY_STORE_COLLECTION;\n\n  function viewFor(accountId: string): AdcpStateStore {\n    return scopedStore(options.store, accountId);\n  }\n\n  async function loadRecord(accountId: string, mediaBuyId: string): Promise<PersistedRecord | null> {\n    const view = viewFor(accountId);\n    return view.get<PersistedRecord>(collection, mediaBuyId);\n  }\n\n  async function writeRecord(accountId: string, record: PersistedRecord): Promise<void> {\n    const view = viewFor(accountId);\n    await view.put(collection, record.media_buy_id, record);\n  }\n\n  return {\n    async persistFromCreate(accountId, request, result) {\n      const requestPackages = request.packages ?? [];\n      const responsePackages = result.packages ?? [];\n      if (requestPackages.length === 0 || !result.media_buy_id) return;\n\n      const persistedPackages: PersistedPackage[] = [];\n      for (let i = 0; i < requestPackages.length; i++) {\n        const reqPkg = requestPackages[i];\n        if (!reqPkg?.targeting_overlay) continue;\n\n        // Resolve the seller's assigned package_id. Prefer matching by\n        // buyer_ref (deterministic across reorderings); fall back to\n        // positional alignment which is the wire convention when the\n        // request did not supply buyer refs.\n        const buyerRef = reqPkg.buyer_ref;\n        const matchedByRef =\n          buyerRef && buyerRef.length > 0 ? responsePackages.find(p => p?.buyer_ref === buyerRef) : undefined;\n        const respPkg = matchedByRef ?? responsePackages[i];\n        const packageId = respPkg?.package_id;\n        if (!packageId) continue;\n\n        persistedPackages.push({\n          package_id: packageId,\n          targeting_overlay: respPkg?.targeting_overlay ?? reqPkg.targeting_overlay,\n        });\n      }\n\n      if (persistedPackages.length === 0) return;\n      await writeRecord(accountId, {\n        media_buy_id: result.media_buy_id,\n        packages: persistedPackages,\n      });\n    },\n\n    async mergeFromUpdate(accountId, mediaBuyId, patch) {\n      const prior = (await loadRecord(accountId, mediaBuyId)) ?? {\n        media_buy_id: mediaBuyId,\n        packages: [],\n      };\n\n      const byId = new Map(prior.packages.map(p => [p.package_id, p.targeting_overlay]));\n\n      for (const pkg of patch.packages ?? []) {\n        const packageId = pkg?.package_id;\n        if (!packageId) continue;\n        // `'targeting_overlay' in pkg` distinguishes \"patch did not mention\n        // overlay\" (keep prior) from \"patch sent null/empty overlay\"\n        // (process the clear). With the wire-shape coming through JSON\n        // parse, omitted fields are absent from the object entirely.\n        if (!('targeting_overlay' in pkg)) continue;\n        const incoming = pkg.targeting_overlay;\n        if (incoming === null) {\n          byId.delete(packageId);\n          continue;\n        }\n        if (incoming === undefined) continue;\n        const priorOverlay = byId.get(packageId);\n        byId.set(packageId, mergeOverlay(priorOverlay, incoming));\n      }\n\n      for (const pkg of patch.new_packages ?? []) {\n        if (!pkg?.targeting_overlay || !pkg.package_id) continue;\n        byId.set(pkg.package_id, pkg.targeting_overlay);\n      }\n\n      await writeRecord(accountId, {\n        media_buy_id: mediaBuyId,\n        packages: Array.from(byId.entries()).map(([package_id, targeting_overlay]) => ({\n          package_id,\n          targeting_overlay,\n        })),\n      });\n    },\n\n    async backfill(accountId, result) {\n      const buys = result.media_buys;\n      if (!buys || buys.length === 0) return result;\n      for (const buy of buys) {\n        if (!buy?.media_buy_id || !buy.packages) continue;\n        const record = await loadRecord(accountId, buy.media_buy_id);\n        if (!record) continue;\n        const overlayById = new Map(record.packages.map(p => [p.package_id, p.targeting_overlay]));\n        for (const pkg of buy.packages) {\n          if (!pkg?.package_id || pkg.targeting_overlay !== undefined) continue;\n          const persisted = overlayById.get(pkg.package_id);\n          if (persisted) pkg.targeting_overlay = persisted;\n        }\n      }\n      return result;\n    },\n  };\n}\n\n/**\n * Per-key merge of an incoming `TargetingOverlay` patch against the prior\n * persisted overlay. Each key the patch sets to `null` is dropped; each\n * key the patch sets to a value replaces the prior; keys absent from the\n * patch are preserved.\n *\n * The merge is one level deep — `property_list` / `collection_list` are\n * reference objects keyed by `list_id`, so a \"partial\" property-list\n * update is meaningless and a top-level replace is the right semantics.\n */\nfunction mergeOverlay(prior: TargetingOverlay | undefined, patch: TargetingOverlay): TargetingOverlay {\n  const merged: Record<string, unknown> = { ...(prior ?? {}) };\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === null) {\n      delete merged[key];\n    } else if (value !== undefined) {\n      merged[key] = value;\n    }\n  }\n  return merged as TargetingOverlay;\n}\n"],"mappings":";;;;;;AAoCA,SAAS,mBAAmB;AAGrB,MAAM,qCAAqC;AA+G3C,SAAS,oBAAoB,SAAoD;AACtF,QAAM,aAAa,QAAQ,cAAc;AAEzC,WAAS,QAAQ,WAAmC;AAClD,WAAO,YAAY,QAAQ,OAAO,SAAS;AAAA,EAC7C;AAEA,iBAAe,WAAW,WAAmB,YAAqD;AAChG,UAAM,OAAO,QAAQ,SAAS;AAC9B,WAAO,KAAK,IAAqB,YAAY,UAAU;AAAA,EACzD;AAEA,iBAAe,YAAY,WAAmB,QAAwC;AACpF,UAAM,OAAO,QAAQ,SAAS;AAC9B,UAAM,KAAK,IAAI,YAAY,OAAO,cAAc,MAAM;AAAA,EACxD;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB,WAAW,SAAS,QAAQ;AAClD,YAAM,kBAAkB,QAAQ,YAAY,CAAC;AAC7C,YAAM,mBAAmB,OAAO,YAAY,CAAC;AAC7C,UAAI,gBAAgB,WAAW,KAAK,CAAC,OAAO,aAAc;AAE1D,YAAM,oBAAwC,CAAC;AAC/C,eAAS,IAAI,GAAG,IAAI,gBAAgB,QAAQ,KAAK;AAC/C,cAAM,SAAS,gBAAgB,CAAC;AAChC,YAAI,CAAC,QAAQ,kBAAmB;AAMhC,cAAM,WAAW,OAAO;AACxB,cAAM,eACJ,YAAY,SAAS,SAAS,IAAI,iBAAiB,KAAK,OAAK,GAAG,cAAc,QAAQ,IAAI;AAC5F,cAAM,UAAU,gBAAgB,iBAAiB,CAAC;AAClD,cAAM,YAAY,SAAS;AAC3B,YAAI,CAAC,UAAW;AAEhB,0BAAkB,KAAK;AAAA,UACrB,YAAY;AAAA,UACZ,mBAAmB,SAAS,qBAAqB,OAAO;AAAA,QAC1D,CAAC;AAAA,MACH;AAEA,UAAI,kBAAkB,WAAW,EAAG;AACpC,YAAM,YAAY,WAAW;AAAA,QAC3B,cAAc,OAAO;AAAA,QACrB,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,gBAAgB,WAAW,YAAY,OAAO;AAClD,YAAM,QAAS,MAAM,WAAW,WAAW,UAAU,KAAM;AAAA,QACzD,cAAc;AAAA,QACd,UAAU,CAAC;AAAA,MACb;AAEA,YAAM,OAAO,IAAI,IAAI,MAAM,SAAS,IAAI,OAAK,CAAC,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;AAEjF,iBAAW,OAAO,MAAM,YAAY,CAAC,GAAG;AACtC,cAAM,YAAY,KAAK;AACvB,YAAI,CAAC,UAAW;AAKhB,YAAI,EAAE,uBAAuB,KAAM;AACnC,cAAM,WAAW,IAAI;AACrB,YAAI,aAAa,MAAM;AACrB,eAAK,OAAO,SAAS;AACrB;AAAA,QACF;AACA,YAAI,aAAa,OAAW;AAC5B,cAAM,eAAe,KAAK,IAAI,SAAS;AACvC,aAAK,IAAI,WAAW,aAAa,cAAc,QAAQ,CAAC;AAAA,MAC1D;AAEA,iBAAW,OAAO,MAAM,gBAAgB,CAAC,GAAG;AAC1C,YAAI,CAAC,KAAK,qBAAqB,CAAC,IAAI,WAAY;AAChD,aAAK,IAAI,IAAI,YAAY,IAAI,iBAAiB;AAAA,MAChD;AAEA,YAAM,YAAY,WAAW;AAAA,QAC3B,cAAc;AAAA,QACd,UAAU,MAAM,KAAK,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,YAAY,iBAAiB,OAAO;AAAA,UAC7E;AAAA,UACA;AAAA,QACF,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,SAAS,WAAW,QAAQ;AAChC,YAAM,OAAO,OAAO;AACpB,UAAI,CAAC,QAAQ,KAAK,WAAW,EAAG,QAAO;AACvC,iBAAW,OAAO,MAAM;AACtB,YAAI,CAAC,KAAK,gBAAgB,CAAC,IAAI,SAAU;AACzC,cAAM,SAAS,MAAM,WAAW,WAAW,IAAI,YAAY;AAC3D,YAAI,CAAC,OAAQ;AACb,cAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI,OAAK,CAAC,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;AACzF,mBAAW,OAAO,IAAI,UAAU;AAC9B,cAAI,CAAC,KAAK,cAAc,IAAI,sBAAsB,OAAW;AAC7D,gBAAM,YAAY,YAAY,IAAI,IAAI,UAAU;AAChD,cAAI,UAAW,KAAI,oBAAoB;AAAA,QACzC;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAYA,SAAS,aAAa,OAAqC,OAA2C;AACpG,QAAM,SAAkC,EAAE,GAAI,SAAS,CAAC,EAAG;AAC3D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,UAAU,MAAM;AAClB,aAAO,OAAO,GAAG;AAAA,IACnB,WAAW,UAAU,QAAW;AAC9B,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/media-buy-store.ts"],"sourcesContent":["/**\n * Opinionated media-buy store that satisfies the seller's spec contract:\n * persist `packages[].targeting_overlay` from `create_media_buy`, echo it on\n * `get_media_buys`, and deep-merge updates without dropping prior\n * `property_list` / `collection_list` references.\n *\n * Per `schemas/cache/<v>/media-buy/get-media-buys-response.json` the seller\n * SHOULD echo persisted targeting; sellers claiming `property-lists` or\n * `collection-lists` MUST include the persisted references inside the\n * echoed `targeting_overlay`. Wiring this store is the framework-side\n * way to honor that contract without each adapter persisting + merging\n * by hand.\n *\n * Adopters opt in by passing `mediaBuyStore` to\n * `createAdcpServerFromPlatform`. Backed by any `AdcpStateStore` —\n * `InMemoryStateStore` for development, `PostgresStateStore` for\n * production.\n *\n * @example\n * ```ts\n * import {\n *   createAdcpServerFromPlatform,\n *   createMediaBuyStore,\n *   InMemoryStateStore,\n * } from '@adcp/sdk/server';\n *\n * const stateStore = new InMemoryStateStore();\n *\n * createAdcpServerFromPlatform(platform, {\n *   mediaBuyStore: createMediaBuyStore({ store: stateStore }),\n * });\n * ```\n */\n\nimport type { TargetingOverlay } from '../types/core.generated';\nimport type { AdcpStateStore } from './state-store';\nimport { scopedStore } from './state-store';\n\n/** Default state-store collection name. Adopters can override per-store. */\nexport const DEFAULT_MEDIA_BUY_STORE_COLLECTION = 'media_buys_targeting';\n\ninterface PersistedPackage {\n  package_id: string;\n  targeting_overlay: TargetingOverlay;\n}\n\ninterface PersistedRecord extends Record<string, unknown> {\n  media_buy_id: string;\n  packages: PersistedPackage[];\n}\n\n/**\n * Subset of `CreateMediaBuyRequest` the store cares about. Typed loosely\n * so the wrapper code in `from-platform.ts` doesn't have to upcast the\n * request to the full generated type just to thread it through.\n */\nexport interface CreateMediaBuyInputForStore {\n  packages?: Array<{\n    package_id?: string;\n    buyer_ref?: string;\n    targeting_overlay?: TargetingOverlay;\n  }>;\n}\n\n/**\n * Subset of `CreateMediaBuyResponse` (the success arm) the store needs to\n * pin persisted-from-request packages to seller-assigned `package_id`s.\n */\nexport interface CreateMediaBuyResultForStore {\n  media_buy_id: string;\n  packages?: Array<{\n    package_id?: string;\n    buyer_ref?: string;\n    targeting_overlay?: TargetingOverlay;\n  }>;\n}\n\nexport interface UpdateMediaBuyInputForStore {\n  packages?: Array<{\n    package_id?: string;\n    targeting_overlay?: TargetingOverlay | null;\n  }>;\n  new_packages?: Array<{\n    package_id?: string;\n    buyer_ref?: string;\n    targeting_overlay?: TargetingOverlay;\n  }>;\n}\n\n/**\n * Subset of `GetMediaBuysResponse` mirroring the fields the store reads\n * + writes. Echoing is non-mutating from the buyer's perspective: every\n * package the seller already returned with `targeting_overlay` is left\n * alone.\n */\nexport interface GetMediaBuysResultForStore {\n  media_buys?: Array<{\n    media_buy_id?: string;\n    packages?: Array<{\n      package_id?: string;\n      targeting_overlay?: TargetingOverlay;\n    }>;\n  }>;\n}\n\nexport interface MediaBuyStore {\n  /**\n   * Persist `packages[].targeting_overlay` from a successful\n   * `create_media_buy`. Joins the request's per-package targeting\n   * overlay with the response's seller-assigned `package_id` (or\n   * `buyer_ref` when the request used buyer-supplied refs).\n   */\n  persistFromCreate(\n    accountId: string,\n    request: CreateMediaBuyInputForStore,\n    result: CreateMediaBuyResultForStore\n  ): Promise<void>;\n\n  /**\n   * Apply an `update_media_buy` patch to the persisted record.\n   *\n   * Per-field merge semantics inside `targeting_overlay`:\n   * - field omitted from the patch → keep prior value\n   * - field present with a non-null value → replace\n   * - field present and `null` → clear (drop the field)\n   *\n   * `new_packages` from the patch are persisted as fresh entries when\n   * they declare `targeting_overlay`. Entries that omit it are\n   * intentionally NOT tracked — this store is overlay-only, and a\n   * later patch can still seed an overlay onto the package_id when\n   * one becomes relevant.\n   */\n  mergeFromUpdate(accountId: string, mediaBuyId: string, patch: UpdateMediaBuyInputForStore): Promise<void>;\n\n  /**\n   * Fill in missing `packages[].targeting_overlay` on the seller's\n   * `get_media_buys` response from the persisted store. **Mutates the\n   * response in place** (and returns it for fluent chaining). Packages\n   * the seller already echoed are left untouched.\n   */\n  backfill<T extends GetMediaBuysResultForStore>(accountId: string, result: T): Promise<T>;\n}\n\nexport interface CreateMediaBuyStoreOptions {\n  /** Backing state store. Reuses your existing `InMemoryStateStore` / `PostgresStateStore`. */\n  store: AdcpStateStore;\n  /** Override the logical collection name. Defaults to {@link DEFAULT_MEDIA_BUY_STORE_COLLECTION}. */\n  collection?: string;\n}\n\nexport function createMediaBuyStore(options: CreateMediaBuyStoreOptions): MediaBuyStore {\n  const collection = options.collection ?? DEFAULT_MEDIA_BUY_STORE_COLLECTION;\n\n  function viewFor(accountId: string): AdcpStateStore {\n    return scopedStore(options.store, accountId);\n  }\n\n  async function loadRecord(accountId: string, mediaBuyId: string): Promise<PersistedRecord | null> {\n    const view = viewFor(accountId);\n    return view.get<PersistedRecord>(collection, mediaBuyId);\n  }\n\n  async function writeRecord(accountId: string, record: PersistedRecord): Promise<void> {\n    const view = viewFor(accountId);\n    await view.put(collection, record.media_buy_id, record);\n  }\n\n  return {\n    async persistFromCreate(accountId, request, result) {\n      const requestPackages = request.packages ?? [];\n      const responsePackages = result.packages ?? [];\n      if (requestPackages.length === 0 || !result.media_buy_id) return;\n\n      const persistedPackages: PersistedPackage[] = [];\n      for (let i = 0; i < requestPackages.length; i++) {\n        const reqPkg = requestPackages[i];\n        if (!reqPkg?.targeting_overlay) continue;\n\n        // Resolve the seller's assigned package_id. Prefer matching by\n        // buyer_ref (deterministic across reorderings); fall back to\n        // positional alignment which is the wire convention when the\n        // request did not supply buyer refs.\n        const buyerRef = reqPkg.buyer_ref;\n        const matchedByRef =\n          buyerRef && buyerRef.length > 0 ? responsePackages.find(p => p?.buyer_ref === buyerRef) : undefined;\n        const respPkg = matchedByRef ?? responsePackages[i];\n        const packageId = respPkg?.package_id;\n        if (!packageId) continue;\n\n        persistedPackages.push({\n          package_id: packageId,\n          targeting_overlay: respPkg?.targeting_overlay ?? reqPkg.targeting_overlay,\n        });\n      }\n\n      if (persistedPackages.length === 0) return;\n      await writeRecord(accountId, {\n        media_buy_id: result.media_buy_id,\n        packages: persistedPackages,\n      });\n    },\n\n    async mergeFromUpdate(accountId, mediaBuyId, patch) {\n      const prior = (await loadRecord(accountId, mediaBuyId)) ?? {\n        media_buy_id: mediaBuyId,\n        packages: [],\n      };\n\n      const byId = new Map(prior.packages.map(p => [p.package_id, p.targeting_overlay]));\n\n      for (const pkg of patch.packages ?? []) {\n        const packageId = pkg?.package_id;\n        if (!packageId) continue;\n        // `'targeting_overlay' in pkg` distinguishes \"patch did not mention\n        // overlay\" (keep prior) from \"patch sent null/empty overlay\"\n        // (process the clear). With the wire-shape coming through JSON\n        // parse, omitted fields are absent from the object entirely.\n        if (!('targeting_overlay' in pkg)) continue;\n        const incoming = pkg.targeting_overlay;\n        if (incoming === null) {\n          byId.delete(packageId);\n          continue;\n        }\n        if (incoming === undefined) continue;\n        const priorOverlay = byId.get(packageId);\n        byId.set(packageId, mergeOverlay(priorOverlay, incoming));\n      }\n\n      for (const pkg of patch.new_packages ?? []) {\n        if (!pkg?.targeting_overlay || !pkg.package_id) continue;\n        byId.set(pkg.package_id, pkg.targeting_overlay);\n      }\n\n      await writeRecord(accountId, {\n        media_buy_id: mediaBuyId,\n        packages: Array.from(byId.entries()).map(([package_id, targeting_overlay]) => ({\n          package_id,\n          targeting_overlay,\n        })),\n      });\n    },\n\n    async backfill(accountId, result) {\n      const buys = result.media_buys;\n      if (!buys || buys.length === 0) return result;\n      for (const buy of buys) {\n        if (!buy?.media_buy_id || !buy.packages) continue;\n        const record = await loadRecord(accountId, buy.media_buy_id);\n        if (!record) continue;\n        const overlayById = new Map(record.packages.map(p => [p.package_id, p.targeting_overlay]));\n        for (const pkg of buy.packages) {\n          if (!pkg?.package_id || pkg.targeting_overlay !== undefined) continue;\n          const persisted = overlayById.get(pkg.package_id);\n          if (persisted) pkg.targeting_overlay = persisted;\n        }\n      }\n      return result;\n    },\n  };\n}\n\n/**\n * Per-key merge of an incoming `TargetingOverlay` patch against the prior\n * persisted overlay. Each key the patch sets to `null` is dropped; each\n * key the patch sets to a value replaces the prior; keys absent from the\n * patch are preserved.\n *\n * The merge is one level deep — `property_list` / `collection_list` are\n * reference objects keyed by `list_id`, so a \"partial\" property-list\n * update is meaningless and a top-level replace is the right semantics.\n */\nfunction mergeOverlay(prior: TargetingOverlay | undefined, patch: TargetingOverlay): TargetingOverlay {\n  const merged: Record<string, unknown> = { ...(prior ?? {}) };\n  for (const [key, value] of Object.entries(patch)) {\n    if (value === null) {\n      delete merged[key];\n    } else if (value !== undefined) {\n      merged[key] = value;\n    }\n  }\n  return merged as TargetingOverlay;\n}\n"],"mappings":"AAoCA,SAAS,mBAAmB;AAGrB,MAAM,qCAAqC;AA+G3C,SAAS,oBAAoB,SAAoD;AACtF,QAAM,aAAa,QAAQ,cAAc;AAEzC,WAAS,QAAQ,WAAmC;AAClD,WAAO,YAAY,QAAQ,OAAO,SAAS;AAAA,EAC7C;AAEA,iBAAe,WAAW,WAAmB,YAAqD;AAChG,UAAM,OAAO,QAAQ,SAAS;AAC9B,WAAO,KAAK,IAAqB,YAAY,UAAU;AAAA,EACzD;AAEA,iBAAe,YAAY,WAAmB,QAAwC;AACpF,UAAM,OAAO,QAAQ,SAAS;AAC9B,UAAM,KAAK,IAAI,YAAY,OAAO,cAAc,MAAM;AAAA,EACxD;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB,WAAW,SAAS,QAAQ;AAClD,YAAM,kBAAkB,QAAQ,YAAY,CAAC;AAC7C,YAAM,mBAAmB,OAAO,YAAY,CAAC;AAC7C,UAAI,gBAAgB,WAAW,KAAK,CAAC,OAAO,aAAc;AAE1D,YAAM,oBAAwC,CAAC;AAC/C,eAAS,IAAI,GAAG,IAAI,gBAAgB,QAAQ,KAAK;AAC/C,cAAM,SAAS,gBAAgB,CAAC;AAChC,YAAI,CAAC,QAAQ,kBAAmB;AAMhC,cAAM,WAAW,OAAO;AACxB,cAAM,eACJ,YAAY,SAAS,SAAS,IAAI,iBAAiB,KAAK,OAAK,GAAG,cAAc,QAAQ,IAAI;AAC5F,cAAM,UAAU,gBAAgB,iBAAiB,CAAC;AAClD,cAAM,YAAY,SAAS;AAC3B,YAAI,CAAC,UAAW;AAEhB,0BAAkB,KAAK;AAAA,UACrB,YAAY;AAAA,UACZ,mBAAmB,SAAS,qBAAqB,OAAO;AAAA,QAC1D,CAAC;AAAA,MACH;AAEA,UAAI,kBAAkB,WAAW,EAAG;AACpC,YAAM,YAAY,WAAW;AAAA,QAC3B,cAAc,OAAO;AAAA,QACrB,UAAU;AAAA,MACZ,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,gBAAgB,WAAW,YAAY,OAAO;AAClD,YAAM,QAAS,MAAM,WAAW,WAAW,UAAU,KAAM;AAAA,QACzD,cAAc;AAAA,QACd,UAAU,CAAC;AAAA,MACb;AAEA,YAAM,OAAO,IAAI,IAAI,MAAM,SAAS,IAAI,OAAK,CAAC,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;AAEjF,iBAAW,OAAO,MAAM,YAAY,CAAC,GAAG;AACtC,cAAM,YAAY,KAAK;AACvB,YAAI,CAAC,UAAW;AAKhB,YAAI,EAAE,uBAAuB,KAAM;AACnC,cAAM,WAAW,IAAI;AACrB,YAAI,aAAa,MAAM;AACrB,eAAK,OAAO,SAAS;AACrB;AAAA,QACF;AACA,YAAI,aAAa,OAAW;AAC5B,cAAM,eAAe,KAAK,IAAI,SAAS;AACvC,aAAK,IAAI,WAAW,aAAa,cAAc,QAAQ,CAAC;AAAA,MAC1D;AAEA,iBAAW,OAAO,MAAM,gBAAgB,CAAC,GAAG;AAC1C,YAAI,CAAC,KAAK,qBAAqB,CAAC,IAAI,WAAY;AAChD,aAAK,IAAI,IAAI,YAAY,IAAI,iBAAiB;AAAA,MAChD;AAEA,YAAM,YAAY,WAAW;AAAA,QAC3B,cAAc;AAAA,QACd,UAAU,MAAM,KAAK,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,YAAY,iBAAiB,OAAO;AAAA,UAC7E;AAAA,UACA;AAAA,QACF,EAAE;AAAA,MACJ,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,SAAS,WAAW,QAAQ;AAChC,YAAM,OAAO,OAAO;AACpB,UAAI,CAAC,QAAQ,KAAK,WAAW,EAAG,QAAO;AACvC,iBAAW,OAAO,MAAM;AACtB,YAAI,CAAC,KAAK,gBAAgB,CAAC,IAAI,SAAU;AACzC,cAAM,SAAS,MAAM,WAAW,WAAW,IAAI,YAAY;AAC3D,YAAI,CAAC,OAAQ;AACb,cAAM,cAAc,IAAI,IAAI,OAAO,SAAS,IAAI,OAAK,CAAC,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC;AACzF,mBAAW,OAAO,IAAI,UAAU;AAC9B,cAAI,CAAC,KAAK,cAAc,IAAI,sBAAsB,OAAW;AAC7D,gBAAM,YAAY,YAAY,IAAI,IAAI,UAAU;AAChD,cAAI,UAAW,KAAI,oBAAoB;AAAA,QACzC;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAYA,SAAS,aAAa,OAAqC,OAA2C;AACpG,QAAM,SAAkC,EAAE,GAAI,SAAS,CAAC,EAAG;AAC3D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,QAAI,UAAU,MAAM;AAClB,aAAO,OAAO,GAAG;AAAA,IACnB,WAAW,UAAU,QAAW;AAC9B,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/lib/server/normalize-errors.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 function normalizeError(input) {
   if (input == null) {
     return { code: "GENERIC_ERROR", message: "Unknown error", recovery: "terminal" };

package/dist/lib/server/normalize-errors.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/normalize-errors.ts"],"sourcesContent":["/**\n * Wire-shape normalizer for the AdCP `Error` row used in tool responses\n * carrying per-row failures (`sync_creatives`, `sync_audiences`,\n * `sync_accounts`, `report_usage`, `acquire_rights` error arm).\n *\n * Adopters return errors in whichever shape their codebase already\n * speaks: bare strings, native `Error` instances, plain\n * `{ code, message }` objects, `AdcpError` instances thrown internally,\n * upstream-platform error objects with vendor-specific fields. This\n * helper coerces all of those into the canonical wire `Error` shape\n * (`code`, `message`, optional `field` / `suggestion` / `retry_after`\n * / `details` / `recovery`) so the framework's response validator\n * accepts the projected response without forcing every adopter to\n * hand-shape the wire envelope.\n *\n * @see AdCP wire spec: `core/error.json`\n *\n * @public\n */\n\nimport type { ErrorCode } from './decisioning/async-outcome';\n\n/**\n * Canonical wire `Error` row. Mirrors `core/error.json` —\n * `code` + `message` are required; everything else optional.\n *\n * Differs from the SDK's `AdcpStructuredError` in only one detail —\n * `recovery` is optional here (per the wire spec) but required on\n * `AdcpStructuredError` (the SDK's stricter shape for thrown errors).\n *\n * @public\n */\nexport interface NormalizedError {\n  code: string;\n  message: string;\n  field?: string;\n  suggestion?: string;\n  retry_after?: number;\n  details?: Record<string, unknown>;\n  recovery?: 'transient' | 'correctable' | 'terminal';\n}\n\n/**\n * Coerce a single adopter-returned error value into the canonical\n * wire `Error` shape. Handles:\n *\n *   - `string` → `{ code: 'GENERIC_ERROR', message: <input>, recovery: 'terminal' }`\n *   - `Error` instance → `{ code: 'GENERIC_ERROR', message: err.message, recovery: 'terminal' }`\n *   - `AdcpError` instance → projected to wire shape using its `code` /\n *     `recovery` / `field` / `suggestion` / `retry_after` / `details`\n *   - Plain object with `code` + `message` → fields whitelisted to the\n *     wire shape; vendor-specific fields dropped (use `details` for\n *     vendor extensions)\n *   - Any other object → `{ code: 'GENERIC_ERROR', message: <safeStringify>, recovery: 'terminal' }`\n *   - `null` / `undefined` → `{ code: 'GENERIC_ERROR', message: 'Unknown error', recovery: 'terminal' }`\n *\n * The `details` field, when present on the input, is shallow-copied\n * and SHOULD be passed through {@link pickSafeDetails} on the\n * adopter side before reaching this helper. `normalizeError` does NOT\n * sanitize `details` — it's the adopter's job to ensure no\n * credentials / PII / stack traces land there.\n *\n * @public\n */\nexport function normalizeError(input: unknown): NormalizedError {\n  if (input == null) {\n    return { code: 'GENERIC_ERROR', message: 'Unknown error', recovery: 'terminal' };\n  }\n  if (typeof input === 'string') {\n    return { code: 'GENERIC_ERROR', message: input, recovery: 'terminal' };\n  }\n  // AdcpError-shaped (has `code`, optional structured fields). Detected\n  // structurally rather than via instanceof so framework code in different\n  // module realms (test fixtures, server-side renderers) still gets the\n  // typed projection.\n  if (typeof input === 'object' && 'code' in input) {\n    const obj = input as Record<string, unknown>;\n    const code = typeof obj.code === 'string' && obj.code.length > 0 ? obj.code : 'GENERIC_ERROR';\n    const message = typeof obj.message === 'string' && obj.message.length > 0 ? obj.message : code; // fall back to code when message missing — never empty-string\n    const out: NormalizedError = { code, message };\n    if (typeof obj.field === 'string') out.field = obj.field;\n    if (typeof obj.suggestion === 'string') out.suggestion = obj.suggestion;\n    if (typeof obj.retry_after === 'number' && Number.isFinite(obj.retry_after)) {\n      // Wire spec clamps retry_after to [1, 3600]\n      out.retry_after = Math.max(1, Math.min(3600, Math.floor(obj.retry_after)));\n    }\n    if (obj.recovery === 'transient' || obj.recovery === 'correctable' || obj.recovery === 'terminal') {\n      out.recovery = obj.recovery;\n    }\n    if (typeof obj.details === 'object' && obj.details !== null) {\n      // Shallow copy to break aliasing; adopter is responsible for sanitizing\n      // via pickSafeDetails before reaching here.\n      out.details = { ...(obj.details as Record<string, unknown>) };\n    }\n    return out;\n  }\n  // Native Error (no `code` field, has `message`).\n  if (input instanceof Error) {\n    return { code: 'GENERIC_ERROR', message: input.message || 'Unknown error', recovery: 'terminal' };\n  }\n  // Last-resort: stringify whatever was passed.\n  return {\n    code: 'GENERIC_ERROR',\n    message: safeStringify(input),\n    recovery: 'terminal',\n  };\n}\n\n/**\n * Coerce an adopter-returned errors collection into a wire-shaped\n * `Error[]`. Accepts `undefined` / `null` (returns `undefined`),\n * a single error value (wraps in array), or an array of error values\n * (each normalized via {@link normalizeError}).\n *\n * Empty arrays and arrays where every entry normalizes to the same\n * sentinel \"Unknown error\" are still emitted — the framework lets the\n * wire validator decide whether `errors: []` is acceptable for the\n * specific tool response (sync_creatives accepts empty;\n * sync_creatives_error requires non-empty).\n *\n * Use at the v6 wire-projection seam:\n *\n * ```ts\n * import { normalizeErrors } from '@adcp/client/server';\n *\n * const projected = adopterRows.map(row => ({\n *   ...row,\n *   errors: normalizeErrors(row.errors),\n * }));\n * ```\n *\n * @public\n */\nexport function normalizeErrors(input: unknown): NormalizedError[] | undefined {\n  if (input == null) return undefined;\n  if (Array.isArray(input)) {\n    return input.map(normalizeError);\n  }\n  return [normalizeError(input)];\n}\n\n/**\n * Coerce an `ErrorCode`-typed input back to the underlying string —\n * useful when adopters pass an enum-narrowed code into a place that\n * expects the wire string. Pure-function alias for clarity at call\n * sites; the runtime is identity.\n *\n * @internal\n */\nexport function _coerceErrorCode(code: ErrorCode | string): string {\n  return code;\n}\n\n/** Best-effort `JSON.stringify` that swallows circular-reference errors. */\nfunction safeStringify(input: unknown): string {\n  try {\n    const s = JSON.stringify(input);\n    return typeof s === 'string' ? s : String(input);\n  } catch {\n    return '[unserializable error]';\n  }\n}\n"],"mappings":";;;;;;AAgEO,SAAS,eAAe,OAAiC;AAC9D,MAAI,SAAS,MAAM;AACjB,WAAO,EAAE,MAAM,iBAAiB,SAAS,iBAAiB,UAAU,WAAW;AAAA,EACjF;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,MAAM,iBAAiB,SAAS,OAAO,UAAU,WAAW;AAAA,EACvE;AAKA,MAAI,OAAO,UAAU,YAAY,UAAU,OAAO;AAChD,UAAM,MAAM;AACZ,UAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,SAAS,IAAI,IAAI,OAAO;AAC9E,UAAM,UAAU,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,IAAI,IAAI,UAAU;AAC1F,UAAM,MAAuB,EAAE,MAAM,QAAQ;AAC7C,QAAI,OAAO,IAAI,UAAU,SAAU,KAAI,QAAQ,IAAI;AACnD,QAAI,OAAO,IAAI,eAAe,SAAU,KAAI,aAAa,IAAI;AAC7D,QAAI,OAAO,IAAI,gBAAgB,YAAY,OAAO,SAAS,IAAI,WAAW,GAAG;AAE3E,UAAI,cAAc,KAAK,IAAI,GAAG,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,CAAC;AAAA,IAC3E;AACA,QAAI,IAAI,aAAa,eAAe,IAAI,aAAa,iBAAiB,IAAI,aAAa,YAAY;AACjG,UAAI,WAAW,IAAI;AAAA,IACrB;AACA,QAAI,OAAO,IAAI,YAAY,YAAY,IAAI,YAAY,MAAM;AAG3D,UAAI,UAAU,EAAE,GAAI,IAAI,QAAoC;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAEA,MAAI,iBAAiB,OAAO;AAC1B,WAAO,EAAE,MAAM,iBAAiB,SAAS,MAAM,WAAW,iBAAiB,UAAU,WAAW;AAAA,EAClG;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,cAAc,KAAK;AAAA,IAC5B,UAAU;AAAA,EACZ;AACF;AA2BO,SAAS,gBAAgB,OAA+C;AAC7E,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,cAAc;AAAA,EACjC;AACA,SAAO,CAAC,eAAe,KAAK,CAAC;AAC/B;AAUO,SAAS,iBAAiB,MAAkC;AACjE,SAAO;AACT;AAGA,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,UAAM,IAAI,KAAK,UAAU,KAAK;AAC9B,WAAO,OAAO,MAAM,WAAW,IAAI,OAAO,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/normalize-errors.ts"],"sourcesContent":["/**\n * Wire-shape normalizer for the AdCP `Error` row used in tool responses\n * carrying per-row failures (`sync_creatives`, `sync_audiences`,\n * `sync_accounts`, `report_usage`, `acquire_rights` error arm).\n *\n * Adopters return errors in whichever shape their codebase already\n * speaks: bare strings, native `Error` instances, plain\n * `{ code, message }` objects, `AdcpError` instances thrown internally,\n * upstream-platform error objects with vendor-specific fields. This\n * helper coerces all of those into the canonical wire `Error` shape\n * (`code`, `message`, optional `field` / `suggestion` / `retry_after`\n * / `details` / `recovery`) so the framework's response validator\n * accepts the projected response without forcing every adopter to\n * hand-shape the wire envelope.\n *\n * @see AdCP wire spec: `core/error.json`\n *\n * @public\n */\n\nimport type { ErrorCode } from './decisioning/async-outcome';\n\n/**\n * Canonical wire `Error` row. Mirrors `core/error.json` —\n * `code` + `message` are required; everything else optional.\n *\n * Differs from the SDK's `AdcpStructuredError` in only one detail —\n * `recovery` is optional here (per the wire spec) but required on\n * `AdcpStructuredError` (the SDK's stricter shape for thrown errors).\n *\n * @public\n */\nexport interface NormalizedError {\n  code: string;\n  message: string;\n  field?: string;\n  suggestion?: string;\n  retry_after?: number;\n  details?: Record<string, unknown>;\n  recovery?: 'transient' | 'correctable' | 'terminal';\n}\n\n/**\n * Coerce a single adopter-returned error value into the canonical\n * wire `Error` shape. Handles:\n *\n *   - `string` → `{ code: 'GENERIC_ERROR', message: <input>, recovery: 'terminal' }`\n *   - `Error` instance → `{ code: 'GENERIC_ERROR', message: err.message, recovery: 'terminal' }`\n *   - `AdcpError` instance → projected to wire shape using its `code` /\n *     `recovery` / `field` / `suggestion` / `retry_after` / `details`\n *   - Plain object with `code` + `message` → fields whitelisted to the\n *     wire shape; vendor-specific fields dropped (use `details` for\n *     vendor extensions)\n *   - Any other object → `{ code: 'GENERIC_ERROR', message: <safeStringify>, recovery: 'terminal' }`\n *   - `null` / `undefined` → `{ code: 'GENERIC_ERROR', message: 'Unknown error', recovery: 'terminal' }`\n *\n * The `details` field, when present on the input, is shallow-copied\n * and SHOULD be passed through {@link pickSafeDetails} on the\n * adopter side before reaching this helper. `normalizeError` does NOT\n * sanitize `details` — it's the adopter's job to ensure no\n * credentials / PII / stack traces land there.\n *\n * @public\n */\nexport function normalizeError(input: unknown): NormalizedError {\n  if (input == null) {\n    return { code: 'GENERIC_ERROR', message: 'Unknown error', recovery: 'terminal' };\n  }\n  if (typeof input === 'string') {\n    return { code: 'GENERIC_ERROR', message: input, recovery: 'terminal' };\n  }\n  // AdcpError-shaped (has `code`, optional structured fields). Detected\n  // structurally rather than via instanceof so framework code in different\n  // module realms (test fixtures, server-side renderers) still gets the\n  // typed projection.\n  if (typeof input === 'object' && 'code' in input) {\n    const obj = input as Record<string, unknown>;\n    const code = typeof obj.code === 'string' && obj.code.length > 0 ? obj.code : 'GENERIC_ERROR';\n    const message = typeof obj.message === 'string' && obj.message.length > 0 ? obj.message : code; // fall back to code when message missing — never empty-string\n    const out: NormalizedError = { code, message };\n    if (typeof obj.field === 'string') out.field = obj.field;\n    if (typeof obj.suggestion === 'string') out.suggestion = obj.suggestion;\n    if (typeof obj.retry_after === 'number' && Number.isFinite(obj.retry_after)) {\n      // Wire spec clamps retry_after to [1, 3600]\n      out.retry_after = Math.max(1, Math.min(3600, Math.floor(obj.retry_after)));\n    }\n    if (obj.recovery === 'transient' || obj.recovery === 'correctable' || obj.recovery === 'terminal') {\n      out.recovery = obj.recovery;\n    }\n    if (typeof obj.details === 'object' && obj.details !== null) {\n      // Shallow copy to break aliasing; adopter is responsible for sanitizing\n      // via pickSafeDetails before reaching here.\n      out.details = { ...(obj.details as Record<string, unknown>) };\n    }\n    return out;\n  }\n  // Native Error (no `code` field, has `message`).\n  if (input instanceof Error) {\n    return { code: 'GENERIC_ERROR', message: input.message || 'Unknown error', recovery: 'terminal' };\n  }\n  // Last-resort: stringify whatever was passed.\n  return {\n    code: 'GENERIC_ERROR',\n    message: safeStringify(input),\n    recovery: 'terminal',\n  };\n}\n\n/**\n * Coerce an adopter-returned errors collection into a wire-shaped\n * `Error[]`. Accepts `undefined` / `null` (returns `undefined`),\n * a single error value (wraps in array), or an array of error values\n * (each normalized via {@link normalizeError}).\n *\n * Empty arrays and arrays where every entry normalizes to the same\n * sentinel \"Unknown error\" are still emitted — the framework lets the\n * wire validator decide whether `errors: []` is acceptable for the\n * specific tool response (sync_creatives accepts empty;\n * sync_creatives_error requires non-empty).\n *\n * Use at the v6 wire-projection seam:\n *\n * ```ts\n * import { normalizeErrors } from '@adcp/client/server';\n *\n * const projected = adopterRows.map(row => ({\n *   ...row,\n *   errors: normalizeErrors(row.errors),\n * }));\n * ```\n *\n * @public\n */\nexport function normalizeErrors(input: unknown): NormalizedError[] | undefined {\n  if (input == null) return undefined;\n  if (Array.isArray(input)) {\n    return input.map(normalizeError);\n  }\n  return [normalizeError(input)];\n}\n\n/**\n * Coerce an `ErrorCode`-typed input back to the underlying string —\n * useful when adopters pass an enum-narrowed code into a place that\n * expects the wire string. Pure-function alias for clarity at call\n * sites; the runtime is identity.\n *\n * @internal\n */\nexport function _coerceErrorCode(code: ErrorCode | string): string {\n  return code;\n}\n\n/** Best-effort `JSON.stringify` that swallows circular-reference errors. */\nfunction safeStringify(input: unknown): string {\n  try {\n    const s = JSON.stringify(input);\n    return typeof s === 'string' ? s : String(input);\n  } catch {\n    return '[unserializable error]';\n  }\n}\n"],"mappings":"AAgEO,SAAS,eAAe,OAAiC;AAC9D,MAAI,SAAS,MAAM;AACjB,WAAO,EAAE,MAAM,iBAAiB,SAAS,iBAAiB,UAAU,WAAW;AAAA,EACjF;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,EAAE,MAAM,iBAAiB,SAAS,OAAO,UAAU,WAAW;AAAA,EACvE;AAKA,MAAI,OAAO,UAAU,YAAY,UAAU,OAAO;AAChD,UAAM,MAAM;AACZ,UAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,SAAS,IAAI,IAAI,OAAO;AAC9E,UAAM,UAAU,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,IAAI,IAAI,UAAU;AAC1F,UAAM,MAAuB,EAAE,MAAM,QAAQ;AAC7C,QAAI,OAAO,IAAI,UAAU,SAAU,KAAI,QAAQ,IAAI;AACnD,QAAI,OAAO,IAAI,eAAe,SAAU,KAAI,aAAa,IAAI;AAC7D,QAAI,OAAO,IAAI,gBAAgB,YAAY,OAAO,SAAS,IAAI,WAAW,GAAG;AAE3E,UAAI,cAAc,KAAK,IAAI,GAAG,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,CAAC;AAAA,IAC3E;AACA,QAAI,IAAI,aAAa,eAAe,IAAI,aAAa,iBAAiB,IAAI,aAAa,YAAY;AACjG,UAAI,WAAW,IAAI;AAAA,IACrB;AACA,QAAI,OAAO,IAAI,YAAY,YAAY,IAAI,YAAY,MAAM;AAG3D,UAAI,UAAU,EAAE,GAAI,IAAI,QAAoC;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAEA,MAAI,iBAAiB,OAAO;AAC1B,WAAO,EAAE,MAAM,iBAAiB,SAAS,MAAM,WAAW,iBAAiB,UAAU,WAAW;AAAA,EAClG;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,cAAc,KAAK;AAAA,IAC5B,UAAU;AAAA,EACZ;AACF;AA2BO,SAAS,gBAAgB,OAA+C;AAC7E,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,cAAc;AAAA,EACjC;AACA,SAAO,CAAC,eAAe,KAAK,CAAC;AAC/B;AAUO,SAAS,iBAAiB,MAAkC;AACjE,SAAO;AACT;AAGA,SAAS,cAAc,OAAwB;AAC7C,MAAI;AACF,UAAM,IAAI,KAAK,UAAU,KAAK;AAC9B,WAAO,OAAO,MAAM,WAAW,IAAI,OAAO,KAAK;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/lib/server/operational-platform.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 function defineOperationalPlatform(ops) {
   return ops;
 }

package/dist/lib/server/operational-platform.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/operational-platform.ts"],"sourcesContent":["/**\n * `OperationalPlatform` — in-process operational contract.\n *\n * `DecisioningPlatform` covers buyer-facing MCP request dispatch:\n * `platform.sales.updateMediaBuy(req, ctx)` etc., where `ctx` is a\n * `RequestContext` built by the framework from `authInfo` via\n * `AccountStore.resolve`, threading `state`, `resolve`, `ctxMetadata`,\n * and `handoffToTask`.\n *\n * In-process consumers are different. The price-optimization poller,\n * audience-sync task poller, scheduled jobs, and the storefront\n * fan-out path do NOT have an MCP request to derive auth from. They\n * have a stored task with an access token (or, for fan-out, no token\n * — the storefront synthesizes one per upstream target). They cannot\n * honestly satisfy `RequestContext`. Every adopter doing operational\n * work would otherwise reinvent this seam.\n *\n * `OperationalPlatform` is the named contract for that seam. Five\n * methods covering the real operational surface:\n *\n * 1. `extractContext` — synthesize a per-call platform context from\n *    a stored token (and optional request args, for fan-out callers).\n *    The single CTX-METADATA-SAFETY boundary outside\n *    `AccountStore.resolve`: anything touching credentials in an\n *    in-process consumer flows through here.\n * 2. `updateMediaBuy` — required. Fan-out callers dispatch one of\n *    these per upstream target.\n * 3. `getMediaBuyDelivery` — required. Pollers read delivery metrics\n *    here.\n * 4. `pollAudienceStatuses` — optional. Audience-sync pollers only.\n * 5. `getProducts` — optional. Storefront bundle composition only;\n *    server-side internal call, not buyer-facing dispatch.\n *\n * Naming the contract honestly — \"operational\" rather than \"adapter\"\n * — separates it from any v5 `PlatformAdapter` baggage and from\n * `DecisioningPlatform`'s MCP-request flow. Tests mock\n * `OperationalPlatform`, not the broader v6 interface.\n *\n * Errors: methods throw `AdcpError` for structured rejection, matching\n * `DecisioningPlatform`'s convention. Generic thrown `Error` /\n * `TypeError` propagate; callers catch and log per their needs.\n *\n * Status: 6.10. See adcontextprotocol/adcp-client#1530.\n *\n * @see DecisioningPlatform — buyer-facing MCP dispatch\n * @see docs/guides/CTX-METADATA-SAFETY.md — credential discipline\n * @public\n */\n\nimport type {\n  GetMediaBuyDeliveryResponse,\n  GetProductsResponse,\n  UpdateMediaBuyRequest,\n  UpdateMediaBuyResponse,\n} from '../types/tools.generated';\nimport type { RequireCacheScopeWhenProducts, ServerPayload } from '../types/server-payload';\nimport type { AudienceStatus } from './decisioning/specialisms/audiences';\n\n/**\n * Minimal context for in-process operational calls. Adopters extend\n * with platform-specific fields (advertiser id, sandbox mode, region,\n * etc.); the type parameter on `OperationalPlatform<TCtx>` carries\n * the extension through.\n *\n * `accessToken` is the only field shared across adopters: the rest of\n * the context shape is platform-internal. Pollers and scheduled jobs\n * that legitimately have no token (server-side internal scans) leave\n * it `undefined`.\n *\n * @example\n * ```ts\n * interface SnapOpCtx extends OperationalContext {\n *   advertiserId: string;\n *   sandbox: boolean;\n * }\n *\n * const snapOps = defineOperationalPlatform<SnapOpCtx>({\n *   platformId: 'snap',\n *   extractContext: async (args, sessionToken) => ({\n *     accessToken: sessionToken,\n *     advertiserId: String(args.advertiser_id ?? ''),\n *     sandbox: Boolean(args.sandbox),\n *   }),\n *   // ...\n * });\n * ```\n */\nexport interface OperationalContext {\n  /**\n   * The access token used by upstream HTTP calls. `undefined` for\n   * server-side internal scans that don't authenticate against a\n   * specific tenant.\n   */\n  accessToken: string | undefined;\n}\n\n/**\n * In-process operational contract. Implementations dispatch to\n * upstream platform APIs from pollers, scheduled jobs, fan-out paths,\n * and other contexts that don't carry an MCP request.\n *\n * Type parameter `TCtx` extends {@link OperationalContext} to carry\n * platform-specific context fields through every method.\n */\nexport interface OperationalPlatform<TCtx extends OperationalContext = OperationalContext> {\n  /**\n   * Stable platform identifier matching `DecisioningPlatform`'s\n   * registered name. Used by registries and routing layers to look up\n   * the operational delegate by platform.\n   */\n  readonly platformId: string;\n\n  /**\n   * Synthesize an operational context from a stored token (and\n   * optional request args for fan-out callers). The single\n   * documented credential-synthesis path outside\n   * `AccountStore.resolve` — so the only place adopters need\n   * CTX-METADATA-SAFETY review on the operational side.\n   *\n   * Three call patterns this method serves:\n   *   - **Poller / scheduled job**: `args` is `{}`, `sessionToken` is\n   *     the stored token. Returns a context bound to that token.\n   *   - **Storefront fan-out**: `args` is the (scrubbed) buyer\n   *     request body, `sessionToken` is the storefront's master\n   *     credential. Returns a context for one upstream target.\n   *   - **Server-side internal scan**: `args` is `{}`, `sessionToken`\n   *     is `undefined`, `requireAuth` is `false`. Returns a\n   *     no-token context.\n   *\n   * @param args - Optional request args (storefront fan-out path)\n   * @param sessionToken - Stored access token (poller path)\n   * @param requireAuth - Throw `AuthMissingError` when no token is\n   *   available. Defaults to `true`.\n   *\n   * @remarks Post-migration the SDK will likely split this into\n   * `synthesizeFromToken` / `synthesizeFromArgs` (see #1530 for the\n   * follow-up). The combined signature today matches the v5\n   * `PlatformAdapter.extractContext` shape so v5 adapters duck-type\n   * satisfy this interface during migration without a wrapper.\n   */\n  extractContext(args: Record<string, unknown>, sessionToken?: string, requireAuth?: boolean): Promise<TCtx>;\n\n  /**\n   * Update a media buy upstream. Required because every operational\n   * consumer assumes it — adapters that can't update media buys have\n   * no business registering as operational.\n   *\n   * Throw `AdcpError` for structured rejection (`NOT_CANCELLABLE`,\n   * `CONFLICT`, etc.). Generic thrown errors propagate to the caller.\n   */\n  updateMediaBuy(ctx: TCtx, request: UpdateMediaBuyRequest): Promise<ServerPayload<UpdateMediaBuyResponse>>;\n\n  /**\n   * Fetch delivery metrics for one or more media buys. Required for\n   * the same reason as `updateMediaBuy`: every operational consumer\n   * assumes it.\n   *\n   * `mediaBuyIds` is plural — matches the wire-spec\n   * `GetMediaBuyDeliveryRequest.media_buy_ids` field (per AdCP 3.0\n   * and PR #1342). Pollers that batch-query N buys in one upstream\n   * call pass an array; single-buy callers pass `[id]`. Decomposed\n   * here (vs. taking the full request shape) because pollers\n   * synthesize requests internally and don't have a typed wire\n   * payload to thread.\n   *\n   * `args` carries optional adopter-specific pass-through (e.g.\n   * tenant-scoped query parameters); pollers leave it `undefined`.\n   */\n  getMediaBuyDelivery(\n    ctx: TCtx,\n    mediaBuyIds: readonly string[],\n    startTime: string,\n    endTime: string,\n    args?: Record<string, unknown>\n  ): Promise<ServerPayload<GetMediaBuyDeliveryResponse>>;\n\n  /**\n   * Poll upstream for the current status of one or more audiences.\n   * Optional — only audience-sync pollers need this.\n   *\n   * Takes opaque `platformData` (whatever the adapter stored when\n   * initiating the sync) plus a fresh access token. No operational\n   * context is threaded because the original sync may have been\n   * initiated under a now-expired auth principal; the poller carries\n   * a freshly-resolved token from its own credential store.\n   *\n   * **`platformData` is for opaque upstream IDs only — never for\n   * bearer tokens.** The fresh `accessToken` argument is the blessed\n   * credential channel; reading a stale token from `platformData`\n   * defeats the design and lands requests with revoked auth.\n   *\n   * Returns a `Map<audience_id, AudienceStatus>`. Audiences not\n   * resolvable upstream are omitted from the map. Throw\n   * `AdcpError('REFERENCE_NOT_FOUND')` only when the entire batch\n   * is unresolvable for the tenant.\n   *\n   * Plural method name aligns with `AudiencePlatform.pollAudienceStatuses`\n   * (the buyer-facing analog), which also returns\n   * `Map<string, AudienceStatus>`. Signature differs because operational\n   * callers don't have a `RequestContext` to thread.\n   */\n  pollAudienceStatuses?(\n    platformData: Record<string, unknown>,\n    accessToken: string\n  ): Promise<Map<string, AudienceStatus>>;\n\n  /**\n   * Discover advertising products. Used by storefront bundle services\n   * to query upstream platforms for products available for bundling\n   * — server-side internal call, not buyer-facing dispatch.\n   *\n   * Optional: bundle-search is opt-in per storefront, and not every\n   * upstream platform exposes a product-discovery surface.\n   *\n   * Signature differs from `SalesPlatform.getProducts` because the\n   * caller is a storefront bundle service, not an MCP request\n   * handler — they have a brief and brand context, not a typed\n   * `GetProductsRequest` wire payload.\n   */\n  getProducts?(\n    ctx: TCtx,\n    brief: string,\n    contextId?: string,\n    brand?: Record<string, unknown>,\n    sourceChain?: readonly string[]\n  ): Promise<RequireCacheScopeWhenProducts<ServerPayload<GetProductsResponse>>>;\n}\n\n/**\n * Type-level identity for an `OperationalPlatform` object literal.\n * Forces the contextual type so handler bodies get typed `ctx` and\n * `request` parameters in TypeScript without an explicit annotation.\n *\n * Mirrors the `definePlatform` family for `DecisioningPlatform`\n * sub-interfaces — see `decisioning/platform-helpers.ts`.\n *\n * @example\n * ```ts\n * import { AuthMissingError, defineOperationalPlatform, type OperationalContext } from '@adcp/sdk/server';\n *\n * interface SnapOpCtx extends OperationalContext {\n *   advertiserId: string;\n * }\n *\n * export const snapOperational = defineOperationalPlatform<SnapOpCtx>({\n *   platformId: 'snap',\n *   extractContext: async (args, sessionToken, requireAuth = true) => {\n *     if (!sessionToken && requireAuth) {\n *       throw new AuthMissingError({ message: 'No Snap token available' });\n *     }\n *     return {\n *       accessToken: sessionToken,\n *       advertiserId: String(args.advertiser_id ?? ''),\n *     };\n *   },\n *   updateMediaBuy: async (ctx, request) => {\n *     // ctx.advertiserId typed ✓; request: UpdateMediaBuyRequest ✓\n *     return upstream.update(ctx, request);\n *   },\n *   getMediaBuyDelivery: async (ctx, id, start, end) => {\n *     return upstream.delivery(ctx, id, start, end);\n *   },\n * });\n * ```\n */\nexport function defineOperationalPlatform<TCtx extends OperationalContext = OperationalContext>(\n  ops: OperationalPlatform<TCtx>\n): OperationalPlatform<TCtx> {\n  return ops;\n}\n"],"mappings":";;;;;;AAyQO,SAAS,0BACd,KAC2B;AAC3B,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/operational-platform.ts"],"sourcesContent":["/**\n * `OperationalPlatform` — in-process operational contract.\n *\n * `DecisioningPlatform` covers buyer-facing MCP request dispatch:\n * `platform.sales.updateMediaBuy(req, ctx)` etc., where `ctx` is a\n * `RequestContext` built by the framework from `authInfo` via\n * `AccountStore.resolve`, threading `state`, `resolve`, `ctxMetadata`,\n * and `handoffToTask`.\n *\n * In-process consumers are different. The price-optimization poller,\n * audience-sync task poller, scheduled jobs, and the storefront\n * fan-out path do NOT have an MCP request to derive auth from. They\n * have a stored task with an access token (or, for fan-out, no token\n * — the storefront synthesizes one per upstream target). They cannot\n * honestly satisfy `RequestContext`. Every adopter doing operational\n * work would otherwise reinvent this seam.\n *\n * `OperationalPlatform` is the named contract for that seam. Five\n * methods covering the real operational surface:\n *\n * 1. `extractContext` — synthesize a per-call platform context from\n *    a stored token (and optional request args, for fan-out callers).\n *    The single CTX-METADATA-SAFETY boundary outside\n *    `AccountStore.resolve`: anything touching credentials in an\n *    in-process consumer flows through here.\n * 2. `updateMediaBuy` — required. Fan-out callers dispatch one of\n *    these per upstream target.\n * 3. `getMediaBuyDelivery` — required. Pollers read delivery metrics\n *    here.\n * 4. `pollAudienceStatuses` — optional. Audience-sync pollers only.\n * 5. `getProducts` — optional. Storefront bundle composition only;\n *    server-side internal call, not buyer-facing dispatch.\n *\n * Naming the contract honestly — \"operational\" rather than \"adapter\"\n * — separates it from any v5 `PlatformAdapter` baggage and from\n * `DecisioningPlatform`'s MCP-request flow. Tests mock\n * `OperationalPlatform`, not the broader v6 interface.\n *\n * Errors: methods throw `AdcpError` for structured rejection, matching\n * `DecisioningPlatform`'s convention. Generic thrown `Error` /\n * `TypeError` propagate; callers catch and log per their needs.\n *\n * Status: 6.10. See adcontextprotocol/adcp-client#1530.\n *\n * @see DecisioningPlatform — buyer-facing MCP dispatch\n * @see docs/guides/CTX-METADATA-SAFETY.md — credential discipline\n * @public\n */\n\nimport type {\n  GetMediaBuyDeliveryResponse,\n  GetProductsResponse,\n  UpdateMediaBuyRequest,\n  UpdateMediaBuyResponse,\n} from '../types/tools.generated';\nimport type { RequireCacheScopeWhenProducts, ServerPayload } from '../types/server-payload';\nimport type { AudienceStatus } from './decisioning/specialisms/audiences';\n\n/**\n * Minimal context for in-process operational calls. Adopters extend\n * with platform-specific fields (advertiser id, sandbox mode, region,\n * etc.); the type parameter on `OperationalPlatform<TCtx>` carries\n * the extension through.\n *\n * `accessToken` is the only field shared across adopters: the rest of\n * the context shape is platform-internal. Pollers and scheduled jobs\n * that legitimately have no token (server-side internal scans) leave\n * it `undefined`.\n *\n * @example\n * ```ts\n * interface SnapOpCtx extends OperationalContext {\n *   advertiserId: string;\n *   sandbox: boolean;\n * }\n *\n * const snapOps = defineOperationalPlatform<SnapOpCtx>({\n *   platformId: 'snap',\n *   extractContext: async (args, sessionToken) => ({\n *     accessToken: sessionToken,\n *     advertiserId: String(args.advertiser_id ?? ''),\n *     sandbox: Boolean(args.sandbox),\n *   }),\n *   // ...\n * });\n * ```\n */\nexport interface OperationalContext {\n  /**\n   * The access token used by upstream HTTP calls. `undefined` for\n   * server-side internal scans that don't authenticate against a\n   * specific tenant.\n   */\n  accessToken: string | undefined;\n}\n\n/**\n * In-process operational contract. Implementations dispatch to\n * upstream platform APIs from pollers, scheduled jobs, fan-out paths,\n * and other contexts that don't carry an MCP request.\n *\n * Type parameter `TCtx` extends {@link OperationalContext} to carry\n * platform-specific context fields through every method.\n */\nexport interface OperationalPlatform<TCtx extends OperationalContext = OperationalContext> {\n  /**\n   * Stable platform identifier matching `DecisioningPlatform`'s\n   * registered name. Used by registries and routing layers to look up\n   * the operational delegate by platform.\n   */\n  readonly platformId: string;\n\n  /**\n   * Synthesize an operational context from a stored token (and\n   * optional request args for fan-out callers). The single\n   * documented credential-synthesis path outside\n   * `AccountStore.resolve` — so the only place adopters need\n   * CTX-METADATA-SAFETY review on the operational side.\n   *\n   * Three call patterns this method serves:\n   *   - **Poller / scheduled job**: `args` is `{}`, `sessionToken` is\n   *     the stored token. Returns a context bound to that token.\n   *   - **Storefront fan-out**: `args` is the (scrubbed) buyer\n   *     request body, `sessionToken` is the storefront's master\n   *     credential. Returns a context for one upstream target.\n   *   - **Server-side internal scan**: `args` is `{}`, `sessionToken`\n   *     is `undefined`, `requireAuth` is `false`. Returns a\n   *     no-token context.\n   *\n   * @param args - Optional request args (storefront fan-out path)\n   * @param sessionToken - Stored access token (poller path)\n   * @param requireAuth - Throw `AuthMissingError` when no token is\n   *   available. Defaults to `true`.\n   *\n   * @remarks Post-migration the SDK will likely split this into\n   * `synthesizeFromToken` / `synthesizeFromArgs` (see #1530 for the\n   * follow-up). The combined signature today matches the v5\n   * `PlatformAdapter.extractContext` shape so v5 adapters duck-type\n   * satisfy this interface during migration without a wrapper.\n   */\n  extractContext(args: Record<string, unknown>, sessionToken?: string, requireAuth?: boolean): Promise<TCtx>;\n\n  /**\n   * Update a media buy upstream. Required because every operational\n   * consumer assumes it — adapters that can't update media buys have\n   * no business registering as operational.\n   *\n   * Throw `AdcpError` for structured rejection (`NOT_CANCELLABLE`,\n   * `CONFLICT`, etc.). Generic thrown errors propagate to the caller.\n   */\n  updateMediaBuy(ctx: TCtx, request: UpdateMediaBuyRequest): Promise<ServerPayload<UpdateMediaBuyResponse>>;\n\n  /**\n   * Fetch delivery metrics for one or more media buys. Required for\n   * the same reason as `updateMediaBuy`: every operational consumer\n   * assumes it.\n   *\n   * `mediaBuyIds` is plural — matches the wire-spec\n   * `GetMediaBuyDeliveryRequest.media_buy_ids` field (per AdCP 3.0\n   * and PR #1342). Pollers that batch-query N buys in one upstream\n   * call pass an array; single-buy callers pass `[id]`. Decomposed\n   * here (vs. taking the full request shape) because pollers\n   * synthesize requests internally and don't have a typed wire\n   * payload to thread.\n   *\n   * `args` carries optional adopter-specific pass-through (e.g.\n   * tenant-scoped query parameters); pollers leave it `undefined`.\n   */\n  getMediaBuyDelivery(\n    ctx: TCtx,\n    mediaBuyIds: readonly string[],\n    startTime: string,\n    endTime: string,\n    args?: Record<string, unknown>\n  ): Promise<ServerPayload<GetMediaBuyDeliveryResponse>>;\n\n  /**\n   * Poll upstream for the current status of one or more audiences.\n   * Optional — only audience-sync pollers need this.\n   *\n   * Takes opaque `platformData` (whatever the adapter stored when\n   * initiating the sync) plus a fresh access token. No operational\n   * context is threaded because the original sync may have been\n   * initiated under a now-expired auth principal; the poller carries\n   * a freshly-resolved token from its own credential store.\n   *\n   * **`platformData` is for opaque upstream IDs only — never for\n   * bearer tokens.** The fresh `accessToken` argument is the blessed\n   * credential channel; reading a stale token from `platformData`\n   * defeats the design and lands requests with revoked auth.\n   *\n   * Returns a `Map<audience_id, AudienceStatus>`. Audiences not\n   * resolvable upstream are omitted from the map. Throw\n   * `AdcpError('REFERENCE_NOT_FOUND')` only when the entire batch\n   * is unresolvable for the tenant.\n   *\n   * Plural method name aligns with `AudiencePlatform.pollAudienceStatuses`\n   * (the buyer-facing analog), which also returns\n   * `Map<string, AudienceStatus>`. Signature differs because operational\n   * callers don't have a `RequestContext` to thread.\n   */\n  pollAudienceStatuses?(\n    platformData: Record<string, unknown>,\n    accessToken: string\n  ): Promise<Map<string, AudienceStatus>>;\n\n  /**\n   * Discover advertising products. Used by storefront bundle services\n   * to query upstream platforms for products available for bundling\n   * — server-side internal call, not buyer-facing dispatch.\n   *\n   * Optional: bundle-search is opt-in per storefront, and not every\n   * upstream platform exposes a product-discovery surface.\n   *\n   * Signature differs from `SalesPlatform.getProducts` because the\n   * caller is a storefront bundle service, not an MCP request\n   * handler — they have a brief and brand context, not a typed\n   * `GetProductsRequest` wire payload.\n   */\n  getProducts?(\n    ctx: TCtx,\n    brief: string,\n    contextId?: string,\n    brand?: Record<string, unknown>,\n    sourceChain?: readonly string[]\n  ): Promise<RequireCacheScopeWhenProducts<ServerPayload<GetProductsResponse>>>;\n}\n\n/**\n * Type-level identity for an `OperationalPlatform` object literal.\n * Forces the contextual type so handler bodies get typed `ctx` and\n * `request` parameters in TypeScript without an explicit annotation.\n *\n * Mirrors the `definePlatform` family for `DecisioningPlatform`\n * sub-interfaces — see `decisioning/platform-helpers.ts`.\n *\n * @example\n * ```ts\n * import { AuthMissingError, defineOperationalPlatform, type OperationalContext } from '@adcp/sdk/server';\n *\n * interface SnapOpCtx extends OperationalContext {\n *   advertiserId: string;\n * }\n *\n * export const snapOperational = defineOperationalPlatform<SnapOpCtx>({\n *   platformId: 'snap',\n *   extractContext: async (args, sessionToken, requireAuth = true) => {\n *     if (!sessionToken && requireAuth) {\n *       throw new AuthMissingError({ message: 'No Snap token available' });\n *     }\n *     return {\n *       accessToken: sessionToken,\n *       advertiserId: String(args.advertiser_id ?? ''),\n *     };\n *   },\n *   updateMediaBuy: async (ctx, request) => {\n *     // ctx.advertiserId typed ✓; request: UpdateMediaBuyRequest ✓\n *     return upstream.update(ctx, request);\n *   },\n *   getMediaBuyDelivery: async (ctx, id, start, end) => {\n *     return upstream.delivery(ctx, id, start, end);\n *   },\n * });\n * ```\n */\nexport function defineOperationalPlatform<TCtx extends OperationalContext = OperationalContext>(\n  ops: OperationalPlatform<TCtx>\n): OperationalPlatform<TCtx> {\n  return ops;\n}\n"],"mappings":"AAyQO,SAAS,0BACd,KAC2B;AAC3B,SAAO;AACT;","names":[]}

package/dist/lib/server/pick-safe-details.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 const DEFAULT_OPTIONS = {
   maxDepth: 2,
   maxSizeBytes: 2048

package/dist/lib/server/pick-safe-details.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/pick-safe-details.ts"],"sourcesContent":["/**\n * Security primitive for the `details` field on `AdcpError` and the\n * `Error` wire row. Adopters fronting upstream platforms (GAM, Snap,\n * retail-media APIs, internal billing systems) often want to surface\n * upstream error context to buyers — but raw upstream errors carry\n * credentials, PII, internal stack traces, request IDs that leak\n * tenant identity, and other liability surfaces that MUST NOT cross\n * the wire boundary.\n *\n * `pickSafeDetails(input, allowlist, opts?)` is an explicit-allowlist\n * sanitizer: only keys in the allowlist survive, with optional caps\n * on depth and serialized size. Returns `undefined` when the input is\n * not a plain object or the allowlist filter produces an empty\n * result, so callers can spread the return into an optional `details`\n * field without polluting it with `{}`.\n *\n * Adopters should call this BEFORE constructing the `AdcpError` /\n * wire `Error` row. The framework's `normalizeError` does NOT\n * sanitize details — it shallow-copies whatever was passed.\n *\n * @example\n * ```ts\n * import { pickSafeDetails } from '@adcp/client/server';\n *\n * try {\n *   await gamClient.createOrder(req);\n * } catch (upstreamErr) {\n *   throw new AdcpError('UPSTREAM_REJECTED', {\n *     recovery: 'transient',\n *     message: 'Ad server rejected the order',\n *     // Allowlist: only safe upstream fields cross the wire\n *     details: pickSafeDetails(upstreamErr, [\n *       'http_status',\n *       'request_id',\n *       'gam_error_code',\n *     ]),\n *   });\n * }\n * ```\n *\n * @public\n */\n\nexport interface PickSafeDetailsOptions {\n  /**\n   * Maximum nesting depth retained in the result. `undefined` keeps\n   * the input unchanged at any depth; values like `2` keep top-level\n   * + one nested level. Strings, numbers, booleans, and null are\n   * leaves; arrays and plain objects count as a level.\n   *\n   * Default: `2` — top-level + one nested level. Caps cardinality\n   * blast radius from accidentally-recursive upstream error objects.\n   */\n  maxDepth?: number;\n\n  /**\n   * Maximum serialized JSON byte size of the result (best-effort\n   * UTF-8 estimate via `JSON.stringify().length`). When the projected\n   * result exceeds this, returns `undefined` rather than truncating —\n   * adopters should choose a tighter allowlist if they hit the cap.\n   *\n   * Default: `2048` bytes. Wire envelopes shouldn't carry kilobytes\n   * of details; if you need that, ship via `publishStatusChange` or\n   * `task_registry.progress`.\n   */\n  maxSizeBytes?: number;\n}\n\nconst DEFAULT_OPTIONS: Required<PickSafeDetailsOptions> = {\n  maxDepth: 2,\n  maxSizeBytes: 2048,\n};\n\n/**\n * Filter `input` to keys named in `allowlist`, depth-capped and\n * size-capped. Returns `undefined` when the result is empty or\n * exceeds the size cap so callers can spread the value into an\n * optional `details` field without polluting it.\n *\n * Properties NOT in the allowlist are dropped silently (no warning;\n * the design assumes the allowlist is the contract). Nested objects\n * are recursively filtered with the SAME allowlist — there is no\n * per-key allowlist for nested fields. Adopters who need per-level\n * filtering should call `pickSafeDetails` recursively on each\n * nested value.\n *\n * Common-sense behaviors:\n *   - `null` / `undefined` / non-object input → `undefined`\n *   - Empty result after filtering → `undefined`\n *   - Arrays at the top level → `undefined` (use a wrapping object)\n *   - Functions and Symbols are dropped\n *   - Date / RegExp / Error / Map / Set are dropped (use a string\n *     allowlist of primitive fields, or pre-shape the input)\n *\n * @public\n */\nexport function pickSafeDetails(\n  input: unknown,\n  allowlist: readonly string[],\n  opts?: PickSafeDetailsOptions\n): Record<string, unknown> | undefined {\n  if (!isPlainObject(input)) return undefined;\n  if (allowlist.length === 0) return undefined;\n\n  const maxDepth = opts?.maxDepth ?? DEFAULT_OPTIONS.maxDepth;\n  const maxSize = opts?.maxSizeBytes ?? DEFAULT_OPTIONS.maxSizeBytes;\n  const allowSet = new Set(allowlist);\n\n  const result = filterByAllowlist(input, allowSet, maxDepth);\n  if (result == null || Object.keys(result).length === 0) return undefined;\n\n  // Size cap. Use JSON.stringify length as a UTF-8-ish proxy.\n  // Adopters who need exact byte counting should sanitize ahead of\n  // pickSafeDetails.\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(result);\n  } catch {\n    // Circular reference snuck through (shouldn't happen for plain\n    // objects but defensive). Return undefined rather than half-data.\n    return undefined;\n  }\n  if (serialized.length > maxSize) return undefined;\n\n  return result;\n}\n\nfunction filterByAllowlist(\n  obj: Record<string, unknown>,\n  allow: ReadonlySet<string>,\n  remainingDepth: number\n): Record<string, unknown> | null {\n  const out: Record<string, unknown> = {};\n  for (const key of Object.keys(obj)) {\n    if (!allow.has(key)) continue;\n    const value = obj[key];\n    const safe = sanitizeValue(value, allow, remainingDepth - 1);\n    // Drop undefined results so the caller sees only present keys.\n    if (safe !== undefined) out[key] = safe;\n  }\n  return Object.keys(out).length === 0 ? null : out;\n}\n\nfunction sanitizeValue(value: unknown, allow: ReadonlySet<string>, remainingDepth: number): unknown {\n  // Primitives pass through.\n  if (value === null) return null;\n  const t = typeof value;\n  if (t === 'string' || t === 'number' || t === 'boolean') return value;\n  if (t === 'function' || t === 'symbol' || t === 'undefined' || t === 'bigint') return undefined;\n\n  if (Array.isArray(value)) {\n    // Arrays don't count as a depth level — only plain objects do.\n    // Pass items through with the SAME remainingDepth so an array-of-\n    // objects gets the same nesting budget as a bare object would.\n    const mapped = value.map(v => sanitizeValue(v, allow, remainingDepth));\n    return mapped.filter(v => v !== undefined);\n  }\n\n  if (isPlainObject(value)) {\n    if (remainingDepth <= 0) return undefined;\n    const filtered = filterByAllowlist(value, allow, remainingDepth);\n    return filtered ?? undefined;\n  }\n\n  // Date / RegExp / Map / Set / Error / class instances — drop.\n  // Adopters who need these should pre-shape into primitives.\n  return undefined;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== 'object') return false;\n  if (Array.isArray(value)) return false;\n  // Only plain objects (not Date, RegExp, Map, Set, class instances).\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n"],"mappings":";;;;;;AAoEA,MAAM,kBAAoD;AAAA,EACxD,UAAU;AAAA,EACV,cAAc;AAChB;AAyBO,SAAS,gBACd,OACA,WACA,MACqC;AACrC,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,MAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,QAAM,WAAW,MAAM,YAAY,gBAAgB;AACnD,QAAM,UAAU,MAAM,gBAAgB,gBAAgB;AACtD,QAAM,WAAW,IAAI,IAAI,SAAS;AAElC,QAAM,SAAS,kBAAkB,OAAO,UAAU,QAAQ;AAC1D,MAAI,UAAU,QAAQ,OAAO,KAAK,MAAM,EAAE,WAAW,EAAG,QAAO;AAK/D,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,UAAU,MAAM;AAAA,EACpC,QAAQ;AAGN,WAAO;AAAA,EACT;AACA,MAAI,WAAW,SAAS,QAAS,QAAO;AAExC,SAAO;AACT;AAEA,SAAS,kBACP,KACA,OACA,gBACgC;AAChC,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,OAAO,KAAK,GAAG,GAAG;AAClC,QAAI,CAAC,MAAM,IAAI,GAAG,EAAG;AACrB,UAAM,QAAQ,IAAI,GAAG;AACrB,UAAM,OAAO,cAAc,OAAO,OAAO,iBAAiB,CAAC;AAE3D,QAAI,SAAS,OAAW,KAAI,GAAG,IAAI;AAAA,EACrC;AACA,SAAO,OAAO,KAAK,GAAG,EAAE,WAAW,IAAI,OAAO;AAChD;AAEA,SAAS,cAAc,OAAgB,OAA4B,gBAAiC;AAElG,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,IAAI,OAAO;AACjB,MAAI,MAAM,YAAY,MAAM,YAAY,MAAM,UAAW,QAAO;AAChE,MAAI,MAAM,cAAc,MAAM,YAAY,MAAM,eAAe,MAAM,SAAU,QAAO;AAEtF,MAAI,MAAM,QAAQ,KAAK,GAAG;AAIxB,UAAM,SAAS,MAAM,IAAI,OAAK,cAAc,GAAG,OAAO,cAAc,CAAC;AACrE,WAAO,OAAO,OAAO,OAAK,MAAM,MAAS;AAAA,EAC3C;AAEA,MAAI,cAAc,KAAK,GAAG;AACxB,QAAI,kBAAkB,EAAG,QAAO;AAChC,UAAM,WAAW,kBAAkB,OAAO,OAAO,cAAc;AAC/D,WAAO,YAAY;AAAA,EACrB;AAIA,SAAO;AACT;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AAEjC,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/pick-safe-details.ts"],"sourcesContent":["/**\n * Security primitive for the `details` field on `AdcpError` and the\n * `Error` wire row. Adopters fronting upstream platforms (GAM, Snap,\n * retail-media APIs, internal billing systems) often want to surface\n * upstream error context to buyers — but raw upstream errors carry\n * credentials, PII, internal stack traces, request IDs that leak\n * tenant identity, and other liability surfaces that MUST NOT cross\n * the wire boundary.\n *\n * `pickSafeDetails(input, allowlist, opts?)` is an explicit-allowlist\n * sanitizer: only keys in the allowlist survive, with optional caps\n * on depth and serialized size. Returns `undefined` when the input is\n * not a plain object or the allowlist filter produces an empty\n * result, so callers can spread the return into an optional `details`\n * field without polluting it with `{}`.\n *\n * Adopters should call this BEFORE constructing the `AdcpError` /\n * wire `Error` row. The framework's `normalizeError` does NOT\n * sanitize details — it shallow-copies whatever was passed.\n *\n * @example\n * ```ts\n * import { pickSafeDetails } from '@adcp/client/server';\n *\n * try {\n *   await gamClient.createOrder(req);\n * } catch (upstreamErr) {\n *   throw new AdcpError('UPSTREAM_REJECTED', {\n *     recovery: 'transient',\n *     message: 'Ad server rejected the order',\n *     // Allowlist: only safe upstream fields cross the wire\n *     details: pickSafeDetails(upstreamErr, [\n *       'http_status',\n *       'request_id',\n *       'gam_error_code',\n *     ]),\n *   });\n * }\n * ```\n *\n * @public\n */\n\nexport interface PickSafeDetailsOptions {\n  /**\n   * Maximum nesting depth retained in the result. `undefined` keeps\n   * the input unchanged at any depth; values like `2` keep top-level\n   * + one nested level. Strings, numbers, booleans, and null are\n   * leaves; arrays and plain objects count as a level.\n   *\n   * Default: `2` — top-level + one nested level. Caps cardinality\n   * blast radius from accidentally-recursive upstream error objects.\n   */\n  maxDepth?: number;\n\n  /**\n   * Maximum serialized JSON byte size of the result (best-effort\n   * UTF-8 estimate via `JSON.stringify().length`). When the projected\n   * result exceeds this, returns `undefined` rather than truncating —\n   * adopters should choose a tighter allowlist if they hit the cap.\n   *\n   * Default: `2048` bytes. Wire envelopes shouldn't carry kilobytes\n   * of details; if you need that, ship via `publishStatusChange` or\n   * `task_registry.progress`.\n   */\n  maxSizeBytes?: number;\n}\n\nconst DEFAULT_OPTIONS: Required<PickSafeDetailsOptions> = {\n  maxDepth: 2,\n  maxSizeBytes: 2048,\n};\n\n/**\n * Filter `input` to keys named in `allowlist`, depth-capped and\n * size-capped. Returns `undefined` when the result is empty or\n * exceeds the size cap so callers can spread the value into an\n * optional `details` field without polluting it.\n *\n * Properties NOT in the allowlist are dropped silently (no warning;\n * the design assumes the allowlist is the contract). Nested objects\n * are recursively filtered with the SAME allowlist — there is no\n * per-key allowlist for nested fields. Adopters who need per-level\n * filtering should call `pickSafeDetails` recursively on each\n * nested value.\n *\n * Common-sense behaviors:\n *   - `null` / `undefined` / non-object input → `undefined`\n *   - Empty result after filtering → `undefined`\n *   - Arrays at the top level → `undefined` (use a wrapping object)\n *   - Functions and Symbols are dropped\n *   - Date / RegExp / Error / Map / Set are dropped (use a string\n *     allowlist of primitive fields, or pre-shape the input)\n *\n * @public\n */\nexport function pickSafeDetails(\n  input: unknown,\n  allowlist: readonly string[],\n  opts?: PickSafeDetailsOptions\n): Record<string, unknown> | undefined {\n  if (!isPlainObject(input)) return undefined;\n  if (allowlist.length === 0) return undefined;\n\n  const maxDepth = opts?.maxDepth ?? DEFAULT_OPTIONS.maxDepth;\n  const maxSize = opts?.maxSizeBytes ?? DEFAULT_OPTIONS.maxSizeBytes;\n  const allowSet = new Set(allowlist);\n\n  const result = filterByAllowlist(input, allowSet, maxDepth);\n  if (result == null || Object.keys(result).length === 0) return undefined;\n\n  // Size cap. Use JSON.stringify length as a UTF-8-ish proxy.\n  // Adopters who need exact byte counting should sanitize ahead of\n  // pickSafeDetails.\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(result);\n  } catch {\n    // Circular reference snuck through (shouldn't happen for plain\n    // objects but defensive). Return undefined rather than half-data.\n    return undefined;\n  }\n  if (serialized.length > maxSize) return undefined;\n\n  return result;\n}\n\nfunction filterByAllowlist(\n  obj: Record<string, unknown>,\n  allow: ReadonlySet<string>,\n  remainingDepth: number\n): Record<string, unknown> | null {\n  const out: Record<string, unknown> = {};\n  for (const key of Object.keys(obj)) {\n    if (!allow.has(key)) continue;\n    const value = obj[key];\n    const safe = sanitizeValue(value, allow, remainingDepth - 1);\n    // Drop undefined results so the caller sees only present keys.\n    if (safe !== undefined) out[key] = safe;\n  }\n  return Object.keys(out).length === 0 ? null : out;\n}\n\nfunction sanitizeValue(value: unknown, allow: ReadonlySet<string>, remainingDepth: number): unknown {\n  // Primitives pass through.\n  if (value === null) return null;\n  const t = typeof value;\n  if (t === 'string' || t === 'number' || t === 'boolean') return value;\n  if (t === 'function' || t === 'symbol' || t === 'undefined' || t === 'bigint') return undefined;\n\n  if (Array.isArray(value)) {\n    // Arrays don't count as a depth level — only plain objects do.\n    // Pass items through with the SAME remainingDepth so an array-of-\n    // objects gets the same nesting budget as a bare object would.\n    const mapped = value.map(v => sanitizeValue(v, allow, remainingDepth));\n    return mapped.filter(v => v !== undefined);\n  }\n\n  if (isPlainObject(value)) {\n    if (remainingDepth <= 0) return undefined;\n    const filtered = filterByAllowlist(value, allow, remainingDepth);\n    return filtered ?? undefined;\n  }\n\n  // Date / RegExp / Map / Set / Error / class instances — drop.\n  // Adopters who need these should pre-shape into primitives.\n  return undefined;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== 'object') return false;\n  if (Array.isArray(value)) return false;\n  // Only plain objects (not Date, RegExp, Map, Set, class instances).\n  const proto = Object.getPrototypeOf(value);\n  return proto === Object.prototype || proto === null;\n}\n"],"mappings":"AAoEA,MAAM,kBAAoD;AAAA,EACxD,UAAU;AAAA,EACV,cAAc;AAChB;AAyBO,SAAS,gBACd,OACA,WACA,MACqC;AACrC,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,MAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,QAAM,WAAW,MAAM,YAAY,gBAAgB;AACnD,QAAM,UAAU,MAAM,gBAAgB,gBAAgB;AACtD,QAAM,WAAW,IAAI,IAAI,SAAS;AAElC,QAAM,SAAS,kBAAkB,OAAO,UAAU,QAAQ;AAC1D,MAAI,UAAU,QAAQ,OAAO,KAAK,MAAM,EAAE,WAAW,EAAG,QAAO;AAK/D,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,UAAU,MAAM;AAAA,EACpC,QAAQ;AAGN,WAAO;AAAA,EACT;AACA,MAAI,WAAW,SAAS,QAAS,QAAO;AAExC,SAAO;AACT;AAEA,SAAS,kBACP,KACA,OACA,gBACgC;AAChC,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,OAAO,KAAK,GAAG,GAAG;AAClC,QAAI,CAAC,MAAM,IAAI,GAAG,EAAG;AACrB,UAAM,QAAQ,IAAI,GAAG;AACrB,UAAM,OAAO,cAAc,OAAO,OAAO,iBAAiB,CAAC;AAE3D,QAAI,SAAS,OAAW,KAAI,GAAG,IAAI;AAAA,EACrC;AACA,SAAO,OAAO,KAAK,GAAG,EAAE,WAAW,IAAI,OAAO;AAChD;AAEA,SAAS,cAAc,OAAgB,OAA4B,gBAAiC;AAElG,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,IAAI,OAAO;AACjB,MAAI,MAAM,YAAY,MAAM,YAAY,MAAM,UAAW,QAAO;AAChE,MAAI,MAAM,cAAc,MAAM,YAAY,MAAM,eAAe,MAAM,SAAU,QAAO;AAEtF,MAAI,MAAM,QAAQ,KAAK,GAAG;AAIxB,UAAM,SAAS,MAAM,IAAI,OAAK,cAAc,GAAG,OAAO,cAAc,CAAC;AACrE,WAAO,OAAO,OAAO,OAAK,MAAM,MAAS;AAAA,EAC3C;AAEA,MAAI,cAAc,KAAK,GAAG;AACxB,QAAI,kBAAkB,EAAG,QAAO;AAChC,UAAM,WAAW,kBAAkB,OAAO,OAAO,cAAc;AAC/D,WAAO,YAAY;AAAA,EACrB;AAIA,SAAO;AACT;AAEA,SAAS,cAAc,OAAkD;AACvE,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AAEjC,QAAM,QAAQ,OAAO,eAAe,KAAK;AACzC,SAAO,UAAU,OAAO,aAAa,UAAU;AACjD;","names":[]}

package/dist/lib/server/pin-and-bind-fetch.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { Agent, fetch as undiciFetch } from "undici";
 import { lookup as nativeDnsLookup } from "node:dns";
 import { isIPv6 } from "node:net";

package/dist/lib/server/pin-and-bind-fetch.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/pin-and-bind-fetch.ts"],"sourcesContent":["/**\n * Pin-and-bind fetch — DNS-rebinding-resistant `fetch` for outbound webhook\n * delivery and other callbacks where the destination is buyer-supplied.\n *\n * The problem: validating a `push_notification_config.url`'s LITERAL hostname\n * against an SSRF deny list does not protect against a DNS-rebinding attack.\n * A buyer can register `https://rebind.attacker.com/`, pass the literal-host\n * check, and then flip the A-record TTL to `169.254.169.254` (cloud metadata)\n * or `127.0.0.1` (loopback) before the webhook fires. Node's `fetch` resolves\n * the host fresh at request time, gets the rebound IP, and posts the\n * signed payload to the attacker-controlled destination.\n *\n * The fix: control DNS resolution and connect-target inside the fetch itself.\n *   1. Resolve the hostname.\n *   2. Validate every resolved IP against the SSRF policy (CIDR deny lists,\n *      metadata-host names, scheme rules).\n *   3. Pin the connection to the validated IP — undici opens TCP/TLS to that\n *      specific address, but the original hostname is preserved for TLS SNI\n *      and the `Host:` header so HTTPS routing still works.\n *\n * Implementation note: undici's `Agent` accepts a `connect.lookup` callback\n * with the same signature as `dns.lookup`. We hook the callback, resolve via\n * `dns.lookup({ all: true })` to see EVERY address the host can reach, run\n * the resolved IPs through {@link enforceSsrfPolicyResolved}, and only return\n * a pinned address when every resolved IP is in an allowed range. This\n * matches the AdCP substitution-observer SSRF contract — a host that\n * resolves to *any* denied IP is treated as suspect and rejected wholesale.\n */\n\nimport { Agent, fetch as undiciFetch, type Dispatcher } from 'undici';\nimport { lookup as nativeDnsLookup, type LookupAddress } from 'node:dns';\nimport { isIPv6 } from 'node:net';\n\nimport { enforceSsrfPolicy, enforceSsrfPolicyResolved } from '../substitution/observer/ssrf';\nimport type { SsrfPolicy } from '../substitution/types';\n\n/**\n * Default SSRF policy for outbound webhook delivery. Stricter than\n * `DEFAULT_SSRF_POLICY` (substitution observer) only in that it allows\n * `host_literal_policy: 'allow'` — webhook URLs MAY use IP literals\n * (e.g. `https://203.0.113.10/cb`) as long as the IP is not in a denied\n * CIDR range. Schemes restricted to https; signed webhooks SHOULD be\n * delivered over TLS.\n *\n * For storyboard / in-process tests where the receiver runs on\n * `http://127.0.0.1:port`, use {@link LOOPBACK_OK_WEBHOOK_SSRF_POLICY}\n * instead. That preset relaxes only the loopback + http rules and keeps\n * every other deny range — adopters get most of the SSRF protection\n * during tests without disabling pin-and-bind entirely.\n */\nexport const WEBHOOK_SSRF_POLICY: SsrfPolicy = Object.freeze({\n  schemes_allowed: Object.freeze(['https']),\n  schemes_denied: Object.freeze(['http', 'file', 'gopher', 'ftp', 'ftps', 'data', 'javascript', 'about', 'ws', 'wss']),\n  hosts_denied_ipv4_cidrs: Object.freeze([\n    '0.0.0.0/8',\n    '10.0.0.0/8',\n    '100.64.0.0/10',\n    '127.0.0.0/8',\n    '169.254.0.0/16',\n    '172.16.0.0/12',\n    '192.0.0.0/24',\n    '192.168.0.0/16',\n    '224.0.0.0/4',\n    '240.0.0.0/4',\n  ]),\n  hosts_denied_ipv6_cidrs: Object.freeze([\n    '::1/128',\n    '::/128',\n    '::ffff:0:0/96',\n    '64:ff9b::/96',\n    'fc00::/7',\n    'fe80::/10',\n    'ff00::/8',\n  ]),\n  hosts_denied_metadata: Object.freeze([\n    'metadata.google.internal',\n    'metadata',\n    'metadata.packet.net',\n    'fd00:ec2::254',\n  ]),\n  host_literal_policy: 'allow',\n}) as SsrfPolicy;\n\n/**\n * Pin-and-bind policy that allows http URLs and IPv4/IPv6 loopback so\n * adopters can enable pin-and-bind for production webhook delivery while\n * keeping storyboard / in-process tests working — `createWebhookReceiver`\n * listens on `http://127.0.0.1:port`. Every other private CIDR, metadata\n * host, and link-local range is still denied, so loopback is the only\n * relaxation. Pass to `createPinAndBindFetch({ policy })` from your test\n * fixture or storyboard runner harness; do NOT use in production.\n */\nexport const LOOPBACK_OK_WEBHOOK_SSRF_POLICY: SsrfPolicy = Object.freeze({\n  schemes_allowed: Object.freeze(['http', 'https']),\n  schemes_denied: Object.freeze(['file', 'gopher', 'ftp', 'ftps', 'data', 'javascript', 'about', 'ws', 'wss']),\n  hosts_denied_ipv4_cidrs: Object.freeze([\n    '0.0.0.0/8',\n    '10.0.0.0/8',\n    '100.64.0.0/10',\n    // 127.0.0.0/8 omitted — loopback allowed for tests.\n    '169.254.0.0/16',\n    '172.16.0.0/12',\n    '192.0.0.0/24',\n    '192.168.0.0/16',\n    '224.0.0.0/4',\n    '240.0.0.0/4',\n  ]),\n  hosts_denied_ipv6_cidrs: Object.freeze([\n    // ::1/128 and ::/128 omitted — IPv6 loopback allowed for tests.\n    '::ffff:0:0/96',\n    '64:ff9b::/96',\n    'fc00::/7',\n    'fe80::/10',\n    'ff00::/8',\n  ]),\n  hosts_denied_metadata: Object.freeze([\n    'metadata.google.internal',\n    'metadata',\n    'metadata.packet.net',\n    'fd00:ec2::254',\n  ]),\n  host_literal_policy: 'allow',\n}) as SsrfPolicy;\n\n/**\n * Signature of the lookup callback `dns.lookup` accepts. Re-declared here\n * because the native type from `node:dns` is a complex overload set; the\n * shape we actually need is the all=true variant the Agent expects.\n */\nexport type DnsLookupAll = (\n  hostname: string,\n  options: { family?: number; hints?: number; all: true; verbatim?: boolean },\n  callback: (err: NodeJS.ErrnoException | null, addresses: LookupAddress[]) => void\n) => void;\n\nexport interface PinAndBindFetchOptions {\n  /**\n   * SSRF policy to enforce against resolved IPs. Defaults to\n   * {@link WEBHOOK_SSRF_POLICY} (https-only, all private/loopback/metadata\n   * ranges denied, IP literals allowed).\n   */\n  policy?: SsrfPolicy;\n  /**\n   * Override the underlying DNS lookup. Default uses `dns.lookup` with\n   * `all: true`. Tests inject a stub to simulate rebinding attacks without\n   * touching real DNS.\n   */\n  lookup?: DnsLookupAll;\n  /**\n   * Forward to `Agent` — connect-attempt timeout, TLS options, etc. Cannot\n   * override `lookup`; that is wired by this helper.\n   */\n  agentOptions?: Omit<Agent.Options, 'connect'> & {\n    connect?: Omit<NonNullable<Agent.Options['connect']>, 'lookup'>;\n  };\n}\n\nconst DEFAULT_LOOKUP_ALL: DnsLookupAll = (hostname, options, callback) => {\n  nativeDnsLookup(hostname, { ...options, all: true }, (err, addresses) => {\n    callback(err, addresses as LookupAddress[]);\n  });\n};\n\n/**\n * Build a `fetch` that pins outbound connections to the IPs the SSRF policy\n * allows, defeating DNS-rebinding attacks against per-attempt DNS resolution.\n *\n * This is the default `fetch` for `createWebhookEmitter` /\n * `createAdcpServer({ webhooks })`, so production webhook delivery is\n * rebinding-protected without extra wiring. Call it explicitly only to\n * override the policy — e.g. {@link LOOPBACK_OK_WEBHOOK_SSRF_POLICY} for\n * storyboard tests that deliver to a loopback http receiver. See\n * `docs/guides/SIGNING-GUIDE.md` § Webhook SSRF defense.\n *\n * Construct once per emitter and reuse — each call instantiates a fresh\n * `undici.Agent` with its own connection pool.\n *\n * @example\n * ```ts\n * import { createWebhookEmitter, createPinAndBindFetch } from '@adcp/sdk/server';\n *\n * const emitter = createWebhookEmitter({\n *   signerKey: webhookKey,\n *   fetch: createPinAndBindFetch(),\n * });\n * ```\n */\nexport function createPinAndBindFetch(options: PinAndBindFetchOptions = {}): typeof fetch {\n  const policy = options.policy ?? WEBHOOK_SSRF_POLICY;\n  const lookupImpl = options.lookup ?? DEFAULT_LOOKUP_ALL;\n\n  const guardedLookup = (\n    hostname: string,\n    opts: { family?: number; hints?: number; all?: boolean; verbatim?: boolean } | undefined,\n    callback: (err: NodeJS.ErrnoException | null, addressOrAll?: string | LookupAddress[], family?: number) => void\n  ): void => {\n    const wantsAll = opts?.all === true;\n    lookupImpl(hostname, { ...(opts ?? {}), all: true }, (err, addresses) => {\n      if (err) {\n        callback(err);\n        return;\n      }\n      if (!Array.isArray(addresses) || addresses.length === 0) {\n        callback(\n          makeSsrfError(`DNS resolution returned no addresses for ${hostname}`, 'dns_revalidation:no_addresses')\n        );\n        return;\n      }\n\n      // The URL passed in here only matters for scheme + hostname checks,\n      // both of which were already validated synchronously by undici when\n      // the request started. We re-build a placeholder URL to feed the\n      // resolved-address rule, which is the load-bearing check for\n      // rebinding defense.\n      const url = new URL(`https://${bracketIfV6(hostname)}`);\n      const ips = addresses.map(a => a.address);\n      const result = enforceSsrfPolicyResolved(url, ips, policy);\n      if (!result.allowed) {\n        callback(makeSsrfError(result.message ?? 'SSRF policy denied resolved address', result.rule ?? 'ssrf'));\n        return;\n      }\n\n      if (wantsAll) {\n        callback(null, addresses);\n        return;\n      }\n      // Pin to the first resolved address. enforceSsrfPolicyResolved is\n      // all-or-none: if it allowed the resolution, every entry passed.\n      const first = addresses[0]!;\n      callback(null, first.address, first.family);\n    });\n  };\n\n  const dispatcher = new Agent({\n    ...(options.agentOptions ?? {}),\n    connect: {\n      ...(options.agentOptions?.connect ?? {}),\n      // undici's connect type accepts a lookup with the dns.lookup signature.\n      lookup: guardedLookup as unknown as Agent.Options['connect'] extends infer T\n        ? T extends { lookup?: infer L }\n          ? L\n          : never\n        : never,\n    },\n  });\n\n  const wrapped = async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]): Promise<Response> => {\n    // Synchronous pre-check for the URL's literal scheme + (if it's an IP)\n    // its CIDR membership. undici skips `connect.lookup` for IP-literal\n    // hostnames, so the resolved-IP path below would never see them.\n    // This pre-check enforces the same SSRF policy on URLs like\n    // `https://127.0.0.1/cb` or `https://[::1]/cb`.\n    const url = resolveRequestUrl(input);\n    if (url) {\n      const sync = enforceSsrfPolicy(url, policy);\n      if (!sync.allowed) {\n        throw makeSsrfError(sync.message ?? 'SSRF policy denied URL', sync.rule ?? 'ssrf');\n      }\n    }\n    return undiciFetch(input as Parameters<typeof undiciFetch>[0], {\n      ...(init as Parameters<typeof undiciFetch>[1]),\n      dispatcher: dispatcher as unknown as Dispatcher,\n    }) as unknown as Response;\n  };\n\n  return wrapped as typeof fetch;\n}\n\nfunction resolveRequestUrl(input: Parameters<typeof fetch>[0]): URL | null {\n  try {\n    if (typeof input === 'string') return new URL(input);\n    if (input instanceof URL) return input;\n    if (\n      typeof input === 'object' &&\n      input !== null &&\n      'url' in input &&\n      typeof (input as { url: unknown }).url === 'string'\n    ) {\n      return new URL((input as { url: string }).url);\n    }\n  } catch {\n    // Let undici surface the parse error in its own shape.\n    return null;\n  }\n  return null;\n}\n\nfunction bracketIfV6(host: string): string {\n  return isIPv6(host) ? `[${host}]` : host;\n}\n\nfunction makeSsrfError(message: string, rule: string): NodeJS.ErrnoException {\n  const err = new Error(`pin-and-bind: ${rule}: ${message}`) as NodeJS.ErrnoException;\n  err.code = 'EADCP_SSRF_BLOCKED';\n  return err;\n}\n"],"mappings":";;;;;;AA6BA,SAAS,OAAO,SAAS,mBAAoC;AAC7D,SAAS,UAAU,uBAA2C;AAC9D,SAAS,cAAc;AAEvB,SAAS,mBAAmB,iCAAiC;AAiBtD,MAAM,sBAAkC,OAAO,OAAO;AAAA,EAC3D,iBAAiB,OAAO,OAAO,CAAC,OAAO,CAAC;AAAA,EACxC,gBAAgB,OAAO,OAAO,CAAC,QAAQ,QAAQ,UAAU,OAAO,QAAQ,QAAQ,cAAc,SAAS,MAAM,KAAK,CAAC;AAAA,EACnH,yBAAyB,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,yBAAyB,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,uBAAuB,OAAO,OAAO;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,qBAAqB;AACvB,CAAC;AAWM,MAAM,kCAA8C,OAAO,OAAO;AAAA,EACvE,iBAAiB,OAAO,OAAO,CAAC,QAAQ,OAAO,CAAC;AAAA,EAChD,gBAAgB,OAAO,OAAO,CAAC,QAAQ,UAAU,OAAO,QAAQ,QAAQ,cAAc,SAAS,MAAM,KAAK,CAAC;AAAA,EAC3G,yBAAyB,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,yBAAyB,OAAO,OAAO;AAAA;AAAA,IAErC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,uBAAuB,OAAO,OAAO;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,qBAAqB;AACvB,CAAC;AAmCD,MAAM,qBAAmC,CAAC,UAAU,SAAS,aAAa;AACxE,kBAAgB,UAAU,EAAE,GAAG,SAAS,KAAK,KAAK,GAAG,CAAC,KAAK,cAAc;AACvE,aAAS,KAAK,SAA4B;AAAA,EAC5C,CAAC;AACH;AA0BO,SAAS,sBAAsB,UAAkC,CAAC,GAAiB;AACxF,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,QAAQ,UAAU;AAErC,QAAM,gBAAgB,CACpB,UACA,MACA,aACS;AACT,UAAM,WAAW,MAAM,QAAQ;AAC/B,eAAW,UAAU,EAAE,GAAI,QAAQ,CAAC,GAAI,KAAK,KAAK,GAAG,CAAC,KAAK,cAAc;AACvE,UAAI,KAAK;AACP,iBAAS,GAAG;AACZ;AAAA,MACF;AACA,UAAI,CAAC,MAAM,QAAQ,SAAS,KAAK,UAAU,WAAW,GAAG;AACvD;AAAA,UACE,cAAc,4CAA4C,QAAQ,IAAI,+BAA+B;AAAA,QACvG;AACA;AAAA,MACF;AAOA,YAAM,MAAM,IAAI,IAAI,WAAW,YAAY,QAAQ,CAAC,EAAE;AACtD,YAAM,MAAM,UAAU,IAAI,OAAK,EAAE,OAAO;AACxC,YAAM,SAAS,0BAA0B,KAAK,KAAK,MAAM;AACzD,UAAI,CAAC,OAAO,SAAS;AACnB,iBAAS,cAAc,OAAO,WAAW,uCAAuC,OAAO,QAAQ,MAAM,CAAC;AACtG;AAAA,MACF;AAEA,UAAI,UAAU;AACZ,iBAAS,MAAM,SAAS;AACxB;AAAA,MACF;AAGA,YAAM,QAAQ,UAAU,CAAC;AACzB,eAAS,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,IAC5C,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,MAAM;AAAA,IAC3B,GAAI,QAAQ,gBAAgB,CAAC;AAAA,IAC7B,SAAS;AAAA,MACP,GAAI,QAAQ,cAAc,WAAW,CAAC;AAAA;AAAA,MAEtC,QAAQ;AAAA,IAKV;AAAA,EACF,CAAC;AAED,QAAM,UAAU,OAAO,OAAoC,SAA0D;AAMnH,UAAM,MAAM,kBAAkB,KAAK;AACnC,QAAI,KAAK;AACP,YAAM,OAAO,kBAAkB,KAAK,MAAM;AAC1C,UAAI,CAAC,KAAK,SAAS;AACjB,cAAM,cAAc,KAAK,WAAW,0BAA0B,KAAK,QAAQ,MAAM;AAAA,MACnF;AAAA,IACF;AACA,WAAO,YAAY,OAA4C;AAAA,MAC7D,GAAI;AAAA,MACJ;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAgD;AACzE,MAAI;AACF,QAAI,OAAO,UAAU,SAAU,QAAO,IAAI,IAAI,KAAK;AACnD,QAAI,iBAAiB,IAAK,QAAO;AACjC,QACE,OAAO,UAAU,YACjB,UAAU,QACV,SAAS,SACT,OAAQ,MAA2B,QAAQ,UAC3C;AACA,aAAO,IAAI,IAAK,MAA0B,GAAG;AAAA,IAC/C;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAAsB;AACzC,SAAO,OAAO,IAAI,IAAI,IAAI,IAAI,MAAM;AACtC;AAEA,SAAS,cAAc,SAAiB,MAAqC;AAC3E,QAAM,MAAM,IAAI,MAAM,iBAAiB,IAAI,KAAK,OAAO,EAAE;AACzD,MAAI,OAAO;AACX,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/pin-and-bind-fetch.ts"],"sourcesContent":["/**\n * Pin-and-bind fetch — DNS-rebinding-resistant `fetch` for outbound webhook\n * delivery and other callbacks where the destination is buyer-supplied.\n *\n * The problem: validating a `push_notification_config.url`'s LITERAL hostname\n * against an SSRF deny list does not protect against a DNS-rebinding attack.\n * A buyer can register `https://rebind.attacker.com/`, pass the literal-host\n * check, and then flip the A-record TTL to `169.254.169.254` (cloud metadata)\n * or `127.0.0.1` (loopback) before the webhook fires. Node's `fetch` resolves\n * the host fresh at request time, gets the rebound IP, and posts the\n * signed payload to the attacker-controlled destination.\n *\n * The fix: control DNS resolution and connect-target inside the fetch itself.\n *   1. Resolve the hostname.\n *   2. Validate every resolved IP against the SSRF policy (CIDR deny lists,\n *      metadata-host names, scheme rules).\n *   3. Pin the connection to the validated IP — undici opens TCP/TLS to that\n *      specific address, but the original hostname is preserved for TLS SNI\n *      and the `Host:` header so HTTPS routing still works.\n *\n * Implementation note: undici's `Agent` accepts a `connect.lookup` callback\n * with the same signature as `dns.lookup`. We hook the callback, resolve via\n * `dns.lookup({ all: true })` to see EVERY address the host can reach, run\n * the resolved IPs through {@link enforceSsrfPolicyResolved}, and only return\n * a pinned address when every resolved IP is in an allowed range. This\n * matches the AdCP substitution-observer SSRF contract — a host that\n * resolves to *any* denied IP is treated as suspect and rejected wholesale.\n */\n\nimport { Agent, fetch as undiciFetch, type Dispatcher } from 'undici';\nimport { lookup as nativeDnsLookup, type LookupAddress } from 'node:dns';\nimport { isIPv6 } from 'node:net';\n\nimport { enforceSsrfPolicy, enforceSsrfPolicyResolved } from '../substitution/observer/ssrf';\nimport type { SsrfPolicy } from '../substitution/types';\n\n/**\n * Default SSRF policy for outbound webhook delivery. Stricter than\n * `DEFAULT_SSRF_POLICY` (substitution observer) only in that it allows\n * `host_literal_policy: 'allow'` — webhook URLs MAY use IP literals\n * (e.g. `https://203.0.113.10/cb`) as long as the IP is not in a denied\n * CIDR range. Schemes restricted to https; signed webhooks SHOULD be\n * delivered over TLS.\n *\n * For storyboard / in-process tests where the receiver runs on\n * `http://127.0.0.1:port`, use {@link LOOPBACK_OK_WEBHOOK_SSRF_POLICY}\n * instead. That preset relaxes only the loopback + http rules and keeps\n * every other deny range — adopters get most of the SSRF protection\n * during tests without disabling pin-and-bind entirely.\n */\nexport const WEBHOOK_SSRF_POLICY: SsrfPolicy = Object.freeze({\n  schemes_allowed: Object.freeze(['https']),\n  schemes_denied: Object.freeze(['http', 'file', 'gopher', 'ftp', 'ftps', 'data', 'javascript', 'about', 'ws', 'wss']),\n  hosts_denied_ipv4_cidrs: Object.freeze([\n    '0.0.0.0/8',\n    '10.0.0.0/8',\n    '100.64.0.0/10',\n    '127.0.0.0/8',\n    '169.254.0.0/16',\n    '172.16.0.0/12',\n    '192.0.0.0/24',\n    '192.168.0.0/16',\n    '224.0.0.0/4',\n    '240.0.0.0/4',\n  ]),\n  hosts_denied_ipv6_cidrs: Object.freeze([\n    '::1/128',\n    '::/128',\n    '::ffff:0:0/96',\n    '64:ff9b::/96',\n    'fc00::/7',\n    'fe80::/10',\n    'ff00::/8',\n  ]),\n  hosts_denied_metadata: Object.freeze([\n    'metadata.google.internal',\n    'metadata',\n    'metadata.packet.net',\n    'fd00:ec2::254',\n  ]),\n  host_literal_policy: 'allow',\n}) as SsrfPolicy;\n\n/**\n * Pin-and-bind policy that allows http URLs and IPv4/IPv6 loopback so\n * adopters can enable pin-and-bind for production webhook delivery while\n * keeping storyboard / in-process tests working — `createWebhookReceiver`\n * listens on `http://127.0.0.1:port`. Every other private CIDR, metadata\n * host, and link-local range is still denied, so loopback is the only\n * relaxation. Pass to `createPinAndBindFetch({ policy })` from your test\n * fixture or storyboard runner harness; do NOT use in production.\n */\nexport const LOOPBACK_OK_WEBHOOK_SSRF_POLICY: SsrfPolicy = Object.freeze({\n  schemes_allowed: Object.freeze(['http', 'https']),\n  schemes_denied: Object.freeze(['file', 'gopher', 'ftp', 'ftps', 'data', 'javascript', 'about', 'ws', 'wss']),\n  hosts_denied_ipv4_cidrs: Object.freeze([\n    '0.0.0.0/8',\n    '10.0.0.0/8',\n    '100.64.0.0/10',\n    // 127.0.0.0/8 omitted — loopback allowed for tests.\n    '169.254.0.0/16',\n    '172.16.0.0/12',\n    '192.0.0.0/24',\n    '192.168.0.0/16',\n    '224.0.0.0/4',\n    '240.0.0.0/4',\n  ]),\n  hosts_denied_ipv6_cidrs: Object.freeze([\n    // ::1/128 and ::/128 omitted — IPv6 loopback allowed for tests.\n    '::ffff:0:0/96',\n    '64:ff9b::/96',\n    'fc00::/7',\n    'fe80::/10',\n    'ff00::/8',\n  ]),\n  hosts_denied_metadata: Object.freeze([\n    'metadata.google.internal',\n    'metadata',\n    'metadata.packet.net',\n    'fd00:ec2::254',\n  ]),\n  host_literal_policy: 'allow',\n}) as SsrfPolicy;\n\n/**\n * Signature of the lookup callback `dns.lookup` accepts. Re-declared here\n * because the native type from `node:dns` is a complex overload set; the\n * shape we actually need is the all=true variant the Agent expects.\n */\nexport type DnsLookupAll = (\n  hostname: string,\n  options: { family?: number; hints?: number; all: true; verbatim?: boolean },\n  callback: (err: NodeJS.ErrnoException | null, addresses: LookupAddress[]) => void\n) => void;\n\nexport interface PinAndBindFetchOptions {\n  /**\n   * SSRF policy to enforce against resolved IPs. Defaults to\n   * {@link WEBHOOK_SSRF_POLICY} (https-only, all private/loopback/metadata\n   * ranges denied, IP literals allowed).\n   */\n  policy?: SsrfPolicy;\n  /**\n   * Override the underlying DNS lookup. Default uses `dns.lookup` with\n   * `all: true`. Tests inject a stub to simulate rebinding attacks without\n   * touching real DNS.\n   */\n  lookup?: DnsLookupAll;\n  /**\n   * Forward to `Agent` — connect-attempt timeout, TLS options, etc. Cannot\n   * override `lookup`; that is wired by this helper.\n   */\n  agentOptions?: Omit<Agent.Options, 'connect'> & {\n    connect?: Omit<NonNullable<Agent.Options['connect']>, 'lookup'>;\n  };\n}\n\nconst DEFAULT_LOOKUP_ALL: DnsLookupAll = (hostname, options, callback) => {\n  nativeDnsLookup(hostname, { ...options, all: true }, (err, addresses) => {\n    callback(err, addresses as LookupAddress[]);\n  });\n};\n\n/**\n * Build a `fetch` that pins outbound connections to the IPs the SSRF policy\n * allows, defeating DNS-rebinding attacks against per-attempt DNS resolution.\n *\n * This is the default `fetch` for `createWebhookEmitter` /\n * `createAdcpServer({ webhooks })`, so production webhook delivery is\n * rebinding-protected without extra wiring. Call it explicitly only to\n * override the policy — e.g. {@link LOOPBACK_OK_WEBHOOK_SSRF_POLICY} for\n * storyboard tests that deliver to a loopback http receiver. See\n * `docs/guides/SIGNING-GUIDE.md` § Webhook SSRF defense.\n *\n * Construct once per emitter and reuse — each call instantiates a fresh\n * `undici.Agent` with its own connection pool.\n *\n * @example\n * ```ts\n * import { createWebhookEmitter, createPinAndBindFetch } from '@adcp/sdk/server';\n *\n * const emitter = createWebhookEmitter({\n *   signerKey: webhookKey,\n *   fetch: createPinAndBindFetch(),\n * });\n * ```\n */\nexport function createPinAndBindFetch(options: PinAndBindFetchOptions = {}): typeof fetch {\n  const policy = options.policy ?? WEBHOOK_SSRF_POLICY;\n  const lookupImpl = options.lookup ?? DEFAULT_LOOKUP_ALL;\n\n  const guardedLookup = (\n    hostname: string,\n    opts: { family?: number; hints?: number; all?: boolean; verbatim?: boolean } | undefined,\n    callback: (err: NodeJS.ErrnoException | null, addressOrAll?: string | LookupAddress[], family?: number) => void\n  ): void => {\n    const wantsAll = opts?.all === true;\n    lookupImpl(hostname, { ...(opts ?? {}), all: true }, (err, addresses) => {\n      if (err) {\n        callback(err);\n        return;\n      }\n      if (!Array.isArray(addresses) || addresses.length === 0) {\n        callback(\n          makeSsrfError(`DNS resolution returned no addresses for ${hostname}`, 'dns_revalidation:no_addresses')\n        );\n        return;\n      }\n\n      // The URL passed in here only matters for scheme + hostname checks,\n      // both of which were already validated synchronously by undici when\n      // the request started. We re-build a placeholder URL to feed the\n      // resolved-address rule, which is the load-bearing check for\n      // rebinding defense.\n      const url = new URL(`https://${bracketIfV6(hostname)}`);\n      const ips = addresses.map(a => a.address);\n      const result = enforceSsrfPolicyResolved(url, ips, policy);\n      if (!result.allowed) {\n        callback(makeSsrfError(result.message ?? 'SSRF policy denied resolved address', result.rule ?? 'ssrf'));\n        return;\n      }\n\n      if (wantsAll) {\n        callback(null, addresses);\n        return;\n      }\n      // Pin to the first resolved address. enforceSsrfPolicyResolved is\n      // all-or-none: if it allowed the resolution, every entry passed.\n      const first = addresses[0]!;\n      callback(null, first.address, first.family);\n    });\n  };\n\n  const dispatcher = new Agent({\n    ...(options.agentOptions ?? {}),\n    connect: {\n      ...(options.agentOptions?.connect ?? {}),\n      // undici's connect type accepts a lookup with the dns.lookup signature.\n      lookup: guardedLookup as unknown as Agent.Options['connect'] extends infer T\n        ? T extends { lookup?: infer L }\n          ? L\n          : never\n        : never,\n    },\n  });\n\n  const wrapped = async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]): Promise<Response> => {\n    // Synchronous pre-check for the URL's literal scheme + (if it's an IP)\n    // its CIDR membership. undici skips `connect.lookup` for IP-literal\n    // hostnames, so the resolved-IP path below would never see them.\n    // This pre-check enforces the same SSRF policy on URLs like\n    // `https://127.0.0.1/cb` or `https://[::1]/cb`.\n    const url = resolveRequestUrl(input);\n    if (url) {\n      const sync = enforceSsrfPolicy(url, policy);\n      if (!sync.allowed) {\n        throw makeSsrfError(sync.message ?? 'SSRF policy denied URL', sync.rule ?? 'ssrf');\n      }\n    }\n    return undiciFetch(input as Parameters<typeof undiciFetch>[0], {\n      ...(init as Parameters<typeof undiciFetch>[1]),\n      dispatcher: dispatcher as unknown as Dispatcher,\n    }) as unknown as Response;\n  };\n\n  return wrapped as typeof fetch;\n}\n\nfunction resolveRequestUrl(input: Parameters<typeof fetch>[0]): URL | null {\n  try {\n    if (typeof input === 'string') return new URL(input);\n    if (input instanceof URL) return input;\n    if (\n      typeof input === 'object' &&\n      input !== null &&\n      'url' in input &&\n      typeof (input as { url: unknown }).url === 'string'\n    ) {\n      return new URL((input as { url: string }).url);\n    }\n  } catch {\n    // Let undici surface the parse error in its own shape.\n    return null;\n  }\n  return null;\n}\n\nfunction bracketIfV6(host: string): string {\n  return isIPv6(host) ? `[${host}]` : host;\n}\n\nfunction makeSsrfError(message: string, rule: string): NodeJS.ErrnoException {\n  const err = new Error(`pin-and-bind: ${rule}: ${message}`) as NodeJS.ErrnoException;\n  err.code = 'EADCP_SSRF_BLOCKED';\n  return err;\n}\n"],"mappings":"AA6BA,SAAS,OAAO,SAAS,mBAAoC;AAC7D,SAAS,UAAU,uBAA2C;AAC9D,SAAS,cAAc;AAEvB,SAAS,mBAAmB,iCAAiC;AAiBtD,MAAM,sBAAkC,OAAO,OAAO;AAAA,EAC3D,iBAAiB,OAAO,OAAO,CAAC,OAAO,CAAC;AAAA,EACxC,gBAAgB,OAAO,OAAO,CAAC,QAAQ,QAAQ,UAAU,OAAO,QAAQ,QAAQ,cAAc,SAAS,MAAM,KAAK,CAAC;AAAA,EACnH,yBAAyB,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,yBAAyB,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,uBAAuB,OAAO,OAAO;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,qBAAqB;AACvB,CAAC;AAWM,MAAM,kCAA8C,OAAO,OAAO;AAAA,EACvE,iBAAiB,OAAO,OAAO,CAAC,QAAQ,OAAO,CAAC;AAAA,EAChD,gBAAgB,OAAO,OAAO,CAAC,QAAQ,UAAU,OAAO,QAAQ,QAAQ,cAAc,SAAS,MAAM,KAAK,CAAC;AAAA,EAC3G,yBAAyB,OAAO,OAAO;AAAA,IACrC;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,yBAAyB,OAAO,OAAO;AAAA;AAAA,IAErC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,uBAAuB,OAAO,OAAO;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,qBAAqB;AACvB,CAAC;AAmCD,MAAM,qBAAmC,CAAC,UAAU,SAAS,aAAa;AACxE,kBAAgB,UAAU,EAAE,GAAG,SAAS,KAAK,KAAK,GAAG,CAAC,KAAK,cAAc;AACvE,aAAS,KAAK,SAA4B;AAAA,EAC5C,CAAC;AACH;AA0BO,SAAS,sBAAsB,UAAkC,CAAC,GAAiB;AACxF,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,aAAa,QAAQ,UAAU;AAErC,QAAM,gBAAgB,CACpB,UACA,MACA,aACS;AACT,UAAM,WAAW,MAAM,QAAQ;AAC/B,eAAW,UAAU,EAAE,GAAI,QAAQ,CAAC,GAAI,KAAK,KAAK,GAAG,CAAC,KAAK,cAAc;AACvE,UAAI,KAAK;AACP,iBAAS,GAAG;AACZ;AAAA,MACF;AACA,UAAI,CAAC,MAAM,QAAQ,SAAS,KAAK,UAAU,WAAW,GAAG;AACvD;AAAA,UACE,cAAc,4CAA4C,QAAQ,IAAI,+BAA+B;AAAA,QACvG;AACA;AAAA,MACF;AAOA,YAAM,MAAM,IAAI,IAAI,WAAW,YAAY,QAAQ,CAAC,EAAE;AACtD,YAAM,MAAM,UAAU,IAAI,OAAK,EAAE,OAAO;AACxC,YAAM,SAAS,0BAA0B,KAAK,KAAK,MAAM;AACzD,UAAI,CAAC,OAAO,SAAS;AACnB,iBAAS,cAAc,OAAO,WAAW,uCAAuC,OAAO,QAAQ,MAAM,CAAC;AACtG;AAAA,MACF;AAEA,UAAI,UAAU;AACZ,iBAAS,MAAM,SAAS;AACxB;AAAA,MACF;AAGA,YAAM,QAAQ,UAAU,CAAC;AACzB,eAAS,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,IAC5C,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,MAAM;AAAA,IAC3B,GAAI,QAAQ,gBAAgB,CAAC;AAAA,IAC7B,SAAS;AAAA,MACP,GAAI,QAAQ,cAAc,WAAW,CAAC;AAAA;AAAA,MAEtC,QAAQ;AAAA,IAKV;AAAA,EACF,CAAC;AAED,QAAM,UAAU,OAAO,OAAoC,SAA0D;AAMnH,UAAM,MAAM,kBAAkB,KAAK;AACnC,QAAI,KAAK;AACP,YAAM,OAAO,kBAAkB,KAAK,MAAM;AAC1C,UAAI,CAAC,KAAK,SAAS;AACjB,cAAM,cAAc,KAAK,WAAW,0BAA0B,KAAK,QAAQ,MAAM;AAAA,MACnF;AAAA,IACF;AACA,WAAO,YAAY,OAA4C;AAAA,MAC7D,GAAI;AAAA,MACJ;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAgD;AACzE,MAAI;AACF,QAAI,OAAO,UAAU,SAAU,QAAO,IAAI,IAAI,KAAK;AACnD,QAAI,iBAAiB,IAAK,QAAO;AACjC,QACE,OAAO,UAAU,YACjB,UAAU,QACV,SAAS,SACT,OAAQ,MAA2B,QAAQ,UAC3C;AACA,aAAO,IAAI,IAAK,MAA0B,GAAG;AAAA,IAC/C;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAAsB;AACzC,SAAO,OAAO,IAAI,IAAI,IAAI,IAAI,MAAM;AACtC;AAEA,SAAS,cAAc,SAAiB,MAAqC;AAC3E,QAAM,MAAM,IAAI,MAAM,iBAAiB,IAAI,KAAK,OAAO,EAAE;AACzD,MAAI,OAAO;AACX,SAAO;AACT;","names":[]}

package/dist/lib/server/postgres-state-store.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import {
   DEFAULT_MAX_DOCUMENT_BYTES,
   createSessionedStore,

package/dist/lib/server/postgres-state-store.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/postgres-state-store.ts"],"sourcesContent":["/**\n * PostgreSQL-backed state store for distributed AdCP servers.\n *\n * Replaces InMemoryStateStore when running multiple server instances behind\n * a load balancer. Domain objects are stored in a shared JSONB table so any\n * instance can read or write state regardless of which instance handled\n * the original request.\n *\n * @example\n * ```typescript\n * import { Pool } from 'pg';\n * import { PostgresStateStore, createAdcpServer, serve } from '@adcp/sdk/server/legacy/v5';\n *\n * const pool = new Pool({ connectionString: process.env.DATABASE_URL });\n * const stateStore = new PostgresStateStore(pool);\n *\n * // Run migration once at startup\n * await pool.query(getAdcpStateMigration());\n *\n * serve(() => createAdcpServer({\n *   name: 'My Publisher', version: '1.0.0',\n *   stateStore,\n *   mediaBuy: {\n *     createMediaBuy: async (params, ctx) => {\n *       const buy = { media_buy_id: 'mb_1', status: 'active', packages: [] };\n *       await ctx.store.put('media_buys', buy.media_buy_id, buy);\n *       return buy;\n *     },\n *   },\n * }));\n * ```\n */\n\nimport type { PgQueryable } from './postgres-task-store';\nimport {\n  DEFAULT_MAX_DOCUMENT_BYTES,\n  createSessionedStore,\n  validateCollection,\n  validateId,\n  validateWrite,\n  type AdcpStateStore,\n  type ListOptions,\n  type ListResult,\n  type PutIfMatchResult,\n  type VersionedDocument,\n} from './state-store';\n\nexport interface PostgresStateStoreOptions {\n  /** Table name. Must contain only lowercase letters, digits, and underscores. Defaults to `\"adcp_state\"`. */\n  tableName?: string;\n  /** Max bytes per document. Defaults to {@link DEFAULT_MAX_DOCUMENT_BYTES}. */\n  maxDocumentBytes?: number;\n}\n\nconst DEFAULT_TABLE = 'adcp_state';\nconst VALID_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;\nconst PAGE_SIZE = 50;\nconst MAX_PAGE_SIZE = 500;\n\n/**\n * Generate the SQL DDL for the state store table.\n *\n * Idempotent: safe to run on existing tables. The `ADD COLUMN IF NOT EXISTS`\n * clause upgrades databases created by earlier SDK versions (no `version`\n * column) without rewriting data — existing rows start at version 1. A seller's\n * first `putIfMatch` against an existing (pre-migration) row will see\n * `currentVersion: 1` — same as a freshly inserted row. Treat version as opaque.\n *\n * Do not attach triggers that suppress `UPDATE` or return `OLD` for this table —\n * `putIfMatch` relies on affected-row count to detect conflicts, and a trigger\n * that drops the update will be reported as a CAS conflict. RLS policies that\n * silently reject writes have the same problem.\n */\nexport function getAdcpStateMigration(tableName = DEFAULT_TABLE): string {\n  if (!VALID_IDENTIFIER.test(tableName)) {\n    throw new Error(`Invalid table name: \"${tableName}\". Must match /^[a-z_][a-z0-9_]*$/.`);\n  }\n\n  return `\n    CREATE TABLE IF NOT EXISTS ${tableName} (\n      collection    TEXT NOT NULL,\n      id            TEXT NOT NULL,\n      data          JSONB NOT NULL,\n      version       INTEGER NOT NULL DEFAULT 1,\n      created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n      updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\n      PRIMARY KEY (collection, id)\n    );\n\n    ALTER TABLE ${tableName}\n      ADD COLUMN IF NOT EXISTS version INTEGER NOT NULL DEFAULT 1;\n\n    CREATE INDEX IF NOT EXISTS idx_${tableName}_collection\n      ON ${tableName}(collection);\n\n    CREATE INDEX IF NOT EXISTS idx_${tableName}_updated\n      ON ${tableName}(updated_at);\n  `;\n}\n\n/** The migration SQL as a constant for the default table name. */\nexport const ADCP_STATE_MIGRATION = getAdcpStateMigration();\n\nexport class PostgresStateStore implements AdcpStateStore {\n  private readonly db: PgQueryable;\n  private readonly table: string;\n  private readonly maxDocumentBytes: number;\n\n  constructor(db: PgQueryable, options?: PostgresStateStoreOptions) {\n    this.db = db;\n    this.table = options?.tableName ?? DEFAULT_TABLE;\n    this.maxDocumentBytes = options?.maxDocumentBytes ?? DEFAULT_MAX_DOCUMENT_BYTES;\n    if (!VALID_IDENTIFIER.test(this.table)) {\n      throw new Error(`Invalid table name: \"${this.table}\". Must match /^[a-z_][a-z0-9_]*$/.`);\n    }\n  }\n\n  async get<T extends Record<string, unknown> = Record<string, unknown>>(\n    collection: string,\n    id: string\n  ): Promise<T | null> {\n    validateCollection(collection);\n    validateId(id);\n    const { rows } = await this.db.query(`SELECT data FROM ${this.table} WHERE collection = $1 AND id = $2`, [\n      collection,\n      id,\n    ]);\n    if (rows.length === 0) return null;\n    return rows[0]!.data as T;\n  }\n\n  async getWithVersion<T extends Record<string, unknown> = Record<string, unknown>>(\n    collection: string,\n    id: string\n  ): Promise<VersionedDocument<T> | null> {\n    validateCollection(collection);\n    validateId(id);\n    const { rows } = await this.db.query(`SELECT data, version FROM ${this.table} WHERE collection = $1 AND id = $2`, [\n      collection,\n      id,\n    ]);\n    if (rows.length === 0) return null;\n    const row = rows[0]!;\n    return { data: row.data as T, version: row.version as number };\n  }\n\n  async put(collection: string, id: string, data: Record<string, unknown>): Promise<void> {\n    const serialized = validateWrite(collection, id, data, this.maxDocumentBytes);\n    await this.db.query(\n      `INSERT INTO ${this.table} (collection, id, data, version)\n       VALUES ($1, $2, $3, 1)\n       ON CONFLICT (collection, id)\n       DO UPDATE SET data = $3, version = ${this.table}.version + 1, updated_at = NOW()`,\n      [collection, id, serialized]\n    );\n  }\n\n  async putIfMatch(\n    collection: string,\n    id: string,\n    data: Record<string, unknown>,\n    expectedVersion: number | null\n  ): Promise<PutIfMatchResult> {\n    const serialized = validateWrite(collection, id, data, this.maxDocumentBytes);\n\n    if (expectedVersion === null) {\n      // Insert-only path: succeed iff no row exists. Returns version on success,\n      // nothing on conflict (then we re-read to report the current version).\n      const { rows } = await this.db.query(\n        `INSERT INTO ${this.table} (collection, id, data, version)\n         VALUES ($1, $2, $3, 1)\n         ON CONFLICT (collection, id) DO NOTHING\n         RETURNING version`,\n        [collection, id, serialized]\n      );\n      if (rows.length > 0) return { ok: true, version: rows[0]!.version as number };\n      const { rows: existing } = await this.db.query(\n        `SELECT version FROM ${this.table} WHERE collection = $1 AND id = $2`,\n        [collection, id]\n      );\n      return { ok: false, currentVersion: (existing[0]?.version as number | undefined) ?? null };\n    }\n\n    const { rows } = await this.db.query(\n      `UPDATE ${this.table}\n       SET data = $3, version = version + 1, updated_at = NOW()\n       WHERE collection = $1 AND id = $2 AND version = $4\n       RETURNING version`,\n      [collection, id, serialized, expectedVersion]\n    );\n    if (rows.length > 0) return { ok: true, version: rows[0]!.version as number };\n\n    const { rows: existing } = await this.db.query(\n      `SELECT version FROM ${this.table} WHERE collection = $1 AND id = $2`,\n      [collection, id]\n    );\n    return { ok: false, currentVersion: (existing[0]?.version as number | undefined) ?? null };\n  }\n\n  async patch(collection: string, id: string, partial: Record<string, unknown>): Promise<void> {\n    const serialized = validateWrite(collection, id, partial, this.maxDocumentBytes);\n    await this.db.query(\n      `INSERT INTO ${this.table} (collection, id, data, version)\n       VALUES ($1, $2, $3, 1)\n       ON CONFLICT (collection, id)\n       DO UPDATE SET data = ${this.table}.data || $3, version = ${this.table}.version + 1, updated_at = NOW()`,\n      [collection, id, serialized]\n    );\n  }\n\n  async delete(collection: string, id: string): Promise<boolean> {\n    validateCollection(collection);\n    validateId(id);\n    const { rowCount } = await this.db.query(`DELETE FROM ${this.table} WHERE collection = $1 AND id = $2`, [\n      collection,\n      id,\n    ]);\n    return (rowCount ?? 0) > 0;\n  }\n\n  async list<T extends Record<string, unknown> = Record<string, unknown>>(\n    collection: string,\n    options?: ListOptions\n  ): Promise<ListResult<T>> {\n    validateCollection(collection);\n    const limit = Math.min(options?.limit ?? PAGE_SIZE, MAX_PAGE_SIZE);\n    const conditions = ['collection = $1'];\n    const values: unknown[] = [collection];\n    let paramIndex = 2;\n\n    // Filter by JSONB containment\n    if (options?.filter && Object.keys(options.filter).length > 0) {\n      conditions.push(`data @> $${paramIndex}`);\n      values.push(JSON.stringify(options.filter));\n      paramIndex++;\n    }\n\n    // Cursor-based pagination (cursor = \"updated_at|id\")\n    if (options?.cursor) {\n      const parts = options.cursor.split('|', 2);\n      if (parts.length !== 2 || !parts[0] || !parts[1]) {\n        throw new Error(`Invalid cursor format: expected \"timestamp|id\"`);\n      }\n      const [cursorTime, cursorId] = parts;\n      conditions.push(`(updated_at, id) > ($${paramIndex}::timestamptz, $${paramIndex + 1})`);\n      values.push(cursorTime, cursorId);\n      paramIndex += 2;\n    }\n\n    const where = conditions.join(' AND ');\n    // Fetch one extra to detect hasMore\n    values.push(limit + 1);\n\n    const { rows } = await this.db.query(\n      `SELECT id, data, updated_at::text AS updated_at_raw\n       FROM ${this.table}\n       WHERE ${where}\n       ORDER BY updated_at, id\n       LIMIT $${paramIndex}`,\n      values\n    );\n\n    const hasMore = rows.length > limit;\n    const resultRows = hasMore ? rows.slice(0, limit) : rows;\n    const items = resultRows.map(r => r.data as T);\n\n    let nextCursor: string | undefined;\n    if (hasMore && resultRows.length > 0) {\n      const last = resultRows[resultRows.length - 1]!;\n      nextCursor = `${last.updated_at_raw as string}|${last.id as string}`;\n    }\n\n    return { items, nextCursor };\n  }\n\n  /**\n   * Delete all documents in a collection.\n   */\n  async clearCollection(collection: string): Promise<number> {\n    const { rowCount } = await this.db.query(`DELETE FROM ${this.table} WHERE collection = $1`, [collection]);\n    return rowCount ?? 0;\n  }\n\n  scoped(sessionKey: string): AdcpStateStore {\n    return createSessionedStore(this, sessionKey);\n  }\n}\n"],"mappings":";;;;;;AAkCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AASP,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AACzB,MAAM,YAAY;AAClB,MAAM,gBAAgB;AAgBf,SAAS,sBAAsB,YAAY,eAAuB;AACvE,MAAI,CAAC,iBAAiB,KAAK,SAAS,GAAG;AACrC,UAAM,IAAI,MAAM,wBAAwB,SAAS,qCAAqC;AAAA,EACxF;AAEA,SAAO;AAAA,iCACwB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAWxB,SAAS;AAAA;AAAA;AAAA,qCAGU,SAAS;AAAA,WACnC,SAAS;AAAA;AAAA,qCAEiB,SAAS;AAAA,WACnC,SAAS;AAAA;AAEpB;AAGO,MAAM,uBAAuB,sBAAsB;AAEnD,MAAM,mBAA6C;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,IAAiB,SAAqC;AAChE,SAAK,KAAK;AACV,SAAK,QAAQ,SAAS,aAAa;AACnC,SAAK,mBAAmB,SAAS,oBAAoB;AACrD,QAAI,CAAC,iBAAiB,KAAK,KAAK,KAAK,GAAG;AACtC,YAAM,IAAI,MAAM,wBAAwB,KAAK,KAAK,qCAAqC;AAAA,IACzF;AAAA,EACF;AAAA,EAEA,MAAM,IACJ,YACA,IACmB;AACnB,uBAAmB,UAAU;AAC7B,eAAW,EAAE;AACb,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,GAAG,MAAM,oBAAoB,KAAK,KAAK,sCAAsC;AAAA,MACvG;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,WAAO,KAAK,CAAC,EAAG;AAAA,EAClB;AAAA,EAEA,MAAM,eACJ,YACA,IACsC;AACtC,uBAAmB,UAAU;AAC7B,eAAW,EAAE;AACb,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,GAAG,MAAM,6BAA6B,KAAK,KAAK,sCAAsC;AAAA,MAChH;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,UAAM,MAAM,KAAK,CAAC;AAClB,WAAO,EAAE,MAAM,IAAI,MAAW,SAAS,IAAI,QAAkB;AAAA,EAC/D;AAAA,EAEA,MAAM,IAAI,YAAoB,IAAY,MAA8C;AACtF,UAAM,aAAa,cAAc,YAAY,IAAI,MAAM,KAAK,gBAAgB;AAC5E,UAAM,KAAK,GAAG;AAAA,MACZ,eAAe,KAAK,KAAK;AAAA;AAAA;AAAA,4CAGa,KAAK,KAAK;AAAA,MAChD,CAAC,YAAY,IAAI,UAAU;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,WACJ,YACA,IACA,MACA,iBAC2B;AAC3B,UAAM,aAAa,cAAc,YAAY,IAAI,MAAM,KAAK,gBAAgB;AAE5E,QAAI,oBAAoB,MAAM;AAG5B,YAAM,EAAE,MAAAA,MAAK,IAAI,MAAM,KAAK,GAAG;AAAA,QAC7B,eAAe,KAAK,KAAK;AAAA;AAAA;AAAA;AAAA,QAIzB,CAAC,YAAY,IAAI,UAAU;AAAA,MAC7B;AACA,UAAIA,MAAK,SAAS,EAAG,QAAO,EAAE,IAAI,MAAM,SAASA,MAAK,CAAC,EAAG,QAAkB;AAC5E,YAAM,EAAE,MAAMC,UAAS,IAAI,MAAM,KAAK,GAAG;AAAA,QACvC,uBAAuB,KAAK,KAAK;AAAA,QACjC,CAAC,YAAY,EAAE;AAAA,MACjB;AACA,aAAO,EAAE,IAAI,OAAO,gBAAiBA,UAAS,CAAC,GAAG,WAAkC,KAAK;AAAA,IAC3F;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,GAAG;AAAA,MAC7B,UAAU,KAAK,KAAK;AAAA;AAAA;AAAA;AAAA,MAIpB,CAAC,YAAY,IAAI,YAAY,eAAe;AAAA,IAC9C;AACA,QAAI,KAAK,SAAS,EAAG,QAAO,EAAE,IAAI,MAAM,SAAS,KAAK,CAAC,EAAG,QAAkB;AAE5E,UAAM,EAAE,MAAM,SAAS,IAAI,MAAM,KAAK,GAAG;AAAA,MACvC,uBAAuB,KAAK,KAAK;AAAA,MACjC,CAAC,YAAY,EAAE;AAAA,IACjB;AACA,WAAO,EAAE,IAAI,OAAO,gBAAiB,SAAS,CAAC,GAAG,WAAkC,KAAK;AAAA,EAC3F;AAAA,EAEA,MAAM,MAAM,YAAoB,IAAY,SAAiD;AAC3F,UAAM,aAAa,cAAc,YAAY,IAAI,SAAS,KAAK,gBAAgB;AAC/E,UAAM,KAAK,GAAG;AAAA,MACZ,eAAe,KAAK,KAAK;AAAA;AAAA;AAAA,8BAGD,KAAK,KAAK,0BAA0B,KAAK,KAAK;AAAA,MACtE,CAAC,YAAY,IAAI,UAAU;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,IAA8B;AAC7D,uBAAmB,UAAU;AAC7B,eAAW,EAAE;AACb,UAAM,EAAE,SAAS,IAAI,MAAM,KAAK,GAAG,MAAM,eAAe,KAAK,KAAK,sCAAsC;AAAA,MACtG;AAAA,MACA;AAAA,IACF,CAAC;AACD,YAAQ,YAAY,KAAK;AAAA,EAC3B;AAAA,EAEA,MAAM,KACJ,YACA,SACwB;AACxB,uBAAmB,UAAU;AAC7B,UAAM,QAAQ,KAAK,IAAI,SAAS,SAAS,WAAW,aAAa;AACjE,UAAM,aAAa,CAAC,iBAAiB;AACrC,UAAM,SAAoB,CAAC,UAAU;AACrC,QAAI,aAAa;AAGjB,QAAI,SAAS,UAAU,OAAO,KAAK,QAAQ,MAAM,EAAE,SAAS,GAAG;AAC7D,iBAAW,KAAK,YAAY,UAAU,EAAE;AACxC,aAAO,KAAK,KAAK,UAAU,QAAQ,MAAM,CAAC;AAC1C;AAAA,IACF;AAGA,QAAI,SAAS,QAAQ;AACnB,YAAM,QAAQ,QAAQ,OAAO,MAAM,KAAK,CAAC;AACzC,UAAI,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;AAChD,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,YAAM,CAAC,YAAY,QAAQ,IAAI;AAC/B,iBAAW,KAAK,wBAAwB,UAAU,mBAAmB,aAAa,CAAC,GAAG;AACtF,aAAO,KAAK,YAAY,QAAQ;AAChC,oBAAc;AAAA,IAChB;AAEA,UAAM,QAAQ,WAAW,KAAK,OAAO;AAErC,WAAO,KAAK,QAAQ,CAAC;AAErB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,cACQ,KAAK,KAAK;AAAA,eACT,KAAK;AAAA;AAAA,gBAEJ,UAAU;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,aAAa,UAAU,KAAK,MAAM,GAAG,KAAK,IAAI;AACpD,UAAM,QAAQ,WAAW,IAAI,OAAK,EAAE,IAAS;AAE7C,QAAI;AACJ,QAAI,WAAW,WAAW,SAAS,GAAG;AACpC,YAAM,OAAO,WAAW,WAAW,SAAS,CAAC;AAC7C,mBAAa,GAAG,KAAK,cAAwB,IAAI,KAAK,EAAY;AAAA,IACpE;AAEA,WAAO,EAAE,OAAO,WAAW;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,YAAqC;AACzD,UAAM,EAAE,SAAS,IAAI,MAAM,KAAK,GAAG,MAAM,eAAe,KAAK,KAAK,0BAA0B,CAAC,UAAU,CAAC;AACxG,WAAO,YAAY;AAAA,EACrB;AAAA,EAEA,OAAO,YAAoC;AACzC,WAAO,qBAAqB,MAAM,UAAU;AAAA,EAC9C;AACF;","names":["rows","existing"]}
+{"version":3,"sources":["../../../src/lib/server/postgres-state-store.ts"],"sourcesContent":["/**\n * PostgreSQL-backed state store for distributed AdCP servers.\n *\n * Replaces InMemoryStateStore when running multiple server instances behind\n * a load balancer. Domain objects are stored in a shared JSONB table so any\n * instance can read or write state regardless of which instance handled\n * the original request.\n *\n * @example\n * ```typescript\n * import { Pool } from 'pg';\n * import { PostgresStateStore, createAdcpServer, serve } from '@adcp/sdk/server/legacy/v5';\n *\n * const pool = new Pool({ connectionString: process.env.DATABASE_URL });\n * const stateStore = new PostgresStateStore(pool);\n *\n * // Run migration once at startup\n * await pool.query(getAdcpStateMigration());\n *\n * serve(() => createAdcpServer({\n *   name: 'My Publisher', version: '1.0.0',\n *   stateStore,\n *   mediaBuy: {\n *     createMediaBuy: async (params, ctx) => {\n *       const buy = { media_buy_id: 'mb_1', status: 'active', packages: [] };\n *       await ctx.store.put('media_buys', buy.media_buy_id, buy);\n *       return buy;\n *     },\n *   },\n * }));\n * ```\n */\n\nimport type { PgQueryable } from './postgres-task-store';\nimport {\n  DEFAULT_MAX_DOCUMENT_BYTES,\n  createSessionedStore,\n  validateCollection,\n  validateId,\n  validateWrite,\n  type AdcpStateStore,\n  type ListOptions,\n  type ListResult,\n  type PutIfMatchResult,\n  type VersionedDocument,\n} from './state-store';\n\nexport interface PostgresStateStoreOptions {\n  /** Table name. Must contain only lowercase letters, digits, and underscores. Defaults to `\"adcp_state\"`. */\n  tableName?: string;\n  /** Max bytes per document. Defaults to {@link DEFAULT_MAX_DOCUMENT_BYTES}. */\n  maxDocumentBytes?: number;\n}\n\nconst DEFAULT_TABLE = 'adcp_state';\nconst VALID_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;\nconst PAGE_SIZE = 50;\nconst MAX_PAGE_SIZE = 500;\n\n/**\n * Generate the SQL DDL for the state store table.\n *\n * Idempotent: safe to run on existing tables. The `ADD COLUMN IF NOT EXISTS`\n * clause upgrades databases created by earlier SDK versions (no `version`\n * column) without rewriting data — existing rows start at version 1. A seller's\n * first `putIfMatch` against an existing (pre-migration) row will see\n * `currentVersion: 1` — same as a freshly inserted row. Treat version as opaque.\n *\n * Do not attach triggers that suppress `UPDATE` or return `OLD` for this table —\n * `putIfMatch` relies on affected-row count to detect conflicts, and a trigger\n * that drops the update will be reported as a CAS conflict. RLS policies that\n * silently reject writes have the same problem.\n */\nexport function getAdcpStateMigration(tableName = DEFAULT_TABLE): string {\n  if (!VALID_IDENTIFIER.test(tableName)) {\n    throw new Error(`Invalid table name: \"${tableName}\". Must match /^[a-z_][a-z0-9_]*$/.`);\n  }\n\n  return `\n    CREATE TABLE IF NOT EXISTS ${tableName} (\n      collection    TEXT NOT NULL,\n      id            TEXT NOT NULL,\n      data          JSONB NOT NULL,\n      version       INTEGER NOT NULL DEFAULT 1,\n      created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n      updated_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\n      PRIMARY KEY (collection, id)\n    );\n\n    ALTER TABLE ${tableName}\n      ADD COLUMN IF NOT EXISTS version INTEGER NOT NULL DEFAULT 1;\n\n    CREATE INDEX IF NOT EXISTS idx_${tableName}_collection\n      ON ${tableName}(collection);\n\n    CREATE INDEX IF NOT EXISTS idx_${tableName}_updated\n      ON ${tableName}(updated_at);\n  `;\n}\n\n/** The migration SQL as a constant for the default table name. */\nexport const ADCP_STATE_MIGRATION = getAdcpStateMigration();\n\nexport class PostgresStateStore implements AdcpStateStore {\n  private readonly db: PgQueryable;\n  private readonly table: string;\n  private readonly maxDocumentBytes: number;\n\n  constructor(db: PgQueryable, options?: PostgresStateStoreOptions) {\n    this.db = db;\n    this.table = options?.tableName ?? DEFAULT_TABLE;\n    this.maxDocumentBytes = options?.maxDocumentBytes ?? DEFAULT_MAX_DOCUMENT_BYTES;\n    if (!VALID_IDENTIFIER.test(this.table)) {\n      throw new Error(`Invalid table name: \"${this.table}\". Must match /^[a-z_][a-z0-9_]*$/.`);\n    }\n  }\n\n  async get<T extends Record<string, unknown> = Record<string, unknown>>(\n    collection: string,\n    id: string\n  ): Promise<T | null> {\n    validateCollection(collection);\n    validateId(id);\n    const { rows } = await this.db.query(`SELECT data FROM ${this.table} WHERE collection = $1 AND id = $2`, [\n      collection,\n      id,\n    ]);\n    if (rows.length === 0) return null;\n    return rows[0]!.data as T;\n  }\n\n  async getWithVersion<T extends Record<string, unknown> = Record<string, unknown>>(\n    collection: string,\n    id: string\n  ): Promise<VersionedDocument<T> | null> {\n    validateCollection(collection);\n    validateId(id);\n    const { rows } = await this.db.query(`SELECT data, version FROM ${this.table} WHERE collection = $1 AND id = $2`, [\n      collection,\n      id,\n    ]);\n    if (rows.length === 0) return null;\n    const row = rows[0]!;\n    return { data: row.data as T, version: row.version as number };\n  }\n\n  async put(collection: string, id: string, data: Record<string, unknown>): Promise<void> {\n    const serialized = validateWrite(collection, id, data, this.maxDocumentBytes);\n    await this.db.query(\n      `INSERT INTO ${this.table} (collection, id, data, version)\n       VALUES ($1, $2, $3, 1)\n       ON CONFLICT (collection, id)\n       DO UPDATE SET data = $3, version = ${this.table}.version + 1, updated_at = NOW()`,\n      [collection, id, serialized]\n    );\n  }\n\n  async putIfMatch(\n    collection: string,\n    id: string,\n    data: Record<string, unknown>,\n    expectedVersion: number | null\n  ): Promise<PutIfMatchResult> {\n    const serialized = validateWrite(collection, id, data, this.maxDocumentBytes);\n\n    if (expectedVersion === null) {\n      // Insert-only path: succeed iff no row exists. Returns version on success,\n      // nothing on conflict (then we re-read to report the current version).\n      const { rows } = await this.db.query(\n        `INSERT INTO ${this.table} (collection, id, data, version)\n         VALUES ($1, $2, $3, 1)\n         ON CONFLICT (collection, id) DO NOTHING\n         RETURNING version`,\n        [collection, id, serialized]\n      );\n      if (rows.length > 0) return { ok: true, version: rows[0]!.version as number };\n      const { rows: existing } = await this.db.query(\n        `SELECT version FROM ${this.table} WHERE collection = $1 AND id = $2`,\n        [collection, id]\n      );\n      return { ok: false, currentVersion: (existing[0]?.version as number | undefined) ?? null };\n    }\n\n    const { rows } = await this.db.query(\n      `UPDATE ${this.table}\n       SET data = $3, version = version + 1, updated_at = NOW()\n       WHERE collection = $1 AND id = $2 AND version = $4\n       RETURNING version`,\n      [collection, id, serialized, expectedVersion]\n    );\n    if (rows.length > 0) return { ok: true, version: rows[0]!.version as number };\n\n    const { rows: existing } = await this.db.query(\n      `SELECT version FROM ${this.table} WHERE collection = $1 AND id = $2`,\n      [collection, id]\n    );\n    return { ok: false, currentVersion: (existing[0]?.version as number | undefined) ?? null };\n  }\n\n  async patch(collection: string, id: string, partial: Record<string, unknown>): Promise<void> {\n    const serialized = validateWrite(collection, id, partial, this.maxDocumentBytes);\n    await this.db.query(\n      `INSERT INTO ${this.table} (collection, id, data, version)\n       VALUES ($1, $2, $3, 1)\n       ON CONFLICT (collection, id)\n       DO UPDATE SET data = ${this.table}.data || $3, version = ${this.table}.version + 1, updated_at = NOW()`,\n      [collection, id, serialized]\n    );\n  }\n\n  async delete(collection: string, id: string): Promise<boolean> {\n    validateCollection(collection);\n    validateId(id);\n    const { rowCount } = await this.db.query(`DELETE FROM ${this.table} WHERE collection = $1 AND id = $2`, [\n      collection,\n      id,\n    ]);\n    return (rowCount ?? 0) > 0;\n  }\n\n  async list<T extends Record<string, unknown> = Record<string, unknown>>(\n    collection: string,\n    options?: ListOptions\n  ): Promise<ListResult<T>> {\n    validateCollection(collection);\n    const limit = Math.min(options?.limit ?? PAGE_SIZE, MAX_PAGE_SIZE);\n    const conditions = ['collection = $1'];\n    const values: unknown[] = [collection];\n    let paramIndex = 2;\n\n    // Filter by JSONB containment\n    if (options?.filter && Object.keys(options.filter).length > 0) {\n      conditions.push(`data @> $${paramIndex}`);\n      values.push(JSON.stringify(options.filter));\n      paramIndex++;\n    }\n\n    // Cursor-based pagination (cursor = \"updated_at|id\")\n    if (options?.cursor) {\n      const parts = options.cursor.split('|', 2);\n      if (parts.length !== 2 || !parts[0] || !parts[1]) {\n        throw new Error(`Invalid cursor format: expected \"timestamp|id\"`);\n      }\n      const [cursorTime, cursorId] = parts;\n      conditions.push(`(updated_at, id) > ($${paramIndex}::timestamptz, $${paramIndex + 1})`);\n      values.push(cursorTime, cursorId);\n      paramIndex += 2;\n    }\n\n    const where = conditions.join(' AND ');\n    // Fetch one extra to detect hasMore\n    values.push(limit + 1);\n\n    const { rows } = await this.db.query(\n      `SELECT id, data, updated_at::text AS updated_at_raw\n       FROM ${this.table}\n       WHERE ${where}\n       ORDER BY updated_at, id\n       LIMIT $${paramIndex}`,\n      values\n    );\n\n    const hasMore = rows.length > limit;\n    const resultRows = hasMore ? rows.slice(0, limit) : rows;\n    const items = resultRows.map(r => r.data as T);\n\n    let nextCursor: string | undefined;\n    if (hasMore && resultRows.length > 0) {\n      const last = resultRows[resultRows.length - 1]!;\n      nextCursor = `${last.updated_at_raw as string}|${last.id as string}`;\n    }\n\n    return { items, nextCursor };\n  }\n\n  /**\n   * Delete all documents in a collection.\n   */\n  async clearCollection(collection: string): Promise<number> {\n    const { rowCount } = await this.db.query(`DELETE FROM ${this.table} WHERE collection = $1`, [collection]);\n    return rowCount ?? 0;\n  }\n\n  scoped(sessionKey: string): AdcpStateStore {\n    return createSessionedStore(this, sessionKey);\n  }\n}\n"],"mappings":"AAkCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AASP,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AACzB,MAAM,YAAY;AAClB,MAAM,gBAAgB;AAgBf,SAAS,sBAAsB,YAAY,eAAuB;AACvE,MAAI,CAAC,iBAAiB,KAAK,SAAS,GAAG;AACrC,UAAM,IAAI,MAAM,wBAAwB,SAAS,qCAAqC;AAAA,EACxF;AAEA,SAAO;AAAA,iCACwB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAWxB,SAAS;AAAA;AAAA;AAAA,qCAGU,SAAS;AAAA,WACnC,SAAS;AAAA;AAAA,qCAEiB,SAAS;AAAA,WACnC,SAAS;AAAA;AAEpB;AAGO,MAAM,uBAAuB,sBAAsB;AAEnD,MAAM,mBAA6C;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,IAAiB,SAAqC;AAChE,SAAK,KAAK;AACV,SAAK,QAAQ,SAAS,aAAa;AACnC,SAAK,mBAAmB,SAAS,oBAAoB;AACrD,QAAI,CAAC,iBAAiB,KAAK,KAAK,KAAK,GAAG;AACtC,YAAM,IAAI,MAAM,wBAAwB,KAAK,KAAK,qCAAqC;AAAA,IACzF;AAAA,EACF;AAAA,EAEA,MAAM,IACJ,YACA,IACmB;AACnB,uBAAmB,UAAU;AAC7B,eAAW,EAAE;AACb,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,GAAG,MAAM,oBAAoB,KAAK,KAAK,sCAAsC;AAAA,MACvG;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,WAAO,KAAK,CAAC,EAAG;AAAA,EAClB;AAAA,EAEA,MAAM,eACJ,YACA,IACsC;AACtC,uBAAmB,UAAU;AAC7B,eAAW,EAAE;AACb,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,GAAG,MAAM,6BAA6B,KAAK,KAAK,sCAAsC;AAAA,MAChH;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,UAAM,MAAM,KAAK,CAAC;AAClB,WAAO,EAAE,MAAM,IAAI,MAAW,SAAS,IAAI,QAAkB;AAAA,EAC/D;AAAA,EAEA,MAAM,IAAI,YAAoB,IAAY,MAA8C;AACtF,UAAM,aAAa,cAAc,YAAY,IAAI,MAAM,KAAK,gBAAgB;AAC5E,UAAM,KAAK,GAAG;AAAA,MACZ,eAAe,KAAK,KAAK;AAAA;AAAA;AAAA,4CAGa,KAAK,KAAK;AAAA,MAChD,CAAC,YAAY,IAAI,UAAU;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,WACJ,YACA,IACA,MACA,iBAC2B;AAC3B,UAAM,aAAa,cAAc,YAAY,IAAI,MAAM,KAAK,gBAAgB;AAE5E,QAAI,oBAAoB,MAAM;AAG5B,YAAM,EAAE,MAAAA,MAAK,IAAI,MAAM,KAAK,GAAG;AAAA,QAC7B,eAAe,KAAK,KAAK;AAAA;AAAA;AAAA;AAAA,QAIzB,CAAC,YAAY,IAAI,UAAU;AAAA,MAC7B;AACA,UAAIA,MAAK,SAAS,EAAG,QAAO,EAAE,IAAI,MAAM,SAASA,MAAK,CAAC,EAAG,QAAkB;AAC5E,YAAM,EAAE,MAAMC,UAAS,IAAI,MAAM,KAAK,GAAG;AAAA,QACvC,uBAAuB,KAAK,KAAK;AAAA,QACjC,CAAC,YAAY,EAAE;AAAA,MACjB;AACA,aAAO,EAAE,IAAI,OAAO,gBAAiBA,UAAS,CAAC,GAAG,WAAkC,KAAK;AAAA,IAC3F;AAEA,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,GAAG;AAAA,MAC7B,UAAU,KAAK,KAAK;AAAA;AAAA;AAAA;AAAA,MAIpB,CAAC,YAAY,IAAI,YAAY,eAAe;AAAA,IAC9C;AACA,QAAI,KAAK,SAAS,EAAG,QAAO,EAAE,IAAI,MAAM,SAAS,KAAK,CAAC,EAAG,QAAkB;AAE5E,UAAM,EAAE,MAAM,SAAS,IAAI,MAAM,KAAK,GAAG;AAAA,MACvC,uBAAuB,KAAK,KAAK;AAAA,MACjC,CAAC,YAAY,EAAE;AAAA,IACjB;AACA,WAAO,EAAE,IAAI,OAAO,gBAAiB,SAAS,CAAC,GAAG,WAAkC,KAAK;AAAA,EAC3F;AAAA,EAEA,MAAM,MAAM,YAAoB,IAAY,SAAiD;AAC3F,UAAM,aAAa,cAAc,YAAY,IAAI,SAAS,KAAK,gBAAgB;AAC/E,UAAM,KAAK,GAAG;AAAA,MACZ,eAAe,KAAK,KAAK;AAAA;AAAA;AAAA,8BAGD,KAAK,KAAK,0BAA0B,KAAK,KAAK;AAAA,MACtE,CAAC,YAAY,IAAI,UAAU;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,YAAoB,IAA8B;AAC7D,uBAAmB,UAAU;AAC7B,eAAW,EAAE;AACb,UAAM,EAAE,SAAS,IAAI,MAAM,KAAK,GAAG,MAAM,eAAe,KAAK,KAAK,sCAAsC;AAAA,MACtG;AAAA,MACA;AAAA,IACF,CAAC;AACD,YAAQ,YAAY,KAAK;AAAA,EAC3B;AAAA,EAEA,MAAM,KACJ,YACA,SACwB;AACxB,uBAAmB,UAAU;AAC7B,UAAM,QAAQ,KAAK,IAAI,SAAS,SAAS,WAAW,aAAa;AACjE,UAAM,aAAa,CAAC,iBAAiB;AACrC,UAAM,SAAoB,CAAC,UAAU;AACrC,QAAI,aAAa;AAGjB,QAAI,SAAS,UAAU,OAAO,KAAK,QAAQ,MAAM,EAAE,SAAS,GAAG;AAC7D,iBAAW,KAAK,YAAY,UAAU,EAAE;AACxC,aAAO,KAAK,KAAK,UAAU,QAAQ,MAAM,CAAC;AAC1C;AAAA,IACF;AAGA,QAAI,SAAS,QAAQ;AACnB,YAAM,QAAQ,QAAQ,OAAO,MAAM,KAAK,CAAC;AACzC,UAAI,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;AAChD,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,YAAM,CAAC,YAAY,QAAQ,IAAI;AAC/B,iBAAW,KAAK,wBAAwB,UAAU,mBAAmB,aAAa,CAAC,GAAG;AACtF,aAAO,KAAK,YAAY,QAAQ;AAChC,oBAAc;AAAA,IAChB;AAEA,UAAM,QAAQ,WAAW,KAAK,OAAO;AAErC,WAAO,KAAK,QAAQ,CAAC;AAErB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,cACQ,KAAK,KAAK;AAAA,eACT,KAAK;AAAA;AAAA,gBAEJ,UAAU;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,aAAa,UAAU,KAAK,MAAM,GAAG,KAAK,IAAI;AACpD,UAAM,QAAQ,WAAW,IAAI,OAAK,EAAE,IAAS;AAE7C,QAAI;AACJ,QAAI,WAAW,WAAW,SAAS,GAAG;AACpC,YAAM,OAAO,WAAW,WAAW,SAAS,CAAC;AAC7C,mBAAa,GAAG,KAAK,cAAwB,IAAI,KAAK,EAAY;AAAA,IACpE;AAEA,WAAO,EAAE,OAAO,WAAW;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,YAAqC;AACzD,UAAM,EAAE,SAAS,IAAI,MAAM,KAAK,GAAG,MAAM,eAAe,KAAK,KAAK,0BAA0B,CAAC,UAAU,CAAC;AACxG,WAAO,YAAY;AAAA,EACrB;AAAA,EAEA,OAAO,YAAoC;AACzC,WAAO,qBAAqB,MAAM,UAAU;AAAA,EAC9C;AACF;","names":["rows","existing"]}

package/dist/lib/server/postgres-task-store.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { randomBytes } from "node:crypto";
 const DEFAULT_TABLE = "adcp_mcp_tasks";
 const VALID_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;