@adcp/sdk 12.0.0 → 12.0.2

package/dist/lib/server/credential-policy.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 const DEFAULT_CREDENTIAL_PATTERNS = Object.freeze([
   /_token$/i,
   /_secret$/i,

package/dist/lib/server/credential-policy.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/server/credential-policy.ts"],"sourcesContent":["/**\n * Credential discipline at the request boundary.\n *\n * Scans incoming buyer args for credential-shaped keys at any depth and\n * rejects with `INVALID_REQUEST` when `credentialPolicy === 'authInfo-only'`.\n * Closes the bug class observed in storefront fan-out paths where buyer-\n * supplied keys like `<platform>_access_token` (top-level, in `context`,\n * or in `ext`) flow through to upstream calls.\n *\n * Default mode is `'lax'` for back-compat. Opt into `'authInfo-only'` to\n * enforce: credentials must arrive on `authInfo` (the framework-resolved\n * bearer / signature / OAuth principal) and never on the args bag.\n *\n * Pattern set is extensible. Adopters whose platform vocabulary uses\n * additional credential names extend via `credentialPolicy.patterns.extend`\n * or replace the matcher entirely. Per-tool opt-out via\n * `credentialPolicy.tools`.\n *\n * @see {@link AdcpServerConfig.credentialPolicy}\n * @see docs/guides/CTX-METADATA-SAFETY.md\n */\n\n/**\n * Enforcement mode.\n *\n * - `'lax'` — no scan; current behavior.\n * - `'authInfo-only'` — scan args for credential-shaped keys; reject any\n *   match with `INVALID_REQUEST` listing the offending paths (not values).\n *   Adopters who legitimately accept buyer-presented credentials opt out\n *   per-tool via {@link CredentialPolicyConfig.tools}.\n */\nexport type CredentialPolicyMode = 'lax' | 'authInfo-only';\n\n/**\n * Patterns that flag a key as credential-shaped. Values matching ANY\n * regex (or returning `true` from the matcher) are treated as\n * credential-bearing.\n */\nexport interface CredentialPatternsConfig {\n  /**\n   * Additional patterns appended to {@link DEFAULT_CREDENTIAL_PATTERNS}.\n   * Use for platform-specific names the defaults don't cover (e.g.\n   * `/^bearer$/i`, `/credentials/i`, `/^[a-z]+Pat$/`).\n   */\n  extend?: RegExp[];\n\n  /**\n   * Replace the regex-based check entirely. Receives each property name\n   * encountered during recursion, plus the parent path. Return `true`\n   * to flag as credential-bearing. Mutually exclusive with `extend` —\n   * setting both throws at server construction.\n   */\n  matcher?: (key: string, path: readonly string[]) => boolean;\n}\n\n/**\n * Per-tool override shape. Adopters specify either a mode string for\n * coarse-grained override (`'lax'` lets every credential-shaped key\n * through; `'authInfo-only'` rejects them all) or a granular\n * `{ allow: [...] }` allowlist that permits specific credential paths\n * while still rejecting unlisted ones.\n *\n * The `allow` shape is the recommended choice for storefronts that\n * legitimately accept ONE specific buyer-presented credential per\n * tool — `tools: { activate_signal: 'lax' }` opens the tool to every\n * credential-shaped key (including `password=`, `client_secret=`),\n * while `tools: { activate_signal: { allow: ['delivery.api_token'] } }`\n * permits only the spec-blessed field and still rejects everything\n * else.\n */\nexport type ToolCredentialPolicy = CredentialPolicyMode | { readonly allow: readonly string[] };\n\n/**\n * Full credential-policy configuration. Pass a string for the simple\n * case (`credentialPolicy: 'authInfo-only'`) or this shape for\n * pattern customization or per-tool overrides.\n */\nexport interface CredentialPolicyConfig {\n  policy: CredentialPolicyMode;\n  patterns?: CredentialPatternsConfig;\n  /**\n   * Per-tool mode overrides. Storefronts that legitimately accept\n   * buyer-presented credentials on a specific tool opt that tool out\n   * of the server-wide `'authInfo-only'`:\n   *\n   * ```ts\n   * credentialPolicy: {\n   *   policy: 'authInfo-only',\n   *   tools: {\n   *     // Coarse: lets every credential-shaped key through\n   *     legacy_tool: 'lax',\n   *\n   *     // Granular: only the listed paths are allowlisted; other\n   *     // credential-shaped keys still reject. Recommended for\n   *     // tools where the legitimate buyer-presented credential is\n   *     // a known, named field.\n   *     activate_signal: { allow: ['delivery.api_token'] },\n   *   },\n   * }\n   * ```\n   *\n   * Allowlist entries are exact path matches against the\n   * dot-notation path the scanner emits — e.g. `'snap_access_token'`\n   * (top-level), `'context.linkedin_access_token'` (nested),\n   * `'packages.0.extra.tiktok_access_token'` (array element).\n   */\n  tools?: Record<string, ToolCredentialPolicy>;\n\n  /**\n   * Extend the credential-shaped-key scan to cover `ctx.authInfo.extra`\n   * in addition to the buyer args bag. Default `false`.\n   *\n   * Custom authenticators that stamp values into `authInfo.extra` (token\n   * introspection responses, JWT claim sets, OAuth scope blobs) are\n   * outside L1's args-bag scan. Adopter handler code that reads\n   * `ctx.authInfo.extra.<credential>` for upstream auth produces a\n   * silent leak surface: a buggy `BuyerAgentRegistry.resolve` factory\n   * that throws an error embedding `extra` lands the value in\n   * `logger.error` before `redactCredentialPatterns` (which only catches\n   * labeled `Bearer <token>` shapes and ≥32-char base64 blobs) could\n   * mask it.\n   *\n   * Orthogonal to {@link policy} — adopters can mix-and-match. Common\n   * shapes:\n   *\n   * - `policy: 'authInfo-only', scanAuthInfo: true` — strictest.\n   * - `policy: 'lax', scanAuthInfo: true` — trust args, defend log\n   *   propagation of authInfo extras.\n   * - `policy: 'authInfo-only', scanAuthInfo: false` — current default\n   *   if `scanAuthInfo` is omitted; args-only enforcement.\n   *\n   * **Default `false` is deliberate.** OAuth introspection blobs and\n   * JWT claims in `extra` will false-positive on default patterns\n   * like `/_token$/i` (e.g. `id_token`, `access_token` claims that\n   * the framework's authenticator legitimately stamps).\n   *\n   * **Wire-envelope discipline.** Args-bag hits are reported in\n   * `details.credential_paths` (the buyer already sent these — no\n   * info disclosure). `authInfo.extra` hits are NOT reported on\n   * the wire; they're logged server-side only. Returning paths\n   * to the buyer would create a probing oracle for the structure\n   * of `authInfo.extra` (an internal value the buyer has no read\n   * access to). The wire envelope reports a coarse signal —\n   * `details.scope: 'credentials'` plus a generic message —\n   * without enumerating which `extra` field tripped the scan.\n   *\n   * See adcontextprotocol/adcp-client#1539.\n   */\n  scanAuthInfo?: boolean;\n}\n\nexport type CredentialPolicy = CredentialPolicyMode | CredentialPolicyConfig;\n\n/**\n * Default credential-name patterns. Catches the three vectors observed\n * in PR scope3data/agentic-adapters#248 plus the broader credential\n * vocabulary common in TS ecosystems and HTTPSig / OAuth flows.\n * Adopters whose platform names fall outside this set extend via\n * {@link CredentialPatternsConfig.extend}.\n *\n * Coverage:\n *   - `_token$` (case-insensitive) — `*_access_token`, `bearer_token`,\n *     `id_token`, `session_token`, `auth_token`, `refresh_token`.\n *   - `_secret$` / `_password$` — `client_secret`, `db_password`.\n *   - `api[_-]?key` (case-insensitive) — `api_key`, `apiKey`, `api-key`,\n *     and prefixed variants like `criteo_api_key`.\n *   - `private[_-]?key` (case-insensitive) — `private_key`, `privateKey`,\n *     `private-key`. Common in JWT / RFC 9421 signing-key flows.\n *   - `^authorization$` / `^cookie$` (case-insensitive) — HTTP-header\n *     value smuggled as a field.\n *   - `^bearer$` — bare `bearer` field.\n *   - `^accessToken$` / `^refreshToken$` (case-insensitive) — camelCase\n *     and PascalCase exact matches.\n *\n * Intentionally excluded from defaults (too many false positives):\n *   - bare `key` / `principal` / `kid` / `pat` — too short to risk\n *     matching legitimate routing fields.\n *   - `*Token$` PascalCase suffix without a known prefix — e.g.\n *     `paymentToken` could be a legitimate wire field. Adopters who\n *     want broader coverage extend.\n */\nexport const DEFAULT_CREDENTIAL_PATTERNS: readonly RegExp[] = Object.freeze([\n  /_token$/i,\n  /_secret$/i,\n  /_password$/i,\n  /api[_-]?key/i,\n  /private[_-]?key/i,\n  /^authorization$/i,\n  /^cookie$/i,\n  /^bearer$/i,\n  /^accessToken$/i,\n  /^refreshToken$/i,\n]);\n\ntype ResolvedMatcher = (key: string, path: readonly string[]) => boolean;\n\n/**\n * Strip `/g` and `/y` flags from a regex. With those flags set,\n * `RegExp.prototype.test` advances `lastIndex`, causing alternating-skip\n * behavior on repeated calls against the same pattern instance. The\n * scanner calls `.test()` per key per request and reuses the regex\n * instance across calls, so `/credentials/gi` (a natural footgun) would\n * produce non-deterministic hits. Strip the offending flags rather than\n * forcing adopters to read a footnote.\n */\nfunction stripStatefulFlags(rx: RegExp): RegExp {\n  if (!rx.global && !rx.sticky) return rx;\n  return new RegExp(rx.source, rx.flags.replace(/[gy]/g, ''));\n}\n\nfunction buildMatcher(patterns?: CredentialPatternsConfig): ResolvedMatcher {\n  if (patterns?.matcher && patterns.extend) {\n    throw new Error(\n      'createAdcpServer: credentialPolicy.patterns cannot set both `matcher` and `extend`. ' +\n        '`matcher` fully replaces the regex-based check; `extend` adds to the default set. ' +\n        'Pick one — they answer different questions and combining them silently drops the regex set.'\n    );\n  }\n  if (patterns?.matcher) {\n    return patterns.matcher;\n  }\n  const regexes = patterns?.extend\n    ? [...DEFAULT_CREDENTIAL_PATTERNS, ...patterns.extend.map(stripStatefulFlags)]\n    : DEFAULT_CREDENTIAL_PATTERNS;\n  return (key: string) => regexes.some(rx => rx.test(key));\n}\n\n/**\n * Recursively scan `value` for credential-shaped keys. Returns dotted\n * paths to every match (e.g. `['snap_access_token',\n * 'context.snap_access_token', 'ext.snap_access_token']`). Empty array\n * means clean.\n *\n * Scope:\n *   - Walks own string-keyed data properties only. Symbol keys,\n *     prototype-chain inherited properties, and accessor (getter/setter)\n *     properties are skipped — JSON-derived inputs (the only source the\n *     framework dispatches) cannot carry any of those. Hand-built\n *     objects with credential-named getters are still flagged\n *     fail-closed (the property name is matched against the regex\n *     set), but the getter is never invoked, so a throwing or\n *     side-effecting getter cannot reach the dispatcher.\n *   - Walks both plain objects and arrays; array indices appear as\n *     numeric path segments.\n *   - Stops at primitives.\n *   - Cycle-safe via a `WeakSet` tracking visited objects.\n */\nexport function scanArgsForCredentials(value: unknown, patterns?: CredentialPatternsConfig): string[] {\n  const matcher = buildMatcher(patterns);\n  const hits: string[] = [];\n  const seen = new WeakSet<object>();\n\n  const walk = (node: unknown, path: readonly string[]): void => {\n    if (node === null || typeof node !== 'object') return;\n    if (seen.has(node)) return;\n    seen.add(node);\n\n    if (Array.isArray(node)) {\n      for (let i = 0; i < node.length; i++) {\n        walk(node[i], [...path, String(i)]);\n      }\n      return;\n    }\n\n    // Use property descriptors so accessor (getter/setter) properties\n    // are visible to the scanner without invoking the getter — a\n    // throwing getter on a credential-named property would otherwise\n    // either crash the dispatcher or land the surrounding `params`\n    // object in an outer error log. Data-only inputs (JSON.parse,\n    // structured clone) never have accessor descriptors, so this is\n    // a defensive measure for hand-built test inputs and any future\n    // transport that bypasses JSON parsing.\n    let descriptors: Record<string, PropertyDescriptor>;\n    try {\n      descriptors = Object.getOwnPropertyDescriptors(node) as Record<string, PropertyDescriptor>;\n    } catch {\n      // Proxy-trapped property enumeration that throws — fail closed\n      // by recording the parent path as suspicious. Cannot enumerate\n      // to a finer-grained location.\n      hits.push([...path, '<unreadable>'].join('.'));\n      return;\n    }\n\n    for (const key of Object.keys(descriptors)) {\n      const desc = descriptors[key];\n      if (desc === undefined) continue;\n      const childPath = [...path, key];\n      if (matcher(key, path)) {\n        hits.push(childPath.join('.'));\n      }\n      // Only recurse into data descriptors. Accessor descriptors\n      // (no `value` slot) are flagged-by-name above but never invoked.\n      if ('value' in desc) {\n        walk(desc.value, childPath);\n      }\n    }\n  };\n\n  walk(value, []);\n  return hits;\n}\n\n/**\n * Normalize a `CredentialPolicy` (string or object) plus a tool name\n * to the effective {@link ToolCredentialPolicy} for that tool —\n * either a mode string or an `{ allow: [...] }` allowlist. Per-tool\n * overrides win; otherwise the server-wide policy applies.\n *\n * Caller dispatch:\n *\n * ```ts\n * const effective = resolveCredentialPolicyForTool(policy, toolName);\n * if (effective === 'lax') return; // skip scan\n * const hits = scanArgsForCredentials(args, patterns);\n * if (typeof effective === 'object') {\n *   // Granular allow — filter hits by the allowlist\n *   const blocked = hits.filter(p => !effective.allow.includes(p));\n *   if (blocked.length > 0) reject(blocked);\n * } else {\n *   // 'authInfo-only' — every hit blocks\n *   if (hits.length > 0) reject(hits);\n * }\n * ```\n */\nexport function resolveCredentialPolicyForTool(\n  policy: CredentialPolicy | undefined,\n  toolName: string\n): ToolCredentialPolicy {\n  if (policy === undefined) return 'lax';\n  if (typeof policy === 'string') return policy;\n  return policy.tools?.[toolName] ?? policy.policy;\n}\n\n/**\n * Validate a `CredentialPolicy` at server construction. Catches typos\n * in `tools` keys (`activte_signal` instead of `activate_signal`) and\n * the both-`extend`-and-`matcher` config error before any traffic\n * dispatches. Throws `Error` with a specific message; callers convert\n * to their construction-time error envelope of choice.\n *\n * `knownToolNames` is the set of tool names the framework will\n * register for this server (spec tools for the claimed specialisms +\n * any adopter-supplied custom tools). Pass after the registration\n * loop completes so the set is authoritative.\n *\n * @internal — adopters cannot construct `knownToolNames` outside the\n * framework. The framework calls this once, late in `createAdcpServer`,\n * after every tool (including `get_adcp_capabilities`) is registered.\n */\nexport function validateCredentialPolicy(\n  policy: CredentialPolicy | undefined,\n  knownToolNames: ReadonlySet<string>\n): void {\n  if (policy === undefined || typeof policy === 'string') return;\n\n  // Surface the both-fields-set conflict at construction, not on the\n  // first credential-bearing request. Mirrors the runtime check in\n  // `buildMatcher` so adopters get the same diagnostic regardless of\n  // whether traffic is flowing yet.\n  if (policy.patterns?.matcher && policy.patterns?.extend) {\n    throw new Error(\n      'createAdcpServer: credentialPolicy.patterns cannot set both `matcher` and `extend`. ' +\n        '`matcher` fully replaces the regex-based check; `extend` adds to the default set. Pick one.'\n    );\n  }\n\n  if (!policy.tools) return;\n  const unknownTools = Object.keys(policy.tools).filter(name => !knownToolNames.has(name));\n  if (unknownTools.length > 0) {\n    const known = [...knownToolNames].sort().join(', ');\n    throw new Error(\n      `createAdcpServer: credentialPolicy.tools references unregistered tool name(s): ${unknownTools\n        .map(n => JSON.stringify(n))\n        .join(', ')}. ` +\n        `A typo in this map silently no-ops the per-tool override and the server-wide policy applies, ` +\n        `which fails-closed on tools that needed an opt-out. ` +\n        `Known tool names: ${known}.`\n    );\n  }\n\n  // Validate granular allow-shape entries — each must be a non-empty\n  // array of strings. An empty `allow` is the same as 'authInfo-only'\n  // for that tool (no path is permitted) and is almost certainly a\n  // bug — surface it at construction. Non-string entries would\n  // silently never match the dotted-path strings the scanner emits.\n  for (const [toolName, toolPolicy] of Object.entries(policy.tools)) {\n    if (typeof toolPolicy === 'string') continue;\n    if (!Array.isArray(toolPolicy.allow)) {\n      throw new Error(\n        `createAdcpServer: credentialPolicy.tools[${JSON.stringify(toolName)}].allow must be an array of path strings.`\n      );\n    }\n    if (toolPolicy.allow.length === 0) {\n      throw new Error(\n        `createAdcpServer: credentialPolicy.tools[${JSON.stringify(toolName)}].allow is empty. ` +\n          `An empty allow list is equivalent to 'authInfo-only' for this tool — drop the entry or use the string shorthand.`\n      );\n    }\n    const nonStrings = toolPolicy.allow.filter(p => typeof p !== 'string');\n    if (nonStrings.length > 0) {\n      throw new Error(\n        `createAdcpServer: credentialPolicy.tools[${JSON.stringify(toolName)}].allow contains non-string entries: ` +\n          `${nonStrings.map(n => JSON.stringify(n)).join(', ')}. ` +\n          `Allowlist entries are exact-match path strings (e.g. 'context.snap_access_token').`\n      );\n    }\n  }\n}\n"],"mappings":";;;;;;AAqLO,MAAM,8BAAiD,OAAO,OAAO;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAaD,SAAS,mBAAmB,IAAoB;AAC9C,MAAI,CAAC,GAAG,UAAU,CAAC,GAAG,OAAQ,QAAO;AACrC,SAAO,IAAI,OAAO,GAAG,QAAQ,GAAG,MAAM,QAAQ,SAAS,EAAE,CAAC;AAC5D;AAEA,SAAS,aAAa,UAAsD;AAC1E,MAAI,UAAU,WAAW,SAAS,QAAQ;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,MAAI,UAAU,SAAS;AACrB,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,UAAU,UAAU,SACtB,CAAC,GAAG,6BAA6B,GAAG,SAAS,OAAO,IAAI,kBAAkB,CAAC,IAC3E;AACJ,SAAO,CAAC,QAAgB,QAAQ,KAAK,QAAM,GAAG,KAAK,GAAG,CAAC;AACzD;AAsBO,SAAS,uBAAuB,OAAgB,UAA+C;AACpG,QAAM,UAAU,aAAa,QAAQ;AACrC,QAAM,OAAiB,CAAC;AACxB,QAAM,OAAO,oBAAI,QAAgB;AAEjC,QAAM,OAAO,CAAC,MAAe,SAAkC;AAC7D,QAAI,SAAS,QAAQ,OAAO,SAAS,SAAU;AAC/C,QAAI,KAAK,IAAI,IAAI,EAAG;AACpB,SAAK,IAAI,IAAI;AAEb,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,eAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,aAAK,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC;AAAA,MACpC;AACA;AAAA,IACF;AAUA,QAAI;AACJ,QAAI;AACF,oBAAc,OAAO,0BAA0B,IAAI;AAAA,IACrD,QAAQ;AAIN,WAAK,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE,KAAK,GAAG,CAAC;AAC7C;AAAA,IACF;AAEA,eAAW,OAAO,OAAO,KAAK,WAAW,GAAG;AAC1C,YAAM,OAAO,YAAY,GAAG;AAC5B,UAAI,SAAS,OAAW;AACxB,YAAM,YAAY,CAAC,GAAG,MAAM,GAAG;AAC/B,UAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,aAAK,KAAK,UAAU,KAAK,GAAG,CAAC;AAAA,MAC/B;AAGA,UAAI,WAAW,MAAM;AACnB,aAAK,KAAK,OAAO,SAAS;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAEA,OAAK,OAAO,CAAC,CAAC;AACd,SAAO;AACT;AAwBO,SAAS,+BACd,QACA,UACsB;AACtB,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,OAAO,QAAQ,QAAQ,KAAK,OAAO;AAC5C;AAkBO,SAAS,yBACd,QACA,gBACM;AACN,MAAI,WAAW,UAAa,OAAO,WAAW,SAAU;AAMxD,MAAI,OAAO,UAAU,WAAW,OAAO,UAAU,QAAQ;AACvD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,MAAO;AACnB,QAAM,eAAe,OAAO,KAAK,OAAO,KAAK,EAAE,OAAO,UAAQ,CAAC,eAAe,IAAI,IAAI,CAAC;AACvF,MAAI,aAAa,SAAS,GAAG;AAC3B,UAAM,QAAQ,CAAC,GAAG,cAAc,EAAE,KAAK,EAAE,KAAK,IAAI;AAClD,UAAM,IAAI;AAAA,MACR,kFAAkF,aAC/E,IAAI,OAAK,KAAK,UAAU,CAAC,CAAC,EAC1B,KAAK,IAAI,CAAC,wKAGU,KAAK;AAAA,IAC9B;AAAA,EACF;AAOA,aAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,OAAO,KAAK,GAAG;AACjE,QAAI,OAAO,eAAe,SAAU;AACpC,QAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,GAAG;AACpC,YAAM,IAAI;AAAA,QACR,4CAA4C,KAAK,UAAU,QAAQ,CAAC;AAAA,MACtE;AAAA,IACF;AACA,QAAI,WAAW,MAAM,WAAW,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,4CAA4C,KAAK,UAAU,QAAQ,CAAC;AAAA,MAEtE;AAAA,IACF;AACA,UAAM,aAAa,WAAW,MAAM,OAAO,OAAK,OAAO,MAAM,QAAQ;AACrE,QAAI,WAAW,SAAS,GAAG;AACzB,YAAM,IAAI;AAAA,QACR,4CAA4C,KAAK,UAAU,QAAQ,CAAC,wCAC/D,WAAW,IAAI,OAAK,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MAExD;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/lib/server/credential-policy.ts"],"sourcesContent":["/**\n * Credential discipline at the request boundary.\n *\n * Scans incoming buyer args for credential-shaped keys at any depth and\n * rejects with `INVALID_REQUEST` when `credentialPolicy === 'authInfo-only'`.\n * Closes the bug class observed in storefront fan-out paths where buyer-\n * supplied keys like `<platform>_access_token` (top-level, in `context`,\n * or in `ext`) flow through to upstream calls.\n *\n * Default mode is `'lax'` for back-compat. Opt into `'authInfo-only'` to\n * enforce: credentials must arrive on `authInfo` (the framework-resolved\n * bearer / signature / OAuth principal) and never on the args bag.\n *\n * Pattern set is extensible. Adopters whose platform vocabulary uses\n * additional credential names extend via `credentialPolicy.patterns.extend`\n * or replace the matcher entirely. Per-tool opt-out via\n * `credentialPolicy.tools`.\n *\n * @see {@link AdcpServerConfig.credentialPolicy}\n * @see docs/guides/CTX-METADATA-SAFETY.md\n */\n\n/**\n * Enforcement mode.\n *\n * - `'lax'` — no scan; current behavior.\n * - `'authInfo-only'` — scan args for credential-shaped keys; reject any\n *   match with `INVALID_REQUEST` listing the offending paths (not values).\n *   Adopters who legitimately accept buyer-presented credentials opt out\n *   per-tool via {@link CredentialPolicyConfig.tools}.\n */\nexport type CredentialPolicyMode = 'lax' | 'authInfo-only';\n\n/**\n * Patterns that flag a key as credential-shaped. Values matching ANY\n * regex (or returning `true` from the matcher) are treated as\n * credential-bearing.\n */\nexport interface CredentialPatternsConfig {\n  /**\n   * Additional patterns appended to {@link DEFAULT_CREDENTIAL_PATTERNS}.\n   * Use for platform-specific names the defaults don't cover (e.g.\n   * `/^bearer$/i`, `/credentials/i`, `/^[a-z]+Pat$/`).\n   */\n  extend?: RegExp[];\n\n  /**\n   * Replace the regex-based check entirely. Receives each property name\n   * encountered during recursion, plus the parent path. Return `true`\n   * to flag as credential-bearing. Mutually exclusive with `extend` —\n   * setting both throws at server construction.\n   */\n  matcher?: (key: string, path: readonly string[]) => boolean;\n}\n\n/**\n * Per-tool override shape. Adopters specify either a mode string for\n * coarse-grained override (`'lax'` lets every credential-shaped key\n * through; `'authInfo-only'` rejects them all) or a granular\n * `{ allow: [...] }` allowlist that permits specific credential paths\n * while still rejecting unlisted ones.\n *\n * The `allow` shape is the recommended choice for storefronts that\n * legitimately accept ONE specific buyer-presented credential per\n * tool — `tools: { activate_signal: 'lax' }` opens the tool to every\n * credential-shaped key (including `password=`, `client_secret=`),\n * while `tools: { activate_signal: { allow: ['delivery.api_token'] } }`\n * permits only the spec-blessed field and still rejects everything\n * else.\n */\nexport type ToolCredentialPolicy = CredentialPolicyMode | { readonly allow: readonly string[] };\n\n/**\n * Full credential-policy configuration. Pass a string for the simple\n * case (`credentialPolicy: 'authInfo-only'`) or this shape for\n * pattern customization or per-tool overrides.\n */\nexport interface CredentialPolicyConfig {\n  policy: CredentialPolicyMode;\n  patterns?: CredentialPatternsConfig;\n  /**\n   * Per-tool mode overrides. Storefronts that legitimately accept\n   * buyer-presented credentials on a specific tool opt that tool out\n   * of the server-wide `'authInfo-only'`:\n   *\n   * ```ts\n   * credentialPolicy: {\n   *   policy: 'authInfo-only',\n   *   tools: {\n   *     // Coarse: lets every credential-shaped key through\n   *     legacy_tool: 'lax',\n   *\n   *     // Granular: only the listed paths are allowlisted; other\n   *     // credential-shaped keys still reject. Recommended for\n   *     // tools where the legitimate buyer-presented credential is\n   *     // a known, named field.\n   *     activate_signal: { allow: ['delivery.api_token'] },\n   *   },\n   * }\n   * ```\n   *\n   * Allowlist entries are exact path matches against the\n   * dot-notation path the scanner emits — e.g. `'snap_access_token'`\n   * (top-level), `'context.linkedin_access_token'` (nested),\n   * `'packages.0.extra.tiktok_access_token'` (array element).\n   */\n  tools?: Record<string, ToolCredentialPolicy>;\n\n  /**\n   * Extend the credential-shaped-key scan to cover `ctx.authInfo.extra`\n   * in addition to the buyer args bag. Default `false`.\n   *\n   * Custom authenticators that stamp values into `authInfo.extra` (token\n   * introspection responses, JWT claim sets, OAuth scope blobs) are\n   * outside L1's args-bag scan. Adopter handler code that reads\n   * `ctx.authInfo.extra.<credential>` for upstream auth produces a\n   * silent leak surface: a buggy `BuyerAgentRegistry.resolve` factory\n   * that throws an error embedding `extra` lands the value in\n   * `logger.error` before `redactCredentialPatterns` (which only catches\n   * labeled `Bearer <token>` shapes and ≥32-char base64 blobs) could\n   * mask it.\n   *\n   * Orthogonal to {@link policy} — adopters can mix-and-match. Common\n   * shapes:\n   *\n   * - `policy: 'authInfo-only', scanAuthInfo: true` — strictest.\n   * - `policy: 'lax', scanAuthInfo: true` — trust args, defend log\n   *   propagation of authInfo extras.\n   * - `policy: 'authInfo-only', scanAuthInfo: false` — current default\n   *   if `scanAuthInfo` is omitted; args-only enforcement.\n   *\n   * **Default `false` is deliberate.** OAuth introspection blobs and\n   * JWT claims in `extra` will false-positive on default patterns\n   * like `/_token$/i` (e.g. `id_token`, `access_token` claims that\n   * the framework's authenticator legitimately stamps).\n   *\n   * **Wire-envelope discipline.** Args-bag hits are reported in\n   * `details.credential_paths` (the buyer already sent these — no\n   * info disclosure). `authInfo.extra` hits are NOT reported on\n   * the wire; they're logged server-side only. Returning paths\n   * to the buyer would create a probing oracle for the structure\n   * of `authInfo.extra` (an internal value the buyer has no read\n   * access to). The wire envelope reports a coarse signal —\n   * `details.scope: 'credentials'` plus a generic message —\n   * without enumerating which `extra` field tripped the scan.\n   *\n   * See adcontextprotocol/adcp-client#1539.\n   */\n  scanAuthInfo?: boolean;\n}\n\nexport type CredentialPolicy = CredentialPolicyMode | CredentialPolicyConfig;\n\n/**\n * Default credential-name patterns. Catches the three vectors observed\n * in PR scope3data/agentic-adapters#248 plus the broader credential\n * vocabulary common in TS ecosystems and HTTPSig / OAuth flows.\n * Adopters whose platform names fall outside this set extend via\n * {@link CredentialPatternsConfig.extend}.\n *\n * Coverage:\n *   - `_token$` (case-insensitive) — `*_access_token`, `bearer_token`,\n *     `id_token`, `session_token`, `auth_token`, `refresh_token`.\n *   - `_secret$` / `_password$` — `client_secret`, `db_password`.\n *   - `api[_-]?key` (case-insensitive) — `api_key`, `apiKey`, `api-key`,\n *     and prefixed variants like `criteo_api_key`.\n *   - `private[_-]?key` (case-insensitive) — `private_key`, `privateKey`,\n *     `private-key`. Common in JWT / RFC 9421 signing-key flows.\n *   - `^authorization$` / `^cookie$` (case-insensitive) — HTTP-header\n *     value smuggled as a field.\n *   - `^bearer$` — bare `bearer` field.\n *   - `^accessToken$` / `^refreshToken$` (case-insensitive) — camelCase\n *     and PascalCase exact matches.\n *\n * Intentionally excluded from defaults (too many false positives):\n *   - bare `key` / `principal` / `kid` / `pat` — too short to risk\n *     matching legitimate routing fields.\n *   - `*Token$` PascalCase suffix without a known prefix — e.g.\n *     `paymentToken` could be a legitimate wire field. Adopters who\n *     want broader coverage extend.\n */\nexport const DEFAULT_CREDENTIAL_PATTERNS: readonly RegExp[] = Object.freeze([\n  /_token$/i,\n  /_secret$/i,\n  /_password$/i,\n  /api[_-]?key/i,\n  /private[_-]?key/i,\n  /^authorization$/i,\n  /^cookie$/i,\n  /^bearer$/i,\n  /^accessToken$/i,\n  /^refreshToken$/i,\n]);\n\ntype ResolvedMatcher = (key: string, path: readonly string[]) => boolean;\n\n/**\n * Strip `/g` and `/y` flags from a regex. With those flags set,\n * `RegExp.prototype.test` advances `lastIndex`, causing alternating-skip\n * behavior on repeated calls against the same pattern instance. The\n * scanner calls `.test()` per key per request and reuses the regex\n * instance across calls, so `/credentials/gi` (a natural footgun) would\n * produce non-deterministic hits. Strip the offending flags rather than\n * forcing adopters to read a footnote.\n */\nfunction stripStatefulFlags(rx: RegExp): RegExp {\n  if (!rx.global && !rx.sticky) return rx;\n  return new RegExp(rx.source, rx.flags.replace(/[gy]/g, ''));\n}\n\nfunction buildMatcher(patterns?: CredentialPatternsConfig): ResolvedMatcher {\n  if (patterns?.matcher && patterns.extend) {\n    throw new Error(\n      'createAdcpServer: credentialPolicy.patterns cannot set both `matcher` and `extend`. ' +\n        '`matcher` fully replaces the regex-based check; `extend` adds to the default set. ' +\n        'Pick one — they answer different questions and combining them silently drops the regex set.'\n    );\n  }\n  if (patterns?.matcher) {\n    return patterns.matcher;\n  }\n  const regexes = patterns?.extend\n    ? [...DEFAULT_CREDENTIAL_PATTERNS, ...patterns.extend.map(stripStatefulFlags)]\n    : DEFAULT_CREDENTIAL_PATTERNS;\n  return (key: string) => regexes.some(rx => rx.test(key));\n}\n\n/**\n * Recursively scan `value` for credential-shaped keys. Returns dotted\n * paths to every match (e.g. `['snap_access_token',\n * 'context.snap_access_token', 'ext.snap_access_token']`). Empty array\n * means clean.\n *\n * Scope:\n *   - Walks own string-keyed data properties only. Symbol keys,\n *     prototype-chain inherited properties, and accessor (getter/setter)\n *     properties are skipped — JSON-derived inputs (the only source the\n *     framework dispatches) cannot carry any of those. Hand-built\n *     objects with credential-named getters are still flagged\n *     fail-closed (the property name is matched against the regex\n *     set), but the getter is never invoked, so a throwing or\n *     side-effecting getter cannot reach the dispatcher.\n *   - Walks both plain objects and arrays; array indices appear as\n *     numeric path segments.\n *   - Stops at primitives.\n *   - Cycle-safe via a `WeakSet` tracking visited objects.\n */\nexport function scanArgsForCredentials(value: unknown, patterns?: CredentialPatternsConfig): string[] {\n  const matcher = buildMatcher(patterns);\n  const hits: string[] = [];\n  const seen = new WeakSet<object>();\n\n  const walk = (node: unknown, path: readonly string[]): void => {\n    if (node === null || typeof node !== 'object') return;\n    if (seen.has(node)) return;\n    seen.add(node);\n\n    if (Array.isArray(node)) {\n      for (let i = 0; i < node.length; i++) {\n        walk(node[i], [...path, String(i)]);\n      }\n      return;\n    }\n\n    // Use property descriptors so accessor (getter/setter) properties\n    // are visible to the scanner without invoking the getter — a\n    // throwing getter on a credential-named property would otherwise\n    // either crash the dispatcher or land the surrounding `params`\n    // object in an outer error log. Data-only inputs (JSON.parse,\n    // structured clone) never have accessor descriptors, so this is\n    // a defensive measure for hand-built test inputs and any future\n    // transport that bypasses JSON parsing.\n    let descriptors: Record<string, PropertyDescriptor>;\n    try {\n      descriptors = Object.getOwnPropertyDescriptors(node) as Record<string, PropertyDescriptor>;\n    } catch {\n      // Proxy-trapped property enumeration that throws — fail closed\n      // by recording the parent path as suspicious. Cannot enumerate\n      // to a finer-grained location.\n      hits.push([...path, '<unreadable>'].join('.'));\n      return;\n    }\n\n    for (const key of Object.keys(descriptors)) {\n      const desc = descriptors[key];\n      if (desc === undefined) continue;\n      const childPath = [...path, key];\n      if (matcher(key, path)) {\n        hits.push(childPath.join('.'));\n      }\n      // Only recurse into data descriptors. Accessor descriptors\n      // (no `value` slot) are flagged-by-name above but never invoked.\n      if ('value' in desc) {\n        walk(desc.value, childPath);\n      }\n    }\n  };\n\n  walk(value, []);\n  return hits;\n}\n\n/**\n * Normalize a `CredentialPolicy` (string or object) plus a tool name\n * to the effective {@link ToolCredentialPolicy} for that tool —\n * either a mode string or an `{ allow: [...] }` allowlist. Per-tool\n * overrides win; otherwise the server-wide policy applies.\n *\n * Caller dispatch:\n *\n * ```ts\n * const effective = resolveCredentialPolicyForTool(policy, toolName);\n * if (effective === 'lax') return; // skip scan\n * const hits = scanArgsForCredentials(args, patterns);\n * if (typeof effective === 'object') {\n *   // Granular allow — filter hits by the allowlist\n *   const blocked = hits.filter(p => !effective.allow.includes(p));\n *   if (blocked.length > 0) reject(blocked);\n * } else {\n *   // 'authInfo-only' — every hit blocks\n *   if (hits.length > 0) reject(hits);\n * }\n * ```\n */\nexport function resolveCredentialPolicyForTool(\n  policy: CredentialPolicy | undefined,\n  toolName: string\n): ToolCredentialPolicy {\n  if (policy === undefined) return 'lax';\n  if (typeof policy === 'string') return policy;\n  return policy.tools?.[toolName] ?? policy.policy;\n}\n\n/**\n * Validate a `CredentialPolicy` at server construction. Catches typos\n * in `tools` keys (`activte_signal` instead of `activate_signal`) and\n * the both-`extend`-and-`matcher` config error before any traffic\n * dispatches. Throws `Error` with a specific message; callers convert\n * to their construction-time error envelope of choice.\n *\n * `knownToolNames` is the set of tool names the framework will\n * register for this server (spec tools for the claimed specialisms +\n * any adopter-supplied custom tools). Pass after the registration\n * loop completes so the set is authoritative.\n *\n * @internal — adopters cannot construct `knownToolNames` outside the\n * framework. The framework calls this once, late in `createAdcpServer`,\n * after every tool (including `get_adcp_capabilities`) is registered.\n */\nexport function validateCredentialPolicy(\n  policy: CredentialPolicy | undefined,\n  knownToolNames: ReadonlySet<string>\n): void {\n  if (policy === undefined || typeof policy === 'string') return;\n\n  // Surface the both-fields-set conflict at construction, not on the\n  // first credential-bearing request. Mirrors the runtime check in\n  // `buildMatcher` so adopters get the same diagnostic regardless of\n  // whether traffic is flowing yet.\n  if (policy.patterns?.matcher && policy.patterns?.extend) {\n    throw new Error(\n      'createAdcpServer: credentialPolicy.patterns cannot set both `matcher` and `extend`. ' +\n        '`matcher` fully replaces the regex-based check; `extend` adds to the default set. Pick one.'\n    );\n  }\n\n  if (!policy.tools) return;\n  const unknownTools = Object.keys(policy.tools).filter(name => !knownToolNames.has(name));\n  if (unknownTools.length > 0) {\n    const known = [...knownToolNames].sort().join(', ');\n    throw new Error(\n      `createAdcpServer: credentialPolicy.tools references unregistered tool name(s): ${unknownTools\n        .map(n => JSON.stringify(n))\n        .join(', ')}. ` +\n        `A typo in this map silently no-ops the per-tool override and the server-wide policy applies, ` +\n        `which fails-closed on tools that needed an opt-out. ` +\n        `Known tool names: ${known}.`\n    );\n  }\n\n  // Validate granular allow-shape entries — each must be a non-empty\n  // array of strings. An empty `allow` is the same as 'authInfo-only'\n  // for that tool (no path is permitted) and is almost certainly a\n  // bug — surface it at construction. Non-string entries would\n  // silently never match the dotted-path strings the scanner emits.\n  for (const [toolName, toolPolicy] of Object.entries(policy.tools)) {\n    if (typeof toolPolicy === 'string') continue;\n    if (!Array.isArray(toolPolicy.allow)) {\n      throw new Error(\n        `createAdcpServer: credentialPolicy.tools[${JSON.stringify(toolName)}].allow must be an array of path strings.`\n      );\n    }\n    if (toolPolicy.allow.length === 0) {\n      throw new Error(\n        `createAdcpServer: credentialPolicy.tools[${JSON.stringify(toolName)}].allow is empty. ` +\n          `An empty allow list is equivalent to 'authInfo-only' for this tool — drop the entry or use the string shorthand.`\n      );\n    }\n    const nonStrings = toolPolicy.allow.filter(p => typeof p !== 'string');\n    if (nonStrings.length > 0) {\n      throw new Error(\n        `createAdcpServer: credentialPolicy.tools[${JSON.stringify(toolName)}].allow contains non-string entries: ` +\n          `${nonStrings.map(n => JSON.stringify(n)).join(', ')}. ` +\n          `Allowlist entries are exact-match path strings (e.g. 'context.snap_access_token').`\n      );\n    }\n  }\n}\n"],"mappings":"AAqLO,MAAM,8BAAiD,OAAO,OAAO;AAAA,EAC1E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAaD,SAAS,mBAAmB,IAAoB;AAC9C,MAAI,CAAC,GAAG,UAAU,CAAC,GAAG,OAAQ,QAAO;AACrC,SAAO,IAAI,OAAO,GAAG,QAAQ,GAAG,MAAM,QAAQ,SAAS,EAAE,CAAC;AAC5D;AAEA,SAAS,aAAa,UAAsD;AAC1E,MAAI,UAAU,WAAW,SAAS,QAAQ;AACxC,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,MAAI,UAAU,SAAS;AACrB,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,UAAU,UAAU,SACtB,CAAC,GAAG,6BAA6B,GAAG,SAAS,OAAO,IAAI,kBAAkB,CAAC,IAC3E;AACJ,SAAO,CAAC,QAAgB,QAAQ,KAAK,QAAM,GAAG,KAAK,GAAG,CAAC;AACzD;AAsBO,SAAS,uBAAuB,OAAgB,UAA+C;AACpG,QAAM,UAAU,aAAa,QAAQ;AACrC,QAAM,OAAiB,CAAC;AACxB,QAAM,OAAO,oBAAI,QAAgB;AAEjC,QAAM,OAAO,CAAC,MAAe,SAAkC;AAC7D,QAAI,SAAS,QAAQ,OAAO,SAAS,SAAU;AAC/C,QAAI,KAAK,IAAI,IAAI,EAAG;AACpB,SAAK,IAAI,IAAI;AAEb,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,eAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,aAAK,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC;AAAA,MACpC;AACA;AAAA,IACF;AAUA,QAAI;AACJ,QAAI;AACF,oBAAc,OAAO,0BAA0B,IAAI;AAAA,IACrD,QAAQ;AAIN,WAAK,KAAK,CAAC,GAAG,MAAM,cAAc,EAAE,KAAK,GAAG,CAAC;AAC7C;AAAA,IACF;AAEA,eAAW,OAAO,OAAO,KAAK,WAAW,GAAG;AAC1C,YAAM,OAAO,YAAY,GAAG;AAC5B,UAAI,SAAS,OAAW;AACxB,YAAM,YAAY,CAAC,GAAG,MAAM,GAAG;AAC/B,UAAI,QAAQ,KAAK,IAAI,GAAG;AACtB,aAAK,KAAK,UAAU,KAAK,GAAG,CAAC;AAAA,MAC/B;AAGA,UAAI,WAAW,MAAM;AACnB,aAAK,KAAK,OAAO,SAAS;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAEA,OAAK,OAAO,CAAC,CAAC;AACd,SAAO;AACT;AAwBO,SAAS,+BACd,QACA,UACsB;AACtB,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,SAAO,OAAO,QAAQ,QAAQ,KAAK,OAAO;AAC5C;AAkBO,SAAS,yBACd,QACA,gBACM;AACN,MAAI,WAAW,UAAa,OAAO,WAAW,SAAU;AAMxD,MAAI,OAAO,UAAU,WAAW,OAAO,UAAU,QAAQ;AACvD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,MAAO;AACnB,QAAM,eAAe,OAAO,KAAK,OAAO,KAAK,EAAE,OAAO,UAAQ,CAAC,eAAe,IAAI,IAAI,CAAC;AACvF,MAAI,aAAa,SAAS,GAAG;AAC3B,UAAM,QAAQ,CAAC,GAAG,cAAc,EAAE,KAAK,EAAE,KAAK,IAAI;AAClD,UAAM,IAAI;AAAA,MACR,kFAAkF,aAC/E,IAAI,OAAK,KAAK,UAAU,CAAC,CAAC,EAC1B,KAAK,IAAI,CAAC,wKAGU,KAAK;AAAA,IAC9B;AAAA,EACF;AAOA,aAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,OAAO,KAAK,GAAG;AACjE,QAAI,OAAO,eAAe,SAAU;AACpC,QAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,GAAG;AACpC,YAAM,IAAI;AAAA,QACR,4CAA4C,KAAK,UAAU,QAAQ,CAAC;AAAA,MACtE;AAAA,IACF;AACA,QAAI,WAAW,MAAM,WAAW,GAAG;AACjC,YAAM,IAAI;AAAA,QACR,4CAA4C,KAAK,UAAU,QAAQ,CAAC;AAAA,MAEtE;AAAA,IACF;AACA,UAAM,aAAa,WAAW,MAAM,OAAO,OAAK,OAAO,MAAM,QAAQ;AACrE,QAAI,WAAW,SAAS,GAAG;AACzB,YAAM,IAAI;AAAA,QACR,4CAA4C,KAAK,UAAU,QAAQ,CAAC,wCAC/D,WAAW,IAAI,OAAK,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MAExD;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/lib/server/ctx-metadata/backends/memory.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 function memoryCtxMetadataStore(options = {}) {
   const store = /* @__PURE__ */ new Map();
   const sweepIntervalMs = options.sweepIntervalMs ?? 6e4;

package/dist/lib/server/ctx-metadata/backends/memory.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/server/ctx-metadata/backends/memory.ts"],"sourcesContent":["/**\n * In-process memory backend for `CtxMetadataStore`.\n *\n * Useful for tests and single-process training agents. **Not suitable\n * for production across multiple replicas** — silent ctx_metadata\n * loss after rolling restart produces \"package not found\" errors\n * that look like publisher bugs and run for weeks. Use\n * `pgCtxMetadataStore(pool)` when horizontal scaling matters.\n *\n * Returns deep-cloned entries on read so callers can't mutate stored\n * values via the returned reference.\n */\n\nimport type { CtxMetadataBackend, CtxMetadataEntry } from '../store';\n\nexport interface MemoryCtxMetadataStoreOptions {\n  /**\n   * How often (in ms) to sweep entries with `expiresAt` past the\n   * current time. Defaults to 60_000 (60s). Set to 0 to disable —\n   * expired entries will still be filtered on read by the store\n   * layer; only memory reclamation is affected.\n   *\n   * Note: most callers don't set `expiresAt`, so the sweep is a\n   * no-op in the default flow.\n   */\n  sweepIntervalMs?: number;\n}\n\nexport function memoryCtxMetadataStore(options: MemoryCtxMetadataStoreOptions = {}): CtxMetadataBackend {\n  const store = new Map<string, CtxMetadataEntry>();\n  const sweepIntervalMs = options.sweepIntervalMs ?? 60_000;\n\n  let sweeper: NodeJS.Timeout | undefined;\n  if (sweepIntervalMs > 0) {\n    sweeper = setInterval(() => {\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      for (const [k, entry] of store) {\n        if (entry.expiresAt != null && entry.expiresAt < nowSeconds) store.delete(k);\n      }\n    }, sweepIntervalMs);\n    if (typeof sweeper.unref === 'function') sweeper.unref();\n  }\n\n  return {\n    async get(scopedKey) {\n      const entry = store.get(scopedKey);\n      if (!entry) return null;\n      return cloneEntry(entry);\n    },\n\n    async bulkGet(scopedKeys) {\n      const result = new Map<string, CtxMetadataEntry>();\n      for (const key of scopedKeys) {\n        const entry = store.get(key);\n        if (entry) result.set(key, cloneEntry(entry));\n      }\n      return result;\n    },\n\n    async put(scopedKey, entry) {\n      store.set(scopedKey, cloneEntry(entry));\n    },\n\n    async delete(scopedKey) {\n      store.delete(scopedKey);\n    },\n\n    async close() {\n      if (sweeper) clearInterval(sweeper);\n      store.clear();\n    },\n\n    async clearAll() {\n      store.clear();\n    },\n  };\n}\n\nfunction cloneEntry(entry: CtxMetadataEntry): CtxMetadataEntry {\n  return {\n    value: entry.value == null ? entry.value : structuredClone(entry.value),\n    ...(entry.resource !== undefined && {\n      resource: entry.resource == null ? entry.resource : structuredClone(entry.resource),\n    }),\n    ...(entry.expiresAt !== undefined && { expiresAt: entry.expiresAt }),\n  };\n}\n"],"mappings":";;;;;;AA4BO,SAAS,uBAAuB,UAAyC,CAAC,GAAuB;AACtG,QAAM,QAAQ,oBAAI,IAA8B;AAChD,QAAM,kBAAkB,QAAQ,mBAAmB;AAEnD,MAAI;AACJ,MAAI,kBAAkB,GAAG;AACvB,cAAU,YAAY,MAAM;AAC1B,YAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,iBAAW,CAAC,GAAG,KAAK,KAAK,OAAO;AAC9B,YAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,WAAY,OAAM,OAAO,CAAC;AAAA,MAC7E;AAAA,IACF,GAAG,eAAe;AAClB,QAAI,OAAO,QAAQ,UAAU,WAAY,SAAQ,MAAM;AAAA,EACzD;AAEA,SAAO;AAAA,IACL,MAAM,IAAI,WAAW;AACnB,YAAM,QAAQ,MAAM,IAAI,SAAS;AACjC,UAAI,CAAC,MAAO,QAAO;AACnB,aAAO,WAAW,KAAK;AAAA,IACzB;AAAA,IAEA,MAAM,QAAQ,YAAY;AACxB,YAAM,SAAS,oBAAI,IAA8B;AACjD,iBAAW,OAAO,YAAY;AAC5B,cAAM,QAAQ,MAAM,IAAI,GAAG;AAC3B,YAAI,MAAO,QAAO,IAAI,KAAK,WAAW,KAAK,CAAC;AAAA,MAC9C;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,WAAW,OAAO;AAC1B,YAAM,IAAI,WAAW,WAAW,KAAK,CAAC;AAAA,IACxC;AAAA,IAEA,MAAM,OAAO,WAAW;AACtB,YAAM,OAAO,SAAS;AAAA,IACxB;AAAA,IAEA,MAAM,QAAQ;AACZ,UAAI,QAAS,eAAc,OAAO;AAClC,YAAM,MAAM;AAAA,IACd;AAAA,IAEA,MAAM,WAAW;AACf,YAAM,MAAM;AAAA,IACd;AAAA,EACF;AACF;AAEA,SAAS,WAAW,OAA2C;AAC7D,SAAO;AAAA,IACL,OAAO,MAAM,SAAS,OAAO,MAAM,QAAQ,gBAAgB,MAAM,KAAK;AAAA,IACtE,GAAI,MAAM,aAAa,UAAa;AAAA,MAClC,UAAU,MAAM,YAAY,OAAO,MAAM,WAAW,gBAAgB,MAAM,QAAQ;AAAA,IACpF;AAAA,IACA,GAAI,MAAM,cAAc,UAAa,EAAE,WAAW,MAAM,UAAU;AAAA,EACpE;AACF;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/server/ctx-metadata/backends/memory.ts"],"sourcesContent":["/**\n * In-process memory backend for `CtxMetadataStore`.\n *\n * Useful for tests and single-process training agents. **Not suitable\n * for production across multiple replicas** — silent ctx_metadata\n * loss after rolling restart produces \"package not found\" errors\n * that look like publisher bugs and run for weeks. Use\n * `pgCtxMetadataStore(pool)` when horizontal scaling matters.\n *\n * Returns deep-cloned entries on read so callers can't mutate stored\n * values via the returned reference.\n */\n\nimport type { CtxMetadataBackend, CtxMetadataEntry } from '../store';\n\nexport interface MemoryCtxMetadataStoreOptions {\n  /**\n   * How often (in ms) to sweep entries with `expiresAt` past the\n   * current time. Defaults to 60_000 (60s). Set to 0 to disable —\n   * expired entries will still be filtered on read by the store\n   * layer; only memory reclamation is affected.\n   *\n   * Note: most callers don't set `expiresAt`, so the sweep is a\n   * no-op in the default flow.\n   */\n  sweepIntervalMs?: number;\n}\n\nexport function memoryCtxMetadataStore(options: MemoryCtxMetadataStoreOptions = {}): CtxMetadataBackend {\n  const store = new Map<string, CtxMetadataEntry>();\n  const sweepIntervalMs = options.sweepIntervalMs ?? 60_000;\n\n  let sweeper: NodeJS.Timeout | undefined;\n  if (sweepIntervalMs > 0) {\n    sweeper = setInterval(() => {\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      for (const [k, entry] of store) {\n        if (entry.expiresAt != null && entry.expiresAt < nowSeconds) store.delete(k);\n      }\n    }, sweepIntervalMs);\n    if (typeof sweeper.unref === 'function') sweeper.unref();\n  }\n\n  return {\n    async get(scopedKey) {\n      const entry = store.get(scopedKey);\n      if (!entry) return null;\n      return cloneEntry(entry);\n    },\n\n    async bulkGet(scopedKeys) {\n      const result = new Map<string, CtxMetadataEntry>();\n      for (const key of scopedKeys) {\n        const entry = store.get(key);\n        if (entry) result.set(key, cloneEntry(entry));\n      }\n      return result;\n    },\n\n    async put(scopedKey, entry) {\n      store.set(scopedKey, cloneEntry(entry));\n    },\n\n    async delete(scopedKey) {\n      store.delete(scopedKey);\n    },\n\n    async close() {\n      if (sweeper) clearInterval(sweeper);\n      store.clear();\n    },\n\n    async clearAll() {\n      store.clear();\n    },\n  };\n}\n\nfunction cloneEntry(entry: CtxMetadataEntry): CtxMetadataEntry {\n  return {\n    value: entry.value == null ? entry.value : structuredClone(entry.value),\n    ...(entry.resource !== undefined && {\n      resource: entry.resource == null ? entry.resource : structuredClone(entry.resource),\n    }),\n    ...(entry.expiresAt !== undefined && { expiresAt: entry.expiresAt }),\n  };\n}\n"],"mappings":"AA4BO,SAAS,uBAAuB,UAAyC,CAAC,GAAuB;AACtG,QAAM,QAAQ,oBAAI,IAA8B;AAChD,QAAM,kBAAkB,QAAQ,mBAAmB;AAEnD,MAAI;AACJ,MAAI,kBAAkB,GAAG;AACvB,cAAU,YAAY,MAAM;AAC1B,YAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,iBAAW,CAAC,GAAG,KAAK,KAAK,OAAO;AAC9B,YAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,WAAY,OAAM,OAAO,CAAC;AAAA,MAC7E;AAAA,IACF,GAAG,eAAe;AAClB,QAAI,OAAO,QAAQ,UAAU,WAAY,SAAQ,MAAM;AAAA,EACzD;AAEA,SAAO;AAAA,IACL,MAAM,IAAI,WAAW;AACnB,YAAM,QAAQ,MAAM,IAAI,SAAS;AACjC,UAAI,CAAC,MAAO,QAAO;AACnB,aAAO,WAAW,KAAK;AAAA,IACzB;AAAA,IAEA,MAAM,QAAQ,YAAY;AACxB,YAAM,SAAS,oBAAI,IAA8B;AACjD,iBAAW,OAAO,YAAY;AAC5B,cAAM,QAAQ,MAAM,IAAI,GAAG;AAC3B,YAAI,MAAO,QAAO,IAAI,KAAK,WAAW,KAAK,CAAC;AAAA,MAC9C;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,WAAW,OAAO;AAC1B,YAAM,IAAI,WAAW,WAAW,KAAK,CAAC;AAAA,IACxC;AAAA,IAEA,MAAM,OAAO,WAAW;AACtB,YAAM,OAAO,SAAS;AAAA,IACxB;AAAA,IAEA,MAAM,QAAQ;AACZ,UAAI,QAAS,eAAc,OAAO;AAClC,YAAM,MAAM;AAAA,IACd;AAAA,IAEA,MAAM,WAAW;AACf,YAAM,MAAM;AAAA,IACd;AAAA,EACF;AACF;AAEA,SAAS,WAAW,OAA2C;AAC7D,SAAO;AAAA,IACL,OAAO,MAAM,SAAS,OAAO,MAAM,QAAQ,gBAAgB,MAAM,KAAK;AAAA,IACtE,GAAI,MAAM,aAAa,UAAa;AAAA,MAClC,UAAU,MAAM,YAAY,OAAO,MAAM,WAAW,gBAAgB,MAAM,QAAQ;AAAA,IACpF;AAAA,IACA,GAAI,MAAM,cAAc,UAAa,EAAE,WAAW,MAAM,UAAU;AAAA,EACpE;AACF;","names":[]}

package/dist/lib/server/ctx-metadata/backends/pg.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 const DEFAULT_TABLE = "adcp_ctx_metadata";
 const VALID_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;
 function quoteIdent(name) {

package/dist/lib/server/ctx-metadata/backends/pg.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/server/ctx-metadata/backends/pg.ts"],"sourcesContent":["/**\n * Postgres backend for `CtxMetadataStore`.\n *\n * Stores one row per `(account_id, kind, id)` flattened to\n * `scoped_key TEXT PRIMARY KEY` with the JSONB `value`, the JSONB\n * `resource` (framework-owned wire shape for auto-hydration), and an\n * optional `expires_at` timestamp. `bulkGet` uses `ANY($1::text[])` to\n * avoid dynamic SQL expansion and parameter-count limits.\n *\n * **Cleanup contract.** No auto-eviction. Adopters running with\n * row-level `expires_at` should periodically call\n * `cleanupExpiredCtxMetadata(db)` to bound table size — Postgres\n * performance dies before disk does, so monitor row count.\n *\n * **Migration on upgrade.** The `resource` column was added to the\n * default migration; deployments that originally ran the older\n * `getCtxMetadataMigration()` must re-run it after upgrading. The new\n * migration is idempotent (`ALTER TABLE … ADD COLUMN IF NOT EXISTS`)\n * and additive — existing rows get `NULL` for `resource`, which the\n * framework treats as \"not yet hydrated\" (next read of the same\n * resource by ID will repopulate it).\n *\n * @example\n * ```ts\n * import { Pool } from 'pg';\n * import {\n *   createCtxMetadataStore,\n *   pgCtxMetadataStore,\n *   getCtxMetadataMigration,\n * } from '@adcp/sdk/server';\n *\n * const pool = new Pool({ connectionString: process.env.DATABASE_URL });\n * await pool.query(getCtxMetadataMigration());\n *\n * const ctxMetadata = createCtxMetadataStore({ backend: pgCtxMetadataStore(pool) });\n * ```\n */\n\nimport type { CtxMetadataBackend, CtxMetadataEntry } from '../store';\nimport type { PgQueryable } from '../../postgres-task-store';\n\nconst DEFAULT_TABLE = 'adcp_ctx_metadata';\nconst VALID_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;\n\nexport interface PgCtxMetadataBackendOptions {\n  /** Table name. Must be lowercase letters/digits/underscores. Defaults to `\"adcp_ctx_metadata\"`. */\n  tableName?: string;\n}\n\nfunction quoteIdent(name: string): string {\n  if (!VALID_IDENTIFIER.test(name)) {\n    throw new Error(`Invalid SQL identifier \"${name}\": must match ${VALID_IDENTIFIER}`);\n  }\n  return `\"${name}\"`;\n}\n\n/**\n * DDL for the ctx-metadata table. Run once per deployment from your bootstrap.\n *\n * @example\n * ```ts\n * await pool.query(getCtxMetadataMigration());\n * ```\n */\nexport function getCtxMetadataMigration(options?: PgCtxMetadataBackendOptions): string {\n  const tableName = options?.tableName ?? DEFAULT_TABLE;\n  const table = quoteIdent(tableName);\n  const indexTable = tableName;\n  // ALTER TABLE … ADD COLUMN IF NOT EXISTS is the idempotent upgrade\n  // path for deployments that ran a pre-7.9 migration without the\n  // `resource` column. No-op on fresh tables (column already exists\n  // from CREATE TABLE); adds the column on existing tables.\n  return `\nCREATE TABLE IF NOT EXISTS ${table} (\n  scoped_key  TEXT PRIMARY KEY,\n  value       JSONB NOT NULL,\n  resource    JSONB,\n  expires_at  TIMESTAMPTZ,\n  created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n  updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()\n);\n\nALTER TABLE ${table} ADD COLUMN IF NOT EXISTS resource JSONB;\n\nCREATE INDEX IF NOT EXISTS idx_${indexTable}_expires_at\n  ON ${table}(expires_at)\n  WHERE expires_at IS NOT NULL;\n`.trim();\n}\n\nexport const CTX_METADATA_MIGRATION = getCtxMetadataMigration();\n\n/**\n * Create a Postgres-backed ctx-metadata cache.\n *\n * Pass a connection pool (or any `PgQueryable`) and optionally a custom\n * table name. Run `getCtxMetadataMigration()` once per deployment.\n *\n * **Startup probe.** Call `store.probe()` (via `serve()`'s\n * `readinessCheck`) before accepting traffic to catch a bad\n * `DATABASE_URL` at boot rather than on the first ctx_metadata write.\n */\nexport function pgCtxMetadataStore(db: PgQueryable, options: PgCtxMetadataBackendOptions = {}): CtxMetadataBackend {\n  const table = quoteIdent(options.tableName ?? DEFAULT_TABLE);\n\n  return {\n    async probe(): Promise<void> {\n      try {\n        await db.query(`SELECT scoped_key, value, resource, expires_at FROM ${table} LIMIT 0`);\n      } catch (err) {\n        throw new Error(\n          `ctx_metadata backend probe failed: cannot reach the \"${options.tableName ?? DEFAULT_TABLE}\" table. ` +\n            `Run getCtxMetadataMigration() to create or upgrade it, or check DATABASE_URL. ` +\n            `See server logs for the underlying cause.`,\n          { cause: err }\n        );\n      }\n    },\n\n    async get(scopedKey: string): Promise<CtxMetadataEntry | null> {\n      const result = await db.query(\n        `SELECT value, resource, EXTRACT(EPOCH FROM expires_at)::BIGINT AS expires_at\n           FROM ${table} WHERE scoped_key = $1`,\n        [scopedKey]\n      );\n      const row = result.rows[0];\n      if (!row) return null;\n      const entry: CtxMetadataEntry = { value: row.value as unknown };\n      // `resource` is omitted (not set to undefined) when null in the\n      // column — keeps the JS object shape identical to the memory and\n      // Redis backends for tests that compare via `assert.deepEqual`.\n      if (row.resource != null) entry.resource = row.resource as unknown;\n      if (row.expires_at != null) entry.expiresAt = Number(row.expires_at);\n      return entry;\n    },\n\n    async bulkGet(scopedKeys: readonly string[]): Promise<Map<string, CtxMetadataEntry>> {\n      if (scopedKeys.length === 0) return new Map();\n      const result = await db.query(\n        `SELECT scoped_key, value, resource, EXTRACT(EPOCH FROM expires_at)::BIGINT AS expires_at\n           FROM ${table}\n           WHERE scoped_key = ANY($1::text[])`,\n        [scopedKeys]\n      );\n      const out = new Map<string, CtxMetadataEntry>();\n      for (const row of result.rows) {\n        const entry: CtxMetadataEntry = { value: row.value as unknown };\n        if (row.resource != null) entry.resource = row.resource as unknown;\n        if (row.expires_at != null) entry.expiresAt = Number(row.expires_at);\n        out.set(row.scoped_key as string, entry);\n      }\n      return out;\n    },\n\n    async put(scopedKey: string, entry: CtxMetadataEntry): Promise<void> {\n      // Always pass all four params; CASE expressions handle NULL casts\n      // because raw `null::jsonb` would produce JSON 'null' (not SQL\n      // NULL) and `TO_TIMESTAMP(NULL)` raises. Keeps the SQL static\n      // and avoids the conditional-clause complexity that grew with\n      // the `resource` field.\n      await db.query(\n        `INSERT INTO ${table} (scoped_key, value, resource, expires_at)\n         VALUES (\n           $1,\n           $2::jsonb,\n           CASE WHEN $3::text IS NULL THEN NULL ELSE $3::jsonb END,\n           CASE WHEN $4::bigint IS NULL THEN NULL ELSE TO_TIMESTAMP($4::bigint) END\n         )\n         ON CONFLICT (scoped_key) DO UPDATE SET\n           value = EXCLUDED.value,\n           resource = EXCLUDED.resource,\n           expires_at = EXCLUDED.expires_at,\n           updated_at = NOW()`,\n        [\n          scopedKey,\n          JSON.stringify(entry.value),\n          entry.resource !== undefined ? JSON.stringify(entry.resource) : null,\n          entry.expiresAt ?? null,\n        ]\n      );\n    },\n\n    async delete(scopedKey: string): Promise<void> {\n      await db.query(`DELETE FROM ${table} WHERE scoped_key = $1`, [scopedKey]);\n    },\n  };\n}\n\n/**\n * Delete entries whose `expires_at` is past. Run periodically (e.g.,\n * hourly) to bound table size for adopters using row-level TTLs.\n * Returns the number of rows deleted.\n */\nexport async function cleanupExpiredCtxMetadata(\n  db: PgQueryable,\n  options: PgCtxMetadataBackendOptions = {}\n): Promise<number> {\n  const table = quoteIdent(options.tableName ?? DEFAULT_TABLE);\n  const result = await db.query(`DELETE FROM ${table} WHERE expires_at IS NOT NULL AND expires_at < NOW()`);\n  return result.rowCount ?? 0;\n}\n"],"mappings":";;;;;;AAyCA,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AAOzB,SAAS,WAAW,MAAsB;AACxC,MAAI,CAAC,iBAAiB,KAAK,IAAI,GAAG;AAChC,UAAM,IAAI,MAAM,2BAA2B,IAAI,iBAAiB,gBAAgB,EAAE;AAAA,EACpF;AACA,SAAO,IAAI,IAAI;AACjB;AAUO,SAAS,wBAAwB,SAA+C;AACrF,QAAM,YAAY,SAAS,aAAa;AACxC,QAAM,QAAQ,WAAW,SAAS;AAClC,QAAM,aAAa;AAKnB,SAAO;AAAA,6BACoB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cASpB,KAAK;AAAA;AAAA,iCAEc,UAAU;AAAA,OACpC,KAAK;AAAA;AAAA,EAEV,KAAK;AACP;AAEO,MAAM,yBAAyB,wBAAwB;AAYvD,SAAS,mBAAmB,IAAiB,UAAuC,CAAC,GAAuB;AACjH,QAAM,QAAQ,WAAW,QAAQ,aAAa,aAAa;AAE3D,SAAO;AAAA,IACL,MAAM,QAAuB;AAC3B,UAAI;AACF,cAAM,GAAG,MAAM,uDAAuD,KAAK,UAAU;AAAA,MACvF,SAAS,KAAK;AACZ,cAAM,IAAI;AAAA,UACR,wDAAwD,QAAQ,aAAa,aAAa;AAAA,UAG1F,EAAE,OAAO,IAAI;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,IAAI,WAAqD;AAC7D,YAAM,SAAS,MAAM,GAAG;AAAA,QACtB;AAAA,kBACU,KAAK;AAAA,QACf,CAAC,SAAS;AAAA,MACZ;AACA,YAAM,MAAM,OAAO,KAAK,CAAC;AACzB,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,QAA0B,EAAE,OAAO,IAAI,MAAiB;AAI9D,UAAI,IAAI,YAAY,KAAM,OAAM,WAAW,IAAI;AAC/C,UAAI,IAAI,cAAc,KAAM,OAAM,YAAY,OAAO,IAAI,UAAU;AACnE,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,YAAuE;AACnF,UAAI,WAAW,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC5C,YAAM,SAAS,MAAM,GAAG;AAAA,QACtB;AAAA,kBACU,KAAK;AAAA;AAAA,QAEf,CAAC,UAAU;AAAA,MACb;AACA,YAAM,MAAM,oBAAI,IAA8B;AAC9C,iBAAW,OAAO,OAAO,MAAM;AAC7B,cAAM,QAA0B,EAAE,OAAO,IAAI,MAAiB;AAC9D,YAAI,IAAI,YAAY,KAAM,OAAM,WAAW,IAAI;AAC/C,YAAI,IAAI,cAAc,KAAM,OAAM,YAAY,OAAO,IAAI,UAAU;AACnE,YAAI,IAAI,IAAI,YAAsB,KAAK;AAAA,MACzC;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,WAAmB,OAAwC;AAMnE,YAAM,GAAG;AAAA,QACP,eAAe,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYpB;AAAA,UACE;AAAA,UACA,KAAK,UAAU,MAAM,KAAK;AAAA,UAC1B,MAAM,aAAa,SAAY,KAAK,UAAU,MAAM,QAAQ,IAAI;AAAA,UAChE,MAAM,aAAa;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,WAAkC;AAC7C,YAAM,GAAG,MAAM,eAAe,KAAK,0BAA0B,CAAC,SAAS,CAAC;AAAA,IAC1E;AAAA,EACF;AACF;AAOA,eAAsB,0BACpB,IACA,UAAuC,CAAC,GACvB;AACjB,QAAM,QAAQ,WAAW,QAAQ,aAAa,aAAa;AAC3D,QAAM,SAAS,MAAM,GAAG,MAAM,eAAe,KAAK,sDAAsD;AACxG,SAAO,OAAO,YAAY;AAC5B;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/server/ctx-metadata/backends/pg.ts"],"sourcesContent":["/**\n * Postgres backend for `CtxMetadataStore`.\n *\n * Stores one row per `(account_id, kind, id)` flattened to\n * `scoped_key TEXT PRIMARY KEY` with the JSONB `value`, the JSONB\n * `resource` (framework-owned wire shape for auto-hydration), and an\n * optional `expires_at` timestamp. `bulkGet` uses `ANY($1::text[])` to\n * avoid dynamic SQL expansion and parameter-count limits.\n *\n * **Cleanup contract.** No auto-eviction. Adopters running with\n * row-level `expires_at` should periodically call\n * `cleanupExpiredCtxMetadata(db)` to bound table size — Postgres\n * performance dies before disk does, so monitor row count.\n *\n * **Migration on upgrade.** The `resource` column was added to the\n * default migration; deployments that originally ran the older\n * `getCtxMetadataMigration()` must re-run it after upgrading. The new\n * migration is idempotent (`ALTER TABLE … ADD COLUMN IF NOT EXISTS`)\n * and additive — existing rows get `NULL` for `resource`, which the\n * framework treats as \"not yet hydrated\" (next read of the same\n * resource by ID will repopulate it).\n *\n * @example\n * ```ts\n * import { Pool } from 'pg';\n * import {\n *   createCtxMetadataStore,\n *   pgCtxMetadataStore,\n *   getCtxMetadataMigration,\n * } from '@adcp/sdk/server';\n *\n * const pool = new Pool({ connectionString: process.env.DATABASE_URL });\n * await pool.query(getCtxMetadataMigration());\n *\n * const ctxMetadata = createCtxMetadataStore({ backend: pgCtxMetadataStore(pool) });\n * ```\n */\n\nimport type { CtxMetadataBackend, CtxMetadataEntry } from '../store';\nimport type { PgQueryable } from '../../postgres-task-store';\n\nconst DEFAULT_TABLE = 'adcp_ctx_metadata';\nconst VALID_IDENTIFIER = /^[a-z_][a-z0-9_]*$/;\n\nexport interface PgCtxMetadataBackendOptions {\n  /** Table name. Must be lowercase letters/digits/underscores. Defaults to `\"adcp_ctx_metadata\"`. */\n  tableName?: string;\n}\n\nfunction quoteIdent(name: string): string {\n  if (!VALID_IDENTIFIER.test(name)) {\n    throw new Error(`Invalid SQL identifier \"${name}\": must match ${VALID_IDENTIFIER}`);\n  }\n  return `\"${name}\"`;\n}\n\n/**\n * DDL for the ctx-metadata table. Run once per deployment from your bootstrap.\n *\n * @example\n * ```ts\n * await pool.query(getCtxMetadataMigration());\n * ```\n */\nexport function getCtxMetadataMigration(options?: PgCtxMetadataBackendOptions): string {\n  const tableName = options?.tableName ?? DEFAULT_TABLE;\n  const table = quoteIdent(tableName);\n  const indexTable = tableName;\n  // ALTER TABLE … ADD COLUMN IF NOT EXISTS is the idempotent upgrade\n  // path for deployments that ran a pre-7.9 migration without the\n  // `resource` column. No-op on fresh tables (column already exists\n  // from CREATE TABLE); adds the column on existing tables.\n  return `\nCREATE TABLE IF NOT EXISTS ${table} (\n  scoped_key  TEXT PRIMARY KEY,\n  value       JSONB NOT NULL,\n  resource    JSONB,\n  expires_at  TIMESTAMPTZ,\n  created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n  updated_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()\n);\n\nALTER TABLE ${table} ADD COLUMN IF NOT EXISTS resource JSONB;\n\nCREATE INDEX IF NOT EXISTS idx_${indexTable}_expires_at\n  ON ${table}(expires_at)\n  WHERE expires_at IS NOT NULL;\n`.trim();\n}\n\nexport const CTX_METADATA_MIGRATION = getCtxMetadataMigration();\n\n/**\n * Create a Postgres-backed ctx-metadata cache.\n *\n * Pass a connection pool (or any `PgQueryable`) and optionally a custom\n * table name. Run `getCtxMetadataMigration()` once per deployment.\n *\n * **Startup probe.** Call `store.probe()` (via `serve()`'s\n * `readinessCheck`) before accepting traffic to catch a bad\n * `DATABASE_URL` at boot rather than on the first ctx_metadata write.\n */\nexport function pgCtxMetadataStore(db: PgQueryable, options: PgCtxMetadataBackendOptions = {}): CtxMetadataBackend {\n  const table = quoteIdent(options.tableName ?? DEFAULT_TABLE);\n\n  return {\n    async probe(): Promise<void> {\n      try {\n        await db.query(`SELECT scoped_key, value, resource, expires_at FROM ${table} LIMIT 0`);\n      } catch (err) {\n        throw new Error(\n          `ctx_metadata backend probe failed: cannot reach the \"${options.tableName ?? DEFAULT_TABLE}\" table. ` +\n            `Run getCtxMetadataMigration() to create or upgrade it, or check DATABASE_URL. ` +\n            `See server logs for the underlying cause.`,\n          { cause: err }\n        );\n      }\n    },\n\n    async get(scopedKey: string): Promise<CtxMetadataEntry | null> {\n      const result = await db.query(\n        `SELECT value, resource, EXTRACT(EPOCH FROM expires_at)::BIGINT AS expires_at\n           FROM ${table} WHERE scoped_key = $1`,\n        [scopedKey]\n      );\n      const row = result.rows[0];\n      if (!row) return null;\n      const entry: CtxMetadataEntry = { value: row.value as unknown };\n      // `resource` is omitted (not set to undefined) when null in the\n      // column — keeps the JS object shape identical to the memory and\n      // Redis backends for tests that compare via `assert.deepEqual`.\n      if (row.resource != null) entry.resource = row.resource as unknown;\n      if (row.expires_at != null) entry.expiresAt = Number(row.expires_at);\n      return entry;\n    },\n\n    async bulkGet(scopedKeys: readonly string[]): Promise<Map<string, CtxMetadataEntry>> {\n      if (scopedKeys.length === 0) return new Map();\n      const result = await db.query(\n        `SELECT scoped_key, value, resource, EXTRACT(EPOCH FROM expires_at)::BIGINT AS expires_at\n           FROM ${table}\n           WHERE scoped_key = ANY($1::text[])`,\n        [scopedKeys]\n      );\n      const out = new Map<string, CtxMetadataEntry>();\n      for (const row of result.rows) {\n        const entry: CtxMetadataEntry = { value: row.value as unknown };\n        if (row.resource != null) entry.resource = row.resource as unknown;\n        if (row.expires_at != null) entry.expiresAt = Number(row.expires_at);\n        out.set(row.scoped_key as string, entry);\n      }\n      return out;\n    },\n\n    async put(scopedKey: string, entry: CtxMetadataEntry): Promise<void> {\n      // Always pass all four params; CASE expressions handle NULL casts\n      // because raw `null::jsonb` would produce JSON 'null' (not SQL\n      // NULL) and `TO_TIMESTAMP(NULL)` raises. Keeps the SQL static\n      // and avoids the conditional-clause complexity that grew with\n      // the `resource` field.\n      await db.query(\n        `INSERT INTO ${table} (scoped_key, value, resource, expires_at)\n         VALUES (\n           $1,\n           $2::jsonb,\n           CASE WHEN $3::text IS NULL THEN NULL ELSE $3::jsonb END,\n           CASE WHEN $4::bigint IS NULL THEN NULL ELSE TO_TIMESTAMP($4::bigint) END\n         )\n         ON CONFLICT (scoped_key) DO UPDATE SET\n           value = EXCLUDED.value,\n           resource = EXCLUDED.resource,\n           expires_at = EXCLUDED.expires_at,\n           updated_at = NOW()`,\n        [\n          scopedKey,\n          JSON.stringify(entry.value),\n          entry.resource !== undefined ? JSON.stringify(entry.resource) : null,\n          entry.expiresAt ?? null,\n        ]\n      );\n    },\n\n    async delete(scopedKey: string): Promise<void> {\n      await db.query(`DELETE FROM ${table} WHERE scoped_key = $1`, [scopedKey]);\n    },\n  };\n}\n\n/**\n * Delete entries whose `expires_at` is past. Run periodically (e.g.,\n * hourly) to bound table size for adopters using row-level TTLs.\n * Returns the number of rows deleted.\n */\nexport async function cleanupExpiredCtxMetadata(\n  db: PgQueryable,\n  options: PgCtxMetadataBackendOptions = {}\n): Promise<number> {\n  const table = quoteIdent(options.tableName ?? DEFAULT_TABLE);\n  const result = await db.query(`DELETE FROM ${table} WHERE expires_at IS NOT NULL AND expires_at < NOW()`);\n  return result.rowCount ?? 0;\n}\n"],"mappings":"AAyCA,MAAM,gBAAgB;AACtB,MAAM,mBAAmB;AAOzB,SAAS,WAAW,MAAsB;AACxC,MAAI,CAAC,iBAAiB,KAAK,IAAI,GAAG;AAChC,UAAM,IAAI,MAAM,2BAA2B,IAAI,iBAAiB,gBAAgB,EAAE;AAAA,EACpF;AACA,SAAO,IAAI,IAAI;AACjB;AAUO,SAAS,wBAAwB,SAA+C;AACrF,QAAM,YAAY,SAAS,aAAa;AACxC,QAAM,QAAQ,WAAW,SAAS;AAClC,QAAM,aAAa;AAKnB,SAAO;AAAA,6BACoB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cASpB,KAAK;AAAA;AAAA,iCAEc,UAAU;AAAA,OACpC,KAAK;AAAA;AAAA,EAEV,KAAK;AACP;AAEO,MAAM,yBAAyB,wBAAwB;AAYvD,SAAS,mBAAmB,IAAiB,UAAuC,CAAC,GAAuB;AACjH,QAAM,QAAQ,WAAW,QAAQ,aAAa,aAAa;AAE3D,SAAO;AAAA,IACL,MAAM,QAAuB;AAC3B,UAAI;AACF,cAAM,GAAG,MAAM,uDAAuD,KAAK,UAAU;AAAA,MACvF,SAAS,KAAK;AACZ,cAAM,IAAI;AAAA,UACR,wDAAwD,QAAQ,aAAa,aAAa;AAAA,UAG1F,EAAE,OAAO,IAAI;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,IAAI,WAAqD;AAC7D,YAAM,SAAS,MAAM,GAAG;AAAA,QACtB;AAAA,kBACU,KAAK;AAAA,QACf,CAAC,SAAS;AAAA,MACZ;AACA,YAAM,MAAM,OAAO,KAAK,CAAC;AACzB,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,QAA0B,EAAE,OAAO,IAAI,MAAiB;AAI9D,UAAI,IAAI,YAAY,KAAM,OAAM,WAAW,IAAI;AAC/C,UAAI,IAAI,cAAc,KAAM,OAAM,YAAY,OAAO,IAAI,UAAU;AACnE,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,YAAuE;AACnF,UAAI,WAAW,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC5C,YAAM,SAAS,MAAM,GAAG;AAAA,QACtB;AAAA,kBACU,KAAK;AAAA;AAAA,QAEf,CAAC,UAAU;AAAA,MACb;AACA,YAAM,MAAM,oBAAI,IAA8B;AAC9C,iBAAW,OAAO,OAAO,MAAM;AAC7B,cAAM,QAA0B,EAAE,OAAO,IAAI,MAAiB;AAC9D,YAAI,IAAI,YAAY,KAAM,OAAM,WAAW,IAAI;AAC/C,YAAI,IAAI,cAAc,KAAM,OAAM,YAAY,OAAO,IAAI,UAAU;AACnE,YAAI,IAAI,IAAI,YAAsB,KAAK;AAAA,MACzC;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,WAAmB,OAAwC;AAMnE,YAAM,GAAG;AAAA,QACP,eAAe,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAYpB;AAAA,UACE;AAAA,UACA,KAAK,UAAU,MAAM,KAAK;AAAA,UAC1B,MAAM,aAAa,SAAY,KAAK,UAAU,MAAM,QAAQ,IAAI;AAAA,UAChE,MAAM,aAAa;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,WAAkC;AAC7C,YAAM,GAAG,MAAM,eAAe,KAAK,0BAA0B,CAAC,SAAS,CAAC;AAAA,IAC1E;AAAA,EACF;AACF;AAOA,eAAsB,0BACpB,IACA,UAAuC,CAAC,GACvB;AACjB,QAAM,QAAQ,WAAW,QAAQ,aAAa,aAAa;AAC3D,QAAM,SAAS,MAAM,GAAG,MAAM,eAAe,KAAK,sDAAsD;AACxG,SAAO,OAAO,YAAY;AAC5B;","names":[]}

package/dist/lib/server/ctx-metadata/backends/redis.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import { maybeWarnOnSharedRedisPrefix } from "../../../utils/redis-default-prefix-warn.mjs";
 const DEFAULT_KEY_PREFIX = "adcp:ctx_meta:";
 const DEFAULT_EXPIRED_GRACE_SECONDS = 60;

package/dist/lib/server/ctx-metadata/backends/redis.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../src/lib/server/ctx-metadata/backends/redis.ts"],"sourcesContent":["/**\n * Redis backend for `CtxMetadataStore`.\n *\n * Stores one key per `(account_id, kind, id)` carrying the JSON payload\n * `{ value, resource?, expiresAt? }`. Entries with no `expiresAt` have\n * no Redis TTL — ctx-metadata lifetimes can be months (a media buy can\n * run all year), and silent eviction would produce \"package not found\"\n * errors that look like publisher bugs and run for weeks.\n *\n * **TTL semantics.** When `entry.expiresAt` is set, the backend stores\n * the key with `EX = expiresAt - now + expiredGraceSeconds` (default\n * 60s grace) so the store layer's own expiry check (`entry.expiresAt <\n * now`) can still run on values within the grace window. When\n * `entry.expiresAt` is absent, the key is stored with no TTL — durable\n * by default, matches the pg backend's `expires_at NULL` semantic.\n *\n * **`bulkGet` uses `MGET`.** Single round trip for any batch size,\n * unlike the looped-`GET` fallback. Adopters using an escape-hatch\n * `RedisLikeClient` adapter MUST implement `mGet` for batch shapes\n * (`get_products` with N products, `create_media_buy` carrying a\n * package list referencing products by ID).\n *\n * **`clearAll` intentionally omitted.** Same rationale as the\n * idempotency Redis backend — a shared Redis is a production resource,\n * and a compliance-reset `FLUSHDB` would nuke unrelated keys. Tests\n * against a dedicated db index (`REDIS_URL=…/15`) call `FLUSHDB`\n * themselves.\n *\n * @example\n * ```typescript\n * import { createClient } from 'redis';\n * import { createCtxMetadataStore, redisCtxMetadataStore } from '@adcp/sdk/server';\n *\n * const client = createClient({ url: process.env.REDIS_URL });\n * client.on('error', (err) => console.error('redis error', err));\n * await client.connect();\n *\n * const ctxMetadata = createCtxMetadataStore({\n *   backend: redisCtxMetadataStore(client),\n * });\n * ```\n */\n\nimport type { CtxMetadataBackend, CtxMetadataEntry } from '../store';\n// `import type` is erased at emit, so this does NOT make `redis` a\n// hard dependency at runtime — adopters who never use this backend\n// never load the redis package.\nimport type { RedisClientType } from 'redis';\nimport { maybeWarnOnSharedRedisPrefix } from '../../../utils/redis-default-prefix-warn';\n\n/**\n * Escape-hatch interface for adopters not using the official `redis`\n * client (node-redis v4/v5). Mirrors the methods this backend calls.\n *\n * `mGet` matches node-redis's batch-get shape (single round trip).\n * `ioredis` exposes `mget(keys)` which returns `(string | null)[]` in\n * the same order — the shim is one line.\n *\n * @example ioredis adapter\n * ```typescript\n * import Redis from 'ioredis';\n * const ioredis = new Redis(process.env.REDIS_URL!);\n *\n * const client: CtxMetadataRedisLikeClient = {\n *   get: (k) => ioredis.get(k),\n *   mGet: (keys) => ioredis.mget(keys),\n *   set: (k, v, opts) =>\n *     opts?.EX !== undefined\n *       ? ioredis.set(k, v, 'EX', opts.EX)\n *       : ioredis.set(k, v),\n *   del: (k) => ioredis.del(k as string),\n *   ping: () => ioredis.ping(),\n * };\n * ```\n */\nexport interface CtxMetadataRedisLikeClient {\n  get(key: string): Promise<string | null>;\n  mGet(keys: string[]): Promise<(string | null)[]>;\n  set(key: string, value: string, options?: { EX?: number }): Promise<string | null>;\n  del(key: string | string[]): Promise<number>;\n  ping(): Promise<string>;\n}\n\n/**\n * Accepted client shape: either a real `redis` (node-redis v4/v5)\n * `RedisClientType` (the typical path — pass `createClient(...)`\n * straight in) or an adapter conforming to `CtxMetadataRedisLikeClient`\n * for non-node-redis clients (ioredis, Upstash, test doubles).\n */\nexport type CtxMetadataRedisBackendClient = RedisClientType<any, any, any> | CtxMetadataRedisLikeClient;\n\nexport interface RedisCtxMetadataBackendOptions {\n  /**\n   * Key prefix prepended to every scoped key written to Redis. Defaults\n   * to `\"adcp:ctx_meta:\"`.\n   *\n   * **Sharing a Redis db across deployments? Override this.** The\n   * default is fine for a dedicated Redis (or a dedicated db index).\n   * Two AdCP servers sharing the same db with the same default prefix\n   * collide on any overlapping `accountId` — the per-tenant scope\n   * segment can't carry deployment isolation on its own. Set a\n   * deployment-unique prefix (`\"adcp:ctx_meta:prod-eu:\"`, etc.) or use\n   * separate Redis dbs.\n   */\n  keyPrefix?: string;\n  /**\n   * How many seconds past `entry.expiresAt` to keep the key alive in\n   * Redis so the store layer's expiry check (`entry.expiresAt < now`)\n   * can still observe the value within a clock-skew window. Defaults\n   * to 60s.\n   *\n   * Only applies to entries with an `expiresAt`; entries without one\n   * are stored with no TTL (durable by design).\n   */\n  expiredGraceSeconds?: number;\n  /**\n   * Suppress the one-time `console.warn` emitted at construction when\n   * the default `keyPrefix` is used against a node-redis client on db\n   * 0. Set to `true` if you know your Redis is dedicated to this\n   * deployment. The recommended fix is to set `keyPrefix` explicitly,\n   * not to suppress.\n   */\n  suppressDefaultPrefixWarning?: boolean;\n}\n\nconst DEFAULT_KEY_PREFIX = 'adcp:ctx_meta:';\nconst DEFAULT_EXPIRED_GRACE_SECONDS = 60;\n\ninterface SerializedEntry {\n  value: unknown;\n  resource?: unknown;\n  expiresAt?: number;\n}\n\n/**\n * Create a Redis-backed ctx-metadata cache.\n *\n * **Startup probe.** Call `store.probe()` before serving traffic to\n * catch a bad `REDIS_URL` at boot rather than on the first\n * ctx_metadata write.\n *\n * **Client error handling.** node-redis emits errors on the client\n * itself for transient connection drops. Without a listener, Node's\n * `EventEmitter` default-throws and crashes the process. Add one in\n * your bootstrap:\n *\n * ```ts\n * client.on('error', (err) => console.error('redis error', err));\n * ```\n *\n * **Redis memory policy — set this on the deployment.** ctx_metadata\n * entries default to durable (no TTL) when no `expiresAt` is provided,\n * matching the pg sibling's `expires_at = NULL` semantic. Without a\n * memory policy, an adopter who writes many durable entries can\n * pressure Redis memory; once `maxmemory` is hit, default `noeviction`\n * makes new writes fail. Choose deliberately:\n *\n * - **`maxmemory-policy allkeys-lru`** on a Redis db dedicated to AdCP\n *   ctx_metadata — evicts the oldest entries to make room. Acceptable\n *   for ctx_metadata because the next call referencing the same\n *   resource will write a fresh entry; evicted entries are recoverable\n *   as publisher traffic re-derives them, not lost permanently.\n * - **`maxmemory-policy volatile-lru`** if you mostly use `expiresAt`\n *   on entries — bounds growth to TTL'd keys only.\n * - **`maxmemory-policy noeviction`** (Redis default) — fail-closed:\n *   writes start erroring at the limit, mutating tools fail. Pages\n *   you instead of silently evicting.\n *\n * For ctx_metadata specifically, evicting cached entries is safer than\n * for the idempotency cache (which uses eviction as a feature) because\n * publisher re-derivation refills the cache on the next reference.\n * Note that this isn't synchronous \"re-hydrate on miss\" — the\n * framework reads `null` for a missing entry and falls through to the\n * publisher's adapter, which may or may not produce a fresh\n * `ctx_metadata` value on that path. `allkeys-lru` is the recommended\n * default on a dedicated db.\n */\nexport function redisCtxMetadataStore(\n  client: CtxMetadataRedisBackendClient,\n  options: RedisCtxMetadataBackendOptions = {}\n): CtxMetadataBackend {\n  // The function calls only the methods on CtxMetadataRedisLikeClient.\n  // The wider RedisClientType union covers the node-redis happy path\n  // without forcing a cast at the call site; internally we narrow.\n  const c = client as CtxMetadataRedisLikeClient;\n\n  const keyPrefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX;\n  const expiredGraceSeconds = options.expiredGraceSeconds ?? DEFAULT_EXPIRED_GRACE_SECONDS;\n\n  if (!Number.isFinite(expiredGraceSeconds) || expiredGraceSeconds < 0) {\n    throw new Error(\n      `redisCtxMetadataStore: expiredGraceSeconds must be a non-negative finite number. Got ${expiredGraceSeconds}.`\n    );\n  }\n\n  maybeWarnOnSharedRedisPrefix({\n    client,\n    callerKeyPrefix: options.keyPrefix,\n    defaultKeyPrefix: DEFAULT_KEY_PREFIX,\n    suppress: options.suppressDefaultPrefixWarning,\n    backendName: 'redisCtxMetadataStore',\n  });\n\n  function prefixed(scopedKey: string): string {\n    return `${keyPrefix}${scopedKey}`;\n  }\n\n  /**\n   * Compute the Redis TTL when `expiresAt` is set. Returns `undefined`\n   * when no TTL should be applied (entry is durable). Throws if the\n   * resulting TTL would be non-positive — a logic bug at the caller.\n   */\n  function ttlFor(expiresAt: number | undefined): number | undefined {\n    if (expiresAt === undefined) return undefined;\n    const nowSeconds = Math.floor(Date.now() / 1000);\n    const ttl = Math.floor(expiresAt - nowSeconds + expiredGraceSeconds);\n    if (ttl <= 0) {\n      throw new Error(\n        `redisCtxMetadataStore: refusing to write an entry whose expiresAt (${expiresAt}) is already past — ` +\n          `the substrate-level TTL would be ${ttl}s. Caller logic error.`\n      );\n    }\n    return ttl;\n  }\n\n  function parseEntry(raw: string, scopedKey: string): CtxMetadataEntry {\n    let parsed: SerializedEntry;\n    try {\n      parsed = JSON.parse(raw) as SerializedEntry;\n    } catch (err) {\n      // The scoped key contains the account id — omit from the public\n      // message; attach the parse error as Error.cause so server logs\n      // retain the detail without leaking via response bodies.\n      void scopedKey;\n      throw new Error(\n        'redisCtxMetadataStore: corrupt cache entry — not valid JSON. See server logs for key + parse error.',\n        {\n          cause: err,\n        }\n      );\n    }\n    const entry: CtxMetadataEntry = { value: parsed.value };\n    if (parsed.resource !== undefined) entry.resource = parsed.resource;\n    if (parsed.expiresAt !== undefined) entry.expiresAt = parsed.expiresAt;\n    return entry;\n  }\n\n  return {\n    async probe(): Promise<void> {\n      try {\n        await c.ping();\n      } catch (err) {\n        throw new Error(\n          `ctx_metadata backend probe failed: Redis is unreachable or misconfigured. ` +\n            `Check REDIS_URL and that the instance is up. See server logs for the underlying cause.`,\n          { cause: err }\n        );\n      }\n    },\n\n    async get(scopedKey: string): Promise<CtxMetadataEntry | null> {\n      const raw = await c.get(prefixed(scopedKey));\n      if (raw === null) return null;\n      return parseEntry(raw, scopedKey);\n    },\n\n    async bulkGet(scopedKeys: readonly string[]): Promise<Map<string, CtxMetadataEntry>> {\n      if (scopedKeys.length === 0) return new Map();\n      const prefixedKeys = scopedKeys.map(k => prefixed(k));\n      const raws = await c.mGet(prefixedKeys);\n      const out = new Map<string, CtxMetadataEntry>();\n      for (let i = 0; i < scopedKeys.length; i++) {\n        const raw = raws[i];\n        if (raw === null || raw === undefined) continue;\n        const scopedKey = scopedKeys[i];\n        if (scopedKey === undefined) continue;\n        out.set(scopedKey, parseEntry(raw, scopedKey));\n      }\n      return out;\n    },\n\n    async put(scopedKey: string, entry: CtxMetadataEntry): Promise<void> {\n      const serialized: SerializedEntry = { value: entry.value };\n      if (entry.resource !== undefined) serialized.resource = entry.resource;\n      if (entry.expiresAt !== undefined) serialized.expiresAt = entry.expiresAt;\n      const ttl = ttlFor(entry.expiresAt);\n      const body = JSON.stringify(serialized);\n      if (ttl !== undefined) {\n        await c.set(prefixed(scopedKey), body, { EX: ttl });\n      } else {\n        // No TTL: durable entry. Pass undefined / empty options so the\n        // call site is symmetric with the pg backend's `expires_at = NULL`.\n        await c.set(prefixed(scopedKey), body);\n      }\n    },\n\n    async delete(scopedKey: string): Promise<void> {\n      await c.del(prefixed(scopedKey));\n    },\n  };\n}\n"],"mappings":";;;;;;AAgDA,SAAS,oCAAoC;AA6E7C,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAmD/B,SAAS,sBACd,QACA,UAA0C,CAAC,GACvB;AAIpB,QAAM,IAAI;AAEV,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,sBAAsB,QAAQ,uBAAuB;AAE3D,MAAI,CAAC,OAAO,SAAS,mBAAmB,KAAK,sBAAsB,GAAG;AACpE,UAAM,IAAI;AAAA,MACR,wFAAwF,mBAAmB;AAAA,IAC7G;AAAA,EACF;AAEA,+BAA6B;AAAA,IAC3B;AAAA,IACA,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB;AAAA,IAClB,UAAU,QAAQ;AAAA,IAClB,aAAa;AAAA,EACf,CAAC;AAED,WAAS,SAAS,WAA2B;AAC3C,WAAO,GAAG,SAAS,GAAG,SAAS;AAAA,EACjC;AAOA,WAAS,OAAO,WAAmD;AACjE,QAAI,cAAc,OAAW,QAAO;AACpC,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,UAAM,MAAM,KAAK,MAAM,YAAY,aAAa,mBAAmB;AACnE,QAAI,OAAO,GAAG;AACZ,YAAM,IAAI;AAAA,QACR,sEAAsE,SAAS,6DACzC,GAAG;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,KAAa,WAAqC;AACpE,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,GAAG;AAAA,IACzB,SAAS,KAAK;AAIZ,WAAK;AACL,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,UACE,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAA0B,EAAE,OAAO,OAAO,MAAM;AACtD,QAAI,OAAO,aAAa,OAAW,OAAM,WAAW,OAAO;AAC3D,QAAI,OAAO,cAAc,OAAW,OAAM,YAAY,OAAO;AAC7D,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,QAAuB;AAC3B,UAAI;AACF,cAAM,EAAE,KAAK;AAAA,MACf,SAAS,KAAK;AACZ,cAAM,IAAI;AAAA,UACR;AAAA,UAEA,EAAE,OAAO,IAAI;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,IAAI,WAAqD;AAC7D,YAAM,MAAM,MAAM,EAAE,IAAI,SAAS,SAAS,CAAC;AAC3C,UAAI,QAAQ,KAAM,QAAO;AACzB,aAAO,WAAW,KAAK,SAAS;AAAA,IAClC;AAAA,IAEA,MAAM,QAAQ,YAAuE;AACnF,UAAI,WAAW,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC5C,YAAM,eAAe,WAAW,IAAI,OAAK,SAAS,CAAC,CAAC;AACpD,YAAM,OAAO,MAAM,EAAE,KAAK,YAAY;AACtC,YAAM,MAAM,oBAAI,IAA8B;AAC9C,eAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AAC1C,cAAM,MAAM,KAAK,CAAC;AAClB,YAAI,QAAQ,QAAQ,QAAQ,OAAW;AACvC,cAAM,YAAY,WAAW,CAAC;AAC9B,YAAI,cAAc,OAAW;AAC7B,YAAI,IAAI,WAAW,WAAW,KAAK,SAAS,CAAC;AAAA,MAC/C;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,WAAmB,OAAwC;AACnE,YAAM,aAA8B,EAAE,OAAO,MAAM,MAAM;AACzD,UAAI,MAAM,aAAa,OAAW,YAAW,WAAW,MAAM;AAC9D,UAAI,MAAM,cAAc,OAAW,YAAW,YAAY,MAAM;AAChE,YAAM,MAAM,OAAO,MAAM,SAAS;AAClC,YAAM,OAAO,KAAK,UAAU,UAAU;AACtC,UAAI,QAAQ,QAAW;AACrB,cAAM,EAAE,IAAI,SAAS,SAAS,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,MACpD,OAAO;AAGL,cAAM,EAAE,IAAI,SAAS,SAAS,GAAG,IAAI;AAAA,MACvC;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,WAAkC;AAC7C,YAAM,EAAE,IAAI,SAAS,SAAS,CAAC;AAAA,IACjC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../../src/lib/server/ctx-metadata/backends/redis.ts"],"sourcesContent":["/**\n * Redis backend for `CtxMetadataStore`.\n *\n * Stores one key per `(account_id, kind, id)` carrying the JSON payload\n * `{ value, resource?, expiresAt? }`. Entries with no `expiresAt` have\n * no Redis TTL — ctx-metadata lifetimes can be months (a media buy can\n * run all year), and silent eviction would produce \"package not found\"\n * errors that look like publisher bugs and run for weeks.\n *\n * **TTL semantics.** When `entry.expiresAt` is set, the backend stores\n * the key with `EX = expiresAt - now + expiredGraceSeconds` (default\n * 60s grace) so the store layer's own expiry check (`entry.expiresAt <\n * now`) can still run on values within the grace window. When\n * `entry.expiresAt` is absent, the key is stored with no TTL — durable\n * by default, matches the pg backend's `expires_at NULL` semantic.\n *\n * **`bulkGet` uses `MGET`.** Single round trip for any batch size,\n * unlike the looped-`GET` fallback. Adopters using an escape-hatch\n * `RedisLikeClient` adapter MUST implement `mGet` for batch shapes\n * (`get_products` with N products, `create_media_buy` carrying a\n * package list referencing products by ID).\n *\n * **`clearAll` intentionally omitted.** Same rationale as the\n * idempotency Redis backend — a shared Redis is a production resource,\n * and a compliance-reset `FLUSHDB` would nuke unrelated keys. Tests\n * against a dedicated db index (`REDIS_URL=…/15`) call `FLUSHDB`\n * themselves.\n *\n * @example\n * ```typescript\n * import { createClient } from 'redis';\n * import { createCtxMetadataStore, redisCtxMetadataStore } from '@adcp/sdk/server';\n *\n * const client = createClient({ url: process.env.REDIS_URL });\n * client.on('error', (err) => console.error('redis error', err));\n * await client.connect();\n *\n * const ctxMetadata = createCtxMetadataStore({\n *   backend: redisCtxMetadataStore(client),\n * });\n * ```\n */\n\nimport type { CtxMetadataBackend, CtxMetadataEntry } from '../store';\n// `import type` is erased at emit, so this does NOT make `redis` a\n// hard dependency at runtime — adopters who never use this backend\n// never load the redis package.\nimport type { RedisClientType } from 'redis';\nimport { maybeWarnOnSharedRedisPrefix } from '../../../utils/redis-default-prefix-warn';\n\n/**\n * Escape-hatch interface for adopters not using the official `redis`\n * client (node-redis v4/v5). Mirrors the methods this backend calls.\n *\n * `mGet` matches node-redis's batch-get shape (single round trip).\n * `ioredis` exposes `mget(keys)` which returns `(string | null)[]` in\n * the same order — the shim is one line.\n *\n * @example ioredis adapter\n * ```typescript\n * import Redis from 'ioredis';\n * const ioredis = new Redis(process.env.REDIS_URL!);\n *\n * const client: CtxMetadataRedisLikeClient = {\n *   get: (k) => ioredis.get(k),\n *   mGet: (keys) => ioredis.mget(keys),\n *   set: (k, v, opts) =>\n *     opts?.EX !== undefined\n *       ? ioredis.set(k, v, 'EX', opts.EX)\n *       : ioredis.set(k, v),\n *   del: (k) => ioredis.del(k as string),\n *   ping: () => ioredis.ping(),\n * };\n * ```\n */\nexport interface CtxMetadataRedisLikeClient {\n  get(key: string): Promise<string | null>;\n  mGet(keys: string[]): Promise<(string | null)[]>;\n  set(key: string, value: string, options?: { EX?: number }): Promise<string | null>;\n  del(key: string | string[]): Promise<number>;\n  ping(): Promise<string>;\n}\n\n/**\n * Accepted client shape: either a real `redis` (node-redis v4/v5)\n * `RedisClientType` (the typical path — pass `createClient(...)`\n * straight in) or an adapter conforming to `CtxMetadataRedisLikeClient`\n * for non-node-redis clients (ioredis, Upstash, test doubles).\n */\nexport type CtxMetadataRedisBackendClient = RedisClientType<any, any, any> | CtxMetadataRedisLikeClient;\n\nexport interface RedisCtxMetadataBackendOptions {\n  /**\n   * Key prefix prepended to every scoped key written to Redis. Defaults\n   * to `\"adcp:ctx_meta:\"`.\n   *\n   * **Sharing a Redis db across deployments? Override this.** The\n   * default is fine for a dedicated Redis (or a dedicated db index).\n   * Two AdCP servers sharing the same db with the same default prefix\n   * collide on any overlapping `accountId` — the per-tenant scope\n   * segment can't carry deployment isolation on its own. Set a\n   * deployment-unique prefix (`\"adcp:ctx_meta:prod-eu:\"`, etc.) or use\n   * separate Redis dbs.\n   */\n  keyPrefix?: string;\n  /**\n   * How many seconds past `entry.expiresAt` to keep the key alive in\n   * Redis so the store layer's expiry check (`entry.expiresAt < now`)\n   * can still observe the value within a clock-skew window. Defaults\n   * to 60s.\n   *\n   * Only applies to entries with an `expiresAt`; entries without one\n   * are stored with no TTL (durable by design).\n   */\n  expiredGraceSeconds?: number;\n  /**\n   * Suppress the one-time `console.warn` emitted at construction when\n   * the default `keyPrefix` is used against a node-redis client on db\n   * 0. Set to `true` if you know your Redis is dedicated to this\n   * deployment. The recommended fix is to set `keyPrefix` explicitly,\n   * not to suppress.\n   */\n  suppressDefaultPrefixWarning?: boolean;\n}\n\nconst DEFAULT_KEY_PREFIX = 'adcp:ctx_meta:';\nconst DEFAULT_EXPIRED_GRACE_SECONDS = 60;\n\ninterface SerializedEntry {\n  value: unknown;\n  resource?: unknown;\n  expiresAt?: number;\n}\n\n/**\n * Create a Redis-backed ctx-metadata cache.\n *\n * **Startup probe.** Call `store.probe()` before serving traffic to\n * catch a bad `REDIS_URL` at boot rather than on the first\n * ctx_metadata write.\n *\n * **Client error handling.** node-redis emits errors on the client\n * itself for transient connection drops. Without a listener, Node's\n * `EventEmitter` default-throws and crashes the process. Add one in\n * your bootstrap:\n *\n * ```ts\n * client.on('error', (err) => console.error('redis error', err));\n * ```\n *\n * **Redis memory policy — set this on the deployment.** ctx_metadata\n * entries default to durable (no TTL) when no `expiresAt` is provided,\n * matching the pg sibling's `expires_at = NULL` semantic. Without a\n * memory policy, an adopter who writes many durable entries can\n * pressure Redis memory; once `maxmemory` is hit, default `noeviction`\n * makes new writes fail. Choose deliberately:\n *\n * - **`maxmemory-policy allkeys-lru`** on a Redis db dedicated to AdCP\n *   ctx_metadata — evicts the oldest entries to make room. Acceptable\n *   for ctx_metadata because the next call referencing the same\n *   resource will write a fresh entry; evicted entries are recoverable\n *   as publisher traffic re-derives them, not lost permanently.\n * - **`maxmemory-policy volatile-lru`** if you mostly use `expiresAt`\n *   on entries — bounds growth to TTL'd keys only.\n * - **`maxmemory-policy noeviction`** (Redis default) — fail-closed:\n *   writes start erroring at the limit, mutating tools fail. Pages\n *   you instead of silently evicting.\n *\n * For ctx_metadata specifically, evicting cached entries is safer than\n * for the idempotency cache (which uses eviction as a feature) because\n * publisher re-derivation refills the cache on the next reference.\n * Note that this isn't synchronous \"re-hydrate on miss\" — the\n * framework reads `null` for a missing entry and falls through to the\n * publisher's adapter, which may or may not produce a fresh\n * `ctx_metadata` value on that path. `allkeys-lru` is the recommended\n * default on a dedicated db.\n */\nexport function redisCtxMetadataStore(\n  client: CtxMetadataRedisBackendClient,\n  options: RedisCtxMetadataBackendOptions = {}\n): CtxMetadataBackend {\n  // The function calls only the methods on CtxMetadataRedisLikeClient.\n  // The wider RedisClientType union covers the node-redis happy path\n  // without forcing a cast at the call site; internally we narrow.\n  const c = client as CtxMetadataRedisLikeClient;\n\n  const keyPrefix = options.keyPrefix ?? DEFAULT_KEY_PREFIX;\n  const expiredGraceSeconds = options.expiredGraceSeconds ?? DEFAULT_EXPIRED_GRACE_SECONDS;\n\n  if (!Number.isFinite(expiredGraceSeconds) || expiredGraceSeconds < 0) {\n    throw new Error(\n      `redisCtxMetadataStore: expiredGraceSeconds must be a non-negative finite number. Got ${expiredGraceSeconds}.`\n    );\n  }\n\n  maybeWarnOnSharedRedisPrefix({\n    client,\n    callerKeyPrefix: options.keyPrefix,\n    defaultKeyPrefix: DEFAULT_KEY_PREFIX,\n    suppress: options.suppressDefaultPrefixWarning,\n    backendName: 'redisCtxMetadataStore',\n  });\n\n  function prefixed(scopedKey: string): string {\n    return `${keyPrefix}${scopedKey}`;\n  }\n\n  /**\n   * Compute the Redis TTL when `expiresAt` is set. Returns `undefined`\n   * when no TTL should be applied (entry is durable). Throws if the\n   * resulting TTL would be non-positive — a logic bug at the caller.\n   */\n  function ttlFor(expiresAt: number | undefined): number | undefined {\n    if (expiresAt === undefined) return undefined;\n    const nowSeconds = Math.floor(Date.now() / 1000);\n    const ttl = Math.floor(expiresAt - nowSeconds + expiredGraceSeconds);\n    if (ttl <= 0) {\n      throw new Error(\n        `redisCtxMetadataStore: refusing to write an entry whose expiresAt (${expiresAt}) is already past — ` +\n          `the substrate-level TTL would be ${ttl}s. Caller logic error.`\n      );\n    }\n    return ttl;\n  }\n\n  function parseEntry(raw: string, scopedKey: string): CtxMetadataEntry {\n    let parsed: SerializedEntry;\n    try {\n      parsed = JSON.parse(raw) as SerializedEntry;\n    } catch (err) {\n      // The scoped key contains the account id — omit from the public\n      // message; attach the parse error as Error.cause so server logs\n      // retain the detail without leaking via response bodies.\n      void scopedKey;\n      throw new Error(\n        'redisCtxMetadataStore: corrupt cache entry — not valid JSON. See server logs for key + parse error.',\n        {\n          cause: err,\n        }\n      );\n    }\n    const entry: CtxMetadataEntry = { value: parsed.value };\n    if (parsed.resource !== undefined) entry.resource = parsed.resource;\n    if (parsed.expiresAt !== undefined) entry.expiresAt = parsed.expiresAt;\n    return entry;\n  }\n\n  return {\n    async probe(): Promise<void> {\n      try {\n        await c.ping();\n      } catch (err) {\n        throw new Error(\n          `ctx_metadata backend probe failed: Redis is unreachable or misconfigured. ` +\n            `Check REDIS_URL and that the instance is up. See server logs for the underlying cause.`,\n          { cause: err }\n        );\n      }\n    },\n\n    async get(scopedKey: string): Promise<CtxMetadataEntry | null> {\n      const raw = await c.get(prefixed(scopedKey));\n      if (raw === null) return null;\n      return parseEntry(raw, scopedKey);\n    },\n\n    async bulkGet(scopedKeys: readonly string[]): Promise<Map<string, CtxMetadataEntry>> {\n      if (scopedKeys.length === 0) return new Map();\n      const prefixedKeys = scopedKeys.map(k => prefixed(k));\n      const raws = await c.mGet(prefixedKeys);\n      const out = new Map<string, CtxMetadataEntry>();\n      for (let i = 0; i < scopedKeys.length; i++) {\n        const raw = raws[i];\n        if (raw === null || raw === undefined) continue;\n        const scopedKey = scopedKeys[i];\n        if (scopedKey === undefined) continue;\n        out.set(scopedKey, parseEntry(raw, scopedKey));\n      }\n      return out;\n    },\n\n    async put(scopedKey: string, entry: CtxMetadataEntry): Promise<void> {\n      const serialized: SerializedEntry = { value: entry.value };\n      if (entry.resource !== undefined) serialized.resource = entry.resource;\n      if (entry.expiresAt !== undefined) serialized.expiresAt = entry.expiresAt;\n      const ttl = ttlFor(entry.expiresAt);\n      const body = JSON.stringify(serialized);\n      if (ttl !== undefined) {\n        await c.set(prefixed(scopedKey), body, { EX: ttl });\n      } else {\n        // No TTL: durable entry. Pass undefined / empty options so the\n        // call site is symmetric with the pg backend's `expires_at = NULL`.\n        await c.set(prefixed(scopedKey), body);\n      }\n    },\n\n    async delete(scopedKey: string): Promise<void> {\n      await c.del(prefixed(scopedKey));\n    },\n  };\n}\n"],"mappings":"AAgDA,SAAS,oCAAoC;AA6E7C,MAAM,qBAAqB;AAC3B,MAAM,gCAAgC;AAmD/B,SAAS,sBACd,QACA,UAA0C,CAAC,GACvB;AAIpB,QAAM,IAAI;AAEV,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,sBAAsB,QAAQ,uBAAuB;AAE3D,MAAI,CAAC,OAAO,SAAS,mBAAmB,KAAK,sBAAsB,GAAG;AACpE,UAAM,IAAI;AAAA,MACR,wFAAwF,mBAAmB;AAAA,IAC7G;AAAA,EACF;AAEA,+BAA6B;AAAA,IAC3B;AAAA,IACA,iBAAiB,QAAQ;AAAA,IACzB,kBAAkB;AAAA,IAClB,UAAU,QAAQ;AAAA,IAClB,aAAa;AAAA,EACf,CAAC;AAED,WAAS,SAAS,WAA2B;AAC3C,WAAO,GAAG,SAAS,GAAG,SAAS;AAAA,EACjC;AAOA,WAAS,OAAO,WAAmD;AACjE,QAAI,cAAc,OAAW,QAAO;AACpC,UAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,UAAM,MAAM,KAAK,MAAM,YAAY,aAAa,mBAAmB;AACnE,QAAI,OAAO,GAAG;AACZ,YAAM,IAAI;AAAA,QACR,sEAAsE,SAAS,6DACzC,GAAG;AAAA,MAC3C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,WAAW,KAAa,WAAqC;AACpE,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAM,GAAG;AAAA,IACzB,SAAS,KAAK;AAIZ,WAAK;AACL,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,UACE,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAA0B,EAAE,OAAO,OAAO,MAAM;AACtD,QAAI,OAAO,aAAa,OAAW,OAAM,WAAW,OAAO;AAC3D,QAAI,OAAO,cAAc,OAAW,OAAM,YAAY,OAAO;AAC7D,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,QAAuB;AAC3B,UAAI;AACF,cAAM,EAAE,KAAK;AAAA,MACf,SAAS,KAAK;AACZ,cAAM,IAAI;AAAA,UACR;AAAA,UAEA,EAAE,OAAO,IAAI;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,IAAI,WAAqD;AAC7D,YAAM,MAAM,MAAM,EAAE,IAAI,SAAS,SAAS,CAAC;AAC3C,UAAI,QAAQ,KAAM,QAAO;AACzB,aAAO,WAAW,KAAK,SAAS;AAAA,IAClC;AAAA,IAEA,MAAM,QAAQ,YAAuE;AACnF,UAAI,WAAW,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC5C,YAAM,eAAe,WAAW,IAAI,OAAK,SAAS,CAAC,CAAC;AACpD,YAAM,OAAO,MAAM,EAAE,KAAK,YAAY;AACtC,YAAM,MAAM,oBAAI,IAA8B;AAC9C,eAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AAC1C,cAAM,MAAM,KAAK,CAAC;AAClB,YAAI,QAAQ,QAAQ,QAAQ,OAAW;AACvC,cAAM,YAAY,WAAW,CAAC;AAC9B,YAAI,cAAc,OAAW;AAC7B,YAAI,IAAI,WAAW,WAAW,KAAK,SAAS,CAAC;AAAA,MAC/C;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,WAAmB,OAAwC;AACnE,YAAM,aAA8B,EAAE,OAAO,MAAM,MAAM;AACzD,UAAI,MAAM,aAAa,OAAW,YAAW,WAAW,MAAM;AAC9D,UAAI,MAAM,cAAc,OAAW,YAAW,YAAY,MAAM;AAChE,YAAM,MAAM,OAAO,MAAM,SAAS;AAClC,YAAM,OAAO,KAAK,UAAU,UAAU;AACtC,UAAI,QAAQ,QAAW;AACrB,cAAM,EAAE,IAAI,SAAS,SAAS,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,MACpD,OAAO;AAGL,cAAM,EAAE,IAAI,SAAS,SAAS,GAAG,IAAI;AAAA,MACvC;AAAA,IACF;AAAA,IAEA,MAAM,OAAO,WAAkC;AAC7C,YAAM,EAAE,IAAI,SAAS,SAAS,CAAC;AAAA,IACjC;AAAA,EACF;AACF;","names":[]}

package/dist/lib/server/ctx-metadata/index.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 import {
   createCtxMetadataStore,
   ctxMetadataResultKey,

package/dist/lib/server/ctx-metadata/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/server/ctx-metadata/index.ts"],"sourcesContent":["/**\n * Public surface for the ctx-metadata store.\n *\n * @see docs/proposals/decisioning-platform-v6-1-ctx-metadata.md\n * @public\n */\n\nexport {\n  createCtxMetadataStore,\n  ctxMetadataResultKey,\n  scopeCtxMetadataKey,\n  CtxMetadataValidationError,\n  ADCP_INTERNAL_TAG,\n  DEFAULT_MAX_VALUE_BYTES,\n  MAX_TTL_SECONDS,\n} from './store';\n\nexport type {\n  CtxMetadataStore,\n  CtxMetadataStoreConfig,\n  CtxMetadataBackend,\n  CtxMetadataEntry,\n  CtxMetadataRef,\n  ResourceKind,\n} from './store';\n\nexport { memoryCtxMetadataStore } from './backends/memory';\nexport type { MemoryCtxMetadataStoreOptions } from './backends/memory';\n\nexport {\n  pgCtxMetadataStore,\n  getCtxMetadataMigration,\n  cleanupExpiredCtxMetadata,\n  CTX_METADATA_MIGRATION,\n} from './backends/pg';\nexport type { PgCtxMetadataBackendOptions } from './backends/pg';\n\nexport { redisCtxMetadataStore } from './backends/redis';\nexport type {\n  RedisCtxMetadataBackendOptions,\n  CtxMetadataRedisBackendClient,\n  CtxMetadataRedisLikeClient,\n} from './backends/redis';\n\nexport { stripCtxMetadata, hasCtxMetadata, stripImplementationConfig, hasImplementationConfig } from './wire-shape';\nexport type { WireShape } from './wire-shape';\n"],"mappings":";;;;;;AAOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP,SAAS,8BAA8B;AAGvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,6BAA6B;AAOtC,SAAS,kBAAkB,gBAAgB,2BAA2B,+BAA+B;","names":[]}
+{"version":3,"sources":["../../../../src/lib/server/ctx-metadata/index.ts"],"sourcesContent":["/**\n * Public surface for the ctx-metadata store.\n *\n * @see docs/proposals/decisioning-platform-v6-1-ctx-metadata.md\n * @public\n */\n\nexport {\n  createCtxMetadataStore,\n  ctxMetadataResultKey,\n  scopeCtxMetadataKey,\n  CtxMetadataValidationError,\n  ADCP_INTERNAL_TAG,\n  DEFAULT_MAX_VALUE_BYTES,\n  MAX_TTL_SECONDS,\n} from './store';\n\nexport type {\n  CtxMetadataStore,\n  CtxMetadataStoreConfig,\n  CtxMetadataBackend,\n  CtxMetadataEntry,\n  CtxMetadataRef,\n  ResourceKind,\n} from './store';\n\nexport { memoryCtxMetadataStore } from './backends/memory';\nexport type { MemoryCtxMetadataStoreOptions } from './backends/memory';\n\nexport {\n  pgCtxMetadataStore,\n  getCtxMetadataMigration,\n  cleanupExpiredCtxMetadata,\n  CTX_METADATA_MIGRATION,\n} from './backends/pg';\nexport type { PgCtxMetadataBackendOptions } from './backends/pg';\n\nexport { redisCtxMetadataStore } from './backends/redis';\nexport type {\n  RedisCtxMetadataBackendOptions,\n  CtxMetadataRedisBackendClient,\n  CtxMetadataRedisLikeClient,\n} from './backends/redis';\n\nexport { stripCtxMetadata, hasCtxMetadata, stripImplementationConfig, hasImplementationConfig } from './wire-shape';\nexport type { WireShape } from './wire-shape';\n"],"mappings":"AAOA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAWP,SAAS,8BAA8B;AAGvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,6BAA6B;AAOtC,SAAS,kBAAkB,gBAAgB,2BAA2B,+BAA+B;","names":[]}

package/dist/lib/server/ctx-metadata/store.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 const ALL_RESOURCE_KINDS = [
   "account",
   "product",

package/dist/lib/server/ctx-metadata/store.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/server/ctx-metadata/store.ts"],"sourcesContent":["/**\n * Ctx-metadata store for AdCP server handlers.\n *\n * Publishers attach platform-specific opaque blobs to any returned\n * resource (product, media_buy, package, creative, audience, signal,\n * rights_grant). The framework persists the blob keyed by\n * `(account_id, kind, id)`, strips it from buyer-facing wire payloads,\n * and threads it back into the publisher's request context on\n * subsequent calls referencing the same resource ID.\n *\n * Use case: GAM ad_unit_ids per product, GAM order_id per media_buy,\n * line_item_id per package — adapter-internal state the AdCP wire\n * spec doesn't model. Avoids forcing publishers to re-derive on every\n * call or maintain a side-cache the SDK could provide.\n *\n * Scope is `(account_id, kind, id)` — keys are tenant-isolated. No\n * auto-eviction by design (a media buy lifetime can be months).\n * Adopter-driven cleanup via `cleanupExpiredCtxMetadata(db)` for\n * Postgres deployments that opt into row-level `expires_at`.\n *\n * @example\n * ```ts\n * import { createCtxMetadataStore, memoryCtxMetadataStore } from '@adcp/sdk/server';\n *\n * const store = createCtxMetadataStore({ backend: memoryCtxMetadataStore() });\n *\n * createAdcpServerFromPlatform({ platform, ctxMetadata: store });\n * ```\n *\n * @public\n */\n\n/**\n * Resource kinds the ctx-metadata store recognizes. Closed enum:\n * adding a new kind is a coordinated change across the framework\n * dispatch (which kinds get hydrated on which request shapes).\n */\nexport type ResourceKind =\n  | 'account'\n  | 'product'\n  | 'media_buy'\n  | 'package'\n  | 'creative'\n  | 'audience'\n  | 'signal'\n  | 'rights_grant'\n  | 'property_list'\n  | 'collection_list'\n  | 'si_session';\n\nconst ALL_RESOURCE_KINDS: readonly ResourceKind[] = [\n  'account',\n  'product',\n  'media_buy',\n  'package',\n  'creative',\n  'audience',\n  'signal',\n  'rights_grant',\n  'property_list',\n  'collection_list',\n  'si_session',\n];\n\n/**\n * Default size cap on serialized blob, in bytes. Crossed → `CTX_METADATA_TOO_LARGE`.\n *\n * Memory backend without a cap is a single-node DoS vector; Postgres\n * JSONB performance dies at scale before disk does. 16KB covers the\n * common case (ad_unit_ids arrays, key-value targeting maps) with\n * room to spare.\n */\nexport const DEFAULT_MAX_VALUE_BYTES = 16 * 1024;\n\n/**\n * Maximum allowed TTL in seconds. Crossed → throws at `set()`.\n *\n * Lifetime of a media buy can be months, but unbounded retention\n * compounds drift between SDK cache and publisher truth. 30 days is\n * the soft ceiling; cleanup is adopter-driven beyond that.\n */\nexport const MAX_TTL_SECONDS = 30 * 24 * 60 * 60;\n\n/**\n * Account ID and resource ID shape allowlist. Excludes the U+001F\n * separator used in the flattened storage key, NUL bytes that\n * Postgres TEXT rejects, and anything else that could confuse the\n * key parser.\n */\nconst VALID_KEY_SEGMENT = /^[A-Za-z0-9_.:\\-]{1,255}$/;\n\n/**\n * Symbol tag attached to retrieved blobs. Symbols don't survive\n * `JSON.stringify`, so an accidental serialization in error envelopes\n * / log lines / agent-card payloads silently elides the blob.\n * Defense-in-depth against LLM-context leaks.\n */\nexport const ADCP_INTERNAL_TAG = Symbol.for('adcp.ctx_metadata.internal');\n\nexport interface CtxMetadataEntry {\n  /** Opaque publisher-attached value. Untouched by the framework. */\n  value: unknown;\n  /**\n   * SDK-attached AdCP wire resource shape (e.g., the full `Product` /\n   * `MediaBuy` / `Creative` object minus `ctx_metadata`). Populated by\n   * the framework's auto-hydration path, not by adopter code.\n   *\n   * Used to reconstruct a hydrated resource on subsequent calls that\n   * reference the same id by string. Buyer sends `product_id: 'p1'`;\n   * SDK looks up the entry, builds `{ ...resource, ctx_metadata: value }`,\n   * attaches as `req.packages[i].product`.\n   *\n   * Adopter code never reads or writes this field — the framework owns\n   * it end-to-end.\n   */\n  resource?: unknown;\n  /** Optional unix epoch seconds expiry. Informational; no auto-eviction. */\n  expiresAt?: number;\n}\n\n/**\n * Storage backend interface. Swap implementations for memory / Postgres / Redis.\n *\n * Keys are flattened to `${accountId}\u001f${kind}\u001f${id}` before\n * reaching the backend. Validation runs before flattening — backends\n * trust their inputs.\n */\nexport interface CtxMetadataBackend {\n  get(scopedKey: string): Promise<CtxMetadataEntry | null>;\n  bulkGet(scopedKeys: readonly string[]): Promise<Map<string, CtxMetadataEntry>>;\n  put(scopedKey: string, entry: CtxMetadataEntry): Promise<void>;\n  delete(scopedKey: string): Promise<void>;\n  /** Optional startup probe. Implementations wrapping an external store should implement. */\n  probe?(): Promise<void>;\n  /** Optional resource-release hook. Called by `store.close()`. */\n  close?(): Promise<void>;\n  /** Optional test-harness flush. Used by `compliance.reset()` between storyboards. */\n  clearAll?(): Promise<void>;\n}\n\nexport interface CtxMetadataStoreConfig {\n  /** Storage backend. Use `memoryCtxMetadataStore()` for dev, `pgCtxMetadataStore(pool)` for cluster. */\n  backend: CtxMetadataBackend;\n  /**\n   * Max serialized blob size in bytes. Defaults to 16384 (16KB).\n   * Crossed → `CTX_METADATA_TOO_LARGE` thrown at `set()`.\n   */\n  maxValueBytes?: number;\n}\n\n/**\n * Reference to a stored entry. `bulkGet` accepts an array of these;\n * the resulting Map is keyed by `${kind}:${id}` for caller convenience.\n */\nexport interface CtxMetadataRef {\n  kind: ResourceKind;\n  id: string;\n}\n\nexport interface CtxMetadataStore {\n  /**\n   * Look up a single entry. Returns `undefined` (not `null`) for misses\n   * so publishers can branch with `??` against their own DB.\n   *\n   * Returned values carry a non-enumerable `[ADCP_INTERNAL_TAG]: true`\n   * marker — JSON serialization elides it automatically (defense\n   * against accidental leak via error envelopes and log lines).\n   */\n  get(accountId: string, kind: ResourceKind, id: string): Promise<unknown | undefined>;\n\n  /**\n   * Bulk lookup. Returns a Map keyed by `${kind}:${id}` so callers\n   * with mixed-kind refs (e.g., `create_media_buy` carrying products\n   * + an audience ref) can index without remembering what they asked for.\n   * Misses are absent from the Map (no `undefined` entries).\n   */\n  bulkGet(accountId: string, refs: readonly CtxMetadataRef[]): Promise<ReadonlyMap<string, unknown>>;\n\n  /**\n   * Store a blob. Throws `CTX_METADATA_TOO_LARGE` if `JSON.stringify(value).length`\n   * exceeds the configured cap. Throws `INVALID_ARGUMENT` for null/undefined/empty\n   * `accountId` or out-of-shape `id`.\n   *\n   * `ttlSeconds` is optional and capped at 30 days. No auto-eviction.\n   */\n  set(accountId: string, kind: ResourceKind, id: string, value: unknown, ttlSeconds?: number): Promise<void>;\n\n  /**\n   * Framework-only: persist the wire resource alongside the publisher's\n   * `ctx_metadata` blob. Called by the dispatch seam after a publisher\n   * returns a resource (Product, MediaBuy, etc.) so subsequent calls\n   * referencing that id by string can hydrate the full object.\n   *\n   * Adopter code does NOT call this — wire resource caching is the\n   * framework's job. Public-but-internal: lives on the interface so\n   * the dispatch layer doesn't need a privileged store handle.\n   *\n   * @internal — adopter code should use `set()`. The framework calls this.\n   */\n  setEntry(accountId: string, kind: ResourceKind, id: string, entry: CtxMetadataEntry): Promise<void>;\n\n  /**\n   * Framework-only: update the wire resource for an existing or new\n   * entry while preserving the publisher's `value` (ctx_metadata blob).\n   * Called by the auto-store path so a publisher's prior\n   * `ctx.ctxMetadata.set('product', id, blob)` is NOT overwritten when\n   * the publisher returns the product without `ctx_metadata` on the\n   * wire shape.\n   *\n   * Update semantics:\n   *   - If entry exists: merge — keep prior `value`, set new `resource`,\n   *     keep prior `expiresAt`.\n   *   - If entry doesn't exist: create with `value: priorValue ?? null`,\n   *     `resource: resource`.\n   *   - If `priorValue` is provided AND the publisher returned ctx_metadata\n   *     on the resource (non-null priorValue param), the new value wins.\n   *\n   * @internal\n   */\n  setResource(\n    accountId: string,\n    kind: ResourceKind,\n    id: string,\n    resource: unknown,\n    publisherCtxMetadata?: unknown\n  ): Promise<void>;\n\n  /**\n   * Framework-only: lookup the full entry (value + resource) by id.\n   * Used by the auto-hydration path to reconstruct hydrated resources.\n   * Adopter code uses `get()` for the value alone.\n   *\n   * @internal\n   */\n  getEntry(accountId: string, kind: ResourceKind, id: string): Promise<CtxMetadataEntry | undefined>;\n\n  /**\n   * Framework-only: bulk variant of `getEntry`.\n   * @internal\n   */\n  bulkGetEntries(accountId: string, refs: readonly CtxMetadataRef[]): Promise<ReadonlyMap<string, CtxMetadataEntry>>;\n\n  /** Delete a single entry. Tenant-scoped via `accountId`. */\n  delete(accountId: string, kind: ResourceKind, id: string): Promise<void>;\n\n  /** Probe the backend for boot-time readiness. */\n  probe(): Promise<void>;\n\n  /** Release backend resources (close pools, clear timers). */\n  close(): Promise<void>;\n\n  /** Test-harness reset. Throws if backend doesn't support it (no `force` opt — production safety). */\n  clearAll(): Promise<void>;\n}\n\n/**\n * Validation error thrown for bad input shape. Distinct from\n * `CTX_METADATA_TOO_LARGE` (size violation) so callers can branch.\n */\nexport class CtxMetadataValidationError extends Error {\n  constructor(\n    public readonly code: 'INVALID_ARGUMENT' | 'CTX_METADATA_TOO_LARGE',\n    message: string\n  ) {\n    super(message);\n    this.name = 'CtxMetadataValidationError';\n  }\n}\n\n/**\n * Compose the flattened storage key. Internal — backends trust this format.\n */\nexport function scopeCtxMetadataKey(accountId: string, kind: ResourceKind, id: string): string {\n  return `${accountId}\u001f${kind}\u001f${id}`;\n}\n\n/**\n * Compose the bulkGet result key. External — callers index Map entries by this.\n */\nexport function ctxMetadataResultKey(kind: ResourceKind, id: string): string {\n  return `${kind}:${id}`;\n}\n\nfunction validateAccountId(accountId: string): void {\n  if (accountId == null || accountId === '') {\n    throw new CtxMetadataValidationError(\n      'INVALID_ARGUMENT',\n      'ctx_metadata requires an account scope. No-account tools (provide_performance_feedback, ' +\n        'list_creative_formats) cannot use ctx_metadata.'\n    );\n  }\n  if (!VALID_KEY_SEGMENT.test(accountId)) {\n    throw new CtxMetadataValidationError(\n      'INVALID_ARGUMENT',\n      `Invalid accountId shape: must match ${VALID_KEY_SEGMENT}`\n    );\n  }\n}\n\nfunction validateResourceId(id: string): void {\n  if (id == null || id === '') {\n    throw new CtxMetadataValidationError('INVALID_ARGUMENT', 'ctx_metadata resource id must be non-empty');\n  }\n  if (!VALID_KEY_SEGMENT.test(id)) {\n    throw new CtxMetadataValidationError(\n      'INVALID_ARGUMENT',\n      `Invalid resource id shape: must match ${VALID_KEY_SEGMENT}`\n    );\n  }\n}\n\nfunction validateResourceKind(kind: ResourceKind): void {\n  if (!ALL_RESOURCE_KINDS.includes(kind)) {\n    throw new CtxMetadataValidationError('INVALID_ARGUMENT', `Unknown ctx_metadata resource kind: ${kind}`);\n  }\n}\n\nfunction tagInternal<T>(value: T): T {\n  if (value == null || typeof value !== 'object') return value;\n  Object.defineProperty(value as object, ADCP_INTERNAL_TAG, {\n    value: true,\n    enumerable: false,\n    writable: false,\n    configurable: false,\n  });\n  return value;\n}\n\n/**\n * Build a CtxMetadataStore wrapping a backend.\n *\n * Memory backend is fine for single-process dev. Cluster deployments\n * MUST use `pgCtxMetadataStore` — silent ctx_metadata loss after a\n * rolling restart produces \"package not found\" errors that look like\n * publisher bugs and run for weeks.\n */\nexport function createCtxMetadataStore(config: CtxMetadataStoreConfig): CtxMetadataStore {\n  const backend = config.backend;\n  const maxValueBytes = config.maxValueBytes ?? DEFAULT_MAX_VALUE_BYTES;\n\n  return {\n    async get(accountId, kind, id) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      const entry = await backend.get(scopeCtxMetadataKey(accountId, kind, id));\n      if (!entry) return undefined;\n      if (entry.expiresAt != null && entry.expiresAt < Math.floor(Date.now() / 1000)) {\n        return undefined;\n      }\n      return tagInternal(entry.value);\n    },\n\n    async bulkGet(accountId, refs) {\n      validateAccountId(accountId);\n      if (refs.length === 0) return new Map();\n      const scopedKeys: string[] = [];\n      const scopedToResultKey = new Map<string, string>();\n      for (const ref of refs) {\n        validateResourceKind(ref.kind);\n        validateResourceId(ref.id);\n        const scoped = scopeCtxMetadataKey(accountId, ref.kind, ref.id);\n        scopedKeys.push(scoped);\n        scopedToResultKey.set(scoped, ctxMetadataResultKey(ref.kind, ref.id));\n      }\n      const entries = await backend.bulkGet(scopedKeys);\n      const result = new Map<string, unknown>();\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      for (const [scopedKey, entry] of entries) {\n        if (entry.expiresAt != null && entry.expiresAt < nowSeconds) continue;\n        const resultKey = scopedToResultKey.get(scopedKey);\n        if (resultKey != null) result.set(resultKey, tagInternal(entry.value));\n      }\n      return result;\n    },\n\n    async set(accountId, kind, id, value, ttlSeconds) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      if (ttlSeconds != null) {\n        if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) {\n          throw new CtxMetadataValidationError('INVALID_ARGUMENT', 'ttlSeconds must be a positive finite number');\n        }\n        if (ttlSeconds > MAX_TTL_SECONDS) {\n          throw new CtxMetadataValidationError(\n            'INVALID_ARGUMENT',\n            `ttlSeconds exceeds the 30-day maximum (${MAX_TTL_SECONDS}s)`\n          );\n        }\n      }\n      const serialized = JSON.stringify(value);\n      if (serialized == null) {\n        throw new CtxMetadataValidationError(\n          'INVALID_ARGUMENT',\n          'ctx_metadata value must be JSON-serializable (got undefined / function / symbol)'\n        );\n      }\n      const byteLen = Buffer.byteLength(serialized, 'utf8');\n      if (byteLen > maxValueBytes) {\n        throw new CtxMetadataValidationError(\n          'CTX_METADATA_TOO_LARGE',\n          `ctx_metadata blob is ${byteLen} bytes, exceeds the configured cap of ${maxValueBytes} bytes ` +\n            `for ${kind}:${id}. Offload large payloads to your own storage and reference by ID.`\n        );\n      }\n      const expiresAt = ttlSeconds != null ? Math.floor(Date.now() / 1000) + ttlSeconds : undefined;\n      // Preserve any prior `resource` from the framework-managed entry —\n      // adopter `set()` only mutates `value`. The dispatch seam writes\n      // resource via `setEntry`.\n      const prior = await backend.get(scopeCtxMetadataKey(accountId, kind, id));\n      const next: CtxMetadataEntry = {\n        value,\n        ...(prior?.resource !== undefined && { resource: prior.resource }),\n        ...(expiresAt !== undefined\n          ? { expiresAt }\n          : prior?.expiresAt !== undefined\n            ? { expiresAt: prior.expiresAt }\n            : {}),\n      };\n      await backend.put(scopeCtxMetadataKey(accountId, kind, id), next);\n    },\n\n    async setEntry(accountId, kind, id, entry) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      // Cap applied to the COMBINED serialization (value + resource) since\n      // both round-trip together. Use the same upstream message so adopters\n      // see the same diagnostic surface.\n      const serialized = JSON.stringify({ value: entry.value, resource: entry.resource });\n      const byteLen = Buffer.byteLength(serialized, 'utf8');\n      if (byteLen > maxValueBytes) {\n        throw new CtxMetadataValidationError(\n          'CTX_METADATA_TOO_LARGE',\n          `ctx_metadata combined blob is ${byteLen} bytes, exceeds the configured cap of ${maxValueBytes} bytes ` +\n            `for ${kind}:${id}. Offload large payloads to your own storage and reference by ID.`\n        );\n      }\n      await backend.put(scopeCtxMetadataKey(accountId, kind, id), entry);\n    },\n\n    async setResource(accountId, kind, id, resource, publisherCtxMetadata) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      const scopedKey = scopeCtxMetadataKey(accountId, kind, id);\n      const prior = await backend.get(scopedKey);\n      // Resolve the value to persist:\n      //   - publisher returned ctx_metadata on the wire shape → use it (overrides prior)\n      //   - publisher omitted ctx_metadata → preserve prior value (don't clobber)\n      //   - no prior, no publisher value → store null\n      const nextValue =\n        publisherCtxMetadata !== undefined && publisherCtxMetadata !== null\n          ? publisherCtxMetadata\n          : (prior?.value ?? null);\n      const nextEntry: CtxMetadataEntry = {\n        value: nextValue,\n        resource,\n        ...(prior?.expiresAt !== undefined && { expiresAt: prior.expiresAt }),\n      };\n      // Apply the same size cap used by setEntry.\n      const serialized = JSON.stringify({ value: nextEntry.value, resource: nextEntry.resource });\n      const byteLen = Buffer.byteLength(serialized, 'utf8');\n      if (byteLen > maxValueBytes) {\n        throw new CtxMetadataValidationError(\n          'CTX_METADATA_TOO_LARGE',\n          `ctx_metadata combined blob is ${byteLen} bytes, exceeds the configured cap of ${maxValueBytes} bytes ` +\n            `for ${kind}:${id}. Offload large payloads to your own storage and reference by ID.`\n        );\n      }\n      await backend.put(scopedKey, nextEntry);\n    },\n\n    async getEntry(accountId, kind, id) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      const entry = await backend.get(scopeCtxMetadataKey(accountId, kind, id));\n      if (!entry) return undefined;\n      if (entry.expiresAt != null && entry.expiresAt < Math.floor(Date.now() / 1000)) {\n        return undefined;\n      }\n      return entry;\n    },\n\n    async bulkGetEntries(accountId, refs) {\n      validateAccountId(accountId);\n      if (refs.length === 0) return new Map();\n      const scopedKeys: string[] = [];\n      const scopedToResultKey = new Map<string, string>();\n      for (const ref of refs) {\n        validateResourceKind(ref.kind);\n        validateResourceId(ref.id);\n        const scoped = scopeCtxMetadataKey(accountId, ref.kind, ref.id);\n        scopedKeys.push(scoped);\n        scopedToResultKey.set(scoped, ctxMetadataResultKey(ref.kind, ref.id));\n      }\n      const entries = await backend.bulkGet(scopedKeys);\n      const result = new Map<string, CtxMetadataEntry>();\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      for (const [scopedKey, entry] of entries) {\n        if (entry.expiresAt != null && entry.expiresAt < nowSeconds) continue;\n        const resultKey = scopedToResultKey.get(scopedKey);\n        if (resultKey != null) result.set(resultKey, entry);\n      }\n      return result;\n    },\n\n    async delete(accountId, kind, id) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      await backend.delete(scopeCtxMetadataKey(accountId, kind, id));\n    },\n\n    async probe() {\n      if (backend.probe) await backend.probe();\n    },\n\n    async close() {\n      if (backend.close) await backend.close();\n    },\n\n    async clearAll() {\n      if (!backend.clearAll) {\n        throw new Error(\n          'ctx_metadata backend does not support clearAll(). ' +\n            'Production backends (e.g., shared Postgres) should refuse this; use memory backend for tests.'\n        );\n      }\n      await backend.clearAll();\n    },\n  };\n}\n"],"mappings":";;;;;;AAkDA,MAAM,qBAA8C;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAUO,MAAM,0BAA0B,KAAK;AASrC,MAAM,kBAAkB,KAAK,KAAK,KAAK;AAQ9C,MAAM,oBAAoB;AAQnB,MAAM,oBAAoB,uBAAO,IAAI,4BAA4B;AAkKjE,MAAM,mCAAmC,MAAM;AAAA,EACpD,YACkB,MAChB,SACA;AACA,UAAM,OAAO;AAHG;AAIhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAMpB;AAKO,SAAS,oBAAoB,WAAmB,MAAoB,IAAoB;AAC7F,SAAO,GAAG,SAAS,IAAI,IAAI,IAAI,EAAE;AACnC;AAKO,SAAS,qBAAqB,MAAoB,IAAoB;AAC3E,SAAO,GAAG,IAAI,IAAI,EAAE;AACtB;AAEA,SAAS,kBAAkB,WAAyB;AAClD,MAAI,aAAa,QAAQ,cAAc,IAAI;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AACA,MAAI,CAAC,kBAAkB,KAAK,SAAS,GAAG;AACtC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,uCAAuC,iBAAiB;AAAA,IAC1D;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,IAAkB;AAC5C,MAAI,MAAM,QAAQ,OAAO,IAAI;AAC3B,UAAM,IAAI,2BAA2B,oBAAoB,4CAA4C;AAAA,EACvG;AACA,MAAI,CAAC,kBAAkB,KAAK,EAAE,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,yCAAyC,iBAAiB;AAAA,IAC5D;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,MAA0B;AACtD,MAAI,CAAC,mBAAmB,SAAS,IAAI,GAAG;AACtC,UAAM,IAAI,2BAA2B,oBAAoB,uCAAuC,IAAI,EAAE;AAAA,EACxG;AACF;AAEA,SAAS,YAAe,OAAa;AACnC,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,SAAO,eAAe,OAAiB,mBAAmB;AAAA,IACxD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,cAAc;AAAA,EAChB,CAAC;AACD,SAAO;AACT;AAUO,SAAS,uBAAuB,QAAkD;AACvF,QAAM,UAAU,OAAO;AACvB,QAAM,gBAAgB,OAAO,iBAAiB;AAE9C,SAAO;AAAA,IACL,MAAM,IAAI,WAAW,MAAM,IAAI;AAC7B,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,YAAM,QAAQ,MAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,CAAC;AACxE,UAAI,CAAC,MAAO,QAAO;AACnB,UAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AAC9E,eAAO;AAAA,MACT;AACA,aAAO,YAAY,MAAM,KAAK;AAAA,IAChC;AAAA,IAEA,MAAM,QAAQ,WAAW,MAAM;AAC7B,wBAAkB,SAAS;AAC3B,UAAI,KAAK,WAAW,EAAG,QAAO,oBAAI,IAAI;AACtC,YAAM,aAAuB,CAAC;AAC9B,YAAM,oBAAoB,oBAAI,IAAoB;AAClD,iBAAW,OAAO,MAAM;AACtB,6BAAqB,IAAI,IAAI;AAC7B,2BAAmB,IAAI,EAAE;AACzB,cAAM,SAAS,oBAAoB,WAAW,IAAI,MAAM,IAAI,EAAE;AAC9D,mBAAW,KAAK,MAAM;AACtB,0BAAkB,IAAI,QAAQ,qBAAqB,IAAI,MAAM,IAAI,EAAE,CAAC;AAAA,MACtE;AACA,YAAM,UAAU,MAAM,QAAQ,QAAQ,UAAU;AAChD,YAAM,SAAS,oBAAI,IAAqB;AACxC,YAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,iBAAW,CAAC,WAAW,KAAK,KAAK,SAAS;AACxC,YAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,WAAY;AAC7D,cAAM,YAAY,kBAAkB,IAAI,SAAS;AACjD,YAAI,aAAa,KAAM,QAAO,IAAI,WAAW,YAAY,MAAM,KAAK,CAAC;AAAA,MACvE;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,WAAW,MAAM,IAAI,OAAO,YAAY;AAChD,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,UAAI,cAAc,MAAM;AACtB,YAAI,CAAC,OAAO,SAAS,UAAU,KAAK,cAAc,GAAG;AACnD,gBAAM,IAAI,2BAA2B,oBAAoB,6CAA6C;AAAA,QACxG;AACA,YAAI,aAAa,iBAAiB;AAChC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,0CAA0C,eAAe;AAAA,UAC3D;AAAA,QACF;AAAA,MACF;AACA,YAAM,aAAa,KAAK,UAAU,KAAK;AACvC,UAAI,cAAc,MAAM;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,UAAU,OAAO,WAAW,YAAY,MAAM;AACpD,UAAI,UAAU,eAAe;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,wBAAwB,OAAO,yCAAyC,aAAa,cAC5E,IAAI,IAAI,EAAE;AAAA,QACrB;AAAA,MACF;AACA,YAAM,YAAY,cAAc,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,aAAa;AAIpF,YAAM,QAAQ,MAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,CAAC;AACxE,YAAM,OAAyB;AAAA,QAC7B;AAAA,QACA,GAAI,OAAO,aAAa,UAAa,EAAE,UAAU,MAAM,SAAS;AAAA,QAChE,GAAI,cAAc,SACd,EAAE,UAAU,IACZ,OAAO,cAAc,SACnB,EAAE,WAAW,MAAM,UAAU,IAC7B,CAAC;AAAA,MACT;AACA,YAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,GAAG,IAAI;AAAA,IAClE;AAAA,IAEA,MAAM,SAAS,WAAW,MAAM,IAAI,OAAO;AACzC,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AAIrB,YAAM,aAAa,KAAK,UAAU,EAAE,OAAO,MAAM,OAAO,UAAU,MAAM,SAAS,CAAC;AAClF,YAAM,UAAU,OAAO,WAAW,YAAY,MAAM;AACpD,UAAI,UAAU,eAAe;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,iCAAiC,OAAO,yCAAyC,aAAa,cACrF,IAAI,IAAI,EAAE;AAAA,QACrB;AAAA,MACF;AACA,YAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,GAAG,KAAK;AAAA,IACnE;AAAA,IAEA,MAAM,YAAY,WAAW,MAAM,IAAI,UAAU,sBAAsB;AACrE,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,YAAM,YAAY,oBAAoB,WAAW,MAAM,EAAE;AACzD,YAAM,QAAQ,MAAM,QAAQ,IAAI,SAAS;AAKzC,YAAM,YACJ,yBAAyB,UAAa,yBAAyB,OAC3D,uBACC,OAAO,SAAS;AACvB,YAAM,YAA8B;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,QACA,GAAI,OAAO,cAAc,UAAa,EAAE,WAAW,MAAM,UAAU;AAAA,MACrE;AAEA,YAAM,aAAa,KAAK,UAAU,EAAE,OAAO,UAAU,OAAO,UAAU,UAAU,SAAS,CAAC;AAC1F,YAAM,UAAU,OAAO,WAAW,YAAY,MAAM;AACpD,UAAI,UAAU,eAAe;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,iCAAiC,OAAO,yCAAyC,aAAa,cACrF,IAAI,IAAI,EAAE;AAAA,QACrB;AAAA,MACF;AACA,YAAM,QAAQ,IAAI,WAAW,SAAS;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,WAAW,MAAM,IAAI;AAClC,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,YAAM,QAAQ,MAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,CAAC;AACxE,UAAI,CAAC,MAAO,QAAO;AACnB,UAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AAC9E,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,eAAe,WAAW,MAAM;AACpC,wBAAkB,SAAS;AAC3B,UAAI,KAAK,WAAW,EAAG,QAAO,oBAAI,IAAI;AACtC,YAAM,aAAuB,CAAC;AAC9B,YAAM,oBAAoB,oBAAI,IAAoB;AAClD,iBAAW,OAAO,MAAM;AACtB,6BAAqB,IAAI,IAAI;AAC7B,2BAAmB,IAAI,EAAE;AACzB,cAAM,SAAS,oBAAoB,WAAW,IAAI,MAAM,IAAI,EAAE;AAC9D,mBAAW,KAAK,MAAM;AACtB,0BAAkB,IAAI,QAAQ,qBAAqB,IAAI,MAAM,IAAI,EAAE,CAAC;AAAA,MACtE;AACA,YAAM,UAAU,MAAM,QAAQ,QAAQ,UAAU;AAChD,YAAM,SAAS,oBAAI,IAA8B;AACjD,YAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,iBAAW,CAAC,WAAW,KAAK,KAAK,SAAS;AACxC,YAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,WAAY;AAC7D,cAAM,YAAY,kBAAkB,IAAI,SAAS;AACjD,YAAI,aAAa,KAAM,QAAO,IAAI,WAAW,KAAK;AAAA,MACpD;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,WAAW,MAAM,IAAI;AAChC,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,YAAM,QAAQ,OAAO,oBAAoB,WAAW,MAAM,EAAE,CAAC;AAAA,IAC/D;AAAA,IAEA,MAAM,QAAQ;AACZ,UAAI,QAAQ,MAAO,OAAM,QAAQ,MAAM;AAAA,IACzC;AAAA,IAEA,MAAM,QAAQ;AACZ,UAAI,QAAQ,MAAO,OAAM,QAAQ,MAAM;AAAA,IACzC;AAAA,IAEA,MAAM,WAAW;AACf,UAAI,CAAC,QAAQ,UAAU;AACrB,cAAM,IAAI;AAAA,UACR;AAAA,QAEF;AAAA,MACF;AACA,YAAM,QAAQ,SAAS;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/server/ctx-metadata/store.ts"],"sourcesContent":["/**\n * Ctx-metadata store for AdCP server handlers.\n *\n * Publishers attach platform-specific opaque blobs to any returned\n * resource (product, media_buy, package, creative, audience, signal,\n * rights_grant). The framework persists the blob keyed by\n * `(account_id, kind, id)`, strips it from buyer-facing wire payloads,\n * and threads it back into the publisher's request context on\n * subsequent calls referencing the same resource ID.\n *\n * Use case: GAM ad_unit_ids per product, GAM order_id per media_buy,\n * line_item_id per package — adapter-internal state the AdCP wire\n * spec doesn't model. Avoids forcing publishers to re-derive on every\n * call or maintain a side-cache the SDK could provide.\n *\n * Scope is `(account_id, kind, id)` — keys are tenant-isolated. No\n * auto-eviction by design (a media buy lifetime can be months).\n * Adopter-driven cleanup via `cleanupExpiredCtxMetadata(db)` for\n * Postgres deployments that opt into row-level `expires_at`.\n *\n * @example\n * ```ts\n * import { createCtxMetadataStore, memoryCtxMetadataStore } from '@adcp/sdk/server';\n *\n * const store = createCtxMetadataStore({ backend: memoryCtxMetadataStore() });\n *\n * createAdcpServerFromPlatform({ platform, ctxMetadata: store });\n * ```\n *\n * @public\n */\n\n/**\n * Resource kinds the ctx-metadata store recognizes. Closed enum:\n * adding a new kind is a coordinated change across the framework\n * dispatch (which kinds get hydrated on which request shapes).\n */\nexport type ResourceKind =\n  | 'account'\n  | 'product'\n  | 'media_buy'\n  | 'package'\n  | 'creative'\n  | 'audience'\n  | 'signal'\n  | 'rights_grant'\n  | 'property_list'\n  | 'collection_list'\n  | 'si_session';\n\nconst ALL_RESOURCE_KINDS: readonly ResourceKind[] = [\n  'account',\n  'product',\n  'media_buy',\n  'package',\n  'creative',\n  'audience',\n  'signal',\n  'rights_grant',\n  'property_list',\n  'collection_list',\n  'si_session',\n];\n\n/**\n * Default size cap on serialized blob, in bytes. Crossed → `CTX_METADATA_TOO_LARGE`.\n *\n * Memory backend without a cap is a single-node DoS vector; Postgres\n * JSONB performance dies at scale before disk does. 16KB covers the\n * common case (ad_unit_ids arrays, key-value targeting maps) with\n * room to spare.\n */\nexport const DEFAULT_MAX_VALUE_BYTES = 16 * 1024;\n\n/**\n * Maximum allowed TTL in seconds. Crossed → throws at `set()`.\n *\n * Lifetime of a media buy can be months, but unbounded retention\n * compounds drift between SDK cache and publisher truth. 30 days is\n * the soft ceiling; cleanup is adopter-driven beyond that.\n */\nexport const MAX_TTL_SECONDS = 30 * 24 * 60 * 60;\n\n/**\n * Account ID and resource ID shape allowlist. Excludes the U+001F\n * separator used in the flattened storage key, NUL bytes that\n * Postgres TEXT rejects, and anything else that could confuse the\n * key parser.\n */\nconst VALID_KEY_SEGMENT = /^[A-Za-z0-9_.:\\-]{1,255}$/;\n\n/**\n * Symbol tag attached to retrieved blobs. Symbols don't survive\n * `JSON.stringify`, so an accidental serialization in error envelopes\n * / log lines / agent-card payloads silently elides the blob.\n * Defense-in-depth against LLM-context leaks.\n */\nexport const ADCP_INTERNAL_TAG = Symbol.for('adcp.ctx_metadata.internal');\n\nexport interface CtxMetadataEntry {\n  /** Opaque publisher-attached value. Untouched by the framework. */\n  value: unknown;\n  /**\n   * SDK-attached AdCP wire resource shape (e.g., the full `Product` /\n   * `MediaBuy` / `Creative` object minus `ctx_metadata`). Populated by\n   * the framework's auto-hydration path, not by adopter code.\n   *\n   * Used to reconstruct a hydrated resource on subsequent calls that\n   * reference the same id by string. Buyer sends `product_id: 'p1'`;\n   * SDK looks up the entry, builds `{ ...resource, ctx_metadata: value }`,\n   * attaches as `req.packages[i].product`.\n   *\n   * Adopter code never reads or writes this field — the framework owns\n   * it end-to-end.\n   */\n  resource?: unknown;\n  /** Optional unix epoch seconds expiry. Informational; no auto-eviction. */\n  expiresAt?: number;\n}\n\n/**\n * Storage backend interface. Swap implementations for memory / Postgres / Redis.\n *\n * Keys are flattened to `${accountId}\u001f${kind}\u001f${id}` before\n * reaching the backend. Validation runs before flattening — backends\n * trust their inputs.\n */\nexport interface CtxMetadataBackend {\n  get(scopedKey: string): Promise<CtxMetadataEntry | null>;\n  bulkGet(scopedKeys: readonly string[]): Promise<Map<string, CtxMetadataEntry>>;\n  put(scopedKey: string, entry: CtxMetadataEntry): Promise<void>;\n  delete(scopedKey: string): Promise<void>;\n  /** Optional startup probe. Implementations wrapping an external store should implement. */\n  probe?(): Promise<void>;\n  /** Optional resource-release hook. Called by `store.close()`. */\n  close?(): Promise<void>;\n  /** Optional test-harness flush. Used by `compliance.reset()` between storyboards. */\n  clearAll?(): Promise<void>;\n}\n\nexport interface CtxMetadataStoreConfig {\n  /** Storage backend. Use `memoryCtxMetadataStore()` for dev, `pgCtxMetadataStore(pool)` for cluster. */\n  backend: CtxMetadataBackend;\n  /**\n   * Max serialized blob size in bytes. Defaults to 16384 (16KB).\n   * Crossed → `CTX_METADATA_TOO_LARGE` thrown at `set()`.\n   */\n  maxValueBytes?: number;\n}\n\n/**\n * Reference to a stored entry. `bulkGet` accepts an array of these;\n * the resulting Map is keyed by `${kind}:${id}` for caller convenience.\n */\nexport interface CtxMetadataRef {\n  kind: ResourceKind;\n  id: string;\n}\n\nexport interface CtxMetadataStore {\n  /**\n   * Look up a single entry. Returns `undefined` (not `null`) for misses\n   * so publishers can branch with `??` against their own DB.\n   *\n   * Returned values carry a non-enumerable `[ADCP_INTERNAL_TAG]: true`\n   * marker — JSON serialization elides it automatically (defense\n   * against accidental leak via error envelopes and log lines).\n   */\n  get(accountId: string, kind: ResourceKind, id: string): Promise<unknown | undefined>;\n\n  /**\n   * Bulk lookup. Returns a Map keyed by `${kind}:${id}` so callers\n   * with mixed-kind refs (e.g., `create_media_buy` carrying products\n   * + an audience ref) can index without remembering what they asked for.\n   * Misses are absent from the Map (no `undefined` entries).\n   */\n  bulkGet(accountId: string, refs: readonly CtxMetadataRef[]): Promise<ReadonlyMap<string, unknown>>;\n\n  /**\n   * Store a blob. Throws `CTX_METADATA_TOO_LARGE` if `JSON.stringify(value).length`\n   * exceeds the configured cap. Throws `INVALID_ARGUMENT` for null/undefined/empty\n   * `accountId` or out-of-shape `id`.\n   *\n   * `ttlSeconds` is optional and capped at 30 days. No auto-eviction.\n   */\n  set(accountId: string, kind: ResourceKind, id: string, value: unknown, ttlSeconds?: number): Promise<void>;\n\n  /**\n   * Framework-only: persist the wire resource alongside the publisher's\n   * `ctx_metadata` blob. Called by the dispatch seam after a publisher\n   * returns a resource (Product, MediaBuy, etc.) so subsequent calls\n   * referencing that id by string can hydrate the full object.\n   *\n   * Adopter code does NOT call this — wire resource caching is the\n   * framework's job. Public-but-internal: lives on the interface so\n   * the dispatch layer doesn't need a privileged store handle.\n   *\n   * @internal — adopter code should use `set()`. The framework calls this.\n   */\n  setEntry(accountId: string, kind: ResourceKind, id: string, entry: CtxMetadataEntry): Promise<void>;\n\n  /**\n   * Framework-only: update the wire resource for an existing or new\n   * entry while preserving the publisher's `value` (ctx_metadata blob).\n   * Called by the auto-store path so a publisher's prior\n   * `ctx.ctxMetadata.set('product', id, blob)` is NOT overwritten when\n   * the publisher returns the product without `ctx_metadata` on the\n   * wire shape.\n   *\n   * Update semantics:\n   *   - If entry exists: merge — keep prior `value`, set new `resource`,\n   *     keep prior `expiresAt`.\n   *   - If entry doesn't exist: create with `value: priorValue ?? null`,\n   *     `resource: resource`.\n   *   - If `priorValue` is provided AND the publisher returned ctx_metadata\n   *     on the resource (non-null priorValue param), the new value wins.\n   *\n   * @internal\n   */\n  setResource(\n    accountId: string,\n    kind: ResourceKind,\n    id: string,\n    resource: unknown,\n    publisherCtxMetadata?: unknown\n  ): Promise<void>;\n\n  /**\n   * Framework-only: lookup the full entry (value + resource) by id.\n   * Used by the auto-hydration path to reconstruct hydrated resources.\n   * Adopter code uses `get()` for the value alone.\n   *\n   * @internal\n   */\n  getEntry(accountId: string, kind: ResourceKind, id: string): Promise<CtxMetadataEntry | undefined>;\n\n  /**\n   * Framework-only: bulk variant of `getEntry`.\n   * @internal\n   */\n  bulkGetEntries(accountId: string, refs: readonly CtxMetadataRef[]): Promise<ReadonlyMap<string, CtxMetadataEntry>>;\n\n  /** Delete a single entry. Tenant-scoped via `accountId`. */\n  delete(accountId: string, kind: ResourceKind, id: string): Promise<void>;\n\n  /** Probe the backend for boot-time readiness. */\n  probe(): Promise<void>;\n\n  /** Release backend resources (close pools, clear timers). */\n  close(): Promise<void>;\n\n  /** Test-harness reset. Throws if backend doesn't support it (no `force` opt — production safety). */\n  clearAll(): Promise<void>;\n}\n\n/**\n * Validation error thrown for bad input shape. Distinct from\n * `CTX_METADATA_TOO_LARGE` (size violation) so callers can branch.\n */\nexport class CtxMetadataValidationError extends Error {\n  constructor(\n    public readonly code: 'INVALID_ARGUMENT' | 'CTX_METADATA_TOO_LARGE',\n    message: string\n  ) {\n    super(message);\n    this.name = 'CtxMetadataValidationError';\n  }\n}\n\n/**\n * Compose the flattened storage key. Internal — backends trust this format.\n */\nexport function scopeCtxMetadataKey(accountId: string, kind: ResourceKind, id: string): string {\n  return `${accountId}\u001f${kind}\u001f${id}`;\n}\n\n/**\n * Compose the bulkGet result key. External — callers index Map entries by this.\n */\nexport function ctxMetadataResultKey(kind: ResourceKind, id: string): string {\n  return `${kind}:${id}`;\n}\n\nfunction validateAccountId(accountId: string): void {\n  if (accountId == null || accountId === '') {\n    throw new CtxMetadataValidationError(\n      'INVALID_ARGUMENT',\n      'ctx_metadata requires an account scope. No-account tools (provide_performance_feedback, ' +\n        'list_creative_formats) cannot use ctx_metadata.'\n    );\n  }\n  if (!VALID_KEY_SEGMENT.test(accountId)) {\n    throw new CtxMetadataValidationError(\n      'INVALID_ARGUMENT',\n      `Invalid accountId shape: must match ${VALID_KEY_SEGMENT}`\n    );\n  }\n}\n\nfunction validateResourceId(id: string): void {\n  if (id == null || id === '') {\n    throw new CtxMetadataValidationError('INVALID_ARGUMENT', 'ctx_metadata resource id must be non-empty');\n  }\n  if (!VALID_KEY_SEGMENT.test(id)) {\n    throw new CtxMetadataValidationError(\n      'INVALID_ARGUMENT',\n      `Invalid resource id shape: must match ${VALID_KEY_SEGMENT}`\n    );\n  }\n}\n\nfunction validateResourceKind(kind: ResourceKind): void {\n  if (!ALL_RESOURCE_KINDS.includes(kind)) {\n    throw new CtxMetadataValidationError('INVALID_ARGUMENT', `Unknown ctx_metadata resource kind: ${kind}`);\n  }\n}\n\nfunction tagInternal<T>(value: T): T {\n  if (value == null || typeof value !== 'object') return value;\n  Object.defineProperty(value as object, ADCP_INTERNAL_TAG, {\n    value: true,\n    enumerable: false,\n    writable: false,\n    configurable: false,\n  });\n  return value;\n}\n\n/**\n * Build a CtxMetadataStore wrapping a backend.\n *\n * Memory backend is fine for single-process dev. Cluster deployments\n * MUST use `pgCtxMetadataStore` — silent ctx_metadata loss after a\n * rolling restart produces \"package not found\" errors that look like\n * publisher bugs and run for weeks.\n */\nexport function createCtxMetadataStore(config: CtxMetadataStoreConfig): CtxMetadataStore {\n  const backend = config.backend;\n  const maxValueBytes = config.maxValueBytes ?? DEFAULT_MAX_VALUE_BYTES;\n\n  return {\n    async get(accountId, kind, id) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      const entry = await backend.get(scopeCtxMetadataKey(accountId, kind, id));\n      if (!entry) return undefined;\n      if (entry.expiresAt != null && entry.expiresAt < Math.floor(Date.now() / 1000)) {\n        return undefined;\n      }\n      return tagInternal(entry.value);\n    },\n\n    async bulkGet(accountId, refs) {\n      validateAccountId(accountId);\n      if (refs.length === 0) return new Map();\n      const scopedKeys: string[] = [];\n      const scopedToResultKey = new Map<string, string>();\n      for (const ref of refs) {\n        validateResourceKind(ref.kind);\n        validateResourceId(ref.id);\n        const scoped = scopeCtxMetadataKey(accountId, ref.kind, ref.id);\n        scopedKeys.push(scoped);\n        scopedToResultKey.set(scoped, ctxMetadataResultKey(ref.kind, ref.id));\n      }\n      const entries = await backend.bulkGet(scopedKeys);\n      const result = new Map<string, unknown>();\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      for (const [scopedKey, entry] of entries) {\n        if (entry.expiresAt != null && entry.expiresAt < nowSeconds) continue;\n        const resultKey = scopedToResultKey.get(scopedKey);\n        if (resultKey != null) result.set(resultKey, tagInternal(entry.value));\n      }\n      return result;\n    },\n\n    async set(accountId, kind, id, value, ttlSeconds) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      if (ttlSeconds != null) {\n        if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0) {\n          throw new CtxMetadataValidationError('INVALID_ARGUMENT', 'ttlSeconds must be a positive finite number');\n        }\n        if (ttlSeconds > MAX_TTL_SECONDS) {\n          throw new CtxMetadataValidationError(\n            'INVALID_ARGUMENT',\n            `ttlSeconds exceeds the 30-day maximum (${MAX_TTL_SECONDS}s)`\n          );\n        }\n      }\n      const serialized = JSON.stringify(value);\n      if (serialized == null) {\n        throw new CtxMetadataValidationError(\n          'INVALID_ARGUMENT',\n          'ctx_metadata value must be JSON-serializable (got undefined / function / symbol)'\n        );\n      }\n      const byteLen = Buffer.byteLength(serialized, 'utf8');\n      if (byteLen > maxValueBytes) {\n        throw new CtxMetadataValidationError(\n          'CTX_METADATA_TOO_LARGE',\n          `ctx_metadata blob is ${byteLen} bytes, exceeds the configured cap of ${maxValueBytes} bytes ` +\n            `for ${kind}:${id}. Offload large payloads to your own storage and reference by ID.`\n        );\n      }\n      const expiresAt = ttlSeconds != null ? Math.floor(Date.now() / 1000) + ttlSeconds : undefined;\n      // Preserve any prior `resource` from the framework-managed entry —\n      // adopter `set()` only mutates `value`. The dispatch seam writes\n      // resource via `setEntry`.\n      const prior = await backend.get(scopeCtxMetadataKey(accountId, kind, id));\n      const next: CtxMetadataEntry = {\n        value,\n        ...(prior?.resource !== undefined && { resource: prior.resource }),\n        ...(expiresAt !== undefined\n          ? { expiresAt }\n          : prior?.expiresAt !== undefined\n            ? { expiresAt: prior.expiresAt }\n            : {}),\n      };\n      await backend.put(scopeCtxMetadataKey(accountId, kind, id), next);\n    },\n\n    async setEntry(accountId, kind, id, entry) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      // Cap applied to the COMBINED serialization (value + resource) since\n      // both round-trip together. Use the same upstream message so adopters\n      // see the same diagnostic surface.\n      const serialized = JSON.stringify({ value: entry.value, resource: entry.resource });\n      const byteLen = Buffer.byteLength(serialized, 'utf8');\n      if (byteLen > maxValueBytes) {\n        throw new CtxMetadataValidationError(\n          'CTX_METADATA_TOO_LARGE',\n          `ctx_metadata combined blob is ${byteLen} bytes, exceeds the configured cap of ${maxValueBytes} bytes ` +\n            `for ${kind}:${id}. Offload large payloads to your own storage and reference by ID.`\n        );\n      }\n      await backend.put(scopeCtxMetadataKey(accountId, kind, id), entry);\n    },\n\n    async setResource(accountId, kind, id, resource, publisherCtxMetadata) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      const scopedKey = scopeCtxMetadataKey(accountId, kind, id);\n      const prior = await backend.get(scopedKey);\n      // Resolve the value to persist:\n      //   - publisher returned ctx_metadata on the wire shape → use it (overrides prior)\n      //   - publisher omitted ctx_metadata → preserve prior value (don't clobber)\n      //   - no prior, no publisher value → store null\n      const nextValue =\n        publisherCtxMetadata !== undefined && publisherCtxMetadata !== null\n          ? publisherCtxMetadata\n          : (prior?.value ?? null);\n      const nextEntry: CtxMetadataEntry = {\n        value: nextValue,\n        resource,\n        ...(prior?.expiresAt !== undefined && { expiresAt: prior.expiresAt }),\n      };\n      // Apply the same size cap used by setEntry.\n      const serialized = JSON.stringify({ value: nextEntry.value, resource: nextEntry.resource });\n      const byteLen = Buffer.byteLength(serialized, 'utf8');\n      if (byteLen > maxValueBytes) {\n        throw new CtxMetadataValidationError(\n          'CTX_METADATA_TOO_LARGE',\n          `ctx_metadata combined blob is ${byteLen} bytes, exceeds the configured cap of ${maxValueBytes} bytes ` +\n            `for ${kind}:${id}. Offload large payloads to your own storage and reference by ID.`\n        );\n      }\n      await backend.put(scopedKey, nextEntry);\n    },\n\n    async getEntry(accountId, kind, id) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      const entry = await backend.get(scopeCtxMetadataKey(accountId, kind, id));\n      if (!entry) return undefined;\n      if (entry.expiresAt != null && entry.expiresAt < Math.floor(Date.now() / 1000)) {\n        return undefined;\n      }\n      return entry;\n    },\n\n    async bulkGetEntries(accountId, refs) {\n      validateAccountId(accountId);\n      if (refs.length === 0) return new Map();\n      const scopedKeys: string[] = [];\n      const scopedToResultKey = new Map<string, string>();\n      for (const ref of refs) {\n        validateResourceKind(ref.kind);\n        validateResourceId(ref.id);\n        const scoped = scopeCtxMetadataKey(accountId, ref.kind, ref.id);\n        scopedKeys.push(scoped);\n        scopedToResultKey.set(scoped, ctxMetadataResultKey(ref.kind, ref.id));\n      }\n      const entries = await backend.bulkGet(scopedKeys);\n      const result = new Map<string, CtxMetadataEntry>();\n      const nowSeconds = Math.floor(Date.now() / 1000);\n      for (const [scopedKey, entry] of entries) {\n        if (entry.expiresAt != null && entry.expiresAt < nowSeconds) continue;\n        const resultKey = scopedToResultKey.get(scopedKey);\n        if (resultKey != null) result.set(resultKey, entry);\n      }\n      return result;\n    },\n\n    async delete(accountId, kind, id) {\n      validateAccountId(accountId);\n      validateResourceKind(kind);\n      validateResourceId(id);\n      await backend.delete(scopeCtxMetadataKey(accountId, kind, id));\n    },\n\n    async probe() {\n      if (backend.probe) await backend.probe();\n    },\n\n    async close() {\n      if (backend.close) await backend.close();\n    },\n\n    async clearAll() {\n      if (!backend.clearAll) {\n        throw new Error(\n          'ctx_metadata backend does not support clearAll(). ' +\n            'Production backends (e.g., shared Postgres) should refuse this; use memory backend for tests.'\n        );\n      }\n      await backend.clearAll();\n    },\n  };\n}\n"],"mappings":"AAkDA,MAAM,qBAA8C;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAUO,MAAM,0BAA0B,KAAK;AASrC,MAAM,kBAAkB,KAAK,KAAK,KAAK;AAQ9C,MAAM,oBAAoB;AAQnB,MAAM,oBAAoB,uBAAO,IAAI,4BAA4B;AAkKjE,MAAM,mCAAmC,MAAM;AAAA,EACpD,YACkB,MAChB,SACA;AACA,UAAM,OAAO;AAHG;AAIhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAMpB;AAKO,SAAS,oBAAoB,WAAmB,MAAoB,IAAoB;AAC7F,SAAO,GAAG,SAAS,IAAI,IAAI,IAAI,EAAE;AACnC;AAKO,SAAS,qBAAqB,MAAoB,IAAoB;AAC3E,SAAO,GAAG,IAAI,IAAI,EAAE;AACtB;AAEA,SAAS,kBAAkB,WAAyB;AAClD,MAAI,aAAa,QAAQ,cAAc,IAAI;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AACA,MAAI,CAAC,kBAAkB,KAAK,SAAS,GAAG;AACtC,UAAM,IAAI;AAAA,MACR;AAAA,MACA,uCAAuC,iBAAiB;AAAA,IAC1D;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,IAAkB;AAC5C,MAAI,MAAM,QAAQ,OAAO,IAAI;AAC3B,UAAM,IAAI,2BAA2B,oBAAoB,4CAA4C;AAAA,EACvG;AACA,MAAI,CAAC,kBAAkB,KAAK,EAAE,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA,yCAAyC,iBAAiB;AAAA,IAC5D;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,MAA0B;AACtD,MAAI,CAAC,mBAAmB,SAAS,IAAI,GAAG;AACtC,UAAM,IAAI,2BAA2B,oBAAoB,uCAAuC,IAAI,EAAE;AAAA,EACxG;AACF;AAEA,SAAS,YAAe,OAAa;AACnC,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,SAAO,eAAe,OAAiB,mBAAmB;AAAA,IACxD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,cAAc;AAAA,EAChB,CAAC;AACD,SAAO;AACT;AAUO,SAAS,uBAAuB,QAAkD;AACvF,QAAM,UAAU,OAAO;AACvB,QAAM,gBAAgB,OAAO,iBAAiB;AAE9C,SAAO;AAAA,IACL,MAAM,IAAI,WAAW,MAAM,IAAI;AAC7B,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,YAAM,QAAQ,MAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,CAAC;AACxE,UAAI,CAAC,MAAO,QAAO;AACnB,UAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AAC9E,eAAO;AAAA,MACT;AACA,aAAO,YAAY,MAAM,KAAK;AAAA,IAChC;AAAA,IAEA,MAAM,QAAQ,WAAW,MAAM;AAC7B,wBAAkB,SAAS;AAC3B,UAAI,KAAK,WAAW,EAAG,QAAO,oBAAI,IAAI;AACtC,YAAM,aAAuB,CAAC;AAC9B,YAAM,oBAAoB,oBAAI,IAAoB;AAClD,iBAAW,OAAO,MAAM;AACtB,6BAAqB,IAAI,IAAI;AAC7B,2BAAmB,IAAI,EAAE;AACzB,cAAM,SAAS,oBAAoB,WAAW,IAAI,MAAM,IAAI,EAAE;AAC9D,mBAAW,KAAK,MAAM;AACtB,0BAAkB,IAAI,QAAQ,qBAAqB,IAAI,MAAM,IAAI,EAAE,CAAC;AAAA,MACtE;AACA,YAAM,UAAU,MAAM,QAAQ,QAAQ,UAAU;AAChD,YAAM,SAAS,oBAAI,IAAqB;AACxC,YAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,iBAAW,CAAC,WAAW,KAAK,KAAK,SAAS;AACxC,YAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,WAAY;AAC7D,cAAM,YAAY,kBAAkB,IAAI,SAAS;AACjD,YAAI,aAAa,KAAM,QAAO,IAAI,WAAW,YAAY,MAAM,KAAK,CAAC;AAAA,MACvE;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,IAAI,WAAW,MAAM,IAAI,OAAO,YAAY;AAChD,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,UAAI,cAAc,MAAM;AACtB,YAAI,CAAC,OAAO,SAAS,UAAU,KAAK,cAAc,GAAG;AACnD,gBAAM,IAAI,2BAA2B,oBAAoB,6CAA6C;AAAA,QACxG;AACA,YAAI,aAAa,iBAAiB;AAChC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,0CAA0C,eAAe;AAAA,UAC3D;AAAA,QACF;AAAA,MACF;AACA,YAAM,aAAa,KAAK,UAAU,KAAK;AACvC,UAAI,cAAc,MAAM;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,UAAU,OAAO,WAAW,YAAY,MAAM;AACpD,UAAI,UAAU,eAAe;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,wBAAwB,OAAO,yCAAyC,aAAa,cAC5E,IAAI,IAAI,EAAE;AAAA,QACrB;AAAA,MACF;AACA,YAAM,YAAY,cAAc,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,aAAa;AAIpF,YAAM,QAAQ,MAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,CAAC;AACxE,YAAM,OAAyB;AAAA,QAC7B;AAAA,QACA,GAAI,OAAO,aAAa,UAAa,EAAE,UAAU,MAAM,SAAS;AAAA,QAChE,GAAI,cAAc,SACd,EAAE,UAAU,IACZ,OAAO,cAAc,SACnB,EAAE,WAAW,MAAM,UAAU,IAC7B,CAAC;AAAA,MACT;AACA,YAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,GAAG,IAAI;AAAA,IAClE;AAAA,IAEA,MAAM,SAAS,WAAW,MAAM,IAAI,OAAO;AACzC,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AAIrB,YAAM,aAAa,KAAK,UAAU,EAAE,OAAO,MAAM,OAAO,UAAU,MAAM,SAAS,CAAC;AAClF,YAAM,UAAU,OAAO,WAAW,YAAY,MAAM;AACpD,UAAI,UAAU,eAAe;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,iCAAiC,OAAO,yCAAyC,aAAa,cACrF,IAAI,IAAI,EAAE;AAAA,QACrB;AAAA,MACF;AACA,YAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,GAAG,KAAK;AAAA,IACnE;AAAA,IAEA,MAAM,YAAY,WAAW,MAAM,IAAI,UAAU,sBAAsB;AACrE,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,YAAM,YAAY,oBAAoB,WAAW,MAAM,EAAE;AACzD,YAAM,QAAQ,MAAM,QAAQ,IAAI,SAAS;AAKzC,YAAM,YACJ,yBAAyB,UAAa,yBAAyB,OAC3D,uBACC,OAAO,SAAS;AACvB,YAAM,YAA8B;AAAA,QAClC,OAAO;AAAA,QACP;AAAA,QACA,GAAI,OAAO,cAAc,UAAa,EAAE,WAAW,MAAM,UAAU;AAAA,MACrE;AAEA,YAAM,aAAa,KAAK,UAAU,EAAE,OAAO,UAAU,OAAO,UAAU,UAAU,SAAS,CAAC;AAC1F,YAAM,UAAU,OAAO,WAAW,YAAY,MAAM;AACpD,UAAI,UAAU,eAAe;AAC3B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,iCAAiC,OAAO,yCAAyC,aAAa,cACrF,IAAI,IAAI,EAAE;AAAA,QACrB;AAAA,MACF;AACA,YAAM,QAAQ,IAAI,WAAW,SAAS;AAAA,IACxC;AAAA,IAEA,MAAM,SAAS,WAAW,MAAM,IAAI;AAClC,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,YAAM,QAAQ,MAAM,QAAQ,IAAI,oBAAoB,WAAW,MAAM,EAAE,CAAC;AACxE,UAAI,CAAC,MAAO,QAAO;AACnB,UAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AAC9E,eAAO;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,eAAe,WAAW,MAAM;AACpC,wBAAkB,SAAS;AAC3B,UAAI,KAAK,WAAW,EAAG,QAAO,oBAAI,IAAI;AACtC,YAAM,aAAuB,CAAC;AAC9B,YAAM,oBAAoB,oBAAI,IAAoB;AAClD,iBAAW,OAAO,MAAM;AACtB,6BAAqB,IAAI,IAAI;AAC7B,2BAAmB,IAAI,EAAE;AACzB,cAAM,SAAS,oBAAoB,WAAW,IAAI,MAAM,IAAI,EAAE;AAC9D,mBAAW,KAAK,MAAM;AACtB,0BAAkB,IAAI,QAAQ,qBAAqB,IAAI,MAAM,IAAI,EAAE,CAAC;AAAA,MACtE;AACA,YAAM,UAAU,MAAM,QAAQ,QAAQ,UAAU;AAChD,YAAM,SAAS,oBAAI,IAA8B;AACjD,YAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC/C,iBAAW,CAAC,WAAW,KAAK,KAAK,SAAS;AACxC,YAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,WAAY;AAC7D,cAAM,YAAY,kBAAkB,IAAI,SAAS;AACjD,YAAI,aAAa,KAAM,QAAO,IAAI,WAAW,KAAK;AAAA,MACpD;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,WAAW,MAAM,IAAI;AAChC,wBAAkB,SAAS;AAC3B,2BAAqB,IAAI;AACzB,yBAAmB,EAAE;AACrB,YAAM,QAAQ,OAAO,oBAAoB,WAAW,MAAM,EAAE,CAAC;AAAA,IAC/D;AAAA,IAEA,MAAM,QAAQ;AACZ,UAAI,QAAQ,MAAO,OAAM,QAAQ,MAAM;AAAA,IACzC;AAAA,IAEA,MAAM,QAAQ;AACZ,UAAI,QAAQ,MAAO,OAAM,QAAQ,MAAM;AAAA,IACzC;AAAA,IAEA,MAAM,WAAW;AACf,UAAI,CAAC,QAAQ,UAAU;AACrB,cAAM,IAAI;AAAA,UACR;AAAA,QAEF;AAAA,MACF;AACA,YAAM,QAAQ,SAAS;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}

package/dist/lib/server/ctx-metadata/wire-shape.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 const CTX_METADATA_KEY = "ctx_metadata";
 function stripCtxMetadata(value) {
   if (value == null || typeof value !== "object") return value;

package/dist/lib/server/ctx-metadata/wire-shape.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/server/ctx-metadata/wire-shape.ts"],"sourcesContent":["/**\n * Compile-time + runtime defense against `ctx_metadata` leaking into\n * buyer-facing wire payloads.\n *\n * - **Compile-time:** `WireShape<T>` strips `ctx_metadata` from a type\n *   tree, so the framework's response builder return types refuse a\n *   payload that carries it.\n * - **Runtime:** `stripCtxMetadata(value)` shape-aware shallow walk\n *   over known carrier locations (response root + `packages[]` +\n *   `creatives[]` + `audiences[]` + `signals[]` + `media_buys[]` +\n *   `products[]`). Catches custom-handler escape hatches and HITL\n *   task return values that re-introduce the field at runtime.\n *\n * Single chokepoint at the dispatcher seam. Strip runs *before* the\n * idempotency cache write so cached replays don't leak.\n *\n * @public\n */\n\nconst CTX_METADATA_KEY = 'ctx_metadata' as const;\n\n/**\n * Compile-time strip: recursively remove `ctx_metadata` from a type\n * tree. Used as the framework's response-boundary type so a publisher\n * payload that carries the field fails type-checking before it\n * reaches the wire.\n *\n * Strips `ctx_metadata` at top level, inside arrays, and inside\n * objects nested under `packages` / `creatives` / `audiences` /\n * `signals` / `media_buys` / `products` — the carrier shapes the\n * AdCP 3.0 wire spec defines. Other shapes pass through unchanged\n * (the runtime walk is deliberately not recursive everywhere — see\n * the docstring).\n */\nexport type WireShape<T> =\n  T extends ReadonlyArray<infer U>\n    ? ReadonlyArray<WireShape<U>>\n    : T extends object\n      ? { [K in keyof T as K extends 'ctx_metadata' ? never : K]: WireShape<T[K]> }\n      : T;\n\n/**\n * Runtime strip. Walks known carrier shapes in the response and\n * deletes `ctx_metadata` keys. Returns the input value (mutates in\n * place — the dispatcher constructs a fresh response per call, so\n * mutation is safe).\n *\n * **Why shape-aware shallow walk, not full recursion.** Full\n * recursion is O(response size) and risks stripping a field a\n * future spec adds with the same name elsewhere (e.g., a diagnostic\n * envelope's `ctx_metadata`). Shape-aware walks the carrier\n * locations defined by AdCP 3.0 — adding a new carrier requires\n * updating this list, which is the right kind of friction.\n */\nexport function stripCtxMetadata<T>(value: T): WireShape<T> {\n  if (value == null || typeof value !== 'object') return value as WireShape<T>;\n  stripFromCarrier(value as Record<string, unknown>);\n  return value as WireShape<T>;\n}\n\n/**\n * Carrier locations: keys whose values may be objects or arrays of\n * objects that carry `ctx_metadata`. Add new keys here when a future\n * spec extends the wire-resource surface.\n */\nconst CARRIER_KEYS = [\n  'account',\n  'accounts',\n  'media_buy',\n  'media_buys',\n  'package',\n  'packages',\n  'product',\n  'products',\n  'creative',\n  'creatives',\n  'audience',\n  'audiences',\n  'signal',\n  'signals',\n  'rights_grant',\n  'rights_grants',\n  'property_list',\n  'property_lists',\n  'collection_list',\n  'collection_lists',\n  'asset',\n  'assets',\n  // Proposal-mode (v1.5 ProposalManager): committed proposals embed\n  // their own `products[]` slice. Without these carriers, ctx_metadata\n  // (and implementation_config, which shares this list) on\n  // `proposals[].products[]` survived the strip and leaked via the\n  // HITL handoff path. Surfaced by security review on PR #1562.\n  'proposal',\n  'proposals',\n] as const;\n\nfunction stripFromCarrier(obj: Record<string, unknown>): void {\n  if (CTX_METADATA_KEY in obj) delete obj[CTX_METADATA_KEY];\n  for (const key of CARRIER_KEYS) {\n    const nested = obj[key];\n    if (nested == null) continue;\n    if (Array.isArray(nested)) {\n      for (const item of nested) {\n        if (item != null && typeof item === 'object') stripFromCarrier(item as Record<string, unknown>);\n      }\n    } else if (typeof nested === 'object') {\n      stripFromCarrier(nested as Record<string, unknown>);\n    }\n  }\n}\n\n/**\n * Detect whether a payload contains `ctx_metadata` at any walked\n * carrier location. Used by the test suite to assert wire payloads\n * are clean — production code paths just call `stripCtxMetadata`.\n */\nexport function hasCtxMetadata(value: unknown): boolean {\n  if (value == null || typeof value !== 'object') return false;\n  return walkForCtxMetadata(value as Record<string, unknown>);\n}\n\n// ---------------------------------------------------------------------------\n// Recipe `implementation_config` strip — Product-specific, parallel pattern\n// ---------------------------------------------------------------------------\n\nconst IMPLEMENTATION_CONFIG_KEY = 'implementation_config' as const;\n\n/**\n * Carrier locations for `implementation_config`. Recipes ride on\n * `Product.implementation_config` per the v1.5 ProposalManager design;\n * the field is opaque-to-buyer (typed-on-server) and must NOT cross to\n * the buyer's wire response. Mirrors the `ctx_metadata` strip pattern.\n *\n * The wire `Product` shape's JSON schema is `additionalProperties: true`\n * so the field is technically legal on the wire — but recipes carry\n * upstream identifiers (network codes, line-item template ids, ad-unit\n * ids, GAM line-item priority, etc.) that leak topology to buyers.\n * Strip at the dispatcher seam, after the platform builds the wire\n * shape and before the idempotency cache writes it.\n *\n * Carrier list mirrors `CARRIER_KEYS` (used by `stripCtxMetadata`)\n * because future spec extensions may nest a Product under any\n * resource carrier (e.g. `media_buys[].products[]`,\n * `creatives[].assigned_packages[].product`). Reusing the same set\n * keeps the two strips from silently diverging — adding a new wire\n * carrier in `CARRIER_KEYS` for `ctx_metadata` automatically extends\n * the implementation_config walk too. Surfaced by security review on\n * PR #1562.\n */\nconst IMPL_CONFIG_CARRIER_KEYS = CARRIER_KEYS;\n\n/**\n * Runtime strip for `Product.implementation_config`. Walks Product\n * carrier locations in the response (top-level `products[]` plus\n * single-product `product` slots inside `proposals[].products[]` etc.)\n * and deletes the recipe field. Mutates in place.\n *\n * Adopters who deliberately want the recipe to ride to the buyer (rare;\n * defeats the typed-on-server contract) can re-attach it in a\n * post-strip hook — but the default is \"strip, always.\"\n *\n * @public\n */\nexport function stripImplementationConfig<T>(value: T): T {\n  if (value == null || typeof value !== 'object') return value;\n  stripImplConfigFromCarrier(value as Record<string, unknown>);\n  return value;\n}\n\nfunction stripImplConfigFromCarrier(obj: Record<string, unknown>): void {\n  // Strip the field on the current object IF this object looks like a\n  // Product (has product_id). We don't strip blindly at every level\n  // because the field name could legitimately appear elsewhere (e.g.,\n  // a diagnostic envelope) in a future spec extension.\n  if ('product_id' in obj && IMPLEMENTATION_CONFIG_KEY in obj) {\n    delete obj[IMPLEMENTATION_CONFIG_KEY];\n  }\n  // Walk the shared carrier set (mirrors stripCtxMetadata) so future\n  // spec additions extending one strip automatically extend both.\n  for (const key of IMPL_CONFIG_CARRIER_KEYS) {\n    const nested = obj[key];\n    if (nested == null) continue;\n    if (Array.isArray(nested)) {\n      for (const item of nested) {\n        if (item != null && typeof item === 'object') stripImplConfigFromCarrier(item as Record<string, unknown>);\n      }\n    } else if (typeof nested === 'object') {\n      stripImplConfigFromCarrier(nested as Record<string, unknown>);\n    }\n  }\n}\n\n/**\n * Detect whether a payload contains `implementation_config` on any\n * Product carrier. Test-suite helper — production paths call\n * `stripImplementationConfig`.\n *\n * @public\n */\nexport function hasImplementationConfig(value: unknown): boolean {\n  if (value == null || typeof value !== 'object') return false;\n  return walkForImplConfig(value as Record<string, unknown>);\n}\n\nfunction walkForImplConfig(obj: Record<string, unknown>): boolean {\n  if ('product_id' in obj && IMPLEMENTATION_CONFIG_KEY in obj) return true;\n  for (const key of IMPL_CONFIG_CARRIER_KEYS) {\n    const nested = obj[key];\n    if (nested == null) continue;\n    if (Array.isArray(nested)) {\n      for (const item of nested) {\n        if (item != null && typeof item === 'object' && walkForImplConfig(item as Record<string, unknown>)) return true;\n      }\n    } else if (typeof nested === 'object') {\n      if (walkForImplConfig(nested as Record<string, unknown>)) return true;\n    }\n  }\n  return false;\n}\n\nfunction walkForCtxMetadata(obj: Record<string, unknown>): boolean {\n  if (CTX_METADATA_KEY in obj) return true;\n  for (const key of CARRIER_KEYS) {\n    const nested = obj[key];\n    if (nested == null) continue;\n    if (Array.isArray(nested)) {\n      for (const item of nested) {\n        if (item != null && typeof item === 'object' && walkForCtxMetadata(item as Record<string, unknown>)) {\n          return true;\n        }\n      }\n    } else if (typeof nested === 'object') {\n      if (walkForCtxMetadata(nested as Record<string, unknown>)) return true;\n    }\n  }\n  return false;\n}\n"],"mappings":";;;;;;AAmBA,MAAM,mBAAmB;AAmClB,SAAS,iBAAoB,OAAwB;AAC1D,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,mBAAiB,KAAgC;AACjD,SAAO;AACT;AAOA,MAAM,eAAe;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AACF;AAEA,SAAS,iBAAiB,KAAoC;AAC5D,MAAI,oBAAoB,IAAK,QAAO,IAAI,gBAAgB;AACxD,aAAW,OAAO,cAAc;AAC9B,UAAM,SAAS,IAAI,GAAG;AACtB,QAAI,UAAU,KAAM;AACpB,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,iBAAW,QAAQ,QAAQ;AACzB,YAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,kBAAiB,IAA+B;AAAA,MAChG;AAAA,IACF,WAAW,OAAO,WAAW,UAAU;AACrC,uBAAiB,MAAiC;AAAA,IACpD;AAAA,EACF;AACF;AAOO,SAAS,eAAe,OAAyB;AACtD,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,SAAO,mBAAmB,KAAgC;AAC5D;AAMA,MAAM,4BAA4B;AAwBlC,MAAM,2BAA2B;AAc1B,SAAS,0BAA6B,OAAa;AACxD,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,6BAA2B,KAAgC;AAC3D,SAAO;AACT;AAEA,SAAS,2BAA2B,KAAoC;AAKtE,MAAI,gBAAgB,OAAO,6BAA6B,KAAK;AAC3D,WAAO,IAAI,yBAAyB;AAAA,EACtC;AAGA,aAAW,OAAO,0BAA0B;AAC1C,UAAM,SAAS,IAAI,GAAG;AACtB,QAAI,UAAU,KAAM;AACpB,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,iBAAW,QAAQ,QAAQ;AACzB,YAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,4BAA2B,IAA+B;AAAA,MAC1G;AAAA,IACF,WAAW,OAAO,WAAW,UAAU;AACrC,iCAA2B,MAAiC;AAAA,IAC9D;AAAA,EACF;AACF;AASO,SAAS,wBAAwB,OAAyB;AAC/D,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,SAAO,kBAAkB,KAAgC;AAC3D;AAEA,SAAS,kBAAkB,KAAuC;AAChE,MAAI,gBAAgB,OAAO,6BAA6B,IAAK,QAAO;AACpE,aAAW,OAAO,0BAA0B;AAC1C,UAAM,SAAS,IAAI,GAAG;AACtB,QAAI,UAAU,KAAM;AACpB,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,iBAAW,QAAQ,QAAQ;AACzB,YAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,kBAAkB,IAA+B,EAAG,QAAO;AAAA,MAC7G;AAAA,IACF,WAAW,OAAO,WAAW,UAAU;AACrC,UAAI,kBAAkB,MAAiC,EAAG,QAAO;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAuC;AACjE,MAAI,oBAAoB,IAAK,QAAO;AACpC,aAAW,OAAO,cAAc;AAC9B,UAAM,SAAS,IAAI,GAAG;AACtB,QAAI,UAAU,KAAM;AACpB,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,iBAAW,QAAQ,QAAQ;AACzB,YAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,mBAAmB,IAA+B,GAAG;AACnG,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF,WAAW,OAAO,WAAW,UAAU;AACrC,UAAI,mBAAmB,MAAiC,EAAG,QAAO;AAAA,IACpE;AAAA,EACF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../../src/lib/server/ctx-metadata/wire-shape.ts"],"sourcesContent":["/**\n * Compile-time + runtime defense against `ctx_metadata` leaking into\n * buyer-facing wire payloads.\n *\n * - **Compile-time:** `WireShape<T>` strips `ctx_metadata` from a type\n *   tree, so the framework's response builder return types refuse a\n *   payload that carries it.\n * - **Runtime:** `stripCtxMetadata(value)` shape-aware shallow walk\n *   over known carrier locations (response root + `packages[]` +\n *   `creatives[]` + `audiences[]` + `signals[]` + `media_buys[]` +\n *   `products[]`). Catches custom-handler escape hatches and HITL\n *   task return values that re-introduce the field at runtime.\n *\n * Single chokepoint at the dispatcher seam. Strip runs *before* the\n * idempotency cache write so cached replays don't leak.\n *\n * @public\n */\n\nconst CTX_METADATA_KEY = 'ctx_metadata' as const;\n\n/**\n * Compile-time strip: recursively remove `ctx_metadata` from a type\n * tree. Used as the framework's response-boundary type so a publisher\n * payload that carries the field fails type-checking before it\n * reaches the wire.\n *\n * Strips `ctx_metadata` at top level, inside arrays, and inside\n * objects nested under `packages` / `creatives` / `audiences` /\n * `signals` / `media_buys` / `products` — the carrier shapes the\n * AdCP 3.0 wire spec defines. Other shapes pass through unchanged\n * (the runtime walk is deliberately not recursive everywhere — see\n * the docstring).\n */\nexport type WireShape<T> =\n  T extends ReadonlyArray<infer U>\n    ? ReadonlyArray<WireShape<U>>\n    : T extends object\n      ? { [K in keyof T as K extends 'ctx_metadata' ? never : K]: WireShape<T[K]> }\n      : T;\n\n/**\n * Runtime strip. Walks known carrier shapes in the response and\n * deletes `ctx_metadata` keys. Returns the input value (mutates in\n * place — the dispatcher constructs a fresh response per call, so\n * mutation is safe).\n *\n * **Why shape-aware shallow walk, not full recursion.** Full\n * recursion is O(response size) and risks stripping a field a\n * future spec adds with the same name elsewhere (e.g., a diagnostic\n * envelope's `ctx_metadata`). Shape-aware walks the carrier\n * locations defined by AdCP 3.0 — adding a new carrier requires\n * updating this list, which is the right kind of friction.\n */\nexport function stripCtxMetadata<T>(value: T): WireShape<T> {\n  if (value == null || typeof value !== 'object') return value as WireShape<T>;\n  stripFromCarrier(value as Record<string, unknown>);\n  return value as WireShape<T>;\n}\n\n/**\n * Carrier locations: keys whose values may be objects or arrays of\n * objects that carry `ctx_metadata`. Add new keys here when a future\n * spec extends the wire-resource surface.\n */\nconst CARRIER_KEYS = [\n  'account',\n  'accounts',\n  'media_buy',\n  'media_buys',\n  'package',\n  'packages',\n  'product',\n  'products',\n  'creative',\n  'creatives',\n  'audience',\n  'audiences',\n  'signal',\n  'signals',\n  'rights_grant',\n  'rights_grants',\n  'property_list',\n  'property_lists',\n  'collection_list',\n  'collection_lists',\n  'asset',\n  'assets',\n  // Proposal-mode (v1.5 ProposalManager): committed proposals embed\n  // their own `products[]` slice. Without these carriers, ctx_metadata\n  // (and implementation_config, which shares this list) on\n  // `proposals[].products[]` survived the strip and leaked via the\n  // HITL handoff path. Surfaced by security review on PR #1562.\n  'proposal',\n  'proposals',\n] as const;\n\nfunction stripFromCarrier(obj: Record<string, unknown>): void {\n  if (CTX_METADATA_KEY in obj) delete obj[CTX_METADATA_KEY];\n  for (const key of CARRIER_KEYS) {\n    const nested = obj[key];\n    if (nested == null) continue;\n    if (Array.isArray(nested)) {\n      for (const item of nested) {\n        if (item != null && typeof item === 'object') stripFromCarrier(item as Record<string, unknown>);\n      }\n    } else if (typeof nested === 'object') {\n      stripFromCarrier(nested as Record<string, unknown>);\n    }\n  }\n}\n\n/**\n * Detect whether a payload contains `ctx_metadata` at any walked\n * carrier location. Used by the test suite to assert wire payloads\n * are clean — production code paths just call `stripCtxMetadata`.\n */\nexport function hasCtxMetadata(value: unknown): boolean {\n  if (value == null || typeof value !== 'object') return false;\n  return walkForCtxMetadata(value as Record<string, unknown>);\n}\n\n// ---------------------------------------------------------------------------\n// Recipe `implementation_config` strip — Product-specific, parallel pattern\n// ---------------------------------------------------------------------------\n\nconst IMPLEMENTATION_CONFIG_KEY = 'implementation_config' as const;\n\n/**\n * Carrier locations for `implementation_config`. Recipes ride on\n * `Product.implementation_config` per the v1.5 ProposalManager design;\n * the field is opaque-to-buyer (typed-on-server) and must NOT cross to\n * the buyer's wire response. Mirrors the `ctx_metadata` strip pattern.\n *\n * The wire `Product` shape's JSON schema is `additionalProperties: true`\n * so the field is technically legal on the wire — but recipes carry\n * upstream identifiers (network codes, line-item template ids, ad-unit\n * ids, GAM line-item priority, etc.) that leak topology to buyers.\n * Strip at the dispatcher seam, after the platform builds the wire\n * shape and before the idempotency cache writes it.\n *\n * Carrier list mirrors `CARRIER_KEYS` (used by `stripCtxMetadata`)\n * because future spec extensions may nest a Product under any\n * resource carrier (e.g. `media_buys[].products[]`,\n * `creatives[].assigned_packages[].product`). Reusing the same set\n * keeps the two strips from silently diverging — adding a new wire\n * carrier in `CARRIER_KEYS` for `ctx_metadata` automatically extends\n * the implementation_config walk too. Surfaced by security review on\n * PR #1562.\n */\nconst IMPL_CONFIG_CARRIER_KEYS = CARRIER_KEYS;\n\n/**\n * Runtime strip for `Product.implementation_config`. Walks Product\n * carrier locations in the response (top-level `products[]` plus\n * single-product `product` slots inside `proposals[].products[]` etc.)\n * and deletes the recipe field. Mutates in place.\n *\n * Adopters who deliberately want the recipe to ride to the buyer (rare;\n * defeats the typed-on-server contract) can re-attach it in a\n * post-strip hook — but the default is \"strip, always.\"\n *\n * @public\n */\nexport function stripImplementationConfig<T>(value: T): T {\n  if (value == null || typeof value !== 'object') return value;\n  stripImplConfigFromCarrier(value as Record<string, unknown>);\n  return value;\n}\n\nfunction stripImplConfigFromCarrier(obj: Record<string, unknown>): void {\n  // Strip the field on the current object IF this object looks like a\n  // Product (has product_id). We don't strip blindly at every level\n  // because the field name could legitimately appear elsewhere (e.g.,\n  // a diagnostic envelope) in a future spec extension.\n  if ('product_id' in obj && IMPLEMENTATION_CONFIG_KEY in obj) {\n    delete obj[IMPLEMENTATION_CONFIG_KEY];\n  }\n  // Walk the shared carrier set (mirrors stripCtxMetadata) so future\n  // spec additions extending one strip automatically extend both.\n  for (const key of IMPL_CONFIG_CARRIER_KEYS) {\n    const nested = obj[key];\n    if (nested == null) continue;\n    if (Array.isArray(nested)) {\n      for (const item of nested) {\n        if (item != null && typeof item === 'object') stripImplConfigFromCarrier(item as Record<string, unknown>);\n      }\n    } else if (typeof nested === 'object') {\n      stripImplConfigFromCarrier(nested as Record<string, unknown>);\n    }\n  }\n}\n\n/**\n * Detect whether a payload contains `implementation_config` on any\n * Product carrier. Test-suite helper — production paths call\n * `stripImplementationConfig`.\n *\n * @public\n */\nexport function hasImplementationConfig(value: unknown): boolean {\n  if (value == null || typeof value !== 'object') return false;\n  return walkForImplConfig(value as Record<string, unknown>);\n}\n\nfunction walkForImplConfig(obj: Record<string, unknown>): boolean {\n  if ('product_id' in obj && IMPLEMENTATION_CONFIG_KEY in obj) return true;\n  for (const key of IMPL_CONFIG_CARRIER_KEYS) {\n    const nested = obj[key];\n    if (nested == null) continue;\n    if (Array.isArray(nested)) {\n      for (const item of nested) {\n        if (item != null && typeof item === 'object' && walkForImplConfig(item as Record<string, unknown>)) return true;\n      }\n    } else if (typeof nested === 'object') {\n      if (walkForImplConfig(nested as Record<string, unknown>)) return true;\n    }\n  }\n  return false;\n}\n\nfunction walkForCtxMetadata(obj: Record<string, unknown>): boolean {\n  if (CTX_METADATA_KEY in obj) return true;\n  for (const key of CARRIER_KEYS) {\n    const nested = obj[key];\n    if (nested == null) continue;\n    if (Array.isArray(nested)) {\n      for (const item of nested) {\n        if (item != null && typeof item === 'object' && walkForCtxMetadata(item as Record<string, unknown>)) {\n          return true;\n        }\n      }\n    } else if (typeof nested === 'object') {\n      if (walkForCtxMetadata(nested as Record<string, unknown>)) return true;\n    }\n  }\n  return false;\n}\n"],"mappings":"AAmBA,MAAM,mBAAmB;AAmClB,SAAS,iBAAoB,OAAwB;AAC1D,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,mBAAiB,KAAgC;AACjD,SAAO;AACT;AAOA,MAAM,eAAe;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA,EACA;AACF;AAEA,SAAS,iBAAiB,KAAoC;AAC5D,MAAI,oBAAoB,IAAK,QAAO,IAAI,gBAAgB;AACxD,aAAW,OAAO,cAAc;AAC9B,UAAM,SAAS,IAAI,GAAG;AACtB,QAAI,UAAU,KAAM;AACpB,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,iBAAW,QAAQ,QAAQ;AACzB,YAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,kBAAiB,IAA+B;AAAA,MAChG;AAAA,IACF,WAAW,OAAO,WAAW,UAAU;AACrC,uBAAiB,MAAiC;AAAA,IACpD;AAAA,EACF;AACF;AAOO,SAAS,eAAe,OAAyB;AACtD,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,SAAO,mBAAmB,KAAgC;AAC5D;AAMA,MAAM,4BAA4B;AAwBlC,MAAM,2BAA2B;AAc1B,SAAS,0BAA6B,OAAa;AACxD,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,6BAA2B,KAAgC;AAC3D,SAAO;AACT;AAEA,SAAS,2BAA2B,KAAoC;AAKtE,MAAI,gBAAgB,OAAO,6BAA6B,KAAK;AAC3D,WAAO,IAAI,yBAAyB;AAAA,EACtC;AAGA,aAAW,OAAO,0BAA0B;AAC1C,UAAM,SAAS,IAAI,GAAG;AACtB,QAAI,UAAU,KAAM;AACpB,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,iBAAW,QAAQ,QAAQ;AACzB,YAAI,QAAQ,QAAQ,OAAO,SAAS,SAAU,4BAA2B,IAA+B;AAAA,MAC1G;AAAA,IACF,WAAW,OAAO,WAAW,UAAU;AACrC,iCAA2B,MAAiC;AAAA,IAC9D;AAAA,EACF;AACF;AASO,SAAS,wBAAwB,OAAyB;AAC/D,MAAI,SAAS,QAAQ,OAAO,UAAU,SAAU,QAAO;AACvD,SAAO,kBAAkB,KAAgC;AAC3D;AAEA,SAAS,kBAAkB,KAAuC;AAChE,MAAI,gBAAgB,OAAO,6BAA6B,IAAK,QAAO;AACpE,aAAW,OAAO,0BAA0B;AAC1C,UAAM,SAAS,IAAI,GAAG;AACtB,QAAI,UAAU,KAAM;AACpB,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,iBAAW,QAAQ,QAAQ;AACzB,YAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,kBAAkB,IAA+B,EAAG,QAAO;AAAA,MAC7G;AAAA,IACF,WAAW,OAAO,WAAW,UAAU;AACrC,UAAI,kBAAkB,MAAiC,EAAG,QAAO;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAuC;AACjE,MAAI,oBAAoB,IAAK,QAAO;AACpC,aAAW,OAAO,cAAc;AAC9B,UAAM,SAAS,IAAI,GAAG;AACtB,QAAI,UAAU,KAAM;AACpB,QAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,iBAAW,QAAQ,QAAQ;AACzB,YAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,mBAAmB,IAA+B,GAAG;AACnG,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF,WAAW,OAAO,WAAW,UAAU;AACrC,UAAI,mBAAmB,MAAiC,EAAG,QAAO;AAAA,IACpE;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/lib/server/decisioning/account.mjs

@@ -1,9 +1,3 @@
-import { fileURLToPath as __adcpFileURLToPath } from 'node:url';
-import { dirname as __adcpDirname } from 'node:path';
-import { createRequire as __adcpCreateRequire } from 'node:module';
-const __filename = __adcpFileURLToPath(import.meta.url);
-const __dirname = __adcpDirname(__filename);
-const require = __adcpCreateRequire(import.meta.url);
 const ACCOUNT_AUTHORIZATION_WIRE_KEYS = [
   "allowed_tasks",
   "field_scopes",