@adcp/sdk 13.0.0-rc.8 → 13.0.0-rc.9

package/dist/lib/server/decisioning/account.d.mts

@@ -16,10 +16,11 @@
  *
  * @public
  */
-import type { Account as WireAccount, AccountAuthorization, AccountScope, BillingParty, BrandReference, AccountReference, BusinessEntity, ExtensionObject, PaymentTerms, ListAccountsResponse, ReportUsageRequest, ReportUsageResponse, SyncAccountsResponse, SyncAccountsSuccess, SyncGovernanceRequest, SyncGovernanceResponse, SyncGovernanceSuccess, GetAccountFinancialsRequest, GetAccountFinancialsResponse, GetAccountFinancialsSuccess } from '../../types/tools.generated.mjs';
+import type { Account as WireAccount, AccountAuthorization, AccountScope, BillingParty, BrandReference, AccountReference, BusinessEntity, ExtensionObject, ListAccountsRequest, PaymentTerms, ListAccountsResponse, ReportUsageRequest, ReportUsageResponse, SyncAccountsResponse, SyncAccountsSuccess, SyncGovernanceRequest, SyncGovernanceResponse, SyncGovernanceSuccess, GetAccountFinancialsRequest, GetAccountFinancialsResponse, GetAccountFinancialsSuccess } from '../../types/tools.generated.mjs';
 import type { ServerPayload } from '../../types/server-payload.mjs';
 import type { NotificationConfig } from '../../types/v3-1-beta/index.mjs';
-import type { CursorPage, CursorRequest } from './pagination.mjs';
+import type { CursorPage } from './pagination.mjs';
+import type { AccountMode } from '../account-mode.mjs';
 import type { AdcpStructuredError } from './async-outcome.mjs';
 import type { AdcpCredential, BuyerAgent } from './buyer-agent.mjs';
 export declare const ACCOUNT_AUTHORIZATION_WIRE_KEYS: readonly ["allowed_tasks", "field_scopes", "scope_name", "read_only"];
@@ -160,6 +161,13 @@ export interface Account<TCtxMeta = Record<string, unknown>> {
      * introspectable account authorization for this caller/account tuple.
      */
     authorization?: AccountAuthorization;
+    /**
+     * Operational mode used by framework gates for test-only surfaces.
+     * Defaults to `'live'` when omitted. Unlike the wire-side
+     * `AccountReference.sandbox` selector, this value comes from the trusted
+     * resolved account and is not emitted on account response payloads.
+     */
+    mode?: AccountMode;
     /**
      * Sandbox account marker. For implicit accounts the wire schema treats
      * this as part of the natural key — the same brand/operator pair can have
@@ -547,7 +555,7 @@ export interface AccountStore<TCtxMeta = Record<string, unknown>> {
      * scope the listing per-principal (e.g., return only accounts visible to
      * the calling buyer agent) without re-deriving identity from the request.
      */
-    list?(filter: AccountFilter & CursorRequest, ctx?: ResolveContext): Promise<ListAccountsHandlerResult<TCtxMeta>>;
+    list?(request: ListAccountsRequest, ctx?: ResolveContext): Promise<ListAccountsHandlerResult<TCtxMeta>>;
     /**
      * report_usage API surface. Operator-billed platforms accept usage rows
      * (often impressions / spend by media_buy + period) for billing
@@ -668,14 +676,11 @@ export declare class AccountNotFoundError extends Error {
     readonly name: "AccountNotFoundError";
     constructor(message?: string);
 }
-export interface AccountFilter {
-    /** Filter by brand domain across all operators. */
-    brand_domain?: string;
-    /** Filter by operator across all brands. */
-    operator?: string;
-    /** Filter by status. */
-    status?: AdcpAccountStatus[];
-}
+/**
+ * @deprecated Use the wire-accurate `ListAccountsRequest` type. Retained as
+ * an alias so existing imports keep compiling.
+ */
+export type AccountFilter = ListAccountsRequest;
 /**
  * Per-account result row returned by an adopter's `accounts.upsert`
  * implementation. Maps to one element of the wire `sync_accounts` response's

package/dist/lib/server/decisioning/account.d.ts

@@ -16,10 +16,11 @@
  *
  * @public
  */
-import type { Account as WireAccount, AccountAuthorization, AccountScope, BillingParty, BrandReference, AccountReference, BusinessEntity, ExtensionObject, PaymentTerms, ListAccountsResponse, ReportUsageRequest, ReportUsageResponse, SyncAccountsResponse, SyncAccountsSuccess, SyncGovernanceRequest, SyncGovernanceResponse, SyncGovernanceSuccess, GetAccountFinancialsRequest, GetAccountFinancialsResponse, GetAccountFinancialsSuccess } from '../../types/tools.generated';
+import type { Account as WireAccount, AccountAuthorization, AccountScope, BillingParty, BrandReference, AccountReference, BusinessEntity, ExtensionObject, ListAccountsRequest, PaymentTerms, ListAccountsResponse, ReportUsageRequest, ReportUsageResponse, SyncAccountsResponse, SyncAccountsSuccess, SyncGovernanceRequest, SyncGovernanceResponse, SyncGovernanceSuccess, GetAccountFinancialsRequest, GetAccountFinancialsResponse, GetAccountFinancialsSuccess } from '../../types/tools.generated';
 import type { ServerPayload } from '../../types/server-payload';
 import type { NotificationConfig } from '../../types/v3-1-beta';
-import type { CursorPage, CursorRequest } from './pagination';
+import type { CursorPage } from './pagination';
+import type { AccountMode } from '../account-mode';
 import type { AdcpStructuredError } from './async-outcome';
 import type { AdcpCredential, BuyerAgent } from './buyer-agent';
 export declare const ACCOUNT_AUTHORIZATION_WIRE_KEYS: readonly ["allowed_tasks", "field_scopes", "scope_name", "read_only"];
@@ -160,6 +161,13 @@ export interface Account<TCtxMeta = Record<string, unknown>> {
      * introspectable account authorization for this caller/account tuple.
      */
     authorization?: AccountAuthorization;
+    /**
+     * Operational mode used by framework gates for test-only surfaces.
+     * Defaults to `'live'` when omitted. Unlike the wire-side
+     * `AccountReference.sandbox` selector, this value comes from the trusted
+     * resolved account and is not emitted on account response payloads.
+     */
+    mode?: AccountMode;
     /**
      * Sandbox account marker. For implicit accounts the wire schema treats
      * this as part of the natural key — the same brand/operator pair can have
@@ -547,7 +555,7 @@ export interface AccountStore<TCtxMeta = Record<string, unknown>> {
      * scope the listing per-principal (e.g., return only accounts visible to
      * the calling buyer agent) without re-deriving identity from the request.
      */
-    list?(filter: AccountFilter & CursorRequest, ctx?: ResolveContext): Promise<ListAccountsHandlerResult<TCtxMeta>>;
+    list?(request: ListAccountsRequest, ctx?: ResolveContext): Promise<ListAccountsHandlerResult<TCtxMeta>>;
     /**
      * report_usage API surface. Operator-billed platforms accept usage rows
      * (often impressions / spend by media_buy + period) for billing
@@ -668,14 +676,11 @@ export declare class AccountNotFoundError extends Error {
     readonly name: "AccountNotFoundError";
     constructor(message?: string);
 }
-export interface AccountFilter {
-    /** Filter by brand domain across all operators. */
-    brand_domain?: string;
-    /** Filter by operator across all brands. */
-    operator?: string;
-    /** Filter by status. */
-    status?: AdcpAccountStatus[];
-}
+/**
+ * @deprecated Use the wire-accurate `ListAccountsRequest` type. Retained as
+ * an alias so existing imports keep compiling.
+ */
+export type AccountFilter = ListAccountsRequest;
 /**
  * Per-account result row returned by an adopter's `accounts.upsert`
  * implementation. Maps to one element of the wire `sync_accounts` response's

package/dist/lib/server/decisioning/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/decisioning/account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,OAAO,IAAI,WAAW,EACtB,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhE,eAAO,MAAM,+BAA+B,uEAKgB,CAAC;AAa7D,KAAK,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC,GACnE,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAEzD,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,oBAAoB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,oBAAoB,CAAC,CAAC;AACtE,MAAM,MAAM,0BAA0B,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;AAC5E,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,aAAa,CAAC,sBAAsB,CAAC,CAAC;AAC1E,MAAM,MAAM,4BAA4B,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;AAChF,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1E,MAAM,MAAM,kBAAkB,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;AACpE,MAAM,MAAM,2BAA2B,GAAG,aAAa,CAAC,4BAA4B,CAAC,CAAC;AACtF,MAAM,MAAM,kCAAkC,GAAG,aAAa,CAAC,2BAA2B,CAAC,CAAC;AAC5F,MAAM,MAAM,yBAAyB,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1G,MAAM,MAAM,yBAAyB,GAAG,qBAAqB,EAAE,CAAC;AAChE,MAAM,MAAM,2BAA2B,GAAG,iBAAiB,EAAE,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAC1D,MAAM,MAAM,iCAAiC,GAAG,kCAAkC,CAAC;AAEnF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IAEX,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IAEb,qDAAqD;IACrD,MAAM,EAAE,iBAAiB,CAAC;IAE1B,uFAAuF;IACvF,KAAK,CAAC,EAAE,cAAc,CAAC;IAEvB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QAAE,UAAU,EAAE,OAAO,GAAG,UAAU,GAAG,cAAc,CAAA;KAAE,CAAC;IAEhE;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,6CAA6C;IAC7C,aAAa,CAAC,EAAE,YAAY,CAAC;IAE7B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IAE3C;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAE7B,iEAAiE;IACjE,aAAa,CAAC,EAAE,YAAY,CAAC;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAErD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAE5C;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAErC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,GAAG,CAAC,EAAE,eAAe,CAAC;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,YAAY,EAAE,QAAQ,CAAC;IAEvB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,sHAAsH;IACtH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,SAAQ,cAAc;IAC5F,8FAA8F;IAC9F,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,MAAM,MAAM,YAAY,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CACjE,OAAO,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EACrD,SAAS,CACV,GAAG;IACF;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;CACxC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAC;IACnD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,YAAY,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACH,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,cAAc,CAAC,CACb,OAAO,EAAE,qBAAqB,CAAC,UAAU,CAAC,EAC1C,GAAG,CAAC,EAAE,cAAc,GACnB,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjH;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAE/F;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,oBAAoB,CAAC,CACnB,GAAG,EAAE,2BAA2B,EAChC,GAAG,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GAChC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,YAAY,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpH;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBACpC,OAAO,SAAsB;CAG1C;AAED,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,iFAAiF;IACjF,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,yEAAyE;IACzE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,YAAY,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IAC3C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5C;;;;OAIG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,kBAAkB,GAClB,UAAU,GACV,kBAAkB,GAClB,WAAW,GACX,QAAQ,CAAC;AAMb;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,WAAW,CAyC/E;AAkBD,KAAK,kBAAkB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,qBAAqB,GAAG,kBAAkB,CA8BnF;AASD,KAAK,qBAAqB,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,qBAAqB,GAAG,qBAAqB,CAczF;AAuCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAEvE"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../../src/lib/server/decisioning/account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,OAAO,IAAI,WAAW,EACtB,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,2BAA2B,EAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhE,eAAO,MAAM,+BAA+B,uEAKgB,CAAC;AAa7D,KAAK,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC,GACnE,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAEzD,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,oBAAoB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC,oBAAoB,CAAC,CAAC;AACtE,MAAM,MAAM,0BAA0B,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;AAC5E,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,MAAM,MAAM,qBAAqB,GAAG,aAAa,CAAC,sBAAsB,CAAC,CAAC;AAC1E,MAAM,MAAM,4BAA4B,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;AAChF,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1E,MAAM,MAAM,kBAAkB,GAAG,aAAa,CAAC,mBAAmB,CAAC,CAAC;AACpE,MAAM,MAAM,2BAA2B,GAAG,aAAa,CAAC,4BAA4B,CAAC,CAAC;AACtF,MAAM,MAAM,kCAAkC,GAAG,aAAa,CAAC,2BAA2B,CAAC,CAAC;AAC5F,MAAM,MAAM,yBAAyB,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1G,MAAM,MAAM,yBAAyB,GAAG,qBAAqB,EAAE,CAAC;AAChE,MAAM,MAAM,2BAA2B,GAAG,iBAAiB,EAAE,CAAC;AAC9D,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;AAC1D,MAAM,MAAM,iCAAiC,GAAG,kCAAkC,CAAC;AAEnF;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IAEX,6FAA6F;IAC7F,IAAI,EAAE,MAAM,CAAC;IAEb,qDAAqD;IACrD,MAAM,EAAE,iBAAiB,CAAC;IAE1B,uFAAuF;IACvF,KAAK,CAAC,EAAE,cAAc,CAAC;IAEvB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;QAAE,UAAU,EAAE,OAAO,GAAG,UAAU,GAAG,cAAc,CAAA;KAAE,CAAC;IAEhE;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,6CAA6C;IAC7C,aAAa,CAAC,EAAE,YAAY,CAAC;IAE7B,2DAA2D;IAC3D,YAAY,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IAE3C;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAE7B,iEAAiE;IACjE,aAAa,CAAC,EAAE,YAAY,CAAC;IAE7B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAErD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAE5C;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAErC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC;IAEnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,GAAG,CAAC,EAAE,eAAe,CAAC;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,YAAY,EAAE,QAAQ,CAAC;IAEvB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAE5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,sHAAsH;IACtH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,kBAAkB,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,SAAQ,cAAc;IAC5F,8FAA8F;IAC9F,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,MAAM,MAAM,YAAY,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CACjE,OAAO,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EACrD,SAAS,CACV,GAAG;IACF;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;CACxC,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAC;IACnD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,YAAY,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACH,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,MAAM,CAAC,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,cAAc,CAAC,CACb,OAAO,EAAE,qBAAqB,CAAC,UAAU,CAAC,EAC1C,GAAG,CAAC,EAAE,cAAc,GACnB,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;;;;;;;OAQG;IACH,IAAI,CAAC,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExG;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,CAAC,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAE/F;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,oBAAoB,CAAC,CACnB,GAAG,EAAE,2BAA2B,EAChC,GAAG,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GAChC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiDG;IACH,YAAY,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpH;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBACpC,OAAO,SAAsB;CAG1C;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAEhD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,cAAc,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACvD,MAAM,EAAE,iBAAiB,CAAC;IAC1B,iFAAiF;IACjF,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,yEAAyE;IACzE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,YAAY,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC;IAC3C,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5C;;;;OAIG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,kBAAkB,GAClB,UAAU,GACV,kBAAkB,GAClB,WAAW,GACX,QAAQ,CAAC;AAMb;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,WAAW,CAyC/E;AAkBD,KAAK,kBAAkB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,qBAAqB,GAAG,kBAAkB,CA8BnF;AASD,KAAK,qBAAqB,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,qBAAqB,GAAG,qBAAqB,CAczF;AAuCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,GAAG,CAAC,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAEvE"}

package/dist/lib/server/decisioning/account.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/server/decisioning/account.ts"],"sourcesContent":["/**\n * Account model. Single-level (matches AdCP wire's AccountReference).\n * Platform-internal hierarchies (GAM Network → Advertiser → Order;\n * Spotify Brand → Campaign) are encoded in `metadata`, not in the typed\n * shape. Generic `TCtxMeta` lets platforms type their metadata at the call site.\n *\n * Tenant scoping is expressed by what `accounts.resolve()` returns, not via\n * a multi-level type. Note that resolve is an isolation gate only when you make\n * it one: `createTenantStore` requires an explicit `refAccess`, and under\n * `'ref-routed'` it resolves the ref the buyer supplies regardless of the caller\n * (isolation then has to come from a composed `resolve-presets` guard).\n * `'auth-scoped'` fails closed instead. See `createTenantStore` and\n * `resolve-presets.ts`.\n *\n * Status: Preview / 6.0.\n *\n * @public\n */\n\nimport type {\n  Account as WireAccount,\n  AccountAuthorization,\n  AccountScope,\n  BillingParty,\n  BrandReference,\n  AccountReference,\n  BusinessEntity,\n  ExtensionObject,\n  PaymentTerms,\n  ListAccountsResponse,\n  ReportUsageRequest,\n  ReportUsageResponse,\n  SyncAccountsResponse,\n  SyncAccountsSuccess,\n  SyncGovernanceRequest,\n  SyncGovernanceResponse,\n  SyncGovernanceSuccess,\n  GetAccountFinancialsRequest,\n  GetAccountFinancialsResponse,\n  GetAccountFinancialsSuccess,\n} from '../../types/tools.generated';\nimport type { ServerPayload } from '../../types/server-payload';\nimport type { NotificationConfig } from '../../types/v3-1-beta';\nimport type { CursorPage, CursorRequest } from './pagination';\nimport type { AdcpStructuredError } from './async-outcome';\nimport type { AdcpCredential, BuyerAgent } from './buyer-agent';\n\nexport const ACCOUNT_AUTHORIZATION_WIRE_KEYS = [\n  'allowed_tasks',\n  'field_scopes',\n  'scope_name',\n  'read_only',\n] as const satisfies readonly (keyof AccountAuthorization)[];\n\ntype MissingAccountAuthorizationWireKey = Exclude<\n  keyof AccountAuthorization,\n  (typeof ACCOUNT_AUTHORIZATION_WIRE_KEYS)[number]\n>;\nconst ACCOUNT_AUTHORIZATION_WIRE_KEY_COVERAGE: Record<MissingAccountAuthorizationWireKey, never> = {};\nvoid ACCOUNT_AUTHORIZATION_WIRE_KEY_COVERAGE;\n\ntype WireNotificationConfig = Omit<NotificationConfig, 'authentication'> & {\n  authentication?: Omit<NonNullable<NotificationConfig['authentication']>, 'credentials'>;\n};\n\ntype SyncAccountError = Pick<AdcpStructuredError, 'code' | 'message'> &\n  Partial<Omit<AdcpStructuredError, 'code' | 'message'>>;\n\nexport type ListAccountsPayload = ServerPayload<ListAccountsResponse>;\nexport type SyncAccountsPayload = ServerPayload<SyncAccountsResponse>;\nexport type SyncAccountsSuccessPayload = ServerPayload<SyncAccountsSuccess>;\nexport type SyncAccountsRow = SyncAccountsSuccess['accounts'][number];\nexport type SyncGovernancePayload = ServerPayload<SyncGovernanceResponse>;\nexport type SyncGovernanceSuccessPayload = ServerPayload<SyncGovernanceSuccess>;\nexport type SyncGovernanceRow = SyncGovernanceSuccess['accounts'][number];\nexport type ReportUsagePayload = ServerPayload<ReportUsageResponse>;\nexport type GetAccountFinancialsPayload = ServerPayload<GetAccountFinancialsResponse>;\nexport type GetAccountFinancialsSuccessPayload = ServerPayload<GetAccountFinancialsSuccess>;\nexport type ListAccountsHandlerResult<TCtxMeta = Record<string, unknown>> = CursorPage<Account<TCtxMeta>>;\nexport type SyncAccountsHandlerResult = SyncAccountsResultRow[];\nexport type SyncGovernanceHandlerResult = SyncGovernanceRow[];\nexport type ReportUsageHandlerResult = ReportUsagePayload;\nexport type GetAccountFinancialsHandlerResult = GetAccountFinancialsSuccessPayload;\n\n/**\n * Account — framework's rich representation. A strict superset of the wire\n * `Account` shape (from `list_accounts` / response envelopes):\n *\n *   - Adds `metadata: TCtxMeta` (platform-internal fields the framework doesn't\n *     read but adopters use to thread platform-specific data)\n *   - Adds `authInfo: AuthPrincipal` (auth context for the request — MUST NOT\n *     leak to the wire)\n *   - All wire-required fields (`id`/`account_id`, `name`, `status`) are\n *     required here too.\n *\n * Framework projects to wire shape via `toWireAccount`: strips `metadata` +\n * `authInfo`, renames `id` → `account_id`. ~10 lines, no `as never` casts.\n */\nexport interface Account<TCtxMeta = Record<string, unknown>> {\n  /** Your platform's account_id. Maps to wire `Account.account_id`. */\n  id: string;\n\n  /** Human-readable account name (e.g., 'Acme', 'Acme c/o Pinnacle'). Required on the wire. */\n  name: string;\n\n  /** Account status. Maps to wire `Account.status`. */\n  status: AdcpAccountStatus;\n\n  /** Canonical brand reference. Either id OR (brand+operator) identifies the account. */\n  brand?: BrandReference;\n\n  /** Operator domain (agency / managed-services). Pairs with `brand`. */\n  operator?: string;\n\n  /**\n   * The advertiser whose rates apply to this account. Maps to wire\n   * `Account.advertiser`. Use when the account is operated by an agency on\n   * behalf of an advertiser whose rates differ from the operator's.\n   */\n  advertiser?: string;\n\n  /**\n   * Optional intermediary who receives invoices on behalf of the advertiser\n   * (e.g., agency holdco). Distinct from `advertiser` (whose rates apply)\n   * and from `billing.invoicedTo` (the legal billing party). Use when the\n   * invoice recipient differs from both — common in agency-handled flows.\n   */\n  billing_proxy?: string;\n\n  /**\n   * Settlement boundary for operator-billed retail-media platforms.\n   * `'agent'` = pass-through (buyer's agent settles directly with the platform).\n   * `'operator'` = retail-media model (operator pays publisher, bills brand).\n   * `BrandReference` = invoice routes to a third party (Amazon DSP returning\n   * a different invoice principal than the requester is the canonical case).\n   *\n   * Optional — most platforms don't need this; comply storyboards use it to\n   * assert the right party is billed.\n   */\n  billing?: { invoicedTo: 'agent' | 'operator' | BrandReference };\n\n  /**\n   * Business entity invoiced on this account. Carries legal name, tax IDs,\n   * address, contacts, and (write-only) bank details for B2B invoicing.\n   *\n   * **`bank` is write-only.** The wire schema marks `BusinessEntity.bank` as\n   * MUST NOT be echoed in responses (sellers store and confirm receipt\n   * without returning the details). `toWireAccount` strips it on emit, so\n   * adopters who store the full entity here will not leak bank details to\n   * buyers — but DO NOT rely on the strip for anything beyond response\n   * projection. Adopters loading the entity from their own DB SHOULD apply\n   * the same rule at retrieval time, especially for non-list endpoints.\n   */\n  billing_entity?: BusinessEntity;\n\n  /**\n   * Identifier for the rate card applied to this account. Opaque seller-side\n   * string; emitted unchanged on the wire.\n   */\n  rate_card?: string;\n\n  /** Payment terms applied to this account. */\n  payment_terms?: PaymentTerms;\n\n  /** Maximum outstanding balance allowed on this account. */\n  credit_limit?: WireAccount['credit_limit'];\n\n  /**\n   * Setup payload for accounts in `pending_approval`. Carries the URL/message\n   * the buyer surfaces to a human to complete activation (credit-app, legal\n   * agreement, fund-add). Required-shape: `message` is mandatory; `url` and\n   * `expires_at` are optional.\n   *\n   * The framework does NOT validate that `setup` is populated when status is\n   * `pending_approval` — that's an adopter contract with the spec. It also\n   * does NOT clear `setup` when status leaves `pending_approval`; adopters\n   * who echo the same `Account` across status transitions should drop the\n   * field themselves.\n   */\n  setup?: WireAccount['setup'];\n\n  /** Account scope (operator / brand / operator_brand / agent). */\n  account_scope?: AccountScope;\n\n  /**\n   * Governance agent endpoints registered on this account. Auth credentials\n   * are write-only on the wire and not modeled here — adopters set/update\n   * via `sync_governance`, not by re-emitting the Account.\n   */\n  governance_agents?: WireAccount['governance_agents'];\n\n  /**\n   * Cloud storage bucket for offline reporting delivery. Only present when\n   * the seller's capabilities advertise `reporting_delivery_methods`\n   * including `'offline'`. Per-account access MUST be IAM-scoped — see the\n   * schema description for security constraints.\n   */\n  reporting_bucket?: WireAccount['reporting_bucket'];\n\n  /**\n   * Account-level webhook subscriptions registered through `sync_accounts`.\n   * Beta 3 adds wholesale product/signal feed webhooks here. The framework\n   * strips legacy `authentication.credentials` before emitting accounts on\n   * `list_accounts`; adopters must still persist credentials server-side if\n   * they accept legacy webhook auth.\n   */\n  notification_configs?: NotificationConfig[];\n\n  /**\n   * Caller-specific authorization metadata for this account. Emitted only on\n   * `list_accounts` / account response surfaces that use the\n   * `AccountWithAuthorization` wire shape. Use this for platform adapters\n   * that can introspect what the authenticated buyer agent may do on this\n   * account, including downstream grants such as advertiser-account access\n   * plus publisher identity/post authorization.\n   *\n   * Absence is silence, not denial: it means the adapter does not expose\n   * introspectable account authorization for this caller/account tuple.\n   */\n  authorization?: AccountAuthorization;\n\n  /**\n   * Sandbox account marker. For implicit accounts the wire schema treats\n   * this as part of the natural key — the same brand/operator pair can have\n   * separate production and sandbox accounts. For explicit accounts, sandbox\n   * accounts are pre-existing test accounts the seller surfaces via\n   * `list_accounts`.\n   *\n   * @deprecated Use {@link Account.mode} instead. As of AdCP 6.7+ the\n   * three-mode `mode: 'live' | 'sandbox' | 'mock'` field is the canonical\n   * signal the framework gate consults — see\n   * `docs/proposals/lifecycle-state-and-sandbox-authority.md`. Adopters\n   * stamping this `sandbox` flag continue to work via\n   * `getAccountMode`'s legacy fallback (`sandbox: true` reads as\n   * `mode: 'sandbox'`); new code should set `mode` directly. This\n   * field will be removed in the next major version.\n   *\n   * The wire-side `AccountReference.sandbox` flag (per\n   * `core/account-ref.json`) stays — it's part of the spec's natural-key\n   * disambiguation for implicit accounts. The deprecation is on the\n   * SERVER-side resolved `Account.sandbox` only.\n   */\n  sandbox?: boolean;\n\n  /**\n   * Wire `ext` extension hatch. Carries forward-compatible additions the\n   * codegen'd type doesn't model yet. Adopters who don't need extensions\n   * leave this undefined.\n   */\n  ext?: ExtensionObject;\n\n  /**\n   * Adapter-internal opaque state. Framework doesn't read this; **stripped\n   * before emitting on the wire**. GAM puts `{ networkId, advertiserId }`;\n   * Spotify puts `{ brandId, businessId }`; Criteo puts `{ customerId }`.\n   * Each platform's choice.\n   *\n   * Same field name (`ctx_metadata`) used across every DecisioningPlatform\n   * resource (Product, MediaBuy, Package, Creative, Audience, Signal,\n   * Account) for naming consistency. Account is special operationally:\n   * `accounts.resolve()` is called per-request, so the publisher is the\n   * canonical source of truth and the SDK does NOT round-trip Account\n   * `ctx_metadata` through the cache (unlike Product / MediaBuy / etc.,\n   * where the SDK bridges between `getProducts` and `createMediaBuy`).\n   * Put adapter state in `ctx_metadata`; treat it as fresh from your\n   * `accounts.resolve()` on every request.\n   *\n   * **DO NOT put credentials here.** The wire-strip protects buyer\n   * responses but does NOT protect server-side log lines, error\n   * envelopes (when `exposeErrorDetails: true`), heap dumps, or\n   * adopter-generated strings (`JSON.stringify(account)` in an error\n   * message). Bearer tokens, OAuth refresh tokens, API keys, and\n   * client secrets belong on `authInfo` (which the framework\n   * round-trips through `refreshToken`) or in your own per-principal\n   * token cache — NOT in `ctx_metadata`. See\n   * [`docs/guides/CTX-METADATA-SAFETY.md`](../../../../docs/guides/CTX-METADATA-SAFETY.md)\n   * for the full guidance and the recommended re-derive-per-request\n   * pattern.\n   */\n  ctx_metadata: TCtxMeta;\n\n  /**\n   * Caller's authenticated principal. **Stripped before emitting on the wire.**\n   *\n   * Optional from the adopter's perspective: when `accounts.resolve` returns\n   * an `Account` without `authInfo`, the framework auto-attaches the\n   * principal from `ctx.authInfo` (the auth shape extracted by\n   * `serve({ authenticate })`). Adopters that need to *transform* the\n   * principal — e.g. derive a tenant-scoped sub-principal from the OAuth\n   * client — set it explicitly; adopters that just want the\n   * `serve({ authenticate })` principal threaded through resource handlers\n   * can omit the field and rely on the framework default.\n   */\n  authInfo?: AuthPrincipal;\n}\n\n/**\n * The OAuth-style auth shape extracted by `serve({ authenticate })`. Threaded\n * to `accounts.resolve(ref, ctx)` and to the `tasks_get` custom-tool handler\n * so adopters can authorize the resolution against the principal.\n *\n * Distinct from {@link AuthPrincipal} — `ResolvedAuthInfo` is the RAW\n * transport-level auth the framework hands to the resolver; `AuthPrincipal`\n * is what the resolver chooses to persist on the resolved `Account`. The\n * resolver decides what to keep / drop / re-shape.\n *\n * @public\n */\nexport interface ResolvedAuthInfo {\n  /**\n   * Kind-discriminated credential — Phase 1 Stage 3 of #1269. Populated by\n   * the framework's built-in authenticators (`verifyApiKey`, `verifyBearer`,\n   * `verifySignatureAsAuthenticator`); custom `authenticate` callbacks can\n   * stamp this directly on the returned `AuthPrincipal` to opt into the\n   * discriminated-credential surface. The framework propagates it from\n   * `req.auth.extra.credential` to this top-level field on every request.\n   *\n   * **Verified vs. claimed.** `credential.kind === 'http_sig'` carries an\n   * `agent_url` that is cryptographically verified by the framework's\n   * signature verifier (per adcontextprotocol/adcp#3831). The framework\n   * brands verified credentials with a module-private symbol that\n   * `BuyerAgentRegistry` factories check before treating the credential\n   * as authentic — a literal-shape `{ kind: 'http_sig', ... }` synthesized\n   * by a custom authenticator is rejected at the registry layer. Adopters\n   * making security-relevant decisions on `agent_url` MUST read it from\n   * the credential variant; framework-stamped registry-derived URLs are\n   * exposed via `ctx.agent.agent_url` only.\n   */\n  credential?: AdcpCredential;\n\n  /**\n   * Optional operator seat within the buyer agent. Stamped only when the\n   * authenticator's claims include a `sub` / `oid` / equivalent identifying\n   * a sub-principal within the agent. Reserved for future use; v1 of\n   * `BuyerAgentRegistry` doesn't consume it.\n   */\n  operator?: string;\n\n  /**\n   * @deprecated Use `credential.kind === 'oauth' ? credential.client_id : ...`\n   * for the discriminated shape. Optional in N+1 of the deprecation cycle\n   * per #1269; framework continues to populate it for adopter compatibility\n   * through the cycle. Removed in N+2.\n   */\n  token?: string;\n\n  /**\n   * @deprecated Use `credential.client_id` (oauth) or `credential.key_id`\n   * (api_key) instead.\n   */\n  clientId?: string;\n\n  /** @deprecated Use `credential.scopes` (oauth) instead. */\n  scopes?: string[];\n\n  expiresAt?: number;\n  extra?: Record<string, unknown>;\n}\n\nexport interface ResolveContext {\n  /** Authenticated principal extracted by `serve({ authenticate })`. Undefined when no `authenticate` is configured. */\n  authInfo?: ResolvedAuthInfo;\n  /** Tool the buyer is calling — useful for tool-aware tenant routing. */\n  toolName?: string;\n  /**\n   * Resolved buyer agent from `BuyerAgentRegistry.resolve()`, when an\n   * `agentRegistry` is configured (Phase 1 of #1269). The framework calls\n   * the registry once per request before `accounts.resolve` and threads the\n   * resolved record here so adopters can route tenant resolution against\n   * the durable buyer-agent identity rather than re-deriving it from\n   * `authInfo`. Undefined when no registry is configured OR when the\n   * registry returns null for the request's credential.\n   */\n  agent?: BuyerAgent;\n  /**\n   * Un-destructured wire request envelope. Set by the framework so account\n   * tool handlers (`syncAccounts`, `syncGovernance`, `listAccounts`,\n   * `reportUsage`, `getAccountFinancials`) can read request fields the\n   * typed signature doesn't model — e.g. `sync_accounts.delete_missing`\n   * and `sync_accounts.dry_run`, which the framework destructures the\n   * payload array out of before calling the handler.\n   *\n   * Same shape and read-site cast pattern as `RequestContext.input` (see\n   * `decisioning/context.ts`). Same caveats:\n   *\n   * - **Identical reference to the typed payload arg.** This is the same\n   *   request body object the platform method's first positional arg\n   *   projects from. Framework auto-hydrate seams mutate this object\n   *   before the platform method runs; treat fields the buyer sent as\n   *   authoritative, but expect framework-injected entities (e.g.\n   *   hydrated product / media-buy refs) to be visible here too.\n   * - **Buyer-controlled untrusted data.** Free-text fields (`brief`,\n   *   `message`, creative snippets, etc.) are attacker-controlled.\n   *   Don't log `ctx.input` wholesale — secret fields like\n   *   `push_notification_config.token` are present on mutating requests.\n   *   When templating into LLM prompts, validate or fence the field\n   *   rather than string-interpolating.\n   *\n   * @public\n   */\n  input?: Readonly<Record<string, unknown>>;\n}\n\n/**\n * Context passed to AccountStore tool methods that operate on a single\n * resolved Account (today: `getAccountFinancials`). Threads the resolved\n * `Account<TCtxMeta>` through so adopters can read `ctx.account.ctx_metadata`\n * (auth tokens, upstream IDs, etc.) without re-resolving from the request.\n *\n * Strict superset of `ResolveContext`: same `authInfo` / `toolName` fields,\n * plus the resolved account. Distinct type because `accounts.resolve()`\n * produces the account and therefore cannot receive it on input.\n *\n * **NOT applicable to `reportUsage`.** `ReportUsageRequest.usage[]` carries\n * a per-row `account: AccountReference`; a request can span multiple\n * accounts. Pre-resolving a single `ctx.account` would misrepresent that\n * shape. `reportUsage` keeps `ResolveContext` and per-row resolution is\n * the adopter's responsibility (call `accounts.resolve` from inside the\n * impl, once per row).\n *\n * @public\n */\nexport interface AccountToolContext<TCtxMeta = Record<string, unknown>> extends ResolveContext {\n  /** Resolved Account from `accounts.resolve()`. Populated by the framework before dispatch. */\n  account: Account<TCtxMeta>;\n}\n\n/**\n * Request context for tools whose wire request does not carry an `account`\n * field — `preview_creative`, `list_creative_formats`, and\n * `provide_performance_feedback`. The framework calls\n * `accounts.resolve(undefined, ctx)` for these, accepting a `null` return; if\n * `null`, `ctx.account` is undefined when the handler runs.\n *\n * Adopter handlers MUST handle the `undefined` case explicitly. Choose one of:\n *\n *   1. **Singleton fallback** — return a non-null synthetic `Account` from\n *      `accounts.resolve(undefined, ctx)` for the publisher-wide tenant\n *      (e.g., format catalog, performance feedback aggregation). Inside the\n *      handler, narrow with `if (!ctx.account) throw ...` once and treat\n *      `ctx.account` as defined for the rest.\n *   2. **Auth-derived lookup** — in `accounts.resolve(undefined, ctx)`, look\n *      up by `ctx.authInfo.clientId` (or whichever principal field your auth\n *      wires) and return the matching account.\n *   3. **Error out** — throw `AdcpError({ code: 'ACCOUNT_NOT_FOUND' })` from\n *      within the handler when `ctx.account == null` and the operation\n *      requires tenant scoping.\n *\n * The narrowed type catches the mismatch at authorship time — adopters who\n * forget to handle `ctx.account === undefined` get a TS error, not a runtime\n * `Cannot read properties of undefined` deep in their upstream call. Same\n * shape as the `definePlatformWithCompliance` invariant: convert a runtime\n * gate into a compile-time one.\n *\n * @public\n */\n// Inline type-import on `RequestContext` instead of a top-level\n// `import type { RequestContext } from './context'` — `context.ts` already\n// imports `Account` from this file, so a top-level import would form a\n// circular type dependency.\nexport type NoAccountCtx<TCtxMeta = Record<string, unknown>> = Omit<\n  import('./context').RequestContext<Account<TCtxMeta>>,\n  'account'\n> & {\n  /**\n   * Resolved account, OR `undefined` when the wire request didn't carry an\n   * account ref AND `accounts.resolve(undefined, ctx)` returned null. Always\n   * narrow before reading `ctx_metadata` / `id`.\n   */\n  account: Account<TCtxMeta> | undefined;\n};\n\nexport interface AuthPrincipal {\n  /** Stable identifier for the calling agent (e.g., `https://buyer.example.com/mcp`). */\n  agent_url?: string;\n  /** Token kind: API key, OAuth bearer, signed-request claim. */\n  kind: 'api_key' | 'oauth' | 'signature' | 'public';\n  /** Bearer token / API key value. Platform-side don't log this. */\n  token?: string;\n  /** Token expiry (ms since epoch). Set by `accounts.refreshToken` after a successful refresh. */\n  expiresAt?: number;\n  /** OAuth scopes / API-key principal name. */\n  principal?: string;\n  /** Additional claims (jwt sub, kid, etc.). */\n  claims?: Record<string, unknown>;\n}\n\nexport interface AccountStore<TCtxMeta = Record<string, unknown>> {\n  /**\n   * How buyers reference accounts on this platform.\n   * - `'explicit'` — buyer passes `account_id` inline on every request (Snap,\n   *   Meta, GAM via Network/Company id). The default.\n   * - `'implicit'` — buyer must `sync_accounts` first; subsequent requests are\n   *   resolved from the auth principal's pre-synced linkage (LinkedIn, some\n   *   retail-media operators). Framework refuses inline `account_id` references\n   *   for these platforms — emits `AdcpError('INVALID_REQUEST', { field:\n   *   'account.account_id' })` before reaching `accounts.resolve`. The\n   *   brand+operator union arm is permitted (used during the initial\n   *   `sync_accounts` flow); only `account_id`-shaped references are rejected.\n   * - `'derived'` — single-tenant agents where there is no account_id on the\n   *   wire at all and the auth principal alone identifies the tenant. Most\n   *   self-hosted broadcasters and retail-media operators in proxy mode.\n   *   Framework refuses inline `account_id` references for these platforms —\n   *   same `AdcpError('INVALID_REQUEST', { field: 'account.account_id' })`\n   *   shape as `'implicit'`, but with a single-tenant message instead of the\n   *   `sync_accounts`-first guidance (no `sync_accounts` step exists in\n   *   derived mode). The brand+operator union arm is permitted.\n   *\n   * Defaults to `'explicit'` when omitted.\n   */\n  readonly resolution?: 'explicit' | 'implicit' | 'derived';\n\n  /**\n   * Resolve buyer's AccountReference into the platform's tenant model.\n   *\n   * `ref` is `undefined` when the wire request didn't carry an account\n   * field — `provide_performance_feedback` and `list_creative_formats` are\n   * the canonical examples. Per `resolution` mode:\n   * - `'derived'` (single-tenant): return the singleton account regardless.\n   * - `'implicit'`: look up the account from the auth principal.\n   * - `'explicit'` (default): no account is available; either throw\n   *   `AccountNotFoundError` to signal \"tool requires account\" OR return\n   *   a synthetic singleton if the tool legitimately doesn't need\n   *   tenant scoping (e.g., publisher-wide format catalog from\n   *   `list_creative_formats`).\n   *\n   * `ctx.authInfo` is the caller's authenticated principal (when\n   * `serve({ authenticate })` is wired). Adapters fronting an upstream\n   * platform API (Snap, Meta, retail-media) translate auth to tenant ID:\n   *\n   * ```ts\n   * resolve: async (ref, ctx) => {\n   *   if (ref?.account_id) return await this.db.findById(ref.account_id);\n   *   const cred = ctx?.authInfo?.credential;\n   *   const clientKey = cred?.kind === 'oauth' ? cred.client_id\n   *     : cred?.kind === 'api_key' ? cred.key_id\n   *     : undefined;\n   *   const platformAcct = clientKey ? await myUpstream.findByClientKey(clientKey) : null;\n   *   return platformAcct ? this.toAccount(platformAcct) : null;\n   * }\n   * ```\n   *\n   * Two failure shapes:\n   * - **Unknown / cross-tenant reference**: return `null` (canonical) — OR\n   *   throw `AccountNotFoundError` if your codebase already throws a\n   *   not-found exception class. Framework emits the spec's fixed\n   *   `ACCOUNT_NOT_FOUND` envelope either way. The buyer learns no detail\n   *   beyond \"not found\" — guarding against principal-enumeration.\n   * - **Transient upstream failure** (DB outage, identity-provider 5xx):\n   *   throw a generic exception. Framework maps to `SERVICE_UNAVAILABLE`\n   *   so the buyer can retry.\n   */\n  resolve(ref: AccountReference | undefined, ctx?: ResolveContext): Promise<Account<TCtxMeta> | null>;\n\n  /**\n   * sync_accounts API surface. Framework normalizes the wire request; platform\n   * upserts and returns per-account result rows. `throw new AdcpError(...)`\n   * for buyer-facing rejection.\n   *\n   * In AdCP 3.1 beta, adopters that need settings-update entries with\n   * `notification_configs[]` can read the full wire body from `ctx.input`\n   * or supply a top-level `accounts.syncAccounts` handler.\n   *\n   * **Optional.** Stateless platforms (creative-template, signal-marketplace\n   * proxies) that don't manage account lifecycle can omit this; framework\n   * surfaces `UNSUPPORTED_FEATURE` to buyers calling `sync_accounts`.\n   *\n   * `ctx.authInfo` carries the caller's authenticated principal (when\n   * `serve({ authenticate })` is wired); `ctx.agent` carries the resolved\n   * `BuyerAgent` record (when an `agentRegistry` is configured). Adopters\n   * implementing principal-keyed gates (e.g., per-buyer-agent\n   * `BILLING_NOT_PERMITTED_FOR_AGENT` on the spec's billing surfaces) read\n   * the principal here — same threading as `accounts.resolve`.\n   *\n   * **Prefer `ctx.agent` over `ctx.authInfo.credential` for commercial-\n   * relationship decisions.** `ctx.agent` is the registry-resolved durable\n   * identity (status, billing capabilities, default account terms);\n   * `ctx.authInfo.credential` is the raw transport-level credential. For\n   * billing gates the registry-resolved identity is canonical. Use\n   * `credential` only for transport-level branching (e.g., reading the\n   * verified `agent_url` from `credential.kind === 'http_sig'` when\n   * `agentRegistry` is not configured).\n   */\n  upsert?(refs: AccountReference[], ctx?: ResolveContext): Promise<SyncAccountsHandlerResult>;\n\n  /**\n   * sync_governance API surface. Buyers register governance agent endpoints\n   * per-account; the seller persists the binding and consults the agents\n   * during media buy lifecycle events via `check_governance`.\n   *\n   * **Optional.** Adopters that don't model buyer-supplied governance agents\n   * (most direct sellers) leave this unimplemented and the framework returns\n   * `UNSUPPORTED_FEATURE`.\n   *\n   * `entries` is the wire request's `accounts[]` — each entry pairs an\n   * `AccountReference` with its `governance_agents[]`. The framework has\n   * already deduped on `idempotency_key` and stripped wire metadata\n   * (`adcp_major_version`, `context`, `ext`) before invoking this method.\n   *\n   * **Replace semantics, per spec.** Each call REPLACES the previously\n   * synced governance agents for the referenced account. An entry whose\n   * `governance_agents` is empty clears the binding for that account.\n   *\n   * **Write-only credentials.** Each `governance_agents[i].authentication.credentials`\n   * is the bearer the seller presents to that governance agent on outbound\n   * `check_governance` calls. Persist them — silently dropping ships\n   * unauthenticated requests once cross-agent calls are wired. The framework\n   * strips `authentication` from each `governance_agents[i]` of every row\n   * before serialization (`toWireSyncGovernanceRow`), so credentials never\n   * reach the response wire OR the idempotency replay cache, even if an\n   * adopter returns a loosely-typed row that spreads the input. Do not rely\n   * on TypeScript narrowing alone — the strip is enforced at the dispatcher.\n   *\n   * `ctx.authInfo` and `ctx.agent` carry the caller's principal — same\n   * threading as `upsert`. Adopters MUST gate per-entry persistence by the\n   * caller's tenant: each entry's `account.operator` (or `account_id`) must\n   * map to the same tenant the auth principal authorizes; otherwise return a\n   * `'failed'` row carrying `errors: [{code: 'PERMISSION_DENIED', ...}]` for\n   * that entry. (Operation-level rejection — `throw new AdcpError(...)` —\n   * fails the whole batch, which is the wrong shape when a single entry\n   * fails the gate.)\n   */\n  syncGovernance?(\n    entries: SyncGovernanceRequest['accounts'],\n    ctx?: ResolveContext\n  ): Promise<SyncGovernanceHandlerResult>;\n\n  /**\n   * list_accounts API surface. Framework wraps with cursor envelope.\n   *\n   * **Optional.** Same rationale as `upsert` — stateless platforms can omit.\n   *\n   * `ctx.authInfo` and `ctx.agent` carry the caller's principal — adopters\n   * scope the listing per-principal (e.g., return only accounts visible to\n   * the calling buyer agent) without re-deriving identity from the request.\n   */\n  list?(filter: AccountFilter & CursorRequest, ctx?: ResolveContext): Promise<ListAccountsHandlerResult<TCtxMeta>>;\n\n  /**\n   * report_usage API surface. Operator-billed platforms accept usage rows\n   * (often impressions / spend by media_buy + period) for billing\n   * reconciliation. Optional — adopters that don't run billing through the\n   * agent leave this unimplemented and the framework returns\n   * UNSUPPORTED_FEATURE.\n   *\n   * Idempotent on `(account, period_start, period_end, line_item_id)` —\n   * platform must dedupe replays under the framework's idempotency key.\n   *\n   * `ctx.authInfo` carries the caller's OAuth principal (when\n   * `serve({ authenticate })` is wired); `ctx.agent` carries the resolved\n   * `BuyerAgent` record (when an `agentRegistry` is configured). Platforms\n   * fronting an upstream billing API (Snap, Meta, retail-media) use them\n   * to authorize the usage post against the principal's tenant — same\n   * pattern as `accounts.resolve`. Prefer `ctx.agent` for principal-keyed\n   * commercial gates; see `upsert?` for the rationale.\n   */\n  reportUsage?(req: ReportUsageRequest, ctx?: ResolveContext): Promise<ReportUsageHandlerResult>;\n\n  /**\n   * get_account_financials API surface. Operator-billed platforms expose\n   * spend / credit / payment status per the wire shape. Optional — agent-\n   * billed platforms (where the buyer settles directly with the publisher)\n   * leave this unimplemented.\n   *\n   * Read tool — no idempotency requirement. Throw `AdcpError` for buyer-\n   * fixable rejection (`'PERMISSION_DENIED'` if the principal can't see\n   * financials for the requested account).\n   *\n   * `ctx.account` is the resolved `Account<TCtxMeta>` (framework calls\n   * `accounts.resolve(req.account)` first and threads the result in).\n   * Adopters fronting an upstream platform read tokens / upstream IDs from\n   * `ctx.account.ctx_metadata` without re-resolving.\n   *\n   * `ctx.authInfo` carries the caller's OAuth principal (when\n   * `serve({ authenticate })` is wired); `ctx.agent` carries the resolved\n   * `BuyerAgent` record (when an `agentRegistry` is configured). Platforms\n   * that guard financials per-principal use them to authorize the read —\n   * same pattern as `accounts.resolve`. Prefer `ctx.agent` for principal-\n   * keyed commercial gates; see `upsert?` for the rationale.\n   */\n  getAccountFinancials?(\n    req: GetAccountFinancialsRequest,\n    ctx: AccountToolContext<TCtxMeta>\n  ): Promise<GetAccountFinancialsHandlerResult>;\n\n  /**\n   * Mid-request token refresh hook. Optional. Called by the framework when\n   * a platform method throws a refreshable token-auth code (`AUTH_REQUIRED`\n   * for legacy compatibility or `AUTH_MISSING` for an AdCP 3.1-native\n   * missing request credential) AND `refreshToken` is defined — the\n   * framework refreshes via this hook, mutates or creates `account.authInfo`\n   * with the returned token, and retries the failing platform method exactly\n   * once.\n   *\n   * The reason string lets adopters distinguish trigger conditions:\n   *   - `'auth_required'` — platform method threw refreshable auth in flight.\n   *\n   * Treat as an open string union: future values may be added. Adopters\n   * SHOULD switch exhaustively (`default: throw`) so behavior drift on\n   * minor SDK bumps fails loud rather than silently no-oping.\n   *\n   * **In-flight only.** The refreshed token is scoped to the current\n   * request — the framework does NOT echo it back to the buyer. Use this\n   * for adapters that front an upstream platform API (Snap, Meta,\n   * retail-media OAuth flows) where the SDK caches an upstream token\n   * server-side and the buyer's auth-to-this-agent is separate.\n   *\n   * **Account-object identity contract.** The framework mutates a\n   * request-local Account clone before retrying, creating an OAuth-shaped\n   * auth principal if the resolver omitted one. The resolver-returned object\n   * is not written back. Adopters should still avoid caching secret-bearing\n   * `Account.authInfo` objects across unrelated callers, but SDK refresh\n   * retry does not mutate a cached resolver object in place.\n   *\n   * **Concurrency.** `refreshToken` MUST be safe under concurrent\n   * invocation on the same account — two parallel in-flight calls hitting\n   * refreshable auth at once will both call this hook. Adopters whose\n   * upstream provider rate-limits refresh should coalesce internally\n   * (e.g., a per-account in-flight refresh promise). The framework does\n   * not coalesce.\n   *\n   * **Failure surfaces correctable AUTH_REQUIRED.** If `refreshToken`\n   * itself throws, the framework projects to `AUTH_REQUIRED` with\n   * `recovery: 'correctable'` and a fixed message (the inner exception\n   * text is NOT echoed on the wire — refresh failures routinely include\n   * upstream details that should not cross the trust boundary). Log inner\n   * details server-side. Don't use SERVICE_UNAVAILABLE — refresh failure\n   * means the upstream authorization is gone, not that the service is\n   * transiently down.\n   *\n   * **Expiry timestamp** (`expiresAt`, ms since epoch) is optional. When\n   * returned, the framework writes it to `account.authInfo.expiresAt` so\n   * adopters reading the resolved Account can branch on it (proactive\n   * refresh is not yet wired; reactive-only in v6.x).\n   */\n  refreshToken?(account: Account<TCtxMeta>, reason: 'auth_required'): Promise<{ token: string; expiresAt?: number }>;\n}\n\n/**\n * Optional throw-class for `AccountStore.resolve` not-found signaling. Returning\n * `null` from `resolve` is canonical and equivalent; throw this only if your\n * codebase already throws a typed not-found exception elsewhere.\n *\n * **Throwable only from `AccountStore.resolve()`.** Throwing it from a\n * specialism method (`createMediaBuy`, `getProducts`, etc.) bypasses the\n * framework's not-found mapping and surfaces as `SERVICE_UNAVAILABLE`.\n *\n * The constructor's `message` is for server-side operator diagnostics only.\n * The framework emits a fixed `ACCOUNT_NOT_FOUND` envelope regardless; the\n * message never reaches the buyer. Operator-side log pipelines may aggregate\n * this string, so MUST NOT include caller-supplied identifiers (echoed account\n * refs, request args) — those leak across operator / buyer trust boundaries.\n *\n * Use ONLY for the narrow not-found case. Upstream-API outages, misconfigured\n * env vars, and schema-validation failures should propagate as generic\n * exceptions and surface to the buyer as `SERVICE_UNAVAILABLE`.\n */\nexport class AccountNotFoundError extends Error {\n  readonly name = 'AccountNotFoundError' as const;\n  constructor(message = 'Account not found') {\n    super(message);\n  }\n}\n\nexport interface AccountFilter {\n  /** Filter by brand domain across all operators. */\n  brand_domain?: string;\n  /** Filter by operator across all brands. */\n  operator?: string;\n  /** Filter by status. */\n  status?: AdcpAccountStatus[];\n}\n\n/**\n * Per-account result row returned by an adopter's `accounts.upsert`\n * implementation. Maps to one element of the wire `sync_accounts` response's\n * `accounts[]` array.\n *\n * Carries the same optional commercial / lifecycle fields as the wire shape\n * so adopters can echo `setup` (for `pending_approval` accounts), `billing`,\n * `billing_entity`, `payment_terms`, caller-specific `authorization`, etc. on creation. The framework\n * projects these through `toWireSyncAccountRow` before emit, applying the\n * same `billing_entity.bank` strip as `toWireAccount` (write-only contract).\n *\n * **MUST NOT carry `authInfo` or other auth-derived fields.** This shape is\n * emitted on the `sync_accounts` response wire. The framework's projector\n * does not read `authInfo`, but adopters MUST NOT add an `authInfo` key on\n * returned rows — same MUST-NOT-LEAK rule the framework enforces on\n * `Account.authInfo`.\n */\nexport interface SyncAccountsResultRow {\n  account_id?: string;\n  brand: BrandReference;\n  operator: string;\n  /** Human-readable account name assigned by the seller. */\n  name?: string;\n  action: 'created' | 'updated' | 'unchanged' | 'failed';\n  status: AdcpAccountStatus;\n  /** Invoiced-to party. Echoes the request's `billing` after seller acceptance. */\n  billing?: BillingParty;\n  /** Business entity invoiced. `bank` is stripped on emit (write-only). */\n  billing_entity?: BusinessEntity;\n  account_scope?: AccountScope;\n  /** Setup payload for `pending_approval` accounts (URL/message/expiry). */\n  setup?: WireAccount['setup'];\n  rate_card?: string;\n  payment_terms?: PaymentTerms;\n  credit_limit?: WireAccount['credit_limit'];\n  /** Applied account-level webhook subscriptions; credentials are stripped on emit. */\n  notification_configs?: NotificationConfig[];\n  /**\n   * Caller-specific authorization metadata for this synced account, including\n   * downstream grants such as advertiser-account access plus publisher\n   * identity/post authorization.\n   */\n  authorization?: AccountAuthorization;\n  errors?: SyncAccountError[];\n  warnings?: string[];\n  sandbox?: boolean;\n}\n\nexport type AdcpAccountStatus =\n  | 'active'\n  | 'pending_approval'\n  | 'rejected'\n  | 'payment_required'\n  | 'suspended'\n  | 'closed';\n\n// ---------------------------------------------------------------------------\n// Wire projection — strip framework-internal fields before emit\n// ---------------------------------------------------------------------------\n\n/**\n * Project a framework `Account<TCtxMeta>` to the wire `Account` shape.\n *\n * Strips `ctx_metadata` and `authInfo` (framework-internal); renames `id` →\n * `account_id`; passes through wire-shaped fields. Strips\n * `billing_entity.bank` per the schema's write-only constraint — bank\n * coordinates flow buyer→seller in `sync_accounts` requests but MUST NOT\n * appear in any response payload.\n *\n * Used by the framework when emitting `list_accounts` and other wire\n * responses that include account data. Adopters never call this directly —\n * they return `Account<TCtxMeta>` from `accounts.resolve` / `accounts.list`\n * and the framework projects.\n */\nexport function toWireAccount<TCtxMeta>(account: Account<TCtxMeta>): WireAccount {\n  const wire: WireAccount = {\n    account_id: account.id,\n    name: account.name,\n    status: account.status,\n  };\n  if (account.brand !== undefined) wire.brand = account.brand;\n  if (account.operator !== undefined) wire.operator = account.operator;\n  if (account.advertiser !== undefined) wire.advertiser = account.advertiser;\n  if (account.billing_proxy !== undefined) wire.billing_proxy = account.billing_proxy;\n  if (account.billing !== undefined) {\n    // Wire `Account.billing: 'operator' | 'agent' | 'advertiser'` is the\n    // invoiced-to party. Internal `billing.invoicedTo` collapses string +\n    // BrandReference; a BrandReference indicates a third-party advertiser\n    // (Amazon DSP-shaped flow), which projects to `'advertiser'`.\n    const t = account.billing.invoicedTo;\n    wire.billing = typeof t === 'string' ? t : 'advertiser';\n  }\n  const projectedEntity = projectBillingEntity(account.billing_entity);\n  if (projectedEntity !== undefined) wire.billing_entity = projectedEntity;\n  if (account.rate_card !== undefined) wire.rate_card = account.rate_card;\n  if (account.payment_terms !== undefined) wire.payment_terms = account.payment_terms;\n  if (account.credit_limit !== undefined) wire.credit_limit = account.credit_limit;\n  if (account.setup !== undefined) wire.setup = account.setup;\n  if (account.account_scope !== undefined) wire.account_scope = account.account_scope;\n  if (account.governance_agents !== undefined) {\n    wire.governance_agents = account.governance_agents.map(projectGovernanceAgent);\n  }\n  if (account.reporting_bucket !== undefined) wire.reporting_bucket = account.reporting_bucket;\n  if (account.notification_configs !== undefined) {\n    (wire as unknown as { notification_configs?: WireNotificationConfig[] }).notification_configs =\n      account.notification_configs.map(projectNotificationConfig);\n  }\n  if (account.authorization !== undefined) {\n    (wire as WireAccount & { authorization?: AccountAuthorization }).authorization = projectAccountAuthorization(\n      account.authorization\n    );\n  }\n  if (account.sandbox !== undefined) wire.sandbox = account.sandbox;\n  if (account.ext !== undefined) wire.ext = account.ext;\n  return wire;\n}\n\nfunction projectAccountAuthorization(authorization: AccountAuthorization): AccountAuthorization {\n  const projected: AccountAuthorization = {\n    allowed_tasks: [...authorization.allowed_tasks],\n  };\n  if (authorization.field_scopes !== undefined) {\n    projected.field_scopes = Object.fromEntries(\n      Object.entries(authorization.field_scopes)\n        .filter((entry): entry is [string, string[]] => Array.isArray(entry[1]))\n        .map(([task, fields]) => [task, [...fields]])\n    );\n  }\n  if (authorization.scope_name !== undefined) projected.scope_name = authorization.scope_name;\n  if (authorization.read_only !== undefined) projected.read_only = authorization.read_only;\n  return projected;\n}\n\ntype WireSyncAccountRow = SyncAccountsSuccess['accounts'][number];\n\n/**\n * Project an adopter `SyncAccountsResultRow` to the wire shape returned by\n * `sync_accounts`. Applies the same `billing_entity.bank` strip as\n * `toWireAccount` — the wire schema marks bank coordinates write-only on\n * EVERY response, not just `list_accounts`. Adopters returning a row that\n * spreads a DB record carrying `bank` (e.g.,\n * `{ ...db.findByBrand(r.brand), action: 'updated' }`) have it stripped\n * before emit.\n *\n * Used by the framework when emitting `sync_accounts` responses. Adopters\n * never call this directly — they return `SyncAccountsResultRow[]` from\n * `accounts.upsert` and the framework projects.\n */\nexport function toWireSyncAccountRow(row: SyncAccountsResultRow): WireSyncAccountRow {\n  const wire: WireSyncAccountRow = {\n    brand: row.brand,\n    operator: row.operator,\n    action: row.action,\n    status: row.status,\n  };\n  if (row.account_id !== undefined) wire.account_id = row.account_id;\n  if (row.name !== undefined) wire.name = row.name;\n  if (row.billing !== undefined) wire.billing = row.billing;\n  const projectedEntity = projectBillingEntity(row.billing_entity);\n  if (projectedEntity !== undefined) wire.billing_entity = projectedEntity;\n  if (row.account_scope !== undefined) wire.account_scope = row.account_scope;\n  if (row.setup !== undefined) wire.setup = row.setup;\n  if (row.rate_card !== undefined) wire.rate_card = row.rate_card;\n  if (row.payment_terms !== undefined) wire.payment_terms = row.payment_terms;\n  if (row.credit_limit !== undefined) wire.credit_limit = row.credit_limit;\n  if (row.notification_configs !== undefined) {\n    (wire as unknown as { notification_configs?: WireNotificationConfig[] }).notification_configs =\n      row.notification_configs.map(projectNotificationConfig);\n  }\n  if (row.authorization !== undefined) {\n    (wire as WireSyncAccountRow & { authorization?: AccountAuthorization }).authorization = projectAccountAuthorization(\n      row.authorization\n    );\n  }\n  if (row.errors !== undefined) wire.errors = row.errors;\n  if (row.warnings !== undefined) wire.warnings = row.warnings;\n  if (row.sandbox !== undefined) wire.sandbox = row.sandbox;\n  return wire;\n}\n\nfunction projectNotificationConfig(config: NotificationConfig): WireNotificationConfig {\n  const { authentication, ...rest } = config;\n  if (!authentication) return rest;\n  const { credentials: _credentials, ...authenticationWithoutCredentials } = authentication;\n  return { ...rest, authentication: authenticationWithoutCredentials };\n}\n\ntype WireSyncGovernanceRow = SyncGovernanceSuccess['accounts'][number];\n\n/**\n * Project a `sync_governance` response row to the wire shape, stripping\n * any fields the buyer is NOT entitled to receive. Critically: each\n * `governance_agents[i]` is reduced to `{url, categories?}` only — the\n * spec marks `authentication.credentials` write-only (the buyer sends\n * the bearer; the seller persists it for outbound `check_governance`\n * calls but MUST NOT echo it back). The natural `{ ...entry.governance_agents[i] }`\n * echo idiom would compile silently against the typed return shape and\n * ship credentials over the wire AND into the idempotency replay cache,\n * arming the buyer (and any subsequent caller hitting the same key) to\n * impersonate the seller against the governance agent.\n *\n * Defense-in-depth: this dispatcher-level strip runs even if an adopter\n * returns a loosely-typed row, and even if a future codegen change\n * loosens the response Zod schema's `.passthrough()` for governance\n * agents.\n */\nexport function toWireSyncGovernanceRow(row: WireSyncGovernanceRow): WireSyncGovernanceRow {\n  const wire: WireSyncGovernanceRow = {\n    account: row.account,\n    status: row.status,\n  };\n  if (row.governance_agents !== undefined) {\n    // AdCP 3.1.0-beta.2 removed `categories` from the governance_agents\n    // wire shape. The schema is now `{ url }` only; per-agent category\n    // signaling moved out of band. The projection still strips\n    // authentication.credentials (write-only) by only naming `url`.\n    wire.governance_agents = row.governance_agents.map(a => ({ url: a.url }));\n  }\n  if (row.errors !== undefined) wire.errors = row.errors;\n  return wire;\n}\n\n/**\n * Strip `BusinessEntity.bank` per the schema's write-only constraint, and\n * skip emission entirely when nothing else is populated. Bank-only inputs\n * project to `undefined`, signaling the caller to omit `billing_entity`\n * rather than emit an empty object that would fail `legal_name` validation.\n *\n * Destructure-and-rest excludes `bank` regardless of source shape: own\n * non-enumerable, getter, prototype-chain, and Proxy-backed bank fields\n * are all excluded by the ES rest-spread evaluation order\n * (`CopyDataProperties` walks own-enumerable keys and skips the\n * destructured names).\n */\nfunction projectBillingEntity(entity: BusinessEntity | undefined): BusinessEntity | undefined {\n  if (entity === undefined) return undefined;\n  const { bank: _bank, ...rest } = entity;\n  return Object.keys(rest).length > 0 ? rest : undefined;\n}\n\ntype WireGovernanceAgent = NonNullable<WireAccount['governance_agents']>[number];\n\n/**\n * Project a governance-agent element to the wire shape, dropping any keys\n * the wire schema doesn't model. The schema notes that authentication\n * credentials are write-only and not included in responses; AdCP 3.1.0-beta.2\n * also removed `categories` from the wire shape. The current shape is\n * `{ url }` only — TS is erased at runtime so adopters using JS or `as any`\n * could otherwise smuggle a `credentials` or `categories` field straight\n * to the wire. Explicit projection closes that gap.\n */\nfunction projectGovernanceAgent(agent: WireGovernanceAgent): WireGovernanceAgent {\n  return { url: agent.url };\n}\n\n// ---------------------------------------------------------------------------\n// AccountReference helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Extract `account_id` from an `AccountReference` discriminated union without\n * casting. Returns `undefined` when `ref` is absent or the union arm doesn't\n * carry an `account_id` (e.g., `{ brand, operator }` or sandbox variants).\n *\n * Typical use in `accounts.resolve` implementations:\n *\n * ```ts\n * resolve: async (ref, ctx) => {\n *   const id = refAccountId(ref);\n *   if (id) return this.db.findById(id);\n *   const cred = ctx?.authInfo?.credential;\n *   const key = cred?.kind === 'oauth' ? cred.client_id : cred?.kind === 'api_key' ? cred.key_id : undefined;\n *   return key ? this.db.findByClientKey(key) : null;\n * }\n * ```\n *\n * @public\n */\nexport function refAccountId(ref?: AccountReference): string | undefined {\n  return ref && 'account_id' in ref ? (ref as { account_id?: string }).account_id : undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA+CO,MAAM,kCAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMA,MAAM,0CAA6F,CAAC;AACpG,KAAK;AA0rBE,MAAM,6BAA6B,MAAM;AAAA,EACrC,OAAO;AAAA,EAChB,YAAY,UAAU,qBAAqB;AACzC,UAAM,OAAO;AAAA,EACf;AACF;AAqFO,SAAS,cAAwB,SAAyC;AAC/E,QAAM,OAAoB;AAAA,IACxB,YAAY,QAAQ;AAAA,IACpB,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ;AAAA,EAClB;AACA,MAAI,QAAQ,UAAU,OAAW,MAAK,QAAQ,QAAQ;AACtD,MAAI,QAAQ,aAAa,OAAW,MAAK,WAAW,QAAQ;AAC5D,MAAI,QAAQ,eAAe,OAAW,MAAK,aAAa,QAAQ;AAChE,MAAI,QAAQ,kBAAkB,OAAW,MAAK,gBAAgB,QAAQ;AACtE,MAAI,QAAQ,YAAY,QAAW;AAKjC,UAAM,IAAI,QAAQ,QAAQ;AAC1B,SAAK,UAAU,OAAO,MAAM,WAAW,IAAI;AAAA,EAC7C;AACA,QAAM,kBAAkB,qBAAqB,QAAQ,cAAc;AACnE,MAAI,oBAAoB,OAAW,MAAK,iBAAiB;AACzD,MAAI,QAAQ,cAAc,OAAW,MAAK,YAAY,QAAQ;AAC9D,MAAI,QAAQ,kBAAkB,OAAW,MAAK,gBAAgB,QAAQ;AACtE,MAAI,QAAQ,iBAAiB,OAAW,MAAK,eAAe,QAAQ;AACpE,MAAI,QAAQ,UAAU,OAAW,MAAK,QAAQ,QAAQ;AACtD,MAAI,QAAQ,kBAAkB,OAAW,MAAK,gBAAgB,QAAQ;AACtE,MAAI,QAAQ,sBAAsB,QAAW;AAC3C,SAAK,oBAAoB,QAAQ,kBAAkB,IAAI,sBAAsB;AAAA,EAC/E;AACA,MAAI,QAAQ,qBAAqB,OAAW,MAAK,mBAAmB,QAAQ;AAC5E,MAAI,QAAQ,yBAAyB,QAAW;AAC9C,IAAC,KAAwE,uBACvE,QAAQ,qBAAqB,IAAI,yBAAyB;AAAA,EAC9D;AACA,MAAI,QAAQ,kBAAkB,QAAW;AACvC,IAAC,KAAgE,gBAAgB;AAAA,MAC/E,QAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,QAAQ,YAAY,OAAW,MAAK,UAAU,QAAQ;AAC1D,MAAI,QAAQ,QAAQ,OAAW,MAAK,MAAM,QAAQ;AAClD,SAAO;AACT;AAEA,SAAS,4BAA4B,eAA2D;AAC9F,QAAM,YAAkC;AAAA,IACtC,eAAe,CAAC,GAAG,cAAc,aAAa;AAAA,EAChD;AACA,MAAI,cAAc,iBAAiB,QAAW;AAC5C,cAAU,eAAe,OAAO;AAAA,MAC9B,OAAO,QAAQ,cAAc,YAAY,EACtC,OAAO,CAAC,UAAuC,MAAM,QAAQ,MAAM,CAAC,CAAC,CAAC,EACtE,IAAI,CAAC,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAChD;AAAA,EACF;AACA,MAAI,cAAc,eAAe,OAAW,WAAU,aAAa,cAAc;AACjF,MAAI,cAAc,cAAc,OAAW,WAAU,YAAY,cAAc;AAC/E,SAAO;AACT;AAiBO,SAAS,qBAAqB,KAAgD;AACnF,QAAM,OAA2B;AAAA,IAC/B,OAAO,IAAI;AAAA,IACX,UAAU,IAAI;AAAA,IACd,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI;AAAA,EACd;AACA,MAAI,IAAI,eAAe,OAAW,MAAK,aAAa,IAAI;AACxD,MAAI,IAAI,SAAS,OAAW,MAAK,OAAO,IAAI;AAC5C,MAAI,IAAI,YAAY,OAAW,MAAK,UAAU,IAAI;AAClD,QAAM,kBAAkB,qBAAqB,IAAI,cAAc;AAC/D,MAAI,oBAAoB,OAAW,MAAK,iBAAiB;AACzD,MAAI,IAAI,kBAAkB,OAAW,MAAK,gBAAgB,IAAI;AAC9D,MAAI,IAAI,UAAU,OAAW,MAAK,QAAQ,IAAI;AAC9C,MAAI,IAAI,cAAc,OAAW,MAAK,YAAY,IAAI;AACtD,MAAI,IAAI,kBAAkB,OAAW,MAAK,gBAAgB,IAAI;AAC9D,MAAI,IAAI,iBAAiB,OAAW,MAAK,eAAe,IAAI;AAC5D,MAAI,IAAI,yBAAyB,QAAW;AAC1C,IAAC,KAAwE,uBACvE,IAAI,qBAAqB,IAAI,yBAAyB;AAAA,EAC1D;AACA,MAAI,IAAI,kBAAkB,QAAW;AACnC,IAAC,KAAuE,gBAAgB;AAAA,MACtF,IAAI;AAAA,IACN;AAAA,EACF;AACA,MAAI,IAAI,WAAW,OAAW,MAAK,SAAS,IAAI;AAChD,MAAI,IAAI,aAAa,OAAW,MAAK,WAAW,IAAI;AACpD,MAAI,IAAI,YAAY,OAAW,MAAK,UAAU,IAAI;AAClD,SAAO;AACT;AAEA,SAAS,0BAA0B,QAAoD;AACrF,QAAM,EAAE,gBAAgB,GAAG,KAAK,IAAI;AACpC,MAAI,CAAC,eAAgB,QAAO;AAC5B,QAAM,EAAE,aAAa,cAAc,GAAG,iCAAiC,IAAI;AAC3E,SAAO,EAAE,GAAG,MAAM,gBAAgB,iCAAiC;AACrE;AAqBO,SAAS,wBAAwB,KAAmD;AACzF,QAAM,OAA8B;AAAA,IAClC,SAAS,IAAI;AAAA,IACb,QAAQ,IAAI;AAAA,EACd;AACA,MAAI,IAAI,sBAAsB,QAAW;AAKvC,SAAK,oBAAoB,IAAI,kBAAkB,IAAI,QAAM,EAAE,KAAK,EAAE,IAAI,EAAE;AAAA,EAC1E;AACA,MAAI,IAAI,WAAW,OAAW,MAAK,SAAS,IAAI;AAChD,SAAO;AACT;AAcA,SAAS,qBAAqB,QAAgE;AAC5F,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,EAAE,MAAM,OAAO,GAAG,KAAK,IAAI;AACjC,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,IAAI,OAAO;AAC/C;AAaA,SAAS,uBAAuB,OAAiD;AAC/E,SAAO,EAAE,KAAK,MAAM,IAAI;AAC1B;AAyBO,SAAS,aAAa,KAA4C;AACvE,SAAO,OAAO,gBAAgB,MAAO,IAAgC,aAAa;AACpF;","names":[]}
+{"version":3,"sources":["../../../../src/lib/server/decisioning/account.ts"],"sourcesContent":["/**\n * Account model. Single-level (matches AdCP wire's AccountReference).\n * Platform-internal hierarchies (GAM Network → Advertiser → Order;\n * Spotify Brand → Campaign) are encoded in `metadata`, not in the typed\n * shape. Generic `TCtxMeta` lets platforms type their metadata at the call site.\n *\n * Tenant scoping is expressed by what `accounts.resolve()` returns, not via\n * a multi-level type. Note that resolve is an isolation gate only when you make\n * it one: `createTenantStore` requires an explicit `refAccess`, and under\n * `'ref-routed'` it resolves the ref the buyer supplies regardless of the caller\n * (isolation then has to come from a composed `resolve-presets` guard).\n * `'auth-scoped'` fails closed instead. See `createTenantStore` and\n * `resolve-presets.ts`.\n *\n * Status: Preview / 6.0.\n *\n * @public\n */\n\nimport type {\n  Account as WireAccount,\n  AccountAuthorization,\n  AccountScope,\n  BillingParty,\n  BrandReference,\n  AccountReference,\n  BusinessEntity,\n  ExtensionObject,\n  ListAccountsRequest,\n  PaymentTerms,\n  ListAccountsResponse,\n  ReportUsageRequest,\n  ReportUsageResponse,\n  SyncAccountsResponse,\n  SyncAccountsSuccess,\n  SyncGovernanceRequest,\n  SyncGovernanceResponse,\n  SyncGovernanceSuccess,\n  GetAccountFinancialsRequest,\n  GetAccountFinancialsResponse,\n  GetAccountFinancialsSuccess,\n} from '../../types/tools.generated';\nimport type { ServerPayload } from '../../types/server-payload';\nimport type { NotificationConfig } from '../../types/v3-1-beta';\nimport type { CursorPage } from './pagination';\nimport type { AccountMode } from '../account-mode';\nimport type { AdcpStructuredError } from './async-outcome';\nimport type { AdcpCredential, BuyerAgent } from './buyer-agent';\n\nexport const ACCOUNT_AUTHORIZATION_WIRE_KEYS = [\n  'allowed_tasks',\n  'field_scopes',\n  'scope_name',\n  'read_only',\n] as const satisfies readonly (keyof AccountAuthorization)[];\n\ntype MissingAccountAuthorizationWireKey = Exclude<\n  keyof AccountAuthorization,\n  (typeof ACCOUNT_AUTHORIZATION_WIRE_KEYS)[number]\n>;\nconst ACCOUNT_AUTHORIZATION_WIRE_KEY_COVERAGE: Record<MissingAccountAuthorizationWireKey, never> = {};\nvoid ACCOUNT_AUTHORIZATION_WIRE_KEY_COVERAGE;\n\ntype WireNotificationConfig = Omit<NotificationConfig, 'authentication'> & {\n  authentication?: Omit<NonNullable<NotificationConfig['authentication']>, 'credentials'>;\n};\n\ntype SyncAccountError = Pick<AdcpStructuredError, 'code' | 'message'> &\n  Partial<Omit<AdcpStructuredError, 'code' | 'message'>>;\n\nexport type ListAccountsPayload = ServerPayload<ListAccountsResponse>;\nexport type SyncAccountsPayload = ServerPayload<SyncAccountsResponse>;\nexport type SyncAccountsSuccessPayload = ServerPayload<SyncAccountsSuccess>;\nexport type SyncAccountsRow = SyncAccountsSuccess['accounts'][number];\nexport type SyncGovernancePayload = ServerPayload<SyncGovernanceResponse>;\nexport type SyncGovernanceSuccessPayload = ServerPayload<SyncGovernanceSuccess>;\nexport type SyncGovernanceRow = SyncGovernanceSuccess['accounts'][number];\nexport type ReportUsagePayload = ServerPayload<ReportUsageResponse>;\nexport type GetAccountFinancialsPayload = ServerPayload<GetAccountFinancialsResponse>;\nexport type GetAccountFinancialsSuccessPayload = ServerPayload<GetAccountFinancialsSuccess>;\nexport type ListAccountsHandlerResult<TCtxMeta = Record<string, unknown>> = CursorPage<Account<TCtxMeta>>;\nexport type SyncAccountsHandlerResult = SyncAccountsResultRow[];\nexport type SyncGovernanceHandlerResult = SyncGovernanceRow[];\nexport type ReportUsageHandlerResult = ReportUsagePayload;\nexport type GetAccountFinancialsHandlerResult = GetAccountFinancialsSuccessPayload;\n\n/**\n * Account — framework's rich representation. A strict superset of the wire\n * `Account` shape (from `list_accounts` / response envelopes):\n *\n *   - Adds `metadata: TCtxMeta` (platform-internal fields the framework doesn't\n *     read but adopters use to thread platform-specific data)\n *   - Adds `authInfo: AuthPrincipal` (auth context for the request — MUST NOT\n *     leak to the wire)\n *   - All wire-required fields (`id`/`account_id`, `name`, `status`) are\n *     required here too.\n *\n * Framework projects to wire shape via `toWireAccount`: strips `metadata` +\n * `authInfo`, renames `id` → `account_id`. ~10 lines, no `as never` casts.\n */\nexport interface Account<TCtxMeta = Record<string, unknown>> {\n  /** Your platform's account_id. Maps to wire `Account.account_id`. */\n  id: string;\n\n  /** Human-readable account name (e.g., 'Acme', 'Acme c/o Pinnacle'). Required on the wire. */\n  name: string;\n\n  /** Account status. Maps to wire `Account.status`. */\n  status: AdcpAccountStatus;\n\n  /** Canonical brand reference. Either id OR (brand+operator) identifies the account. */\n  brand?: BrandReference;\n\n  /** Operator domain (agency / managed-services). Pairs with `brand`. */\n  operator?: string;\n\n  /**\n   * The advertiser whose rates apply to this account. Maps to wire\n   * `Account.advertiser`. Use when the account is operated by an agency on\n   * behalf of an advertiser whose rates differ from the operator's.\n   */\n  advertiser?: string;\n\n  /**\n   * Optional intermediary who receives invoices on behalf of the advertiser\n   * (e.g., agency holdco). Distinct from `advertiser` (whose rates apply)\n   * and from `billing.invoicedTo` (the legal billing party). Use when the\n   * invoice recipient differs from both — common in agency-handled flows.\n   */\n  billing_proxy?: string;\n\n  /**\n   * Settlement boundary for operator-billed retail-media platforms.\n   * `'agent'` = pass-through (buyer's agent settles directly with the platform).\n   * `'operator'` = retail-media model (operator pays publisher, bills brand).\n   * `BrandReference` = invoice routes to a third party (Amazon DSP returning\n   * a different invoice principal than the requester is the canonical case).\n   *\n   * Optional — most platforms don't need this; comply storyboards use it to\n   * assert the right party is billed.\n   */\n  billing?: { invoicedTo: 'agent' | 'operator' | BrandReference };\n\n  /**\n   * Business entity invoiced on this account. Carries legal name, tax IDs,\n   * address, contacts, and (write-only) bank details for B2B invoicing.\n   *\n   * **`bank` is write-only.** The wire schema marks `BusinessEntity.bank` as\n   * MUST NOT be echoed in responses (sellers store and confirm receipt\n   * without returning the details). `toWireAccount` strips it on emit, so\n   * adopters who store the full entity here will not leak bank details to\n   * buyers — but DO NOT rely on the strip for anything beyond response\n   * projection. Adopters loading the entity from their own DB SHOULD apply\n   * the same rule at retrieval time, especially for non-list endpoints.\n   */\n  billing_entity?: BusinessEntity;\n\n  /**\n   * Identifier for the rate card applied to this account. Opaque seller-side\n   * string; emitted unchanged on the wire.\n   */\n  rate_card?: string;\n\n  /** Payment terms applied to this account. */\n  payment_terms?: PaymentTerms;\n\n  /** Maximum outstanding balance allowed on this account. */\n  credit_limit?: WireAccount['credit_limit'];\n\n  /**\n   * Setup payload for accounts in `pending_approval`. Carries the URL/message\n   * the buyer surfaces to a human to complete activation (credit-app, legal\n   * agreement, fund-add). Required-shape: `message` is mandatory; `url` and\n   * `expires_at` are optional.\n   *\n   * The framework does NOT validate that `setup` is populated when status is\n   * `pending_approval` — that's an adopter contract with the spec. It also\n   * does NOT clear `setup` when status leaves `pending_approval`; adopters\n   * who echo the same `Account` across status transitions should drop the\n   * field themselves.\n   */\n  setup?: WireAccount['setup'];\n\n  /** Account scope (operator / brand / operator_brand / agent). */\n  account_scope?: AccountScope;\n\n  /**\n   * Governance agent endpoints registered on this account. Auth credentials\n   * are write-only on the wire and not modeled here — adopters set/update\n   * via `sync_governance`, not by re-emitting the Account.\n   */\n  governance_agents?: WireAccount['governance_agents'];\n\n  /**\n   * Cloud storage bucket for offline reporting delivery. Only present when\n   * the seller's capabilities advertise `reporting_delivery_methods`\n   * including `'offline'`. Per-account access MUST be IAM-scoped — see the\n   * schema description for security constraints.\n   */\n  reporting_bucket?: WireAccount['reporting_bucket'];\n\n  /**\n   * Account-level webhook subscriptions registered through `sync_accounts`.\n   * Beta 3 adds wholesale product/signal feed webhooks here. The framework\n   * strips legacy `authentication.credentials` before emitting accounts on\n   * `list_accounts`; adopters must still persist credentials server-side if\n   * they accept legacy webhook auth.\n   */\n  notification_configs?: NotificationConfig[];\n\n  /**\n   * Caller-specific authorization metadata for this account. Emitted only on\n   * `list_accounts` / account response surfaces that use the\n   * `AccountWithAuthorization` wire shape. Use this for platform adapters\n   * that can introspect what the authenticated buyer agent may do on this\n   * account, including downstream grants such as advertiser-account access\n   * plus publisher identity/post authorization.\n   *\n   * Absence is silence, not denial: it means the adapter does not expose\n   * introspectable account authorization for this caller/account tuple.\n   */\n  authorization?: AccountAuthorization;\n\n  /**\n   * Operational mode used by framework gates for test-only surfaces.\n   * Defaults to `'live'` when omitted. Unlike the wire-side\n   * `AccountReference.sandbox` selector, this value comes from the trusted\n   * resolved account and is not emitted on account response payloads.\n   */\n  mode?: AccountMode;\n\n  /**\n   * Sandbox account marker. For implicit accounts the wire schema treats\n   * this as part of the natural key — the same brand/operator pair can have\n   * separate production and sandbox accounts. For explicit accounts, sandbox\n   * accounts are pre-existing test accounts the seller surfaces via\n   * `list_accounts`.\n   *\n   * @deprecated Use {@link Account.mode} instead. As of AdCP 6.7+ the\n   * three-mode `mode: 'live' | 'sandbox' | 'mock'` field is the canonical\n   * signal the framework gate consults — see\n   * `docs/proposals/lifecycle-state-and-sandbox-authority.md`. Adopters\n   * stamping this `sandbox` flag continue to work via\n   * `getAccountMode`'s legacy fallback (`sandbox: true` reads as\n   * `mode: 'sandbox'`); new code should set `mode` directly. This\n   * field will be removed in the next major version.\n   *\n   * The wire-side `AccountReference.sandbox` flag (per\n   * `core/account-ref.json`) stays — it's part of the spec's natural-key\n   * disambiguation for implicit accounts. The deprecation is on the\n   * SERVER-side resolved `Account.sandbox` only.\n   */\n  sandbox?: boolean;\n\n  /**\n   * Wire `ext` extension hatch. Carries forward-compatible additions the\n   * codegen'd type doesn't model yet. Adopters who don't need extensions\n   * leave this undefined.\n   */\n  ext?: ExtensionObject;\n\n  /**\n   * Adapter-internal opaque state. Framework doesn't read this; **stripped\n   * before emitting on the wire**. GAM puts `{ networkId, advertiserId }`;\n   * Spotify puts `{ brandId, businessId }`; Criteo puts `{ customerId }`.\n   * Each platform's choice.\n   *\n   * Same field name (`ctx_metadata`) used across every DecisioningPlatform\n   * resource (Product, MediaBuy, Package, Creative, Audience, Signal,\n   * Account) for naming consistency. Account is special operationally:\n   * `accounts.resolve()` is called per-request, so the publisher is the\n   * canonical source of truth and the SDK does NOT round-trip Account\n   * `ctx_metadata` through the cache (unlike Product / MediaBuy / etc.,\n   * where the SDK bridges between `getProducts` and `createMediaBuy`).\n   * Put adapter state in `ctx_metadata`; treat it as fresh from your\n   * `accounts.resolve()` on every request.\n   *\n   * **DO NOT put credentials here.** The wire-strip protects buyer\n   * responses but does NOT protect server-side log lines, error\n   * envelopes (when `exposeErrorDetails: true`), heap dumps, or\n   * adopter-generated strings (`JSON.stringify(account)` in an error\n   * message). Bearer tokens, OAuth refresh tokens, API keys, and\n   * client secrets belong on `authInfo` (which the framework\n   * round-trips through `refreshToken`) or in your own per-principal\n   * token cache — NOT in `ctx_metadata`. See\n   * [`docs/guides/CTX-METADATA-SAFETY.md`](../../../../docs/guides/CTX-METADATA-SAFETY.md)\n   * for the full guidance and the recommended re-derive-per-request\n   * pattern.\n   */\n  ctx_metadata: TCtxMeta;\n\n  /**\n   * Caller's authenticated principal. **Stripped before emitting on the wire.**\n   *\n   * Optional from the adopter's perspective: when `accounts.resolve` returns\n   * an `Account` without `authInfo`, the framework auto-attaches the\n   * principal from `ctx.authInfo` (the auth shape extracted by\n   * `serve({ authenticate })`). Adopters that need to *transform* the\n   * principal — e.g. derive a tenant-scoped sub-principal from the OAuth\n   * client — set it explicitly; adopters that just want the\n   * `serve({ authenticate })` principal threaded through resource handlers\n   * can omit the field and rely on the framework default.\n   */\n  authInfo?: AuthPrincipal;\n}\n\n/**\n * The OAuth-style auth shape extracted by `serve({ authenticate })`. Threaded\n * to `accounts.resolve(ref, ctx)` and to the `tasks_get` custom-tool handler\n * so adopters can authorize the resolution against the principal.\n *\n * Distinct from {@link AuthPrincipal} — `ResolvedAuthInfo` is the RAW\n * transport-level auth the framework hands to the resolver; `AuthPrincipal`\n * is what the resolver chooses to persist on the resolved `Account`. The\n * resolver decides what to keep / drop / re-shape.\n *\n * @public\n */\nexport interface ResolvedAuthInfo {\n  /**\n   * Kind-discriminated credential — Phase 1 Stage 3 of #1269. Populated by\n   * the framework's built-in authenticators (`verifyApiKey`, `verifyBearer`,\n   * `verifySignatureAsAuthenticator`); custom `authenticate` callbacks can\n   * stamp this directly on the returned `AuthPrincipal` to opt into the\n   * discriminated-credential surface. The framework propagates it from\n   * `req.auth.extra.credential` to this top-level field on every request.\n   *\n   * **Verified vs. claimed.** `credential.kind === 'http_sig'` carries an\n   * `agent_url` that is cryptographically verified by the framework's\n   * signature verifier (per adcontextprotocol/adcp#3831). The framework\n   * brands verified credentials with a module-private symbol that\n   * `BuyerAgentRegistry` factories check before treating the credential\n   * as authentic — a literal-shape `{ kind: 'http_sig', ... }` synthesized\n   * by a custom authenticator is rejected at the registry layer. Adopters\n   * making security-relevant decisions on `agent_url` MUST read it from\n   * the credential variant; framework-stamped registry-derived URLs are\n   * exposed via `ctx.agent.agent_url` only.\n   */\n  credential?: AdcpCredential;\n\n  /**\n   * Optional operator seat within the buyer agent. Stamped only when the\n   * authenticator's claims include a `sub` / `oid` / equivalent identifying\n   * a sub-principal within the agent. Reserved for future use; v1 of\n   * `BuyerAgentRegistry` doesn't consume it.\n   */\n  operator?: string;\n\n  /**\n   * @deprecated Use `credential.kind === 'oauth' ? credential.client_id : ...`\n   * for the discriminated shape. Optional in N+1 of the deprecation cycle\n   * per #1269; framework continues to populate it for adopter compatibility\n   * through the cycle. Removed in N+2.\n   */\n  token?: string;\n\n  /**\n   * @deprecated Use `credential.client_id` (oauth) or `credential.key_id`\n   * (api_key) instead.\n   */\n  clientId?: string;\n\n  /** @deprecated Use `credential.scopes` (oauth) instead. */\n  scopes?: string[];\n\n  expiresAt?: number;\n  extra?: Record<string, unknown>;\n}\n\nexport interface ResolveContext {\n  /** Authenticated principal extracted by `serve({ authenticate })`. Undefined when no `authenticate` is configured. */\n  authInfo?: ResolvedAuthInfo;\n  /** Tool the buyer is calling — useful for tool-aware tenant routing. */\n  toolName?: string;\n  /**\n   * Resolved buyer agent from `BuyerAgentRegistry.resolve()`, when an\n   * `agentRegistry` is configured (Phase 1 of #1269). The framework calls\n   * the registry once per request before `accounts.resolve` and threads the\n   * resolved record here so adopters can route tenant resolution against\n   * the durable buyer-agent identity rather than re-deriving it from\n   * `authInfo`. Undefined when no registry is configured OR when the\n   * registry returns null for the request's credential.\n   */\n  agent?: BuyerAgent;\n  /**\n   * Un-destructured wire request envelope. Set by the framework so account\n   * tool handlers (`syncAccounts`, `syncGovernance`, `listAccounts`,\n   * `reportUsage`, `getAccountFinancials`) can read request fields the\n   * typed signature doesn't model — e.g. `sync_accounts.delete_missing`\n   * and `sync_accounts.dry_run`, which the framework destructures the\n   * payload array out of before calling the handler.\n   *\n   * Same shape and read-site cast pattern as `RequestContext.input` (see\n   * `decisioning/context.ts`). Same caveats:\n   *\n   * - **Identical reference to the typed payload arg.** This is the same\n   *   request body object the platform method's first positional arg\n   *   projects from. Framework auto-hydrate seams mutate this object\n   *   before the platform method runs; treat fields the buyer sent as\n   *   authoritative, but expect framework-injected entities (e.g.\n   *   hydrated product / media-buy refs) to be visible here too.\n   * - **Buyer-controlled untrusted data.** Free-text fields (`brief`,\n   *   `message`, creative snippets, etc.) are attacker-controlled.\n   *   Don't log `ctx.input` wholesale — secret fields like\n   *   `push_notification_config.token` are present on mutating requests.\n   *   When templating into LLM prompts, validate or fence the field\n   *   rather than string-interpolating.\n   *\n   * @public\n   */\n  input?: Readonly<Record<string, unknown>>;\n}\n\n/**\n * Context passed to AccountStore tool methods that operate on a single\n * resolved Account (today: `getAccountFinancials`). Threads the resolved\n * `Account<TCtxMeta>` through so adopters can read `ctx.account.ctx_metadata`\n * (auth tokens, upstream IDs, etc.) without re-resolving from the request.\n *\n * Strict superset of `ResolveContext`: same `authInfo` / `toolName` fields,\n * plus the resolved account. Distinct type because `accounts.resolve()`\n * produces the account and therefore cannot receive it on input.\n *\n * **NOT applicable to `reportUsage`.** `ReportUsageRequest.usage[]` carries\n * a per-row `account: AccountReference`; a request can span multiple\n * accounts. Pre-resolving a single `ctx.account` would misrepresent that\n * shape. `reportUsage` keeps `ResolveContext` and per-row resolution is\n * the adopter's responsibility (call `accounts.resolve` from inside the\n * impl, once per row).\n *\n * @public\n */\nexport interface AccountToolContext<TCtxMeta = Record<string, unknown>> extends ResolveContext {\n  /** Resolved Account from `accounts.resolve()`. Populated by the framework before dispatch. */\n  account: Account<TCtxMeta>;\n}\n\n/**\n * Request context for tools whose wire request does not carry an `account`\n * field — `preview_creative`, `list_creative_formats`, and\n * `provide_performance_feedback`. The framework calls\n * `accounts.resolve(undefined, ctx)` for these, accepting a `null` return; if\n * `null`, `ctx.account` is undefined when the handler runs.\n *\n * Adopter handlers MUST handle the `undefined` case explicitly. Choose one of:\n *\n *   1. **Singleton fallback** — return a non-null synthetic `Account` from\n *      `accounts.resolve(undefined, ctx)` for the publisher-wide tenant\n *      (e.g., format catalog, performance feedback aggregation). Inside the\n *      handler, narrow with `if (!ctx.account) throw ...` once and treat\n *      `ctx.account` as defined for the rest.\n *   2. **Auth-derived lookup** — in `accounts.resolve(undefined, ctx)`, look\n *      up by `ctx.authInfo.clientId` (or whichever principal field your auth\n *      wires) and return the matching account.\n *   3. **Error out** — throw `AdcpError({ code: 'ACCOUNT_NOT_FOUND' })` from\n *      within the handler when `ctx.account == null` and the operation\n *      requires tenant scoping.\n *\n * The narrowed type catches the mismatch at authorship time — adopters who\n * forget to handle `ctx.account === undefined` get a TS error, not a runtime\n * `Cannot read properties of undefined` deep in their upstream call. Same\n * shape as the `definePlatformWithCompliance` invariant: convert a runtime\n * gate into a compile-time one.\n *\n * @public\n */\n// Inline type-import on `RequestContext` instead of a top-level\n// `import type { RequestContext } from './context'` — `context.ts` already\n// imports `Account` from this file, so a top-level import would form a\n// circular type dependency.\nexport type NoAccountCtx<TCtxMeta = Record<string, unknown>> = Omit<\n  import('./context').RequestContext<Account<TCtxMeta>>,\n  'account'\n> & {\n  /**\n   * Resolved account, OR `undefined` when the wire request didn't carry an\n   * account ref AND `accounts.resolve(undefined, ctx)` returned null. Always\n   * narrow before reading `ctx_metadata` / `id`.\n   */\n  account: Account<TCtxMeta> | undefined;\n};\n\nexport interface AuthPrincipal {\n  /** Stable identifier for the calling agent (e.g., `https://buyer.example.com/mcp`). */\n  agent_url?: string;\n  /** Token kind: API key, OAuth bearer, signed-request claim. */\n  kind: 'api_key' | 'oauth' | 'signature' | 'public';\n  /** Bearer token / API key value. Platform-side don't log this. */\n  token?: string;\n  /** Token expiry (ms since epoch). Set by `accounts.refreshToken` after a successful refresh. */\n  expiresAt?: number;\n  /** OAuth scopes / API-key principal name. */\n  principal?: string;\n  /** Additional claims (jwt sub, kid, etc.). */\n  claims?: Record<string, unknown>;\n}\n\nexport interface AccountStore<TCtxMeta = Record<string, unknown>> {\n  /**\n   * How buyers reference accounts on this platform.\n   * - `'explicit'` — buyer passes `account_id` inline on every request (Snap,\n   *   Meta, GAM via Network/Company id). The default.\n   * - `'implicit'` — buyer must `sync_accounts` first; subsequent requests are\n   *   resolved from the auth principal's pre-synced linkage (LinkedIn, some\n   *   retail-media operators). Framework refuses inline `account_id` references\n   *   for these platforms — emits `AdcpError('INVALID_REQUEST', { field:\n   *   'account.account_id' })` before reaching `accounts.resolve`. The\n   *   brand+operator union arm is permitted (used during the initial\n   *   `sync_accounts` flow); only `account_id`-shaped references are rejected.\n   * - `'derived'` — single-tenant agents where there is no account_id on the\n   *   wire at all and the auth principal alone identifies the tenant. Most\n   *   self-hosted broadcasters and retail-media operators in proxy mode.\n   *   Framework refuses inline `account_id` references for these platforms —\n   *   same `AdcpError('INVALID_REQUEST', { field: 'account.account_id' })`\n   *   shape as `'implicit'`, but with a single-tenant message instead of the\n   *   `sync_accounts`-first guidance (no `sync_accounts` step exists in\n   *   derived mode). The brand+operator union arm is permitted.\n   *\n   * Defaults to `'explicit'` when omitted.\n   */\n  readonly resolution?: 'explicit' | 'implicit' | 'derived';\n\n  /**\n   * Resolve buyer's AccountReference into the platform's tenant model.\n   *\n   * `ref` is `undefined` when the wire request didn't carry an account\n   * field — `provide_performance_feedback` and `list_creative_formats` are\n   * the canonical examples. Per `resolution` mode:\n   * - `'derived'` (single-tenant): return the singleton account regardless.\n   * - `'implicit'`: look up the account from the auth principal.\n   * - `'explicit'` (default): no account is available; either throw\n   *   `AccountNotFoundError` to signal \"tool requires account\" OR return\n   *   a synthetic singleton if the tool legitimately doesn't need\n   *   tenant scoping (e.g., publisher-wide format catalog from\n   *   `list_creative_formats`).\n   *\n   * `ctx.authInfo` is the caller's authenticated principal (when\n   * `serve({ authenticate })` is wired). Adapters fronting an upstream\n   * platform API (Snap, Meta, retail-media) translate auth to tenant ID:\n   *\n   * ```ts\n   * resolve: async (ref, ctx) => {\n   *   if (ref?.account_id) return await this.db.findById(ref.account_id);\n   *   const cred = ctx?.authInfo?.credential;\n   *   const clientKey = cred?.kind === 'oauth' ? cred.client_id\n   *     : cred?.kind === 'api_key' ? cred.key_id\n   *     : undefined;\n   *   const platformAcct = clientKey ? await myUpstream.findByClientKey(clientKey) : null;\n   *   return platformAcct ? this.toAccount(platformAcct) : null;\n   * }\n   * ```\n   *\n   * Two failure shapes:\n   * - **Unknown / cross-tenant reference**: return `null` (canonical) — OR\n   *   throw `AccountNotFoundError` if your codebase already throws a\n   *   not-found exception class. Framework emits the spec's fixed\n   *   `ACCOUNT_NOT_FOUND` envelope either way. The buyer learns no detail\n   *   beyond \"not found\" — guarding against principal-enumeration.\n   * - **Transient upstream failure** (DB outage, identity-provider 5xx):\n   *   throw a generic exception. Framework maps to `SERVICE_UNAVAILABLE`\n   *   so the buyer can retry.\n   */\n  resolve(ref: AccountReference | undefined, ctx?: ResolveContext): Promise<Account<TCtxMeta> | null>;\n\n  /**\n   * sync_accounts API surface. Framework normalizes the wire request; platform\n   * upserts and returns per-account result rows. `throw new AdcpError(...)`\n   * for buyer-facing rejection.\n   *\n   * In AdCP 3.1 beta, adopters that need settings-update entries with\n   * `notification_configs[]` can read the full wire body from `ctx.input`\n   * or supply a top-level `accounts.syncAccounts` handler.\n   *\n   * **Optional.** Stateless platforms (creative-template, signal-marketplace\n   * proxies) that don't manage account lifecycle can omit this; framework\n   * surfaces `UNSUPPORTED_FEATURE` to buyers calling `sync_accounts`.\n   *\n   * `ctx.authInfo` carries the caller's authenticated principal (when\n   * `serve({ authenticate })` is wired); `ctx.agent` carries the resolved\n   * `BuyerAgent` record (when an `agentRegistry` is configured). Adopters\n   * implementing principal-keyed gates (e.g., per-buyer-agent\n   * `BILLING_NOT_PERMITTED_FOR_AGENT` on the spec's billing surfaces) read\n   * the principal here — same threading as `accounts.resolve`.\n   *\n   * **Prefer `ctx.agent` over `ctx.authInfo.credential` for commercial-\n   * relationship decisions.** `ctx.agent` is the registry-resolved durable\n   * identity (status, billing capabilities, default account terms);\n   * `ctx.authInfo.credential` is the raw transport-level credential. For\n   * billing gates the registry-resolved identity is canonical. Use\n   * `credential` only for transport-level branching (e.g., reading the\n   * verified `agent_url` from `credential.kind === 'http_sig'` when\n   * `agentRegistry` is not configured).\n   */\n  upsert?(refs: AccountReference[], ctx?: ResolveContext): Promise<SyncAccountsHandlerResult>;\n\n  /**\n   * sync_governance API surface. Buyers register governance agent endpoints\n   * per-account; the seller persists the binding and consults the agents\n   * during media buy lifecycle events via `check_governance`.\n   *\n   * **Optional.** Adopters that don't model buyer-supplied governance agents\n   * (most direct sellers) leave this unimplemented and the framework returns\n   * `UNSUPPORTED_FEATURE`.\n   *\n   * `entries` is the wire request's `accounts[]` — each entry pairs an\n   * `AccountReference` with its `governance_agents[]`. The framework has\n   * already deduped on `idempotency_key` and stripped wire metadata\n   * (`adcp_major_version`, `context`, `ext`) before invoking this method.\n   *\n   * **Replace semantics, per spec.** Each call REPLACES the previously\n   * synced governance agents for the referenced account. An entry whose\n   * `governance_agents` is empty clears the binding for that account.\n   *\n   * **Write-only credentials.** Each `governance_agents[i].authentication.credentials`\n   * is the bearer the seller presents to that governance agent on outbound\n   * `check_governance` calls. Persist them — silently dropping ships\n   * unauthenticated requests once cross-agent calls are wired. The framework\n   * strips `authentication` from each `governance_agents[i]` of every row\n   * before serialization (`toWireSyncGovernanceRow`), so credentials never\n   * reach the response wire OR the idempotency replay cache, even if an\n   * adopter returns a loosely-typed row that spreads the input. Do not rely\n   * on TypeScript narrowing alone — the strip is enforced at the dispatcher.\n   *\n   * `ctx.authInfo` and `ctx.agent` carry the caller's principal — same\n   * threading as `upsert`. Adopters MUST gate per-entry persistence by the\n   * caller's tenant: each entry's `account.operator` (or `account_id`) must\n   * map to the same tenant the auth principal authorizes; otherwise return a\n   * `'failed'` row carrying `errors: [{code: 'PERMISSION_DENIED', ...}]` for\n   * that entry. (Operation-level rejection — `throw new AdcpError(...)` —\n   * fails the whole batch, which is the wrong shape when a single entry\n   * fails the gate.)\n   */\n  syncGovernance?(\n    entries: SyncGovernanceRequest['accounts'],\n    ctx?: ResolveContext\n  ): Promise<SyncGovernanceHandlerResult>;\n\n  /**\n   * list_accounts API surface. Framework wraps with cursor envelope.\n   *\n   * **Optional.** Same rationale as `upsert` — stateless platforms can omit.\n   *\n   * `ctx.authInfo` and `ctx.agent` carry the caller's principal — adopters\n   * scope the listing per-principal (e.g., return only accounts visible to\n   * the calling buyer agent) without re-deriving identity from the request.\n   */\n  list?(request: ListAccountsRequest, ctx?: ResolveContext): Promise<ListAccountsHandlerResult<TCtxMeta>>;\n\n  /**\n   * report_usage API surface. Operator-billed platforms accept usage rows\n   * (often impressions / spend by media_buy + period) for billing\n   * reconciliation. Optional — adopters that don't run billing through the\n   * agent leave this unimplemented and the framework returns\n   * UNSUPPORTED_FEATURE.\n   *\n   * Idempotent on `(account, period_start, period_end, line_item_id)` —\n   * platform must dedupe replays under the framework's idempotency key.\n   *\n   * `ctx.authInfo` carries the caller's OAuth principal (when\n   * `serve({ authenticate })` is wired); `ctx.agent` carries the resolved\n   * `BuyerAgent` record (when an `agentRegistry` is configured). Platforms\n   * fronting an upstream billing API (Snap, Meta, retail-media) use them\n   * to authorize the usage post against the principal's tenant — same\n   * pattern as `accounts.resolve`. Prefer `ctx.agent` for principal-keyed\n   * commercial gates; see `upsert?` for the rationale.\n   */\n  reportUsage?(req: ReportUsageRequest, ctx?: ResolveContext): Promise<ReportUsageHandlerResult>;\n\n  /**\n   * get_account_financials API surface. Operator-billed platforms expose\n   * spend / credit / payment status per the wire shape. Optional — agent-\n   * billed platforms (where the buyer settles directly with the publisher)\n   * leave this unimplemented.\n   *\n   * Read tool — no idempotency requirement. Throw `AdcpError` for buyer-\n   * fixable rejection (`'PERMISSION_DENIED'` if the principal can't see\n   * financials for the requested account).\n   *\n   * `ctx.account` is the resolved `Account<TCtxMeta>` (framework calls\n   * `accounts.resolve(req.account)` first and threads the result in).\n   * Adopters fronting an upstream platform read tokens / upstream IDs from\n   * `ctx.account.ctx_metadata` without re-resolving.\n   *\n   * `ctx.authInfo` carries the caller's OAuth principal (when\n   * `serve({ authenticate })` is wired); `ctx.agent` carries the resolved\n   * `BuyerAgent` record (when an `agentRegistry` is configured). Platforms\n   * that guard financials per-principal use them to authorize the read —\n   * same pattern as `accounts.resolve`. Prefer `ctx.agent` for principal-\n   * keyed commercial gates; see `upsert?` for the rationale.\n   */\n  getAccountFinancials?(\n    req: GetAccountFinancialsRequest,\n    ctx: AccountToolContext<TCtxMeta>\n  ): Promise<GetAccountFinancialsHandlerResult>;\n\n  /**\n   * Mid-request token refresh hook. Optional. Called by the framework when\n   * a platform method throws a refreshable token-auth code (`AUTH_REQUIRED`\n   * for legacy compatibility or `AUTH_MISSING` for an AdCP 3.1-native\n   * missing request credential) AND `refreshToken` is defined — the\n   * framework refreshes via this hook, mutates or creates `account.authInfo`\n   * with the returned token, and retries the failing platform method exactly\n   * once.\n   *\n   * The reason string lets adopters distinguish trigger conditions:\n   *   - `'auth_required'` — platform method threw refreshable auth in flight.\n   *\n   * Treat as an open string union: future values may be added. Adopters\n   * SHOULD switch exhaustively (`default: throw`) so behavior drift on\n   * minor SDK bumps fails loud rather than silently no-oping.\n   *\n   * **In-flight only.** The refreshed token is scoped to the current\n   * request — the framework does NOT echo it back to the buyer. Use this\n   * for adapters that front an upstream platform API (Snap, Meta,\n   * retail-media OAuth flows) where the SDK caches an upstream token\n   * server-side and the buyer's auth-to-this-agent is separate.\n   *\n   * **Account-object identity contract.** The framework mutates a\n   * request-local Account clone before retrying, creating an OAuth-shaped\n   * auth principal if the resolver omitted one. The resolver-returned object\n   * is not written back. Adopters should still avoid caching secret-bearing\n   * `Account.authInfo` objects across unrelated callers, but SDK refresh\n   * retry does not mutate a cached resolver object in place.\n   *\n   * **Concurrency.** `refreshToken` MUST be safe under concurrent\n   * invocation on the same account — two parallel in-flight calls hitting\n   * refreshable auth at once will both call this hook. Adopters whose\n   * upstream provider rate-limits refresh should coalesce internally\n   * (e.g., a per-account in-flight refresh promise). The framework does\n   * not coalesce.\n   *\n   * **Failure surfaces correctable AUTH_REQUIRED.** If `refreshToken`\n   * itself throws, the framework projects to `AUTH_REQUIRED` with\n   * `recovery: 'correctable'` and a fixed message (the inner exception\n   * text is NOT echoed on the wire — refresh failures routinely include\n   * upstream details that should not cross the trust boundary). Log inner\n   * details server-side. Don't use SERVICE_UNAVAILABLE — refresh failure\n   * means the upstream authorization is gone, not that the service is\n   * transiently down.\n   *\n   * **Expiry timestamp** (`expiresAt`, ms since epoch) is optional. When\n   * returned, the framework writes it to `account.authInfo.expiresAt` so\n   * adopters reading the resolved Account can branch on it (proactive\n   * refresh is not yet wired; reactive-only in v6.x).\n   */\n  refreshToken?(account: Account<TCtxMeta>, reason: 'auth_required'): Promise<{ token: string; expiresAt?: number }>;\n}\n\n/**\n * Optional throw-class for `AccountStore.resolve` not-found signaling. Returning\n * `null` from `resolve` is canonical and equivalent; throw this only if your\n * codebase already throws a typed not-found exception elsewhere.\n *\n * **Throwable only from `AccountStore.resolve()`.** Throwing it from a\n * specialism method (`createMediaBuy`, `getProducts`, etc.) bypasses the\n * framework's not-found mapping and surfaces as `SERVICE_UNAVAILABLE`.\n *\n * The constructor's `message` is for server-side operator diagnostics only.\n * The framework emits a fixed `ACCOUNT_NOT_FOUND` envelope regardless; the\n * message never reaches the buyer. Operator-side log pipelines may aggregate\n * this string, so MUST NOT include caller-supplied identifiers (echoed account\n * refs, request args) — those leak across operator / buyer trust boundaries.\n *\n * Use ONLY for the narrow not-found case. Upstream-API outages, misconfigured\n * env vars, and schema-validation failures should propagate as generic\n * exceptions and surface to the buyer as `SERVICE_UNAVAILABLE`.\n */\nexport class AccountNotFoundError extends Error {\n  readonly name = 'AccountNotFoundError' as const;\n  constructor(message = 'Account not found') {\n    super(message);\n  }\n}\n\n/**\n * @deprecated Use the wire-accurate `ListAccountsRequest` type. Retained as\n * an alias so existing imports keep compiling.\n */\nexport type AccountFilter = ListAccountsRequest;\n\n/**\n * Per-account result row returned by an adopter's `accounts.upsert`\n * implementation. Maps to one element of the wire `sync_accounts` response's\n * `accounts[]` array.\n *\n * Carries the same optional commercial / lifecycle fields as the wire shape\n * so adopters can echo `setup` (for `pending_approval` accounts), `billing`,\n * `billing_entity`, `payment_terms`, caller-specific `authorization`, etc. on creation. The framework\n * projects these through `toWireSyncAccountRow` before emit, applying the\n * same `billing_entity.bank` strip as `toWireAccount` (write-only contract).\n *\n * **MUST NOT carry `authInfo` or other auth-derived fields.** This shape is\n * emitted on the `sync_accounts` response wire. The framework's projector\n * does not read `authInfo`, but adopters MUST NOT add an `authInfo` key on\n * returned rows — same MUST-NOT-LEAK rule the framework enforces on\n * `Account.authInfo`.\n */\nexport interface SyncAccountsResultRow {\n  account_id?: string;\n  brand: BrandReference;\n  operator: string;\n  /** Human-readable account name assigned by the seller. */\n  name?: string;\n  action: 'created' | 'updated' | 'unchanged' | 'failed';\n  status: AdcpAccountStatus;\n  /** Invoiced-to party. Echoes the request's `billing` after seller acceptance. */\n  billing?: BillingParty;\n  /** Business entity invoiced. `bank` is stripped on emit (write-only). */\n  billing_entity?: BusinessEntity;\n  account_scope?: AccountScope;\n  /** Setup payload for `pending_approval` accounts (URL/message/expiry). */\n  setup?: WireAccount['setup'];\n  rate_card?: string;\n  payment_terms?: PaymentTerms;\n  credit_limit?: WireAccount['credit_limit'];\n  /** Applied account-level webhook subscriptions; credentials are stripped on emit. */\n  notification_configs?: NotificationConfig[];\n  /**\n   * Caller-specific authorization metadata for this synced account, including\n   * downstream grants such as advertiser-account access plus publisher\n   * identity/post authorization.\n   */\n  authorization?: AccountAuthorization;\n  errors?: SyncAccountError[];\n  warnings?: string[];\n  sandbox?: boolean;\n}\n\nexport type AdcpAccountStatus =\n  | 'active'\n  | 'pending_approval'\n  | 'rejected'\n  | 'payment_required'\n  | 'suspended'\n  | 'closed';\n\n// ---------------------------------------------------------------------------\n// Wire projection — strip framework-internal fields before emit\n// ---------------------------------------------------------------------------\n\n/**\n * Project a framework `Account<TCtxMeta>` to the wire `Account` shape.\n *\n * Strips `ctx_metadata` and `authInfo` (framework-internal); renames `id` →\n * `account_id`; passes through wire-shaped fields. Strips\n * `billing_entity.bank` per the schema's write-only constraint — bank\n * coordinates flow buyer→seller in `sync_accounts` requests but MUST NOT\n * appear in any response payload.\n *\n * Used by the framework when emitting `list_accounts` and other wire\n * responses that include account data. Adopters never call this directly —\n * they return `Account<TCtxMeta>` from `accounts.resolve` / `accounts.list`\n * and the framework projects.\n */\nexport function toWireAccount<TCtxMeta>(account: Account<TCtxMeta>): WireAccount {\n  const wire: WireAccount = {\n    account_id: account.id,\n    name: account.name,\n    status: account.status,\n  };\n  if (account.brand !== undefined) wire.brand = account.brand;\n  if (account.operator !== undefined) wire.operator = account.operator;\n  if (account.advertiser !== undefined) wire.advertiser = account.advertiser;\n  if (account.billing_proxy !== undefined) wire.billing_proxy = account.billing_proxy;\n  if (account.billing !== undefined) {\n    // Wire `Account.billing: 'operator' | 'agent' | 'advertiser'` is the\n    // invoiced-to party. Internal `billing.invoicedTo` collapses string +\n    // BrandReference; a BrandReference indicates a third-party advertiser\n    // (Amazon DSP-shaped flow), which projects to `'advertiser'`.\n    const t = account.billing.invoicedTo;\n    wire.billing = typeof t === 'string' ? t : 'advertiser';\n  }\n  const projectedEntity = projectBillingEntity(account.billing_entity);\n  if (projectedEntity !== undefined) wire.billing_entity = projectedEntity;\n  if (account.rate_card !== undefined) wire.rate_card = account.rate_card;\n  if (account.payment_terms !== undefined) wire.payment_terms = account.payment_terms;\n  if (account.credit_limit !== undefined) wire.credit_limit = account.credit_limit;\n  if (account.setup !== undefined) wire.setup = account.setup;\n  if (account.account_scope !== undefined) wire.account_scope = account.account_scope;\n  if (account.governance_agents !== undefined) {\n    wire.governance_agents = account.governance_agents.map(projectGovernanceAgent);\n  }\n  if (account.reporting_bucket !== undefined) wire.reporting_bucket = account.reporting_bucket;\n  if (account.notification_configs !== undefined) {\n    (wire as unknown as { notification_configs?: WireNotificationConfig[] }).notification_configs =\n      account.notification_configs.map(projectNotificationConfig);\n  }\n  if (account.authorization !== undefined) {\n    (wire as WireAccount & { authorization?: AccountAuthorization }).authorization = projectAccountAuthorization(\n      account.authorization\n    );\n  }\n  if (account.sandbox !== undefined) wire.sandbox = account.sandbox;\n  if (account.ext !== undefined) wire.ext = account.ext;\n  return wire;\n}\n\nfunction projectAccountAuthorization(authorization: AccountAuthorization): AccountAuthorization {\n  const projected: AccountAuthorization = {\n    allowed_tasks: [...authorization.allowed_tasks],\n  };\n  if (authorization.field_scopes !== undefined) {\n    projected.field_scopes = Object.fromEntries(\n      Object.entries(authorization.field_scopes)\n        .filter((entry): entry is [string, string[]] => Array.isArray(entry[1]))\n        .map(([task, fields]) => [task, [...fields]])\n    );\n  }\n  if (authorization.scope_name !== undefined) projected.scope_name = authorization.scope_name;\n  if (authorization.read_only !== undefined) projected.read_only = authorization.read_only;\n  return projected;\n}\n\ntype WireSyncAccountRow = SyncAccountsSuccess['accounts'][number];\n\n/**\n * Project an adopter `SyncAccountsResultRow` to the wire shape returned by\n * `sync_accounts`. Applies the same `billing_entity.bank` strip as\n * `toWireAccount` — the wire schema marks bank coordinates write-only on\n * EVERY response, not just `list_accounts`. Adopters returning a row that\n * spreads a DB record carrying `bank` (e.g.,\n * `{ ...db.findByBrand(r.brand), action: 'updated' }`) have it stripped\n * before emit.\n *\n * Used by the framework when emitting `sync_accounts` responses. Adopters\n * never call this directly — they return `SyncAccountsResultRow[]` from\n * `accounts.upsert` and the framework projects.\n */\nexport function toWireSyncAccountRow(row: SyncAccountsResultRow): WireSyncAccountRow {\n  const wire: WireSyncAccountRow = {\n    brand: row.brand,\n    operator: row.operator,\n    action: row.action,\n    status: row.status,\n  };\n  if (row.account_id !== undefined) wire.account_id = row.account_id;\n  if (row.name !== undefined) wire.name = row.name;\n  if (row.billing !== undefined) wire.billing = row.billing;\n  const projectedEntity = projectBillingEntity(row.billing_entity);\n  if (projectedEntity !== undefined) wire.billing_entity = projectedEntity;\n  if (row.account_scope !== undefined) wire.account_scope = row.account_scope;\n  if (row.setup !== undefined) wire.setup = row.setup;\n  if (row.rate_card !== undefined) wire.rate_card = row.rate_card;\n  if (row.payment_terms !== undefined) wire.payment_terms = row.payment_terms;\n  if (row.credit_limit !== undefined) wire.credit_limit = row.credit_limit;\n  if (row.notification_configs !== undefined) {\n    (wire as unknown as { notification_configs?: WireNotificationConfig[] }).notification_configs =\n      row.notification_configs.map(projectNotificationConfig);\n  }\n  if (row.authorization !== undefined) {\n    (wire as WireSyncAccountRow & { authorization?: AccountAuthorization }).authorization = projectAccountAuthorization(\n      row.authorization\n    );\n  }\n  if (row.errors !== undefined) wire.errors = row.errors;\n  if (row.warnings !== undefined) wire.warnings = row.warnings;\n  if (row.sandbox !== undefined) wire.sandbox = row.sandbox;\n  return wire;\n}\n\nfunction projectNotificationConfig(config: NotificationConfig): WireNotificationConfig {\n  const { authentication, ...rest } = config;\n  if (!authentication) return rest;\n  const { credentials: _credentials, ...authenticationWithoutCredentials } = authentication;\n  return { ...rest, authentication: authenticationWithoutCredentials };\n}\n\ntype WireSyncGovernanceRow = SyncGovernanceSuccess['accounts'][number];\n\n/**\n * Project a `sync_governance` response row to the wire shape, stripping\n * any fields the buyer is NOT entitled to receive. Critically: each\n * `governance_agents[i]` is reduced to `{url, categories?}` only — the\n * spec marks `authentication.credentials` write-only (the buyer sends\n * the bearer; the seller persists it for outbound `check_governance`\n * calls but MUST NOT echo it back). The natural `{ ...entry.governance_agents[i] }`\n * echo idiom would compile silently against the typed return shape and\n * ship credentials over the wire AND into the idempotency replay cache,\n * arming the buyer (and any subsequent caller hitting the same key) to\n * impersonate the seller against the governance agent.\n *\n * Defense-in-depth: this dispatcher-level strip runs even if an adopter\n * returns a loosely-typed row, and even if a future codegen change\n * loosens the response Zod schema's `.passthrough()` for governance\n * agents.\n */\nexport function toWireSyncGovernanceRow(row: WireSyncGovernanceRow): WireSyncGovernanceRow {\n  const wire: WireSyncGovernanceRow = {\n    account: row.account,\n    status: row.status,\n  };\n  if (row.governance_agents !== undefined) {\n    // AdCP 3.1.0-beta.2 removed `categories` from the governance_agents\n    // wire shape. The schema is now `{ url }` only; per-agent category\n    // signaling moved out of band. The projection still strips\n    // authentication.credentials (write-only) by only naming `url`.\n    wire.governance_agents = row.governance_agents.map(a => ({ url: a.url }));\n  }\n  if (row.errors !== undefined) wire.errors = row.errors;\n  return wire;\n}\n\n/**\n * Strip `BusinessEntity.bank` per the schema's write-only constraint, and\n * skip emission entirely when nothing else is populated. Bank-only inputs\n * project to `undefined`, signaling the caller to omit `billing_entity`\n * rather than emit an empty object that would fail `legal_name` validation.\n *\n * Destructure-and-rest excludes `bank` regardless of source shape: own\n * non-enumerable, getter, prototype-chain, and Proxy-backed bank fields\n * are all excluded by the ES rest-spread evaluation order\n * (`CopyDataProperties` walks own-enumerable keys and skips the\n * destructured names).\n */\nfunction projectBillingEntity(entity: BusinessEntity | undefined): BusinessEntity | undefined {\n  if (entity === undefined) return undefined;\n  const { bank: _bank, ...rest } = entity;\n  return Object.keys(rest).length > 0 ? rest : undefined;\n}\n\ntype WireGovernanceAgent = NonNullable<WireAccount['governance_agents']>[number];\n\n/**\n * Project a governance-agent element to the wire shape, dropping any keys\n * the wire schema doesn't model. The schema notes that authentication\n * credentials are write-only and not included in responses; AdCP 3.1.0-beta.2\n * also removed `categories` from the wire shape. The current shape is\n * `{ url }` only — TS is erased at runtime so adopters using JS or `as any`\n * could otherwise smuggle a `credentials` or `categories` field straight\n * to the wire. Explicit projection closes that gap.\n */\nfunction projectGovernanceAgent(agent: WireGovernanceAgent): WireGovernanceAgent {\n  return { url: agent.url };\n}\n\n// ---------------------------------------------------------------------------\n// AccountReference helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Extract `account_id` from an `AccountReference` discriminated union without\n * casting. Returns `undefined` when `ref` is absent or the union arm doesn't\n * carry an `account_id` (e.g., `{ brand, operator }` or sandbox variants).\n *\n * Typical use in `accounts.resolve` implementations:\n *\n * ```ts\n * resolve: async (ref, ctx) => {\n *   const id = refAccountId(ref);\n *   if (id) return this.db.findById(id);\n *   const cred = ctx?.authInfo?.credential;\n *   const key = cred?.kind === 'oauth' ? cred.client_id : cred?.kind === 'api_key' ? cred.key_id : undefined;\n *   return key ? this.db.findByClientKey(key) : null;\n * }\n * ```\n *\n * @public\n */\nexport function refAccountId(ref?: AccountReference): string | undefined {\n  return ref && 'account_id' in ref ? (ref as { account_id?: string }).account_id : undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiDO,MAAM,kCAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAMA,MAAM,0CAA6F,CAAC;AACpG,KAAK;AAksBE,MAAM,6BAA6B,MAAM;AAAA,EACrC,OAAO;AAAA,EAChB,YAAY,UAAU,qBAAqB;AACzC,UAAM,OAAO;AAAA,EACf;AACF;AAkFO,SAAS,cAAwB,SAAyC;AAC/E,QAAM,OAAoB;AAAA,IACxB,YAAY,QAAQ;AAAA,IACpB,MAAM,QAAQ;AAAA,IACd,QAAQ,QAAQ;AAAA,EAClB;AACA,MAAI,QAAQ,UAAU,OAAW,MAAK,QAAQ,QAAQ;AACtD,MAAI,QAAQ,aAAa,OAAW,MAAK,WAAW,QAAQ;AAC5D,MAAI,QAAQ,eAAe,OAAW,MAAK,aAAa,QAAQ;AAChE,MAAI,QAAQ,kBAAkB,OAAW,MAAK,gBAAgB,QAAQ;AACtE,MAAI,QAAQ,YAAY,QAAW;AAKjC,UAAM,IAAI,QAAQ,QAAQ;AAC1B,SAAK,UAAU,OAAO,MAAM,WAAW,IAAI;AAAA,EAC7C;AACA,QAAM,kBAAkB,qBAAqB,QAAQ,cAAc;AACnE,MAAI,oBAAoB,OAAW,MAAK,iBAAiB;AACzD,MAAI,QAAQ,cAAc,OAAW,MAAK,YAAY,QAAQ;AAC9D,MAAI,QAAQ,kBAAkB,OAAW,MAAK,gBAAgB,QAAQ;AACtE,MAAI,QAAQ,iBAAiB,OAAW,MAAK,eAAe,QAAQ;AACpE,MAAI,QAAQ,UAAU,OAAW,MAAK,QAAQ,QAAQ;AACtD,MAAI,QAAQ,kBAAkB,OAAW,MAAK,gBAAgB,QAAQ;AACtE,MAAI,QAAQ,sBAAsB,QAAW;AAC3C,SAAK,oBAAoB,QAAQ,kBAAkB,IAAI,sBAAsB;AAAA,EAC/E;AACA,MAAI,QAAQ,qBAAqB,OAAW,MAAK,mBAAmB,QAAQ;AAC5E,MAAI,QAAQ,yBAAyB,QAAW;AAC9C,IAAC,KAAwE,uBACvE,QAAQ,qBAAqB,IAAI,yBAAyB;AAAA,EAC9D;AACA,MAAI,QAAQ,kBAAkB,QAAW;AACvC,IAAC,KAAgE,gBAAgB;AAAA,MAC/E,QAAQ;AAAA,IACV;AAAA,EACF;AACA,MAAI,QAAQ,YAAY,OAAW,MAAK,UAAU,QAAQ;AAC1D,MAAI,QAAQ,QAAQ,OAAW,MAAK,MAAM,QAAQ;AAClD,SAAO;AACT;AAEA,SAAS,4BAA4B,eAA2D;AAC9F,QAAM,YAAkC;AAAA,IACtC,eAAe,CAAC,GAAG,cAAc,aAAa;AAAA,EAChD;AACA,MAAI,cAAc,iBAAiB,QAAW;AAC5C,cAAU,eAAe,OAAO;AAAA,MAC9B,OAAO,QAAQ,cAAc,YAAY,EACtC,OAAO,CAAC,UAAuC,MAAM,QAAQ,MAAM,CAAC,CAAC,CAAC,EACtE,IAAI,CAAC,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,IAChD;AAAA,EACF;AACA,MAAI,cAAc,eAAe,OAAW,WAAU,aAAa,cAAc;AACjF,MAAI,cAAc,cAAc,OAAW,WAAU,YAAY,cAAc;AAC/E,SAAO;AACT;AAiBO,SAAS,qBAAqB,KAAgD;AACnF,QAAM,OAA2B;AAAA,IAC/B,OAAO,IAAI;AAAA,IACX,UAAU,IAAI;AAAA,IACd,QAAQ,IAAI;AAAA,IACZ,QAAQ,IAAI;AAAA,EACd;AACA,MAAI,IAAI,eAAe,OAAW,MAAK,aAAa,IAAI;AACxD,MAAI,IAAI,SAAS,OAAW,MAAK,OAAO,IAAI;AAC5C,MAAI,IAAI,YAAY,OAAW,MAAK,UAAU,IAAI;AAClD,QAAM,kBAAkB,qBAAqB,IAAI,cAAc;AAC/D,MAAI,oBAAoB,OAAW,MAAK,iBAAiB;AACzD,MAAI,IAAI,kBAAkB,OAAW,MAAK,gBAAgB,IAAI;AAC9D,MAAI,IAAI,UAAU,OAAW,MAAK,QAAQ,IAAI;AAC9C,MAAI,IAAI,cAAc,OAAW,MAAK,YAAY,IAAI;AACtD,MAAI,IAAI,kBAAkB,OAAW,MAAK,gBAAgB,IAAI;AAC9D,MAAI,IAAI,iBAAiB,OAAW,MAAK,eAAe,IAAI;AAC5D,MAAI,IAAI,yBAAyB,QAAW;AAC1C,IAAC,KAAwE,uBACvE,IAAI,qBAAqB,IAAI,yBAAyB;AAAA,EAC1D;AACA,MAAI,IAAI,kBAAkB,QAAW;AACnC,IAAC,KAAuE,gBAAgB;AAAA,MACtF,IAAI;AAAA,IACN;AAAA,EACF;AACA,MAAI,IAAI,WAAW,OAAW,MAAK,SAAS,IAAI;AAChD,MAAI,IAAI,aAAa,OAAW,MAAK,WAAW,IAAI;AACpD,MAAI,IAAI,YAAY,OAAW,MAAK,UAAU,IAAI;AAClD,SAAO;AACT;AAEA,SAAS,0BAA0B,QAAoD;AACrF,QAAM,EAAE,gBAAgB,GAAG,KAAK,IAAI;AACpC,MAAI,CAAC,eAAgB,QAAO;AAC5B,QAAM,EAAE,aAAa,cAAc,GAAG,iCAAiC,IAAI;AAC3E,SAAO,EAAE,GAAG,MAAM,gBAAgB,iCAAiC;AACrE;AAqBO,SAAS,wBAAwB,KAAmD;AACzF,QAAM,OAA8B;AAAA,IAClC,SAAS,IAAI;AAAA,IACb,QAAQ,IAAI;AAAA,EACd;AACA,MAAI,IAAI,sBAAsB,QAAW;AAKvC,SAAK,oBAAoB,IAAI,kBAAkB,IAAI,QAAM,EAAE,KAAK,EAAE,IAAI,EAAE;AAAA,EAC1E;AACA,MAAI,IAAI,WAAW,OAAW,MAAK,SAAS,IAAI;AAChD,SAAO;AACT;AAcA,SAAS,qBAAqB,QAAgE;AAC5F,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,EAAE,MAAM,OAAO,GAAG,KAAK,IAAI;AACjC,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,IAAI,OAAO;AAC/C;AAaA,SAAS,uBAAuB,OAAiD;AAC/E,SAAO,EAAE,KAAK,MAAM,IAAI;AAC1B;AAyBO,SAAS,aAAa,KAA4C;AACvE,SAAO,OAAO,gBAAgB,MAAO,IAAgC,aAAa;AACpF;","names":[]}