@adcp/sdk 14.0.0-beta.14 → 14.0.0-beta.15

package/dist/lib/core/webhook-registration.d.mts

@@ -1,3 +1,4 @@
+import type { DelegatedOperatorAuthorizationContext } from '../signing/agent-resolver/resolve-agent.mjs';
 export type WebhookAuthenticationMode = 'hmac-sha256' | 'rfc9421';
 /**
  * Trusted provenance for an outbound task-status webhook registration.
@@ -15,6 +16,10 @@ export interface WebhookRegistration {
     callbackUrl: string;
     method: 'POST';
     mode: WebhookAuthenticationMode;
+    /** Versioned marker distinguishing tuple-aware registrations from legacy rows. */
+    authorizationContextVersion?: 1;
+    /** Trusted local tuple used to re-authorize delegated seller keys after restart. */
+    delegatedOperatorAuthorization?: Readonly<DelegatedOperatorAuthorizationContext>;
     /** Originating preview API, persisted so async routing survives races and restarts. */
     previewMode?: 'canonical' | 'legacy';
     /** Callback must fail closed unless a durable mutation-settlement route is recoverable. */
@@ -29,7 +34,9 @@ export interface WebhookRegistrationStore {
     get(agentId: string, operationId: string): Promise<Readonly<WebhookRegistration> | undefined>;
     /**
      * Atomically create a registration. An identical retry is idempotent; a
-     * conflicting live registration for the same key MUST reject.
+     * conflicting live registration for the same key MUST reject. A successful
+     * return MUST provide immediate read-your-writes consistency through `get()`
+     * so the SDK can verify trusted authorization provenance before dispatch.
      */
     putIfAbsent(registration: WebhookRegistration): Promise<void>;
     /** Atomically mark a live registration as requiring durable mutation settlement. */

package/dist/lib/core/webhook-registration.d.ts

@@ -1,3 +1,4 @@
+import type { DelegatedOperatorAuthorizationContext } from '../signing/agent-resolver/resolve-agent';
 export type WebhookAuthenticationMode = 'hmac-sha256' | 'rfc9421';
 /**
  * Trusted provenance for an outbound task-status webhook registration.
@@ -15,6 +16,10 @@ export interface WebhookRegistration {
     callbackUrl: string;
     method: 'POST';
     mode: WebhookAuthenticationMode;
+    /** Versioned marker distinguishing tuple-aware registrations from legacy rows. */
+    authorizationContextVersion?: 1;
+    /** Trusted local tuple used to re-authorize delegated seller keys after restart. */
+    delegatedOperatorAuthorization?: Readonly<DelegatedOperatorAuthorizationContext>;
     /** Originating preview API, persisted so async routing survives races and restarts. */
     previewMode?: 'canonical' | 'legacy';
     /** Callback must fail closed unless a durable mutation-settlement route is recoverable. */
@@ -29,7 +34,9 @@ export interface WebhookRegistrationStore {
     get(agentId: string, operationId: string): Promise<Readonly<WebhookRegistration> | undefined>;
     /**
      * Atomically create a registration. An identical retry is idempotent; a
-     * conflicting live registration for the same key MUST reject.
+     * conflicting live registration for the same key MUST reject. A successful
+     * return MUST provide immediate read-your-writes consistency through `get()`
+     * so the SDK can verify trusted authorization provenance before dispatch.
      */
     putIfAbsent(registration: WebhookRegistration): Promise<void>;
     /** Atomically mark a live registration as requiring durable mutation settlement. */

package/dist/lib/core/webhook-registration.js

@@ -18,7 +18,10 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var webhook_registration_exports = {};
 __export(webhook_registration_exports, {
-  InMemoryWebhookRegistrationStore: () => InMemoryWebhookRegistrationStore
+  InMemoryWebhookRegistrationStore: () => InMemoryWebhookRegistrationStore,
+  canonicalDelegatedOperatorAuthorization: () => canonicalDelegatedOperatorAuthorization,
+  validateDelegatedOperatorAuthorizationContext: () => validateDelegatedOperatorAuthorizationContext,
+  validateWebhookRegistrationAuthorization: () => validateWebhookRegistrationAuthorization
 });
 module.exports = __toCommonJS(webhook_registration_exports);
 var import_errors = require('../errors/index.js');
@@ -59,7 +62,7 @@ class InMemoryWebhookRegistrationStore {
     if (this.entries.size >= this.maxEntries) {
       throw new Error("Webhook registration store capacity reached; refusing to dispatch an untracked callback.");
     }
-    this.entries.set(key, Object.freeze({ ...registration }));
+    this.entries.set(key, freezeRegistration(registration));
   }
   async delete(agentId, operationId) {
     this.entries.delete(registrationKey(agentId, operationId));
@@ -71,7 +74,7 @@ class InMemoryWebhookRegistrationStore {
       this.entries.delete(key);
       throw new Error("Cannot mark a missing or expired webhook registration for durable settlement.");
     }
-    this.entries.set(key, Object.freeze({ ...registration, requiresDurableSettlement: true }));
+    this.entries.set(key, freezeRegistration({ ...registration, requiresDurableSettlement: true }));
   }
   pruneExpired() {
     const now = this.now();
@@ -93,6 +96,7 @@ function validateRegistration(registration) {
   if (registration.previewMode !== void 0 && !["canonical", "legacy"].includes(registration.previewMode)) {
     throw new TypeError("Webhook registration previewMode must be canonical or legacy.");
   }
+  validateWebhookRegistrationAuthorization(registration);
   const callback = new URL(registration.callbackUrl);
   if (callback.username || callback.password || callback.hash) {
     throw new TypeError("Webhook callbackUrl cannot contain userinfo or a fragment.");
@@ -108,10 +112,66 @@ function validateRegistration(registration) {
     throw new TypeError("Webhook registration expiresAt must be later than createdAt.");
   }
 }
+const AUTHORIZED_OPERATOR_SCOPES = /* @__PURE__ */ new Set([
+  "media_buying",
+  "creative_generation",
+  "rights_clearance",
+  "governance",
+  "measurement",
+  "agent_operations"
+]);
+function validateDelegatedOperatorAuthorizationContext(value) {
+  if (value === void 0) return;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError("delegatedOperatorAuthorization must be an object.");
+  }
+  const unknown = Object.keys(value).filter((key) => !["brand", "scope", "country"].includes(key));
+  if (unknown.length > 0) {
+    throw new TypeError("delegatedOperatorAuthorization contains unsupported fields.");
+  }
+  if (value.brand !== void 0 && (typeof value.brand !== "string" || !/^[a-z0-9_]+$/.test(value.brand))) {
+    throw new TypeError("delegatedOperatorAuthorization.brand must be a protocol brand id.");
+  }
+  if (value.scope !== void 0 && (typeof value.scope !== "string" || !AUTHORIZED_OPERATOR_SCOPES.has(value.scope))) {
+    throw new TypeError("delegatedOperatorAuthorization.scope is not an authorized-operator scope.");
+  }
+  if (value.country !== void 0 && (typeof value.country !== "string" || !/^[A-Z]{2}$/.test(value.country))) {
+    throw new TypeError("delegatedOperatorAuthorization.country must be an uppercase ISO alpha-2 code.");
+  }
+  if (value.brand === void 0 && value.scope === void 0 && value.country === void 0) {
+    throw new TypeError("delegatedOperatorAuthorization must select at least one authorization dimension.");
+  }
+}
+function validateWebhookRegistrationAuthorization(registration) {
+  if (registration.authorizationContextVersion !== void 0 && registration.authorizationContextVersion !== 1) {
+    throw new TypeError("Webhook registration authorizationContextVersion must be 1 when present.");
+  }
+  if (registration.delegatedOperatorAuthorization !== void 0 && registration.authorizationContextVersion !== 1) {
+    throw new TypeError("Webhook registration delegatedOperatorAuthorization requires authorizationContextVersion 1.");
+  }
+  validateDelegatedOperatorAuthorizationContext(registration.delegatedOperatorAuthorization);
+}
+function canonicalDelegatedOperatorAuthorization(value) {
+  if (value === void 0) return "";
+  validateDelegatedOperatorAuthorizationContext(value);
+  return JSON.stringify([value.brand ?? null, value.scope ?? null, value.country ?? null]);
+}
+function freezeRegistration(registration) {
+  const delegatedOperatorAuthorization = registration.delegatedOperatorAuthorization;
+  return Object.freeze({
+    ...registration,
+    ...delegatedOperatorAuthorization !== void 0 && {
+      delegatedOperatorAuthorization: Object.freeze({ ...delegatedOperatorAuthorization })
+    }
+  });
+}
 function sameRegistration(a, b) {
-  return a.agentId === b.agentId && a.agentUrl === b.agentUrl && a.protocol === b.protocol && a.operationId === b.operationId && a.taskType === b.taskType && a.callbackUrl === b.callbackUrl && a.method === b.method && a.mode === b.mode && a.previewMode === b.previewMode;
+  return a.agentId === b.agentId && a.agentUrl === b.agentUrl && a.protocol === b.protocol && a.operationId === b.operationId && a.taskType === b.taskType && a.callbackUrl === b.callbackUrl && a.method === b.method && a.mode === b.mode && a.previewMode === b.previewMode && a.authorizationContextVersion === b.authorizationContextVersion && canonicalDelegatedOperatorAuthorization(a.delegatedOperatorAuthorization) === canonicalDelegatedOperatorAuthorization(b.delegatedOperatorAuthorization);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  InMemoryWebhookRegistrationStore
+  InMemoryWebhookRegistrationStore,
+  canonicalDelegatedOperatorAuthorization,
+  validateDelegatedOperatorAuthorizationContext,
+  validateWebhookRegistrationAuthorization
 });

package/dist/lib/core/webhook-registration.mjs

@@ -36,7 +36,7 @@ class InMemoryWebhookRegistrationStore {
     if (this.entries.size >= this.maxEntries) {
       throw new Error("Webhook registration store capacity reached; refusing to dispatch an untracked callback.");
     }
-    this.entries.set(key, Object.freeze({ ...registration }));
+    this.entries.set(key, freezeRegistration(registration));
   }
   async delete(agentId, operationId) {
     this.entries.delete(registrationKey(agentId, operationId));
@@ -48,7 +48,7 @@ class InMemoryWebhookRegistrationStore {
       this.entries.delete(key);
       throw new Error("Cannot mark a missing or expired webhook registration for durable settlement.");
     }
-    this.entries.set(key, Object.freeze({ ...registration, requiresDurableSettlement: true }));
+    this.entries.set(key, freezeRegistration({ ...registration, requiresDurableSettlement: true }));
   }
   pruneExpired() {
     const now = this.now();
@@ -70,6 +70,7 @@ function validateRegistration(registration) {
   if (registration.previewMode !== void 0 && !["canonical", "legacy"].includes(registration.previewMode)) {
     throw new TypeError("Webhook registration previewMode must be canonical or legacy.");
   }
+  validateWebhookRegistrationAuthorization(registration);
   const callback = new URL(registration.callbackUrl);
   if (callback.username || callback.password || callback.hash) {
     throw new TypeError("Webhook callbackUrl cannot contain userinfo or a fragment.");
@@ -85,9 +86,65 @@ function validateRegistration(registration) {
     throw new TypeError("Webhook registration expiresAt must be later than createdAt.");
   }
 }
+const AUTHORIZED_OPERATOR_SCOPES = /* @__PURE__ */ new Set([
+  "media_buying",
+  "creative_generation",
+  "rights_clearance",
+  "governance",
+  "measurement",
+  "agent_operations"
+]);
+function validateDelegatedOperatorAuthorizationContext(value) {
+  if (value === void 0) return;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError("delegatedOperatorAuthorization must be an object.");
+  }
+  const unknown = Object.keys(value).filter((key) => !["brand", "scope", "country"].includes(key));
+  if (unknown.length > 0) {
+    throw new TypeError("delegatedOperatorAuthorization contains unsupported fields.");
+  }
+  if (value.brand !== void 0 && (typeof value.brand !== "string" || !/^[a-z0-9_]+$/.test(value.brand))) {
+    throw new TypeError("delegatedOperatorAuthorization.brand must be a protocol brand id.");
+  }
+  if (value.scope !== void 0 && (typeof value.scope !== "string" || !AUTHORIZED_OPERATOR_SCOPES.has(value.scope))) {
+    throw new TypeError("delegatedOperatorAuthorization.scope is not an authorized-operator scope.");
+  }
+  if (value.country !== void 0 && (typeof value.country !== "string" || !/^[A-Z]{2}$/.test(value.country))) {
+    throw new TypeError("delegatedOperatorAuthorization.country must be an uppercase ISO alpha-2 code.");
+  }
+  if (value.brand === void 0 && value.scope === void 0 && value.country === void 0) {
+    throw new TypeError("delegatedOperatorAuthorization must select at least one authorization dimension.");
+  }
+}
+function validateWebhookRegistrationAuthorization(registration) {
+  if (registration.authorizationContextVersion !== void 0 && registration.authorizationContextVersion !== 1) {
+    throw new TypeError("Webhook registration authorizationContextVersion must be 1 when present.");
+  }
+  if (registration.delegatedOperatorAuthorization !== void 0 && registration.authorizationContextVersion !== 1) {
+    throw new TypeError("Webhook registration delegatedOperatorAuthorization requires authorizationContextVersion 1.");
+  }
+  validateDelegatedOperatorAuthorizationContext(registration.delegatedOperatorAuthorization);
+}
+function canonicalDelegatedOperatorAuthorization(value) {
+  if (value === void 0) return "";
+  validateDelegatedOperatorAuthorizationContext(value);
+  return JSON.stringify([value.brand ?? null, value.scope ?? null, value.country ?? null]);
+}
+function freezeRegistration(registration) {
+  const delegatedOperatorAuthorization = registration.delegatedOperatorAuthorization;
+  return Object.freeze({
+    ...registration,
+    ...delegatedOperatorAuthorization !== void 0 && {
+      delegatedOperatorAuthorization: Object.freeze({ ...delegatedOperatorAuthorization })
+    }
+  });
+}
 function sameRegistration(a, b) {
-  return a.agentId === b.agentId && a.agentUrl === b.agentUrl && a.protocol === b.protocol && a.operationId === b.operationId && a.taskType === b.taskType && a.callbackUrl === b.callbackUrl && a.method === b.method && a.mode === b.mode && a.previewMode === b.previewMode;
+  return a.agentId === b.agentId && a.agentUrl === b.agentUrl && a.protocol === b.protocol && a.operationId === b.operationId && a.taskType === b.taskType && a.callbackUrl === b.callbackUrl && a.method === b.method && a.mode === b.mode && a.previewMode === b.previewMode && a.authorizationContextVersion === b.authorizationContextVersion && canonicalDelegatedOperatorAuthorization(a.delegatedOperatorAuthorization) === canonicalDelegatedOperatorAuthorization(b.delegatedOperatorAuthorization);
 }
 export {
-  InMemoryWebhookRegistrationStore
+  InMemoryWebhookRegistrationStore,
+  canonicalDelegatedOperatorAuthorization,
+  validateDelegatedOperatorAuthorizationContext,
+  validateWebhookRegistrationAuthorization
 };

package/dist/lib/errors/index.d.mts

@@ -204,6 +204,15 @@ export declare class AuthenticationRequiredError extends ADCPError {
      */
     get suggestedScheme(): string | undefined;
 }
+/**
+ * A configured non-interactive credential reached the agent and was rejected.
+ * The transport error is retained as a non-enumerable cause so reflected
+ * credential material from an untrusted 401 body cannot enter JSON reports.
+ */
+export declare class AuthenticationCredentialsRejectedError extends AuthenticationRequiredError {
+    readonly subCode: "credentials_rejected";
+    constructor(agentUrl: string, cause?: unknown);
+}
 /**
  * Error thrown when a request reused an `idempotency_key` with a different
  * canonical payload within the seller's replay window.

package/dist/lib/errors/index.d.ts

@@ -204,6 +204,15 @@ export declare class AuthenticationRequiredError extends ADCPError {
      */
     get suggestedScheme(): string | undefined;
 }
+/**
+ * A configured non-interactive credential reached the agent and was rejected.
+ * The transport error is retained as a non-enumerable cause so reflected
+ * credential material from an untrusted 401 body cannot enter JSON reports.
+ */
+export declare class AuthenticationCredentialsRejectedError extends AuthenticationRequiredError {
+    readonly subCode: "credentials_rejected";
+    constructor(agentUrl: string, cause?: unknown);
+}
 /**
  * Error thrown when a request reused an `idempotency_key` with a different
  * canonical payload within the seller's replay window.

package/dist/lib/errors/index.js

@@ -21,6 +21,7 @@ __export(errors_exports, {
   ADCPError: () => ADCPError,
   ActionNotAllowedError: () => ActionNotAllowedError,
   AgentNotFoundError: () => AgentNotFoundError,
+  AuthenticationCredentialsRejectedError: () => AuthenticationCredentialsRejectedError,
   AuthenticationRequiredError: () => AuthenticationRequiredError,
   ConfigurationError: () => ConfigurationError,
   DeferredTaskError: () => DeferredTaskError,
@@ -216,6 +217,37 @@ class AuthenticationRequiredError extends ADCPError {
     return this.challenge?.scheme;
   }
 }
+class AuthenticationCredentialsRejectedError extends AuthenticationRequiredError {
+  subCode = "credentials_rejected";
+  constructor(agentUrl, cause) {
+    const safeAgentUrl = sanitizeAgentUrlForError(agentUrl);
+    super(
+      safeAgentUrl,
+      void 0,
+      "The agent rejected the configured credential with HTTP 401. Verify or replace the saved credential and retry."
+    );
+    this.name = "AuthenticationCredentialsRejectedError";
+    if (cause !== void 0) {
+      Object.defineProperty(this, "cause", {
+        value: cause,
+        enumerable: false,
+        configurable: true
+      });
+    }
+  }
+}
+function sanitizeAgentUrlForError(value) {
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return "invalid_url";
+  }
+}
 function buildAuthRequiredMessage(agentUrl, oauthMetadata, challenge) {
   if (challenge && challenge.scheme !== "bearer") {
     if (challenge.scheme === "basic") {
@@ -508,6 +540,7 @@ function extractErrorInfo(error) {
   ADCPError,
   ActionNotAllowedError,
   AgentNotFoundError,
+  AuthenticationCredentialsRejectedError,
   AuthenticationRequiredError,
   ConfigurationError,
   DeferredTaskError,

package/dist/lib/errors/index.mjs

@@ -166,6 +166,37 @@ class AuthenticationRequiredError extends ADCPError {
     return this.challenge?.scheme;
   }
 }
+class AuthenticationCredentialsRejectedError extends AuthenticationRequiredError {
+  subCode = "credentials_rejected";
+  constructor(agentUrl, cause) {
+    const safeAgentUrl = sanitizeAgentUrlForError(agentUrl);
+    super(
+      safeAgentUrl,
+      void 0,
+      "The agent rejected the configured credential with HTTP 401. Verify or replace the saved credential and retry."
+    );
+    this.name = "AuthenticationCredentialsRejectedError";
+    if (cause !== void 0) {
+      Object.defineProperty(this, "cause", {
+        value: cause,
+        enumerable: false,
+        configurable: true
+      });
+    }
+  }
+}
+function sanitizeAgentUrlForError(value) {
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString();
+  } catch {
+    return "invalid_url";
+  }
+}
 function buildAuthRequiredMessage(agentUrl, oauthMetadata, challenge) {
   if (challenge && challenge.scheme !== "bearer") {
     if (challenge.scheme === "basic") {
@@ -457,6 +488,7 @@ export {
   ADCPError,
   ActionNotAllowedError,
   AgentNotFoundError,
+  AuthenticationCredentialsRejectedError,
   AuthenticationRequiredError,
   ConfigurationError,
   DeferredTaskError,

package/dist/lib/index.d.mts

@@ -16,6 +16,7 @@ export { validateAdAgents, parseManagerDomain, type DiscoveryMethod, type AdAgen
 export { SingleAgentClient, WebhookDispatchError, createSingleAgentClient, UnsupportedFeatureError, } from './core/SingleAgentClient.mjs';
 export type { ClientProductPropertyPolicy, CreativeDeliveryTaskOptions, SingleAgentClientConfig, SyncCreativesTaskOptions, VerifyAndParseWebhookOptions, WebhookHandlerAdapter, WebhookHandlerRequest, WebhookParseErrorCode, WebhookParseFailure, WebhookParseResult, WebhookParseSuccess, WebhookVerificationConfig, } from './core/SingleAgentClient.mjs';
 export { InMemoryWebhookRegistrationStore, type InMemoryWebhookRegistrationStoreOptions, type WebhookAuthenticationMode, type WebhookRegistration, type WebhookRegistrationStore, } from './core/webhook-registration.mjs';
+export type { DelegatedOperatorAuthorizationContext } from './signing/agent-resolver/index.mjs';
 export { AgentClient, type CanonicalGetProductsResponse, type CanonicalProjectionTaskOptions, type ProposalRefinementTaskOptions, type TaskResponseTypeMap, type TaskRequestTypeMap, type TaskRequestFor, type AdcpTaskName, type InProcessAgentClientConfig, } from './core/AgentClient.mjs';
 export { MediaBuyLifecycleCoordinator, MediaBuyLifecycleCompatibilityError, LegacyPurchaseContinuationError, negotiateMediaBuyLifecycle, type CompatibleDeclineProposalsResponse, type CompatibleDeclineProposalsWireResponse, type CompatibleDeclineResult, type CompatibleProductsResponse, type CompatibleProductsWireResponse, type CompatibleProduct, type CompatibleProposal, type CompatibleProposalResponse, type CompatibleProjectedDeclineResult, type CompatibleRefinementResult, type CompatibleRefineProposalsResponse, type CompatibleRefineProposalsWireResponse, type CompatibleRequestProposalsResponse, type CompatibleRequestProposalsWireResponse, type CompatibleAcceptProposalRequest, type CompatibilityDeferredContinuation, type CompatibilitySubmittedContinuation, type CompatibilityTaskResult, type EstablishedProductsWireResponse, type EstablishedProposalAcceptanceFallback, type EstablishedProposalTaskReconciliationInput, type MediaBuyCompatibility, type MediaBuyCompatibilityLoss, type MediaBuyCompatibilityReport, type MediaBuyLifecycle, type MediaBuyLifecycleCoordinatorOptions, type LegacyPurchaseContinuationErrorCode, } from './media-buy/compatibility.mjs';
 export { InMemoryLegacyPurchaseContinuationStore, createInMemoryLegacyPurchaseContinuationStore, LEGACY_PURCHASE_PUBLICATION_PROOF_RETENTION_MS, legacyPurchaseSettlementFingerprint, type InMemoryLegacyPurchaseContinuationStoreOptions, type LegacyPurchaseBinding, type LegacyPurchaseClaim, type LegacyPurchaseClaimRequest, type LegacyPurchaseClaimResult, type LegacyPurchaseCompleteResult, type LegacyPurchaseContinuationRecord, type LegacyPurchaseContinuationStore, type LegacyPurchaseCreateResult, type LegacyPurchaseLoss, type LegacyPurchaseOperation, type LegacyPurchasePendingSettlement, type LegacyPurchasePendingSettlementResult, type LegacyPurchasePublicationLease, type LegacyPurchaseReconciliationResult, type LegacyPurchaseSourceVersion, type LegacyPurchaseTerminalResult, type ReconcileLegacyPurchase, } from './media-buy/legacy-purchase-continuation.mjs';
@@ -47,7 +48,7 @@ export * from './handlers/types.mjs';
 export type { Storage, AtomicTakeStorage, DeferredTaskStorage, BatchStorage, PatternStorage, AgentCapabilities, ConversationState, DeferredTaskState, StorageConfig, StorageFactory, StorageMiddleware, } from './storage/interfaces.mjs';
 export { MemoryStorage, createMemoryStorage, createMemoryStorageConfig } from './storage/MemoryStorage.mjs';
 export { ADCPError, TaskTimeoutError, MaxClarificationError, DeferredTaskError, TaskAbortedError, AgentNotFoundError, UnsupportedTaskError, ProtocolError, ValidationError as ADCPValidationError, // Rename to avoid conflict
-MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors/index.mjs';
+MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors/index.mjs';
 export type { OAuthMetadataInfo, ClientPreflightAdcpErrorInfo, ClientPreflightAdcpErrorRecovery, FeatureUnsupportedErrorOptions, ProtocolFeatureUnsupportedErrorOptions, ActionNotAllowedErrorDetails, ActionNotAllowedReasonValue, ActionNotAllowedAttemptedAction, ActionNotAllowedAvailableAction, ActionNotAllowedRecovery, } from './errors/index.mjs';
 export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy/index.mjs';
 export { ACTIONS_BY_FIELD, LEGACY_COARSE_ACTIONS, UPDATE_FIELDS_BY_ACTION, canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, findAvailableAction, getActionForMutation, getAvailableActions, getRollupParent, ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, preflightUpdateMediaBuy, recoveryForModeMismatch, validateProductsAgainstPropertyPolicy, } from './media-buy/index.mjs';
@@ -176,7 +177,7 @@ export * from './types/enum-compat.mjs';
 export { getAuthToken, createAdCPHeaders, createMCPAuthHeaders, createAuthenticatedFetch } from './auth/index.mjs';
 export { parseWWWAuthenticate, decodeAccessTokenClaims, validateTokenAudience, type WWWAuthenticateChallenge, type DecodedJWTHeader, type DecodedJWTClaims, type DecodedAccessToken, type TokenAudienceResult, InvalidTokenError, InsufficientScopeError, } from './auth/oauth/index.mjs';
 export { runAuthDiagnosis, AUTH_DIAGNOSIS_SCHEMA_VERSION, type DiagnoseOptions, type HttpCapture as DiagnosisHttpCapture, type DiagnosisStep, type Hypothesis as DiagnosisHypothesis, type HypothesisVerdict as DiagnosisHypothesisVerdict, type AuthDiagnosisReport, } from './auth/oauth/index.mjs';
-export { NeedsAuthorizationError, discoverAuthorizationRequirements, createFileOAuthStorage, bindAgentStorage, getAgentStorage, unbindAgentStorage, type AuthorizationRequirements, type DiscoverAuthorizationOptions, type FileOAuthStorageOptions, } from './auth/oauth/index.mjs';
+export { NeedsAuthorizationError, discoverAuthorizationRequirements, hasValidatedMcpAuthorizationRequirements, createFileOAuthStorage, bindAgentStorage, getAgentStorage, unbindAgentStorage, type AuthorizationRequirements, type DiscoverAuthorizationOptions, type FileOAuthStorageOptions, } from './auth/oauth/index.mjs';
 export { exchangeClientCredentials, ensureClientCredentialsTokens, ClientCredentialsExchangeError, MissingEnvSecretError, resolveSecret, isEnvSecretReference, toEnvSecretReference, extractEnvSecretName, type ExchangeClientCredentialsOptions, type EnsureClientCredentialsOptions, type AgentOAuthClientCredentials, } from './auth/oauth/index.mjs';
 export { validateAgentUrl, validateAdCPResponse, getExpectedSchema, handleAdCPResponse } from './validation/index.mjs';
 export { ProtocolClient, callMCPTool, callA2ATool, createMCPClient, createA2AClient, closeMCPConnections, closeOAuthConnections, bundleSupportsAdcpVersionField, sanitizeTransportHeaders, sanitizeTransportUrl, } from './protocols/index.mjs';

package/dist/lib/index.d.ts

@@ -16,6 +16,7 @@ export { validateAdAgents, parseManagerDomain, type DiscoveryMethod, type AdAgen
 export { SingleAgentClient, WebhookDispatchError, createSingleAgentClient, UnsupportedFeatureError, } from './core/SingleAgentClient';
 export type { ClientProductPropertyPolicy, CreativeDeliveryTaskOptions, SingleAgentClientConfig, SyncCreativesTaskOptions, VerifyAndParseWebhookOptions, WebhookHandlerAdapter, WebhookHandlerRequest, WebhookParseErrorCode, WebhookParseFailure, WebhookParseResult, WebhookParseSuccess, WebhookVerificationConfig, } from './core/SingleAgentClient';
 export { InMemoryWebhookRegistrationStore, type InMemoryWebhookRegistrationStoreOptions, type WebhookAuthenticationMode, type WebhookRegistration, type WebhookRegistrationStore, } from './core/webhook-registration';
+export type { DelegatedOperatorAuthorizationContext } from './signing/agent-resolver';
 export { AgentClient, type CanonicalGetProductsResponse, type CanonicalProjectionTaskOptions, type ProposalRefinementTaskOptions, type TaskResponseTypeMap, type TaskRequestTypeMap, type TaskRequestFor, type AdcpTaskName, type InProcessAgentClientConfig, } from './core/AgentClient';
 export { MediaBuyLifecycleCoordinator, MediaBuyLifecycleCompatibilityError, LegacyPurchaseContinuationError, negotiateMediaBuyLifecycle, type CompatibleDeclineProposalsResponse, type CompatibleDeclineProposalsWireResponse, type CompatibleDeclineResult, type CompatibleProductsResponse, type CompatibleProductsWireResponse, type CompatibleProduct, type CompatibleProposal, type CompatibleProposalResponse, type CompatibleProjectedDeclineResult, type CompatibleRefinementResult, type CompatibleRefineProposalsResponse, type CompatibleRefineProposalsWireResponse, type CompatibleRequestProposalsResponse, type CompatibleRequestProposalsWireResponse, type CompatibleAcceptProposalRequest, type CompatibilityDeferredContinuation, type CompatibilitySubmittedContinuation, type CompatibilityTaskResult, type EstablishedProductsWireResponse, type EstablishedProposalAcceptanceFallback, type EstablishedProposalTaskReconciliationInput, type MediaBuyCompatibility, type MediaBuyCompatibilityLoss, type MediaBuyCompatibilityReport, type MediaBuyLifecycle, type MediaBuyLifecycleCoordinatorOptions, type LegacyPurchaseContinuationErrorCode, } from './media-buy/compatibility';
 export { InMemoryLegacyPurchaseContinuationStore, createInMemoryLegacyPurchaseContinuationStore, LEGACY_PURCHASE_PUBLICATION_PROOF_RETENTION_MS, legacyPurchaseSettlementFingerprint, type InMemoryLegacyPurchaseContinuationStoreOptions, type LegacyPurchaseBinding, type LegacyPurchaseClaim, type LegacyPurchaseClaimRequest, type LegacyPurchaseClaimResult, type LegacyPurchaseCompleteResult, type LegacyPurchaseContinuationRecord, type LegacyPurchaseContinuationStore, type LegacyPurchaseCreateResult, type LegacyPurchaseLoss, type LegacyPurchaseOperation, type LegacyPurchasePendingSettlement, type LegacyPurchasePendingSettlementResult, type LegacyPurchasePublicationLease, type LegacyPurchaseReconciliationResult, type LegacyPurchaseSourceVersion, type LegacyPurchaseTerminalResult, type ReconcileLegacyPurchase, } from './media-buy/legacy-purchase-continuation';
@@ -47,7 +48,7 @@ export * from './handlers/types';
 export type { Storage, AtomicTakeStorage, DeferredTaskStorage, BatchStorage, PatternStorage, AgentCapabilities, ConversationState, DeferredTaskState, StorageConfig, StorageFactory, StorageMiddleware, } from './storage/interfaces';
 export { MemoryStorage, createMemoryStorage, createMemoryStorageConfig } from './storage/MemoryStorage';
 export { ADCPError, TaskTimeoutError, MaxClarificationError, DeferredTaskError, TaskAbortedError, AgentNotFoundError, UnsupportedTaskError, ProtocolError, ValidationError as ADCPValidationError, // Rename to avoid conflict
-MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors';
+MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors';
 export type { OAuthMetadataInfo, ClientPreflightAdcpErrorInfo, ClientPreflightAdcpErrorRecovery, FeatureUnsupportedErrorOptions, ProtocolFeatureUnsupportedErrorOptions, ActionNotAllowedErrorDetails, ActionNotAllowedReasonValue, ActionNotAllowedAttemptedAction, ActionNotAllowedAvailableAction, ActionNotAllowedRecovery, } from './errors';
 export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy';
 export { ACTIONS_BY_FIELD, LEGACY_COARSE_ACTIONS, UPDATE_FIELDS_BY_ACTION, canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, findAvailableAction, getActionForMutation, getAvailableActions, getRollupParent, ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, preflightUpdateMediaBuy, recoveryForModeMismatch, validateProductsAgainstPropertyPolicy, } from './media-buy';
@@ -176,7 +177,7 @@ export * from './types/enum-compat';
 export { getAuthToken, createAdCPHeaders, createMCPAuthHeaders, createAuthenticatedFetch } from './auth';
 export { parseWWWAuthenticate, decodeAccessTokenClaims, validateTokenAudience, type WWWAuthenticateChallenge, type DecodedJWTHeader, type DecodedJWTClaims, type DecodedAccessToken, type TokenAudienceResult, InvalidTokenError, InsufficientScopeError, } from './auth/oauth';
 export { runAuthDiagnosis, AUTH_DIAGNOSIS_SCHEMA_VERSION, type DiagnoseOptions, type HttpCapture as DiagnosisHttpCapture, type DiagnosisStep, type Hypothesis as DiagnosisHypothesis, type HypothesisVerdict as DiagnosisHypothesisVerdict, type AuthDiagnosisReport, } from './auth/oauth';
-export { NeedsAuthorizationError, discoverAuthorizationRequirements, createFileOAuthStorage, bindAgentStorage, getAgentStorage, unbindAgentStorage, type AuthorizationRequirements, type DiscoverAuthorizationOptions, type FileOAuthStorageOptions, } from './auth/oauth';
+export { NeedsAuthorizationError, discoverAuthorizationRequirements, hasValidatedMcpAuthorizationRequirements, createFileOAuthStorage, bindAgentStorage, getAgentStorage, unbindAgentStorage, type AuthorizationRequirements, type DiscoverAuthorizationOptions, type FileOAuthStorageOptions, } from './auth/oauth';
 export { exchangeClientCredentials, ensureClientCredentialsTokens, ClientCredentialsExchangeError, MissingEnvSecretError, resolveSecret, isEnvSecretReference, toEnvSecretReference, extractEnvSecretName, type ExchangeClientCredentialsOptions, type EnsureClientCredentialsOptions, type AgentOAuthClientCredentials, } from './auth/oauth';
 export { validateAgentUrl, validateAdCPResponse, getExpectedSchema, handleAdCPResponse } from './validation';
 export { ProtocolClient, callMCPTool, callA2ATool, createMCPClient, createA2AClient, closeMCPConnections, closeOAuthConnections, bundleSupportsAdcpVersionField, sanitizeTransportHeaders, sanitizeTransportUrl, } from './protocols';

package/dist/lib/index.js

@@ -42,6 +42,7 @@ __export(index_exports, {
   AgentNotFoundError: () => import_errors.AgentNotFoundError,
   Asset: () => import_asset_builders.Asset,
   AsyncHandler: () => import_AsyncHandler.AsyncHandler,
+  AuthenticationCredentialsRejectedError: () => import_errors.AuthenticationCredentialsRejectedError,
   AuthenticationRequiredError: () => import_errors.AuthenticationRequiredError,
   BRAND_RIGHTS_TOOLS: () => import_capabilities.BRAND_RIGHTS_TOOLS,
   BrandJsonSchema: () => import_wellknown_schemas.BrandJsonSchema,
@@ -403,6 +404,7 @@ __export(index_exports, {
   hasAdvisorySuccessPayload: () => import_utils.hasAdvisorySuccessPayload,
   hasAssets: () => import_format_assets.hasAssets,
   hasBrandRightsTools: () => import_testing.hasBrandRightsTools,
+  hasValidatedMcpAuthorizationRequirements: () => import_oauth3.hasValidatedMcpAuthorizationRequirements,
   hashPayload: () => import_server.hashPayload,
   hostname: () => import_server.hostname,
   htmlAsset: () => import_asset_builders.htmlAsset,
@@ -819,6 +821,7 @@ function createAdCPClientFromEnv() {
   AgentNotFoundError,
   Asset,
   AsyncHandler,
+  AuthenticationCredentialsRejectedError,
   AuthenticationRequiredError,
   BRAND_RIGHTS_TOOLS,
   BrandJsonSchema,
@@ -1180,6 +1183,7 @@ function createAdCPClientFromEnv() {
   hasAdvisorySuccessPayload,
   hasAssets,
   hasBrandRightsTools,
+  hasValidatedMcpAuthorizationRequirements,
   hashPayload,
   hostname,
   htmlAsset,

package/dist/lib/index.mjs

@@ -187,6 +187,7 @@ import {
   MissingInputHandlerError,
   InvalidContextError,
   ConfigurationError,
+  AuthenticationCredentialsRejectedError,
   AuthenticationRequiredError,
   FeatureUnsupportedError,
   ProtocolFeatureUnsupportedError,
@@ -388,6 +389,7 @@ import {
 import {
   NeedsAuthorizationError,
   discoverAuthorizationRequirements,
+  hasValidatedMcpAuthorizationRequirements,
   createFileOAuthStorage,
   bindAgentStorage,
   getAgentStorage,
@@ -775,6 +777,7 @@ export {
   AgentNotFoundError,
   Asset,
   AsyncHandler,
+  AuthenticationCredentialsRejectedError,
   AuthenticationRequiredError,
   BRAND_RIGHTS_TOOLS,
   BrandJsonSchema,
@@ -1136,6 +1139,7 @@ export {
   hasAdvisorySuccessPayload,
   hasAssets,
   hasBrandRightsTools,
+  hasValidatedMcpAuthorizationRequirements,
   hashPayload,
   hostname,
   htmlAsset,

package/dist/lib/media-buy/compatibility.js

@@ -426,11 +426,14 @@ function requestFingerprint(value) {
   return (0, import_node_crypto.createHash)("sha256").update((0, import_jcs.canonicalize)(value)).digest("base64url");
 }
 function snapshotCompatibilityTaskOptions(options) {
-  if (!options) return void 0;
+  if (!options) return options;
   return {
     ...options,
     ...options.transport !== void 0 && { transport: { ...options.transport } },
-    ...options.metadata !== void 0 && { metadata: structuredClone(options.metadata) }
+    ...options.metadata !== void 0 && { metadata: structuredClone(options.metadata) },
+    ...options.delegatedOperatorAuthorization !== void 0 && {
+      delegatedOperatorAuthorization: { ...options.delegatedOperatorAuthorization }
+    }
   };
 }
 function stripWebhookAuthenticationCredential(value) {
@@ -3763,6 +3766,7 @@ class MediaBuyLifecycleCoordinator {
     return adapt(result);
   }
   async listProducts(params, inputHandler, options) {
+    options = snapshotCompatibilityTaskOptions(options);
     this.assertActive("listProducts");
     const input = record(params);
     const lifecycle = this.selectLifecycle("list_products");
@@ -3835,6 +3839,7 @@ class MediaBuyLifecycleCoordinator {
     );
   }
   async requestProposals(params, inputHandler, options) {
+    options = snapshotCompatibilityTaskOptions(options);
     this.assertActive("requestProposals");
     const input = record(params);
     const lifecycle = this.selectLifecycle("request_proposals");
@@ -6268,6 +6273,7 @@ class MediaBuyLifecycleCoordinator {
     return (0, import_match.attachMatch)(result);
   }
   async refineProposals(params, inputHandler, options) {
+    options = snapshotCompatibilityTaskOptions(options);
     this.assertActive("refineProposals");
     const lifecycle = this.selectLifecycle("refine_proposals");
     this.assertBeta6ReportingRequest("refineProposals", "refine_proposals", params);
@@ -6563,6 +6569,7 @@ class MediaBuyLifecycleCoordinator {
     }
   }
   async declineProposals(params, inputHandler, options) {
+    options = snapshotCompatibilityTaskOptions(options);
     this.assertActive("declineProposals");
     const input = record(params);
     const lifecycle = this.selectLifecycle("decline_proposals");
@@ -6787,6 +6794,7 @@ class MediaBuyLifecycleCoordinator {
     }
   }
   async buyProducts(params, inputHandler, options) {
+    options = snapshotCompatibilityTaskOptions(options);
     this.assertActive("buyProducts");
     const input = record(params);
     const lifecycle = this.selectLifecycle("buy_products");
@@ -6926,6 +6934,7 @@ class MediaBuyLifecycleCoordinator {
     );
   }
   async acceptProposal(params, inputHandler, options) {
+    options = snapshotCompatibilityTaskOptions(options);
     this.assertActive("acceptProposal");
     const input = record(params);
     const lifecycle = this.selectLifecycle("accept_proposal");
@@ -7404,6 +7413,7 @@ class MediaBuyLifecycleCoordinator {
     return this.attachEstablishedMutationTransitions(adapted, durableMutation);
   }
   async controlMediaBuy(params, inputHandler, options) {
+    options = snapshotCompatibilityTaskOptions(options);
     this.assertActive("controlMediaBuy");
     const input = record(params);
     const lifecycle = this.selectLifecycle("control_media_buy");
@@ -7690,6 +7700,7 @@ class MediaBuyLifecycleCoordinator {
     );
   }
   async getMediaBuys(params, inputHandler, options) {
+    options = snapshotCompatibilityTaskOptions(options);
     this.assertActive("getMediaBuys");
     if (compareRelease(this.negotiated_version, "3.0") < 0) {
       throw this.unsupported(
@@ -7711,6 +7722,7 @@ class MediaBuyLifecycleCoordinator {
     return this.adaptProjectedResult(result, this.makeReport(this.lifecycle, ["get_media_buys"], []), (data) => data);
   }
   async getMediaBuyDelivery(params, inputHandler, options) {
+    options = snapshotCompatibilityTaskOptions(options);
     this.assertActive("getMediaBuyDelivery");
     if (compareRelease(this.negotiated_version, "3.0") < 0) {
       throw this.unsupported(