@adcp/sdk 14.0.0-rc.39 → 14.0.0-rc.40

package/dist/lib/discovery/adagents-redirects.mjs

@@ -15,13 +15,14 @@ class AdAgentsRedirectRefusedError extends Error {
     this.location = meta.location;
   }
 }
-async function ssrfSafeFetchAdAgents(url, options, policy) {
+async function ssrfSafeFetchAdAgents(url, options, policy, onResponse) {
   let currentUrl = url;
   let redirects = 0;
-  const originUrl = policy.mode === "same-registrable-domain" ? policy.originUrl : url;
-  const maxRedirects = policy.mode === "same-registrable-domain" ? policy.maxRedirects ?? DEFAULT_WELL_KNOWN_REDIRECT_HOPS : 0;
+  const originUrl = policy.mode !== "none" ? policy.originUrl : url;
+  const maxRedirects = policy.mode !== "none" ? policy.maxRedirects ?? DEFAULT_WELL_KNOWN_REDIRECT_HOPS : 0;
   while (true) {
     const result = await ssrfSafeFetch(currentUrl, options);
+    onResponse?.(result);
     if (!REDIRECT_STATUSES.has(result.status)) return result;
     const location = result.headers["location"];
     if (!location) {
@@ -61,6 +62,12 @@ async function ssrfSafeFetchAdAgents(url, options, policy) {
         { url: currentUrl, location: scrubUrl(next) }
       );
     }
+    if (policy.mode === "same-origin" && new URL(originUrl).origin !== next.origin) {
+      throw new AdAgentsRedirectRefusedError("redirect_refused", "Authoritative evidence redirect changed origin", {
+        url: currentUrl,
+        location: scrubUrl(next)
+      });
+    }
     validateSameRegistrableDomainRedirect(originUrl, currentUrl, nextUrl);
     redirects++;
     currentUrl = nextUrl;

package/dist/lib/discovery/types.d.mts

@@ -81,6 +81,45 @@ export type CompactPublisherPropertySelector = {
     publisher_domains: string[];
     property_tags: string[];
 };
+/** Authorization-scoped omission grants all collections in this publisher namespace. */
+export interface AuthorizationCollectionSelector {
+    publisher_domain: string;
+    collection_ids?: string[];
+}
+/** Products always select concrete collection IDs; omission is not a product wildcard. */
+export interface ProductCollectionSelector extends AuthorizationCollectionSelector {
+    collection_ids: [string, ...string[]];
+}
+/** Carriage entries can carry host property IDs, catalog identifiers, or both. */
+export type CollectionDistribution = {
+    publisher_domain: string;
+} & ({
+    property_ids: [string, ...string[]];
+    identifiers?: [{
+        type: string;
+        value: string;
+    }, ...Array<{
+        type: string;
+        value: string;
+    }>];
+} | {
+    property_ids?: [string, ...string[]];
+    identifiers: [{
+        type: string;
+        value: string;
+    }, ...Array<{
+        type: string;
+        value: string;
+    }>];
+});
+export interface DiscoveryCollection {
+    /** Required when a shared cross-origin document declares this publisher-scoped collection. */
+    publisher_domain?: string;
+    collection_id: string;
+    name: string;
+    kind?: string;
+    distribution?: CollectionDistribution[];
+}
 /**
  * Entry in `adagents.json` `authorized_agents[]`. The schema requires
  * every entry to carry `authorization_type` plus the matching selector
@@ -94,6 +133,8 @@ export type CompactPublisherPropertySelector = {
 export interface AuthorizedAgent {
     url: string;
     authorized_for: string;
+    collections?: AuthorizationCollectionSelector[];
+    delegation_type?: string;
     /** Discriminator. Required by the schema; absent in pre-schema-3 files. */
     authorization_type?: AuthorizationType;
     /** Selector for `authorization_type: 'property_ids'`. */
@@ -169,6 +210,7 @@ export interface AdAgentsJson {
     authoritative_location?: string;
     authorized_agents?: AuthorizedAgent[];
     properties?: Property[];
+    collections?: DiscoveryCollection[];
     /**
      * Publisher-published format catalog (AdCP 3.1). Each entry declares
      * a v2 `ProductFormatDeclaration` (or v1 named-format ref) the

package/dist/lib/discovery/types.d.ts

@@ -81,6 +81,45 @@ export type CompactPublisherPropertySelector = {
     publisher_domains: string[];
     property_tags: string[];
 };
+/** Authorization-scoped omission grants all collections in this publisher namespace. */
+export interface AuthorizationCollectionSelector {
+    publisher_domain: string;
+    collection_ids?: string[];
+}
+/** Products always select concrete collection IDs; omission is not a product wildcard. */
+export interface ProductCollectionSelector extends AuthorizationCollectionSelector {
+    collection_ids: [string, ...string[]];
+}
+/** Carriage entries can carry host property IDs, catalog identifiers, or both. */
+export type CollectionDistribution = {
+    publisher_domain: string;
+} & ({
+    property_ids: [string, ...string[]];
+    identifiers?: [{
+        type: string;
+        value: string;
+    }, ...Array<{
+        type: string;
+        value: string;
+    }>];
+} | {
+    property_ids?: [string, ...string[]];
+    identifiers: [{
+        type: string;
+        value: string;
+    }, ...Array<{
+        type: string;
+        value: string;
+    }>];
+});
+export interface DiscoveryCollection {
+    /** Required when a shared cross-origin document declares this publisher-scoped collection. */
+    publisher_domain?: string;
+    collection_id: string;
+    name: string;
+    kind?: string;
+    distribution?: CollectionDistribution[];
+}
 /**
  * Entry in `adagents.json` `authorized_agents[]`. The schema requires
  * every entry to carry `authorization_type` plus the matching selector
@@ -94,6 +133,8 @@ export type CompactPublisherPropertySelector = {
 export interface AuthorizedAgent {
     url: string;
     authorized_for: string;
+    collections?: AuthorizationCollectionSelector[];
+    delegation_type?: string;
     /** Discriminator. Required by the schema; absent in pre-schema-3 files. */
     authorization_type?: AuthorizationType;
     /** Selector for `authorization_type: 'property_ids'`. */
@@ -169,6 +210,7 @@ export interface AdAgentsJson {
     authoritative_location?: string;
     authorized_agents?: AuthorizedAgent[];
     properties?: Property[];
+    collections?: DiscoveryCollection[];
     /**
      * Publisher-published format catalog (AdCP 3.1). Each entry declares
      * a v2 `ProductFormatDeclaration` (or v1 named-format ref) the

package/dist/lib/index.d.mts

@@ -42,7 +42,7 @@ export { createCanonicalReferenceCache, createCanonicalReferenceResolver, canoni
 export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, } from './governance/index.mjs';
 export type { BaseTaskEvent, ProtocolRequestEvent, ProtocolResponseEvent, TaskStatusEvent, ObjectEvent, TaskEvent, TaskEventCallbacks, } from './core/TaskEventTypes.mjs';
 export { createOperationId } from './core/TaskEventTypes.mjs';
-export type { AsyncHandlerConfig, WebhookMetadata, Activity, NotificationMetadata, MediaBuyDeliveryNotification, CreateMediaBuyStatusChangeHandler, UpdateMediaBuyStatusChangeHandler, SyncCreativesStatusChangeHandler, GetProductsStatusChangeHandler, } from './core/AsyncHandler.mjs';
+export type { AsyncHandlerConfig, WebhookMetadata, Activity, NotificationMetadata, MediaBuyDeliveryNotification, CreateMediaBuyStatusChangeHandler, UpdateMediaBuyStatusChangeHandler, SyncCreativesStatusChangeHandler, GetProductsStatusChangeHandler, ListProductsStatusChangeHandler, } from './core/AsyncHandler.mjs';
 export { AsyncHandler, WebhookDedupConflictError, WebhookDedupInputError, createAsyncHandler, } from './core/AsyncHandler.mjs';
 export { normalizeWholesaleFeedWebhookNotification, parseWholesaleFeedWebhookNotification, WholesaleFeedWebhookNotificationError, } from './wholesale-feed-sync/webhook-notification.mjs';
 export type { NormalizedWholesaleFeedWebhookNotification, WholesaleFeedWebhookAffectedEntityType, WholesaleFeedWebhookCacheScope, WholesaleFeedWebhookNotificationErrorCode, WholesaleFeedWebhookNotificationErrorDetails, WholesaleFeedWebhookNotificationType, } from './wholesale-feed-sync/webhook-notification.mjs';
@@ -266,3 +266,5 @@ export type { AccountChangeFeedCapabilities } from './utils/capabilities.mjs';
 export * from './media-buy/actions.mjs';
 export { mediaBuyActionResolver } from './server/media-buy-action-resolver.mjs';
 export type { SellerActionDecision, SellerActionResolutionOptions, SellerActionResolution, } from './server/media-buy-action-resolver.mjs';
+export * from './supply-path/index.mjs';
+export type { AuthorizationCollectionSelector, ProductCollectionSelector, CollectionDistribution, DiscoveryCollection, } from './discovery/types.mjs';

package/dist/lib/index.d.ts

@@ -42,7 +42,7 @@ export { createCanonicalReferenceCache, createCanonicalReferenceResolver, canoni
 export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, } from './governance';
 export type { BaseTaskEvent, ProtocolRequestEvent, ProtocolResponseEvent, TaskStatusEvent, ObjectEvent, TaskEvent, TaskEventCallbacks, } from './core/TaskEventTypes';
 export { createOperationId } from './core/TaskEventTypes';
-export type { AsyncHandlerConfig, WebhookMetadata, Activity, NotificationMetadata, MediaBuyDeliveryNotification, CreateMediaBuyStatusChangeHandler, UpdateMediaBuyStatusChangeHandler, SyncCreativesStatusChangeHandler, GetProductsStatusChangeHandler, } from './core/AsyncHandler';
+export type { AsyncHandlerConfig, WebhookMetadata, Activity, NotificationMetadata, MediaBuyDeliveryNotification, CreateMediaBuyStatusChangeHandler, UpdateMediaBuyStatusChangeHandler, SyncCreativesStatusChangeHandler, GetProductsStatusChangeHandler, ListProductsStatusChangeHandler, } from './core/AsyncHandler';
 export { AsyncHandler, WebhookDedupConflictError, WebhookDedupInputError, createAsyncHandler, } from './core/AsyncHandler';
 export { normalizeWholesaleFeedWebhookNotification, parseWholesaleFeedWebhookNotification, WholesaleFeedWebhookNotificationError, } from './wholesale-feed-sync/webhook-notification';
 export type { NormalizedWholesaleFeedWebhookNotification, WholesaleFeedWebhookAffectedEntityType, WholesaleFeedWebhookCacheScope, WholesaleFeedWebhookNotificationErrorCode, WholesaleFeedWebhookNotificationErrorDetails, WholesaleFeedWebhookNotificationType, } from './wholesale-feed-sync/webhook-notification';
@@ -266,3 +266,5 @@ export type { AccountChangeFeedCapabilities } from './utils/capabilities';
 export * from './media-buy/actions';
 export { mediaBuyActionResolver } from './server/media-buy-action-resolver';
 export type { SellerActionDecision, SellerActionResolutionOptions, SellerActionResolution, } from './server/media-buy-action-resolver';
+export * from './supply-path';
+export type { AuthorizationCollectionSelector, ProductCollectionSelector, CollectionDistribution, DiscoveryCollection, } from './discovery/types';

package/dist/lib/index.js

@@ -815,6 +815,7 @@ __reExport(index_exports, require('./client/account-change-subscription.js'), mo
 __reExport(index_exports, require('./notifications/account-change-recorded.js'), module.exports);
 __reExport(index_exports, require('./media-buy/actions.js'), module.exports);
 var import_media_buy_action_resolver = require('./server/media-buy-action-resolver.js');
+__reExport(index_exports, require('./supply-path/index.js'), module.exports);
 const wireVersion = {
   isSupported: import_protocols2.bundleSupportsAdcpVersionField,
   normalize: import_schema_loader2.toReleasePrecisionWire,
@@ -1521,5 +1522,6 @@ function createAdCPClientFromEnv() {
   ...require('./client/account-changes.js'),
   ...require('./client/account-change-subscription.js'),
   ...require('./notifications/account-change-recorded.js'),
-  ...require('./media-buy/actions.js')
+  ...require('./media-buy/actions.js'),
+  ...require('./supply-path/index.js')
 });

package/dist/lib/index.mjs

@@ -785,6 +785,7 @@ export * from "./client/account-change-subscription.mjs";
 export * from "./notifications/account-change-recorded.mjs";
 export * from "./media-buy/actions.mjs";
 import { mediaBuyActionResolver } from "./server/media-buy-action-resolver.mjs";
+export * from "./supply-path/index.mjs";
 export {
   A2AInvocationError,
   A2A_CARD_PATHS,

package/dist/lib/net/ssrf-fetch.js

@@ -102,6 +102,7 @@ async function ssrfSafeFetch(url, options = {}) {
   if (options.signal?.aborted) onExternalAbort();
   const timer = setTimeout(() => ac.abort(new Error("ssrf-fetch: timeout")), timeoutMs);
   let dispatcher;
+  let cancelBody;
   let pinned;
   let pinnedFamily;
   try {
@@ -167,20 +168,23 @@ async function ssrfSafeFetch(url, options = {}) {
         }
       });
     }
-    const res = options.trustedFetchFn ? await options.trustedFetchFn(checkedUrl, {
-      method: options.method ?? "GET",
-      redirect: "manual",
-      signal: ac.signal,
-      headers: options.headers,
-      ...options.body !== void 0 && { body: options.body }
-    }) : await (0, import_undici.fetch)(checkedUrl, {
-      method: options.method ?? "GET",
-      redirect: "manual",
-      signal: ac.signal,
-      headers: options.headers,
-      dispatcher,
-      ...options.body !== void 0 && { body: options.body }
-    });
+    const res = await raceWithAbort(
+      options.trustedFetchFn ? options.trustedFetchFn(checkedUrl, {
+        method: options.method ?? "GET",
+        redirect: "manual",
+        signal: ac.signal,
+        headers: options.headers,
+        ...options.body !== void 0 && { body: options.body }
+      }) : (0, import_undici.fetch)(checkedUrl, {
+        method: options.method ?? "GET",
+        redirect: "manual",
+        signal: ac.signal,
+        headers: options.headers,
+        dispatcher,
+        ...options.body !== void 0 && { body: options.body }
+      }),
+      ac.signal
+    );
     const headers = {};
     res.headers.forEach((v, k) => {
       headers[k.toLowerCase()] = v;
@@ -196,14 +200,19 @@ async function ssrfSafeFetch(url, options = {}) {
         connectionPinned: pinned !== void 0
       };
     }
+    cancelBody = () => {
+      void reader.cancel().catch(() => {
+      });
+    };
     const chunks = [];
     let bytes = 0;
     while (true) {
-      const { done, value } = await reader.read();
+      const { done, value } = await raceWithAbort(reader.read(), ac.signal);
       if (done) break;
       bytes += value.byteLength;
       if (bytes > maxBodyBytes) {
-        await reader.cancel();
+        void reader.cancel().catch(() => {
+        });
         throw new SsrfRefusedError("body_exceeds_limit", `Response body exceeded ${maxBodyBytes} bytes`, {
           url,
           hostname: parsed.hostname,
@@ -229,16 +238,33 @@ async function ssrfSafeFetch(url, options = {}) {
   } finally {
     clearTimeout(timer);
     options.signal?.removeEventListener("abort", onExternalAbort);
-    await dispatcher?.close().catch(() => {
+    if (ac.signal.aborted) {
+      cancelBody?.();
+      await dispatcher?.destroy().catch(() => {
+      });
+    } else await dispatcher?.close().catch(() => {
     });
   }
 }
 function raceWithAbort(operation, signal) {
-  throwIfSignalAborted(signal);
   return new Promise((resolve, reject) => {
-    const onAbort = () => reject(signalAbortError(signal));
-    signal.addEventListener("abort", onAbort, { once: true });
-    operation.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+      cleanup();
+      reject(signalAbortError(signal));
+    };
+    operation.then(
+      (value) => {
+        cleanup();
+        resolve(value);
+      },
+      (error) => {
+        cleanup();
+        reject(error);
+      }
+    );
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
   });
 }
 function signalAbortError(signal) {

package/dist/lib/net/ssrf-fetch.mjs

@@ -76,6 +76,7 @@ async function ssrfSafeFetch(url, options = {}) {
   if (options.signal?.aborted) onExternalAbort();
   const timer = setTimeout(() => ac.abort(new Error("ssrf-fetch: timeout")), timeoutMs);
   let dispatcher;
+  let cancelBody;
   let pinned;
   let pinnedFamily;
   try {
@@ -141,20 +142,23 @@ async function ssrfSafeFetch(url, options = {}) {
         }
       });
     }
-    const res = options.trustedFetchFn ? await options.trustedFetchFn(checkedUrl, {
-      method: options.method ?? "GET",
-      redirect: "manual",
-      signal: ac.signal,
-      headers: options.headers,
-      ...options.body !== void 0 && { body: options.body }
-    }) : await undiciFetch(checkedUrl, {
-      method: options.method ?? "GET",
-      redirect: "manual",
-      signal: ac.signal,
-      headers: options.headers,
-      dispatcher,
-      ...options.body !== void 0 && { body: options.body }
-    });
+    const res = await raceWithAbort(
+      options.trustedFetchFn ? options.trustedFetchFn(checkedUrl, {
+        method: options.method ?? "GET",
+        redirect: "manual",
+        signal: ac.signal,
+        headers: options.headers,
+        ...options.body !== void 0 && { body: options.body }
+      }) : undiciFetch(checkedUrl, {
+        method: options.method ?? "GET",
+        redirect: "manual",
+        signal: ac.signal,
+        headers: options.headers,
+        dispatcher,
+        ...options.body !== void 0 && { body: options.body }
+      }),
+      ac.signal
+    );
     const headers = {};
     res.headers.forEach((v, k) => {
       headers[k.toLowerCase()] = v;
@@ -170,14 +174,19 @@ async function ssrfSafeFetch(url, options = {}) {
         connectionPinned: pinned !== void 0
       };
     }
+    cancelBody = () => {
+      void reader.cancel().catch(() => {
+      });
+    };
     const chunks = [];
     let bytes = 0;
     while (true) {
-      const { done, value } = await reader.read();
+      const { done, value } = await raceWithAbort(reader.read(), ac.signal);
       if (done) break;
       bytes += value.byteLength;
       if (bytes > maxBodyBytes) {
-        await reader.cancel();
+        void reader.cancel().catch(() => {
+        });
         throw new SsrfRefusedError("body_exceeds_limit", `Response body exceeded ${maxBodyBytes} bytes`, {
           url,
           hostname: parsed.hostname,
@@ -203,16 +212,33 @@ async function ssrfSafeFetch(url, options = {}) {
   } finally {
     clearTimeout(timer);
     options.signal?.removeEventListener("abort", onExternalAbort);
-    await dispatcher?.close().catch(() => {
+    if (ac.signal.aborted) {
+      cancelBody?.();
+      await dispatcher?.destroy().catch(() => {
+      });
+    } else await dispatcher?.close().catch(() => {
     });
   }
 }
 function raceWithAbort(operation, signal) {
-  throwIfSignalAborted(signal);
   return new Promise((resolve, reject) => {
-    const onAbort = () => reject(signalAbortError(signal));
-    signal.addEventListener("abort", onAbort, { once: true });
-    operation.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+      cleanup();
+      reject(signalAbortError(signal));
+    };
+    operation.then(
+      (value) => {
+        cleanup();
+        resolve(value);
+      },
+      (error) => {
+        cleanup();
+        reject(error);
+      }
+    );
+    if (signal.aborted) onAbort();
+    else signal.addEventListener("abort", onAbort, { once: true });
   });
 }
 function signalAbortError(signal) {

package/dist/lib/registry/index.d.mts

@@ -1,3 +1,4 @@
+import type { SupplyPathRequest, RegistrySupplyPathResult } from '../supply-path/types.mjs';
 import type { ResolvedBrand, LookupBrandOptions, ResolvedProperty, RegistryClientConfig, SaveBrandRequest, SaveBrandResponse, ListBrandLogosOptions, ListBrandLogosResponse, SaveBrandLogoInput, SaveBrandLogoResponse, UploadBrandLogoInput, UploadBrandLogoResponse, SavePropertyRequest, SavePropertyResponse, ResolveIdentifiersRequest, ResolveIdentifiersResponse, FileCatalogDisputeRequest, FileCatalogDisputeResponse, GetCatalogDisputeResponse, ClaimHostedPropertyDomainResponse, VerifyHostedPropertyOriginResponse, PropertyRegistryItem, ValidationResult, DomainLookupResult, ListBrandsOptions, ListBrandsResponse, GetBrandJsonResponse, ListOptions, ListAgentsOptions, ListAgentsResponse, ListPublishersResponse, ValidateAdagentsResponse, CreateAdagentsRequest, CreateAdagentsResponse, CommunityMirrorAdagentsConfig, CreateCommunityMirrorAdagentsConfig, CommunityMirrorAdagentsCatalog, PublishCommunityMirrorAdagentsResponse, ListCommunityMirrorAdagentsResponse, DeleteCommunityMirrorAdagentsResponse, PublisherPropertySelector, FindCompanyResult, FeedQuery, FeedResponse, AgentSearchQuery, AgentSearchResponse, CrawlRequestResponse, ManagerRevalidationResponse, ListPoliciesQuery, ListPoliciesResponse, ResolvePolicyQuery, ResolvePolicyResponse, ResolvePoliciesBulkRequest, ResolvePoliciesBulkResponse, GetPolicyHistoryQuery, GetPolicyHistoryResponse, SavePolicyRequest, SavePolicyResponse, GetBrandHistoryQuery, GetBrandHistoryResponse, GetPropertyHistoryQuery, GetPropertyHistoryResponse, AgentComplianceDetail, OperatorLookupResult, PublisherLookupResult, GetAgentStoryboardStatusResponse, GetAgentStoryboardStatusBulkResponse } from './types.mjs';
 import type { FeedStreamQuery, FeedStreamMessage } from './feed-stream.mjs';
 export type { ResolvedBrand, LookupBrandOptions, ResolvedProperty, PropertyInfo, RegistryClientConfig, SaveBrandRequest, SaveBrandResponse, BrandLogoReviewStatus, ApprovedBrandLogoAsset, PendingBrandLogoAsset, ReviewedBrandLogoAsset, BrandLogoAsset, ListBrandLogosOptions, ListBrandLogosResponse, SaveBrandLogoInput, SaveBrandLogoResponse, UploadBrandLogoInput, UploadBrandLogoResponse, SavePropertyIdentity, RegistryPropertyIdentity, SavePropertyRequest, SavePropertyResponse, ResolveIdentifiersRequest, ResolveIdentifiersResponse, FileCatalogDisputeRequest, FileCatalogDisputeResponse, GetCatalogDisputeResponse, ClaimHostedPropertyDomainResponse, VerifyHostedPropertyOriginResponse, BrandRegistryItem, PropertyRegistryItem, ValidationResult, FederatedAgentWithDetails, FederatedPublisher, DomainLookupResult, ListBrandsOptions, ListBrandsResponse, GetBrandJsonResponse, ListOptions, ListAgentsOptions, ListAgentsResponse, ListPublishersResponse, ValidateAdagentsRequest, ValidateAdagentsResponse, CreateAdagentsRequest, CreateAdagentsResponse, AdagentsAuthorizedAgent, AdagentsCatalogFormat, AdagentsPlacementDefinition, AdagentsPlacementFormatReference, AdagentsPlacementFormatOption, AdagentsPlacementTag, CreatedAdagentsJson, CommunityMirrorAdagentsConfig, CreateCommunityMirrorAdagentsConfig, CommunityMirrorAdagentsCatalog, PublishCommunityMirrorAdagentsResponse, CommunityMirrorAdagentsSummary, ListCommunityMirrorAdagentsResponse, GetCommunityMirrorAdagentsResponse, PublishCommunityMirrorAdagentsRequest, PublishCommunityMirrorAdagentsError, DeleteCommunityMirrorAdagentsResponse, ValidateProductAuthorizationRequest, ExpandProductIdentifiersRequest, PublisherPropertySelector, CompanySearchResult, FindCompanyResult, FeedQuery, AgentSearchQuery, CrawlRequest, ManagerRevalidationRequest, ManagerRevalidationResponse, ListPoliciesQuery, ListPoliciesResponse, ResolvePolicyQuery, ResolvePolicyResponse, ResolvePoliciesBulkRequest, ResolvePoliciesBulkResponse, GetPolicyHistoryQuery, GetPolicyHistoryResponse, SavePolicyRequest, SavePolicyResponse, GetBrandHistoryQuery, GetBrandHistoryResponse, GetPropertyHistoryQuery, GetPropertyHistoryResponse, AgentComplianceDetail, StoryboardStatus, OperatorLookupResult, PublisherLookupResult, ComplianceChangedPayload, GetAgentStoryboardStatusResponse, GetAgentStoryboardStatusBulkResponse, } from './types.mjs';
@@ -251,6 +252,8 @@ export declare class RegistryClient {
         authorized: boolean;
         checked_at: string;
     }>;
+    /** Cached registry verdict. Fetch authoritative evidence for enforcement. */
+    verifySupplyPath(request: SupplyPathRequest): Promise<RegistrySupplyPathResult>;
     /** Validate product authorization for an agent across publisher properties. */
     validateProductAuthorization(agentUrl: string, publisherProperties: PublisherPropertySelector[]): Promise<Record<string, unknown>>;
     /** Expand product identifiers for an agent across publisher properties. */

package/dist/lib/registry/index.d.ts

@@ -1,3 +1,4 @@
+import type { SupplyPathRequest, RegistrySupplyPathResult } from '../supply-path/types';
 import type { ResolvedBrand, LookupBrandOptions, ResolvedProperty, RegistryClientConfig, SaveBrandRequest, SaveBrandResponse, ListBrandLogosOptions, ListBrandLogosResponse, SaveBrandLogoInput, SaveBrandLogoResponse, UploadBrandLogoInput, UploadBrandLogoResponse, SavePropertyRequest, SavePropertyResponse, ResolveIdentifiersRequest, ResolveIdentifiersResponse, FileCatalogDisputeRequest, FileCatalogDisputeResponse, GetCatalogDisputeResponse, ClaimHostedPropertyDomainResponse, VerifyHostedPropertyOriginResponse, PropertyRegistryItem, ValidationResult, DomainLookupResult, ListBrandsOptions, ListBrandsResponse, GetBrandJsonResponse, ListOptions, ListAgentsOptions, ListAgentsResponse, ListPublishersResponse, ValidateAdagentsResponse, CreateAdagentsRequest, CreateAdagentsResponse, CommunityMirrorAdagentsConfig, CreateCommunityMirrorAdagentsConfig, CommunityMirrorAdagentsCatalog, PublishCommunityMirrorAdagentsResponse, ListCommunityMirrorAdagentsResponse, DeleteCommunityMirrorAdagentsResponse, PublisherPropertySelector, FindCompanyResult, FeedQuery, FeedResponse, AgentSearchQuery, AgentSearchResponse, CrawlRequestResponse, ManagerRevalidationResponse, ListPoliciesQuery, ListPoliciesResponse, ResolvePolicyQuery, ResolvePolicyResponse, ResolvePoliciesBulkRequest, ResolvePoliciesBulkResponse, GetPolicyHistoryQuery, GetPolicyHistoryResponse, SavePolicyRequest, SavePolicyResponse, GetBrandHistoryQuery, GetBrandHistoryResponse, GetPropertyHistoryQuery, GetPropertyHistoryResponse, AgentComplianceDetail, OperatorLookupResult, PublisherLookupResult, GetAgentStoryboardStatusResponse, GetAgentStoryboardStatusBulkResponse } from './types';
 import type { FeedStreamQuery, FeedStreamMessage } from './feed-stream';
 export type { ResolvedBrand, LookupBrandOptions, ResolvedProperty, PropertyInfo, RegistryClientConfig, SaveBrandRequest, SaveBrandResponse, BrandLogoReviewStatus, ApprovedBrandLogoAsset, PendingBrandLogoAsset, ReviewedBrandLogoAsset, BrandLogoAsset, ListBrandLogosOptions, ListBrandLogosResponse, SaveBrandLogoInput, SaveBrandLogoResponse, UploadBrandLogoInput, UploadBrandLogoResponse, SavePropertyIdentity, RegistryPropertyIdentity, SavePropertyRequest, SavePropertyResponse, ResolveIdentifiersRequest, ResolveIdentifiersResponse, FileCatalogDisputeRequest, FileCatalogDisputeResponse, GetCatalogDisputeResponse, ClaimHostedPropertyDomainResponse, VerifyHostedPropertyOriginResponse, BrandRegistryItem, PropertyRegistryItem, ValidationResult, FederatedAgentWithDetails, FederatedPublisher, DomainLookupResult, ListBrandsOptions, ListBrandsResponse, GetBrandJsonResponse, ListOptions, ListAgentsOptions, ListAgentsResponse, ListPublishersResponse, ValidateAdagentsRequest, ValidateAdagentsResponse, CreateAdagentsRequest, CreateAdagentsResponse, AdagentsAuthorizedAgent, AdagentsCatalogFormat, AdagentsPlacementDefinition, AdagentsPlacementFormatReference, AdagentsPlacementFormatOption, AdagentsPlacementTag, CreatedAdagentsJson, CommunityMirrorAdagentsConfig, CreateCommunityMirrorAdagentsConfig, CommunityMirrorAdagentsCatalog, PublishCommunityMirrorAdagentsResponse, CommunityMirrorAdagentsSummary, ListCommunityMirrorAdagentsResponse, GetCommunityMirrorAdagentsResponse, PublishCommunityMirrorAdagentsRequest, PublishCommunityMirrorAdagentsError, DeleteCommunityMirrorAdagentsResponse, ValidateProductAuthorizationRequest, ExpandProductIdentifiersRequest, PublisherPropertySelector, CompanySearchResult, FindCompanyResult, FeedQuery, AgentSearchQuery, CrawlRequest, ManagerRevalidationRequest, ManagerRevalidationResponse, ListPoliciesQuery, ListPoliciesResponse, ResolvePolicyQuery, ResolvePolicyResponse, ResolvePoliciesBulkRequest, ResolvePoliciesBulkResponse, GetPolicyHistoryQuery, GetPolicyHistoryResponse, SavePolicyRequest, SavePolicyResponse, GetBrandHistoryQuery, GetBrandHistoryResponse, GetPropertyHistoryQuery, GetPropertyHistoryResponse, AgentComplianceDetail, StoryboardStatus, OperatorLookupResult, PublisherLookupResult, ComplianceChangedPayload, GetAgentStoryboardStatusResponse, GetAgentStoryboardStatusBulkResponse, } from './types';
@@ -251,6 +252,8 @@ export declare class RegistryClient {
         authorized: boolean;
         checked_at: string;
     }>;
+    /** Cached registry verdict. Fetch authoritative evidence for enforcement. */
+    verifySupplyPath(request: SupplyPathRequest): Promise<RegistrySupplyPathResult>;
     /** Validate product authorization for an agent across publisher properties. */
     validateProductAuthorization(agentUrl: string, publisherProperties: PublisherPropertySelector[]): Promise<Record<string, unknown>>;
     /** Expand product identifiers for an agent across publisher properties. */

package/dist/lib/registry/index.js

@@ -37,6 +37,7 @@ __export(registry_exports, {
   sanitizeStreamText: () => import_feed_stream2.sanitizeStreamText
 });
 module.exports = __toCommonJS(registry_exports);
+var import_validation = require('../supply-path/validation.js');
 var import_feed_stream = require('./feed-stream.js');
 var import_sync = require('./sync.js');
 var import_feed_stream2 = require('./feed-stream.js');
@@ -548,6 +549,13 @@ class RegistryClient {
     });
     return this.get(`${this.baseUrl}/api/registry/validate/property-authorization?${params}`);
   }
+  /** Cached registry verdict. Fetch authoritative evidence for enforcement. */
+  async verifySupplyPath(request) {
+    const normalized = (0, import_validation.validateSupplyPathRequest)(request);
+    const response = await this.post(`${this.baseUrl}/api/registry/verify/supply-path`, normalized);
+    (0, import_validation.assertRegistrySupplyPathResult)(response, normalized);
+    return response;
+  }
   /** Validate product authorization for an agent across publisher properties. */
   async validateProductAuthorization(agentUrl, publisherProperties) {
     return this.post(`${this.baseUrl}/api/registry/validate/product-authorization`, {

package/dist/lib/registry/index.mjs

@@ -1,3 +1,4 @@
+import { validateSupplyPathRequest, assertRegistrySupplyPathResult } from "../supply-path/validation.mjs";
 import { openFeedStream } from "./feed-stream.mjs";
 import { RegistrySync } from "./sync.mjs";
 import {
@@ -519,6 +520,13 @@ class RegistryClient {
     });
     return this.get(`${this.baseUrl}/api/registry/validate/property-authorization?${params}`);
   }
+  /** Cached registry verdict. Fetch authoritative evidence for enforcement. */
+  async verifySupplyPath(request) {
+    const normalized = validateSupplyPathRequest(request);
+    const response = await this.post(`${this.baseUrl}/api/registry/verify/supply-path`, normalized);
+    assertRegistrySupplyPathResult(response, normalized);
+    return response;
+  }
   /** Validate product authorization for an agent across publisher properties. */
   async validateProductAuthorization(agentUrl, publisherProperties) {
     return this.post(`${this.baseUrl}/api/registry/validate/product-authorization`, {

package/dist/lib/registry/types.d.mts

@@ -169,7 +169,8 @@ type RegistryCreateAdagentsRequest = NonNullable<operations['createAdagents']['r
 /** Response from POST /api/adagents/create (200) */
 type RegistryCreateAdagentsResponse = operations['createAdagents']['responses']['200']['content']['application/json'];
 /** Agent authorization entry accepted by the registry adagents.json generator. */
-export type AdagentsAuthorizedAgent = RegistryCreateAdagentsRequest['authorized_agents'][number] & {
+export type AdagentsAuthorizedAgent = Omit<RegistryCreateAdagentsRequest['authorized_agents'][number], 'collections'> & {
+    collections?: import('../discovery/types.mjs').AuthorizationCollectionSelector[];
     [key: string]: unknown;
 };
 /**

package/dist/lib/registry/types.d.ts

@@ -169,7 +169,8 @@ type RegistryCreateAdagentsRequest = NonNullable<operations['createAdagents']['r
 /** Response from POST /api/adagents/create (200) */
 type RegistryCreateAdagentsResponse = operations['createAdagents']['responses']['200']['content']['application/json'];
 /** Agent authorization entry accepted by the registry adagents.json generator. */
-export type AdagentsAuthorizedAgent = RegistryCreateAdagentsRequest['authorized_agents'][number] & {
+export type AdagentsAuthorizedAgent = Omit<RegistryCreateAdagentsRequest['authorized_agents'][number], 'collections'> & {
+    collections?: import('../discovery/types').AuthorizationCollectionSelector[];
     [key: string]: unknown;
 };
 /**

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-09-18T20:08:01.998Z"
+  "synced_at": "2026-09-19T13:45:09.361Z"
 }

package/dist/lib/supply-path/evaluate.d.mts

@@ -0,0 +1,17 @@
+import type { SupplyPathInput, SupplyPathVerdict } from './types.mjs';
+export declare const SUPPLY_PATH_STATES: readonly ["unverified", "owner_attested", "host_delegated", "verified_owner_sold"];
+export declare function parseInventoryPartnerDomains(content: string): string[];
+export declare function isUnqualifiedPropertySelector(value: unknown): boolean;
+/** Reject predicates that conflict with the selector discriminator. */
+export declare function hasValidPropertySelectorPredicate(value: unknown): boolean;
+/** Internal fail-closed result used when preprocessing reaches the same evaluation budget. */
+export declare function evaluationLimitVerdict(): SupplyPathVerdict;
+export declare function evaluateSupplyPath(input: SupplyPathInput): SupplyPathVerdict;
+/** Choose applicable IAB files from the carried host properties, never from catalog channel identifiers. */
+export declare function supplyPathAdsTxtPolicy(input: SupplyPathInput): {
+    files: Array<'ads.txt' | 'app-ads.txt'>;
+    requireAll: boolean;
+};
+export declare function combineInventoryPartnerDomains(contents: Array<string | null>, requireAll: boolean): string[] | null;
+/** Select parsed IAB evidence for one complete path; called after bulk inquiry expansion. */
+export declare function inventoryPartnersForInput(input: SupplyPathInput): string[] | null;

package/dist/lib/supply-path/evaluate.d.ts

@@ -0,0 +1,17 @@
+import type { SupplyPathInput, SupplyPathVerdict } from './types';
+export declare const SUPPLY_PATH_STATES: readonly ["unverified", "owner_attested", "host_delegated", "verified_owner_sold"];
+export declare function parseInventoryPartnerDomains(content: string): string[];
+export declare function isUnqualifiedPropertySelector(value: unknown): boolean;
+/** Reject predicates that conflict with the selector discriminator. */
+export declare function hasValidPropertySelectorPredicate(value: unknown): boolean;
+/** Internal fail-closed result used when preprocessing reaches the same evaluation budget. */
+export declare function evaluationLimitVerdict(): SupplyPathVerdict;
+export declare function evaluateSupplyPath(input: SupplyPathInput): SupplyPathVerdict;
+/** Choose applicable IAB files from the carried host properties, never from catalog channel identifiers. */
+export declare function supplyPathAdsTxtPolicy(input: SupplyPathInput): {
+    files: Array<'ads.txt' | 'app-ads.txt'>;
+    requireAll: boolean;
+};
+export declare function combineInventoryPartnerDomains(contents: Array<string | null>, requireAll: boolean): string[] | null;
+/** Select parsed IAB evidence for one complete path; called after bulk inquiry expansion. */
+export declare function inventoryPartnersForInput(input: SupplyPathInput): string[] | null;