@adcp/sdk 14.0.0 → 14.1.0

package/dist/lib/governance/authorization.js

@@ -28,6 +28,7 @@ __export(authorization_exports, {
   buildGovernanceIntentRequest: () => buildGovernanceIntentRequest,
   buildGovernanceProposedCommitment: () => buildGovernanceProposedCommitment,
   computeGovernedPayloadHash: () => computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver: () => createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware: () => createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks: () => getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask: () => governancePurchaseTypeForTask,
@@ -40,6 +41,8 @@ module.exports = __toCommonJS(authorization_exports);
 var import_node_crypto = require("node:crypto");
 var import_jose = require("jose");
 var import_jcs = require('../utils/jcs.js');
+var import_jwks_https = require('../signing/jwks-https.js');
+var import_select_agent = require('../signing/agent-resolver/select-agent.js');
 var import_strict_json = require('../signing/agent-resolver/strict-json.js');
 const GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS = Object.freeze([
   "authorized_commitment",
@@ -99,6 +102,42 @@ class InMemoryGovernanceReplayStore {
     return scope;
   }
 }
+const governanceDefaultResolvers = /* @__PURE__ */ new Map();
+const governanceConfiguredResolvers = /* @__PURE__ */ new WeakMap();
+function createGovernanceAgentJwksResolver(issuer, buyer) {
+  const record = (0, import_select_agent.relyingPartyAgentRecord)(buyer.brandJson, buyer.brandDomain);
+  const entry = (0, import_select_agent.selectAgentByUrl)(record, issuer, { agentType: "governance" });
+  const uri = (0, import_select_agent.agentJwksUri)(entry);
+  if (buyer.jwksForUri) return buyer.jwksForUri(uri);
+  const key = (0, import_select_agent.canonicalAgentUrl)(uri);
+  let cache = governanceDefaultResolvers;
+  if (buyer.jwksOptions) {
+    const existing = governanceConfiguredResolvers.get(buyer.jwksOptions);
+    cache = existing ?? /* @__PURE__ */ new Map();
+    if (!existing) governanceConfiguredResolvers.set(buyer.jwksOptions, cache);
+  }
+  let resolver = cache.get(key);
+  if (!resolver) {
+    const maxAge = buyer.jwksOptions?.maxAgeSeconds ?? 1800;
+    const minCooldown = buyer.jwksOptions?.minCooldownSeconds ?? 30;
+    if (!Number.isFinite(maxAge) || maxAge <= 0) {
+      throw new TypeError("Governance maxAgeSeconds must be a finite positive number");
+    }
+    if (!Number.isFinite(minCooldown) || minCooldown < 0) {
+      throw new TypeError("Governance minCooldownSeconds must be a finite non-negative number");
+    }
+    resolver = new import_jwks_https.HttpsJwksResolver(uri, {
+      ...buyer.jwksOptions,
+      maxAgeSeconds: Math.min(maxAge, 1800),
+      minCooldownSeconds: Math.max(minCooldown, 30),
+      minCacheAgeSeconds: 60,
+      failClosed: true
+    });
+    if (cache.size >= 512) cache.delete(cache.keys().next().value);
+    cache.set(key, resolver);
+  }
+  return resolver;
+}
 function buildGovernanceCommitment(amount, currency) {
   if (!Number.isFinite(amount) || amount < 0) {
     throw new TypeError("Governance commitment amount must be finite and non-negative");
@@ -300,14 +339,21 @@ async function verifyGovernanceAuthorization(options) {
   if (decodedClaims.authorized_task === void 0 !== (decodedClaims.authorized_payload_hash === void 0)) {
     return reject("governance_token_invalid", "authorized_task and authorized_payload_hash must appear together");
   }
-  if (typeof decodedClaims.iss !== "string" || decodedClaims.iss !== options.expectedIssuer) {
+  let canonicalIssuer;
+  try {
+    if (typeof decodedClaims.iss !== "string") throw new TypeError("Missing issuer");
+    canonicalIssuer = (0, import_select_agent.canonicalAgentUrl)(decodedClaims.iss);
+    if (canonicalIssuer !== (0, import_select_agent.canonicalAgentUrl)(options.expectedIssuer)) throw new TypeError("Issuer mismatch");
+  } catch {
     return reject("governance_token_invalid", "Governance token issuer mismatch");
   }
   const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
   if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
   let jwk;
   try {
-    jwk = await options.jwks.resolve(kid);
+    const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
+    if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
+    jwk = await resolver.resolve(kid);
   } catch {
     return reject("governance_key_unknown", "Governance signing key could not be resolved");
   }
@@ -331,7 +377,7 @@ async function verifyGovernanceAuthorization(options) {
     if (options.revocationStore && await options.revocationStore.isRevoked(kid)) {
       return reject("governance_token_revoked", "Governance signing key is revoked");
     }
-    if (options.isJtiRevoked && typeof decodedClaims.jti === "string" && await options.isJtiRevoked(decodedClaims.iss, decodedClaims.jti)) {
+    if (options.isJtiRevoked && typeof decodedClaims.jti === "string" && await options.isJtiRevoked(canonicalIssuer, decodedClaims.jti)) {
       return reject("governance_token_revoked", "Governance token is revoked");
     }
   } catch {
@@ -401,8 +447,8 @@ async function verifyGovernanceAuthorization(options) {
   let hasFreshCombinedRevocation = false;
   if (options.revocationResolver) {
     try {
-      const status = await options.revocationResolver.resolve(decodedClaims.iss, kid, decodedClaims.jti);
-      if (status.issuer !== decodedClaims.iss || typeof status.keyRevoked !== "boolean" || typeof status.jtiRevoked !== "boolean" || !Number.isFinite(status.nextUpdate) || status.nextUpdate < now) {
+      const status = await options.revocationResolver.resolve(canonicalIssuer, kid, decodedClaims.jti);
+      if ((0, import_select_agent.canonicalAgentUrl)(status.issuer) !== canonicalIssuer || typeof status.keyRevoked !== "boolean" || typeof status.jtiRevoked !== "boolean" || !Number.isFinite(status.nextUpdate) || status.nextUpdate < now) {
         return reject("governance_token_revoked", "Governance revocation status is stale or mismatched");
       }
       if (status.keyRevoked || status.jtiRevoked) {
@@ -455,7 +501,7 @@ async function verifyGovernanceAuthorization(options) {
   try {
     const idempotencyKey = typeof options.payload.idempotency_key === "string" ? options.payload.idempotency_key : void 0;
     replayResult = await options.replayStore.consume(
-      decodedClaims.iss,
+      canonicalIssuer,
       decodedClaims.aud,
       decodedClaims.jti,
       decodedClaims.exp + skew,
@@ -500,7 +546,8 @@ function createGovernanceEnforcementMiddleware(config) {
       expectedTask: input.task,
       payload: input.payload,
       actualCommitment: input.actualCommitment,
-      expectedPhase: input.expectedPhase
+      expectedPhase: input.expectedPhase,
+      ...input.buyerIdentity !== void 0 && { buyerIdentity: input.buyerIdentity }
     });
     if (!result.ok) throw new GovernanceAuthorizationError(result);
     return next(result);
@@ -531,6 +578,7 @@ function decodeJsonObject(segment) {
   buildGovernanceIntentRequest,
   buildGovernanceProposedCommitment,
   computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask,

package/dist/lib/governance/authorization.mjs

@@ -1,6 +1,13 @@
 import { createHash } from "node:crypto";
 import { compactVerify, importJWK } from "jose";
 import { canonicalize } from "../utils/jcs.mjs";
+import { HttpsJwksResolver } from "../signing/jwks-https.mjs";
+import {
+  relyingPartyAgentRecord,
+  selectAgentByUrl,
+  agentJwksUri,
+  canonicalAgentUrl
+} from "../signing/agent-resolver/select-agent.mjs";
 import { parseStrictJson } from "../signing/agent-resolver/strict-json.mjs";
 const GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS = Object.freeze([
   "authorized_commitment",
@@ -60,6 +67,42 @@ class InMemoryGovernanceReplayStore {
     return scope;
   }
 }
+const governanceDefaultResolvers = /* @__PURE__ */ new Map();
+const governanceConfiguredResolvers = /* @__PURE__ */ new WeakMap();
+function createGovernanceAgentJwksResolver(issuer, buyer) {
+  const record = relyingPartyAgentRecord(buyer.brandJson, buyer.brandDomain);
+  const entry = selectAgentByUrl(record, issuer, { agentType: "governance" });
+  const uri = agentJwksUri(entry);
+  if (buyer.jwksForUri) return buyer.jwksForUri(uri);
+  const key = canonicalAgentUrl(uri);
+  let cache = governanceDefaultResolvers;
+  if (buyer.jwksOptions) {
+    const existing = governanceConfiguredResolvers.get(buyer.jwksOptions);
+    cache = existing ?? /* @__PURE__ */ new Map();
+    if (!existing) governanceConfiguredResolvers.set(buyer.jwksOptions, cache);
+  }
+  let resolver = cache.get(key);
+  if (!resolver) {
+    const maxAge = buyer.jwksOptions?.maxAgeSeconds ?? 1800;
+    const minCooldown = buyer.jwksOptions?.minCooldownSeconds ?? 30;
+    if (!Number.isFinite(maxAge) || maxAge <= 0) {
+      throw new TypeError("Governance maxAgeSeconds must be a finite positive number");
+    }
+    if (!Number.isFinite(minCooldown) || minCooldown < 0) {
+      throw new TypeError("Governance minCooldownSeconds must be a finite non-negative number");
+    }
+    resolver = new HttpsJwksResolver(uri, {
+      ...buyer.jwksOptions,
+      maxAgeSeconds: Math.min(maxAge, 1800),
+      minCooldownSeconds: Math.max(minCooldown, 30),
+      minCacheAgeSeconds: 60,
+      failClosed: true
+    });
+    if (cache.size >= 512) cache.delete(cache.keys().next().value);
+    cache.set(key, resolver);
+  }
+  return resolver;
+}
 function buildGovernanceCommitment(amount, currency) {
   if (!Number.isFinite(amount) || amount < 0) {
     throw new TypeError("Governance commitment amount must be finite and non-negative");
@@ -261,14 +304,21 @@ async function verifyGovernanceAuthorization(options) {
   if (decodedClaims.authorized_task === void 0 !== (decodedClaims.authorized_payload_hash === void 0)) {
     return reject("governance_token_invalid", "authorized_task and authorized_payload_hash must appear together");
   }
-  if (typeof decodedClaims.iss !== "string" || decodedClaims.iss !== options.expectedIssuer) {
+  let canonicalIssuer;
+  try {
+    if (typeof decodedClaims.iss !== "string") throw new TypeError("Missing issuer");
+    canonicalIssuer = canonicalAgentUrl(decodedClaims.iss);
+    if (canonicalIssuer !== canonicalAgentUrl(options.expectedIssuer)) throw new TypeError("Issuer mismatch");
+  } catch {
     return reject("governance_token_invalid", "Governance token issuer mismatch");
   }
   const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
   if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
   let jwk;
   try {
-    jwk = await options.jwks.resolve(kid);
+    const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
+    if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
+    jwk = await resolver.resolve(kid);
   } catch {
     return reject("governance_key_unknown", "Governance signing key could not be resolved");
   }
@@ -292,7 +342,7 @@ async function verifyGovernanceAuthorization(options) {
     if (options.revocationStore && await options.revocationStore.isRevoked(kid)) {
       return reject("governance_token_revoked", "Governance signing key is revoked");
     }
-    if (options.isJtiRevoked && typeof decodedClaims.jti === "string" && await options.isJtiRevoked(decodedClaims.iss, decodedClaims.jti)) {
+    if (options.isJtiRevoked && typeof decodedClaims.jti === "string" && await options.isJtiRevoked(canonicalIssuer, decodedClaims.jti)) {
       return reject("governance_token_revoked", "Governance token is revoked");
     }
   } catch {
@@ -362,8 +412,8 @@ async function verifyGovernanceAuthorization(options) {
   let hasFreshCombinedRevocation = false;
   if (options.revocationResolver) {
     try {
-      const status = await options.revocationResolver.resolve(decodedClaims.iss, kid, decodedClaims.jti);
-      if (status.issuer !== decodedClaims.iss || typeof status.keyRevoked !== "boolean" || typeof status.jtiRevoked !== "boolean" || !Number.isFinite(status.nextUpdate) || status.nextUpdate < now) {
+      const status = await options.revocationResolver.resolve(canonicalIssuer, kid, decodedClaims.jti);
+      if (canonicalAgentUrl(status.issuer) !== canonicalIssuer || typeof status.keyRevoked !== "boolean" || typeof status.jtiRevoked !== "boolean" || !Number.isFinite(status.nextUpdate) || status.nextUpdate < now) {
         return reject("governance_token_revoked", "Governance revocation status is stale or mismatched");
       }
       if (status.keyRevoked || status.jtiRevoked) {
@@ -416,7 +466,7 @@ async function verifyGovernanceAuthorization(options) {
   try {
     const idempotencyKey = typeof options.payload.idempotency_key === "string" ? options.payload.idempotency_key : void 0;
     replayResult = await options.replayStore.consume(
-      decodedClaims.iss,
+      canonicalIssuer,
       decodedClaims.aud,
       decodedClaims.jti,
       decodedClaims.exp + skew,
@@ -461,7 +511,8 @@ function createGovernanceEnforcementMiddleware(config) {
       expectedTask: input.task,
       payload: input.payload,
       actualCommitment: input.actualCommitment,
-      expectedPhase: input.expectedPhase
+      expectedPhase: input.expectedPhase,
+      ...input.buyerIdentity !== void 0 && { buyerIdentity: input.buyerIdentity }
     });
     if (!result.ok) throw new GovernanceAuthorizationError(result);
     return next(result);
@@ -491,6 +542,7 @@ export {
   buildGovernanceIntentRequest,
   buildGovernanceProposedCommitment,
   computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask,

package/dist/lib/governance/index.d.mts

@@ -13,8 +13,8 @@
  * advisory — the authoritative check happens in the governance agent, which
  * resolves category synonyms and custom policies server-side.
  */
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, } from './authorization.mjs';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, } from './authorization.mjs';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from './authorization.mjs';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './authorization.mjs';
 /**
  * `policy_categories` values that MUST set `human_review_required: true`
  * under GDPR Art 22 / EU AI Act Annex III. Matches the schema's `if/then`

package/dist/lib/governance/index.d.ts

@@ -13,8 +13,8 @@
  * advisory — the authoritative check happens in the governance agent, which
  * resolves category synonyms and custom policies server-side.
  */
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, } from './authorization';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, } from './authorization';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from './authorization';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './authorization';
 /**
  * `policy_categories` values that MUST set `human_review_required: true`
  * under GDPR Art 22 / EU AI Act Annex III. Matches the schema's `if/then`

package/dist/lib/governance/index.js

@@ -32,6 +32,7 @@ __export(governance_exports, {
   buildHumanOverride: () => buildHumanOverride,
   buildHumanReviewPlan: () => buildHumanReviewPlan,
   computeGovernedPayloadHash: () => import_authorization.computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver: () => import_authorization.createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware: () => import_authorization.createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks: () => import_authorization.getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask: () => import_authorization.governancePurchaseTypeForTask,
@@ -156,6 +157,7 @@ function validateGovernancePlan(plan) {
   buildHumanOverride,
   buildHumanReviewPlan,
   computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask,

package/dist/lib/governance/index.mjs

@@ -15,7 +15,8 @@ import {
   governanceTaskRequiresProposedCommitment,
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
-  verifyGovernanceAuthorization
+  verifyGovernanceAuthorization,
+  createGovernanceAgentJwksResolver
 } from "./authorization.mjs";
 const REGULATED_HUMAN_REVIEW_CATEGORIES = Object.freeze([
   "fair_housing",
@@ -129,6 +130,7 @@ export {
   buildHumanOverride,
   buildHumanReviewPlan,
   computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask,

package/dist/lib/index.d.mts

@@ -37,12 +37,12 @@ export type { GovernanceConfig, CampaignGovernanceConfig, GovernanceCheckResult,
 export { GovernanceMiddleware } from './core/GovernanceMiddleware.mjs';
 export { isGovernanceApproved, isGovernanceConditions, isGovernanceDenied, normalizeGovernanceVerdict, } from './core/GovernanceTypes.mjs';
 export type { GovernanceDebugEntry } from './core/GovernanceMiddleware.mjs';
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, buildHumanReviewPlan, buildHumanOverride, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, validateGovernancePlan, verifyGovernanceAuthorization, REGULATED_HUMAN_REVIEW_CATEGORIES, ANNEX_III_POLICY_IDS, } from './governance/index.mjs';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, buildHumanReviewPlan, buildHumanOverride, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, validateGovernancePlan, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, REGULATED_HUMAN_REVIEW_CATEGORIES, ANNEX_III_POLICY_IDS, } from './governance/index.mjs';
 export { ssrfSafeFetch, decodeBodyAsJsonOrText, SSRF_TRANSIENT_CODES, SsrfRefusedError, isPrivateIp, isAlwaysBlocked, isLikelyPrivateUrl, type SsrfRefusedCode, type SsrfDnsLookup, type SsrfFetchOptions, type SsrfFetchResult, } from './net/index.mjs';
 export { createCanonicalReferenceCache, createCanonicalReferenceResolver, canonicalReferenceCacheKey, resolveCanonicalReference, resolveFormatSchemaReference, resolvePlatformExtensionsReference, type CanonicalReference, type CanonicalReferenceCache, type CanonicalReferenceCacheOptions, type CanonicalReferenceError, type CanonicalReferenceErrorCode, type CanonicalReferenceFailureResult, type CanonicalReferenceKind, type CanonicalReferenceResolveOptions, type CanonicalReferenceResolvedResult, type CanonicalReferenceResolver, type CanonicalReferenceResolverOptions, type CanonicalReferenceResult, type CanonicalReferenceStatus, type ExternalRefDigestMap, type FormatSchemaReferenceResolvedResult, type FormatSchemaReferenceResult, type PlatformExtensionsReferenceResult, } from './canonical-references/index.mjs';
 export { assessAcceptancePolicy, createAcceptancePolicyCatalogResolver, resolveAcceptancePolicyCatalog, resolveAcceptancePolicyProfiles, resolveVerifiedAcceptancePolicyProfiles, type AcceptancePolicyCatalog, type AcceptancePolicyCatalogErrorCode, type AcceptancePolicyCatalogFailure, type AcceptancePolicyCatalogIssue, type AcceptancePolicyCatalogResolver, type AcceptancePolicyCatalogResult, type AcceptancePolicyCatalogSuccess, type AcceptancePolicyDiscoveryCapability, type AcceptancePolicyProfile, type AcceptancePolicyProfileResolution, type AcceptancePolicyRegistryPolicy, type AcceptancePolicyRegistryResolver, type AcceptancePolicyReference, type AcceptancePolicyRequirement, type AcceptancePolicyRule, type AcceptancePolicySurface, type RegistryAcceptancePolicyProfileReference, type ResolveAcceptancePolicyCatalogOptions, type ResolveVerifiedAcceptancePolicyProfilesOptions, type ResolvedAcceptancePolicyDefault, type VerifiedAcceptancePolicyProfilesResult, type VerifiedAcceptancePolicyProfilesSuccess, } from './acceptance-policy/index.mjs';
 export { type AcceptancePolicyAssessment, type AcceptancePolicyAssessmentDiagnostic, type AcceptancePolicyAssessmentDiagnosticCode, type AcceptancePolicyMatchedRule, type AcceptancePolicyOutcome, type AssessAcceptancePolicyInput, } from './acceptance-policy/evaluator.mjs';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, } from './governance/index.mjs';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './governance/index.mjs';
 export type { BaseTaskEvent, ProtocolRequestEvent, ProtocolResponseEvent, TaskStatusEvent, ObjectEvent, TaskEvent, TaskEventCallbacks, } from './core/TaskEventTypes.mjs';
 export { createOperationId } from './core/TaskEventTypes.mjs';
 export type { AsyncHandlerConfig, WebhookMetadata, Activity, NotificationMetadata, MediaBuyDeliveryNotification, CreateMediaBuyStatusChangeHandler, UpdateMediaBuyStatusChangeHandler, SyncCreativesStatusChangeHandler, GetProductsStatusChangeHandler, ListProductsStatusChangeHandler, } from './core/AsyncHandler.mjs';
@@ -53,7 +53,7 @@ export * from './handlers/types.mjs';
 export type { Storage, AtomicTakeStorage, DeferredTaskStorage, BatchStorage, PatternStorage, AgentCapabilities, ConversationState, DeferredTaskState, StorageConfig, StorageFactory, StorageMiddleware, } from './storage/interfaces.mjs';
 export { MemoryStorage, createMemoryStorage, createMemoryStorageConfig } from './storage/MemoryStorage.mjs';
 export { ADCPError, TaskTimeoutError, MaxClarificationError, DeferredTaskError, TaskAbortedError, AgentNotFoundError, UnsupportedTaskError, ProtocolError, ValidationError as ADCPValidationError, // Rename to avoid conflict
-MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors/index.mjs';
+MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, BuyerSetupError, AccountNotFoundError, AccountSetupRequiredError, AccountPaymentRequiredError, AccountNotProvisionedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors/index.mjs';
 export type { OAuthMetadataInfo, ClientPreflightAdcpErrorInfo, ClientPreflightAdcpErrorRecovery, FeatureUnsupportedErrorOptions, ProtocolFeatureUnsupportedErrorOptions, ActionNotAllowedErrorDetails, ActionNotAllowedReasonValue, ActionNotAllowedAttemptedAction, ActionNotAllowedAvailableAction, ActionNotAllowedRecovery, } from './errors/index.mjs';
 export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionId, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyUpdateFieldAction, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, StructuredOnlyMediaBuyAction, ResolvedTargetingInput, TargetingInputFor, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy/index.mjs';
 export { ACTIONS_BY_FIELD, LEGACY_COARSE_ACTIONS, STRUCTURED_ONLY_MEDIA_BUY_ACTIONS, UPDATE_FIELDS_BY_ACTION, applyTargetingInput, hasTargetingClears, resolveTargetingInput, canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, findAvailableAction, getActionForMutation, getAvailableActions, getRollupParent, ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, preflightUpdateMediaBuy, recoveryForModeMismatch, validateProductsAgainstPropertyPolicy, } from './media-buy/index.mjs';
@@ -272,3 +272,5 @@ export { mediaBuyActionResolver } from './server/media-buy-action-resolver.mjs';
 export type { SellerActionDecision, SellerActionResolutionOptions, SellerActionResolution, } from './server/media-buy-action-resolver.mjs';
 export * from './supply-path/index.mjs';
 export type { AuthorizationCollectionSelector, ProductCollectionSelector, CollectionDistribution, DiscoveryCollection, } from './discovery/types.mjs';
+export { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage, type BuyerAccountRegistryOptions, type EnsureAccountOptions, type ProvisionedAccount, } from './core/buyer-account-registry.mjs';
+export { createProductCache, ProductCache, type ProductCacheOptions } from './core/product-cache.mjs';

package/dist/lib/index.d.ts

@@ -37,12 +37,12 @@ export type { GovernanceConfig, CampaignGovernanceConfig, GovernanceCheckResult,
 export { GovernanceMiddleware } from './core/GovernanceMiddleware';
 export { isGovernanceApproved, isGovernanceConditions, isGovernanceDenied, normalizeGovernanceVerdict, } from './core/GovernanceTypes';
 export type { GovernanceDebugEntry } from './core/GovernanceMiddleware';
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, buildHumanReviewPlan, buildHumanOverride, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, validateGovernancePlan, verifyGovernanceAuthorization, REGULATED_HUMAN_REVIEW_CATEGORIES, ANNEX_III_POLICY_IDS, } from './governance';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, buildHumanReviewPlan, buildHumanOverride, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, validateGovernancePlan, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, REGULATED_HUMAN_REVIEW_CATEGORIES, ANNEX_III_POLICY_IDS, } from './governance';
 export { ssrfSafeFetch, decodeBodyAsJsonOrText, SSRF_TRANSIENT_CODES, SsrfRefusedError, isPrivateIp, isAlwaysBlocked, isLikelyPrivateUrl, type SsrfRefusedCode, type SsrfDnsLookup, type SsrfFetchOptions, type SsrfFetchResult, } from './net';
 export { createCanonicalReferenceCache, createCanonicalReferenceResolver, canonicalReferenceCacheKey, resolveCanonicalReference, resolveFormatSchemaReference, resolvePlatformExtensionsReference, type CanonicalReference, type CanonicalReferenceCache, type CanonicalReferenceCacheOptions, type CanonicalReferenceError, type CanonicalReferenceErrorCode, type CanonicalReferenceFailureResult, type CanonicalReferenceKind, type CanonicalReferenceResolveOptions, type CanonicalReferenceResolvedResult, type CanonicalReferenceResolver, type CanonicalReferenceResolverOptions, type CanonicalReferenceResult, type CanonicalReferenceStatus, type ExternalRefDigestMap, type FormatSchemaReferenceResolvedResult, type FormatSchemaReferenceResult, type PlatformExtensionsReferenceResult, } from './canonical-references';
 export { assessAcceptancePolicy, createAcceptancePolicyCatalogResolver, resolveAcceptancePolicyCatalog, resolveAcceptancePolicyProfiles, resolveVerifiedAcceptancePolicyProfiles, type AcceptancePolicyCatalog, type AcceptancePolicyCatalogErrorCode, type AcceptancePolicyCatalogFailure, type AcceptancePolicyCatalogIssue, type AcceptancePolicyCatalogResolver, type AcceptancePolicyCatalogResult, type AcceptancePolicyCatalogSuccess, type AcceptancePolicyDiscoveryCapability, type AcceptancePolicyProfile, type AcceptancePolicyProfileResolution, type AcceptancePolicyRegistryPolicy, type AcceptancePolicyRegistryResolver, type AcceptancePolicyReference, type AcceptancePolicyRequirement, type AcceptancePolicyRule, type AcceptancePolicySurface, type RegistryAcceptancePolicyProfileReference, type ResolveAcceptancePolicyCatalogOptions, type ResolveVerifiedAcceptancePolicyProfilesOptions, type ResolvedAcceptancePolicyDefault, type VerifiedAcceptancePolicyProfilesResult, type VerifiedAcceptancePolicyProfilesSuccess, } from './acceptance-policy';
 export { type AcceptancePolicyAssessment, type AcceptancePolicyAssessmentDiagnostic, type AcceptancePolicyAssessmentDiagnosticCode, type AcceptancePolicyMatchedRule, type AcceptancePolicyOutcome, type AssessAcceptancePolicyInput, } from './acceptance-policy/evaluator';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, } from './governance';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './governance';
 export type { BaseTaskEvent, ProtocolRequestEvent, ProtocolResponseEvent, TaskStatusEvent, ObjectEvent, TaskEvent, TaskEventCallbacks, } from './core/TaskEventTypes';
 export { createOperationId } from './core/TaskEventTypes';
 export type { AsyncHandlerConfig, WebhookMetadata, Activity, NotificationMetadata, MediaBuyDeliveryNotification, CreateMediaBuyStatusChangeHandler, UpdateMediaBuyStatusChangeHandler, SyncCreativesStatusChangeHandler, GetProductsStatusChangeHandler, ListProductsStatusChangeHandler, } from './core/AsyncHandler';
@@ -53,7 +53,7 @@ export * from './handlers/types';
 export type { Storage, AtomicTakeStorage, DeferredTaskStorage, BatchStorage, PatternStorage, AgentCapabilities, ConversationState, DeferredTaskState, StorageConfig, StorageFactory, StorageMiddleware, } from './storage/interfaces';
 export { MemoryStorage, createMemoryStorage, createMemoryStorageConfig } from './storage/MemoryStorage';
 export { ADCPError, TaskTimeoutError, MaxClarificationError, DeferredTaskError, TaskAbortedError, AgentNotFoundError, UnsupportedTaskError, ProtocolError, ValidationError as ADCPValidationError, // Rename to avoid conflict
-MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors';
+MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, BuyerSetupError, AccountNotFoundError, AccountSetupRequiredError, AccountPaymentRequiredError, AccountNotProvisionedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors';
 export type { OAuthMetadataInfo, ClientPreflightAdcpErrorInfo, ClientPreflightAdcpErrorRecovery, FeatureUnsupportedErrorOptions, ProtocolFeatureUnsupportedErrorOptions, ActionNotAllowedErrorDetails, ActionNotAllowedReasonValue, ActionNotAllowedAttemptedAction, ActionNotAllowedAvailableAction, ActionNotAllowedRecovery, } from './errors';
 export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionId, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyUpdateFieldAction, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, StructuredOnlyMediaBuyAction, ResolvedTargetingInput, TargetingInputFor, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy';
 export { ACTIONS_BY_FIELD, LEGACY_COARSE_ACTIONS, STRUCTURED_ONLY_MEDIA_BUY_ACTIONS, UPDATE_FIELDS_BY_ACTION, applyTargetingInput, hasTargetingClears, resolveTargetingInput, canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, findAvailableAction, getActionForMutation, getAvailableActions, getRollupParent, ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, preflightUpdateMediaBuy, recoveryForModeMismatch, validateProductsAgainstPropertyPolicy, } from './media-buy';
@@ -272,3 +272,5 @@ export { mediaBuyActionResolver } from './server/media-buy-action-resolver';
 export type { SellerActionDecision, SellerActionResolutionOptions, SellerActionResolution, } from './server/media-buy-action-resolver';
 export * from './supply-path';
 export type { AuthorizationCollectionSelector, ProductCollectionSelector, CollectionDistribution, DiscoveryCollection, } from './discovery/types';
+export { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage, type BuyerAccountRegistryOptions, type EnsureAccountOptions, type ProvisionedAccount, } from './core/buyer-account-registry';
+export { createProductCache, ProductCache, type ProductCacheOptions } from './core/product-cache';

package/dist/lib/index.js

@@ -37,8 +37,12 @@ __export(index_exports, {
   ANNEX_III_POLICY_IDS: () => import_governance.ANNEX_III_POLICY_IDS,
   AUTH_DIAGNOSIS_SCHEMA_VERSION: () => import_oauth2.AUTH_DIAGNOSIS_SCHEMA_VERSION,
   AccountAmbiguousError: () => import_errors.AccountAmbiguousError,
+  AccountNotFoundError: () => import_errors.AccountNotFoundError,
+  AccountNotProvisionedError: () => import_errors.AccountNotProvisionedError,
+  AccountPaymentRequiredError: () => import_errors.AccountPaymentRequiredError,
   AccountPendingApprovalError: () => import_errors.AccountPendingApprovalError,
   AccountRequiredError: () => import_errors.AccountRequiredError,
+  AccountSetupRequiredError: () => import_errors.AccountSetupRequiredError,
   ActionNotAllowedError: () => import_errors.ActionNotAllowedError,
   AdCPClient: () => AdCPClient,
   AdagentsJsonSchema: () => import_wellknown_schemas.AdagentsJsonSchema,
@@ -52,7 +56,9 @@ __export(index_exports, {
   BRAND_RIGHTS_TOOLS: () => import_capabilities.BRAND_RIGHTS_TOOLS,
   BrandDomainValidationError: () => import_brand.BrandDomainValidationError,
   BrandJsonSchema: () => import_wellknown_schemas.BrandJsonSchema,
+  BuyerAccountRegistry: () => import_buyer_account_registry.BuyerAccountRegistry,
   BuyerRetryPolicy: () => import_buyer_retry_policy.BuyerRetryPolicy,
+  BuyerSetupError: () => import_errors.BuyerSetupError,
   CATALOG_MACRO_VECTORS: () => import_substitution.CATALOG_MACRO_VECTORS,
   COMMON_LOGO_SLOTS: () => import_brand.COMMON_LOGO_SLOTS,
   COMPATIBLE_ADCP_VERSIONS: () => import_version.COMPATIBLE_ADCP_VERSIONS,
@@ -144,6 +150,7 @@ __export(index_exports, {
   PostgresStateStore: () => import_server.PostgresStateStore,
   PostgresTaskStore: () => import_server.PostgresTaskStore,
   PreviewFetchError: () => import_substitution.PreviewFetchError,
+  ProductCache: () => import_product_cache.ProductCache,
   ProductPropertyPolicyError: () => import_media_buy.ProductPropertyPolicyError,
   PropertyCrawler: () => import_property_crawler.PropertyCrawler,
   PropertyIndex: () => import_property_index.PropertyIndex,
@@ -305,6 +312,7 @@ __export(index_exports, {
   createCreativeAgentClient: () => import_CreativeAgentClient.createCreativeAgentClient,
   createDerivedAccountStore: () => import_adapters.createDerivedAccountStore,
   createFileOAuthStorage: () => import_oauth3.createFileOAuthStorage,
+  createGovernanceAgentJwksResolver: () => import_governance.createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware: () => import_governance.createGovernanceEnforcementMiddleware,
   createIdempotencyStore: () => import_server.createIdempotencyStore,
   createInMemoryEstablishedProposalStore: () => import_established_proposal_store.createInMemoryEstablishedProposalStore,
@@ -316,6 +324,7 @@ __export(index_exports, {
   createMemoryStorageConfig: () => import_MemoryStorage.createMemoryStorageConfig,
   createOAuthPassthroughResolver: () => import_adapters.createOAuthPassthroughResolver,
   createOperationId: () => import_TaskEventTypes.createOperationId,
+  createProductCache: () => import_product_cache.createProductCache,
   createRosterAccountStore: () => import_adapters.createRosterAccountStore,
   createSeedFixtureCache: () => import_server.createSeedFixtureCache,
   createSessionedStore: () => import_server.createSessionedStore,
@@ -829,6 +838,8 @@ __reExport(index_exports, require('./notifications/account-change-recorded.js'),
 __reExport(index_exports, require('./media-buy/actions.js'), module.exports);
 var import_media_buy_action_resolver = require('./server/media-buy-action-resolver.js');
 __reExport(index_exports, require('./supply-path/index.js'), module.exports);
+var import_buyer_account_registry = require('./core/buyer-account-registry.js');
+var import_product_cache = require('./core/product-cache.js');
 const wireVersion = {
   isSupported: import_protocols2.bundleSupportsAdcpVersionField,
   normalize: import_schema_loader2.toReleasePrecisionWire,
@@ -861,8 +872,12 @@ function createAdCPClientFromEnv() {
   ANNEX_III_POLICY_IDS,
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
   AccountAmbiguousError,
+  AccountNotFoundError,
+  AccountNotProvisionedError,
+  AccountPaymentRequiredError,
   AccountPendingApprovalError,
   AccountRequiredError,
+  AccountSetupRequiredError,
   ActionNotAllowedError,
   AdCPClient,
   AdagentsJsonSchema,
@@ -876,7 +891,9 @@ function createAdCPClientFromEnv() {
   BRAND_RIGHTS_TOOLS,
   BrandDomainValidationError,
   BrandJsonSchema,
+  BuyerAccountRegistry,
   BuyerRetryPolicy,
+  BuyerSetupError,
   CATALOG_MACRO_VECTORS,
   COMMON_LOGO_SLOTS,
   COMPATIBLE_ADCP_VERSIONS,
@@ -968,6 +985,7 @@ function createAdCPClientFromEnv() {
   PostgresStateStore,
   PostgresTaskStore,
   PreviewFetchError,
+  ProductCache,
   ProductPropertyPolicyError,
   PropertyCrawler,
   PropertyIndex,
@@ -1129,6 +1147,7 @@ function createAdCPClientFromEnv() {
   createCreativeAgentClient,
   createDerivedAccountStore,
   createFileOAuthStorage,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   createIdempotencyStore,
   createInMemoryEstablishedProposalStore,
@@ -1140,6 +1159,7 @@ function createAdCPClientFromEnv() {
   createMemoryStorageConfig,
   createOAuthPassthroughResolver,
   createOperationId,
+  createProductCache,
   createRosterAccountStore,
   createSeedFixtureCache,
   createSessionedStore,

package/dist/lib/index.mjs

@@ -158,6 +158,7 @@ import {
   targetDeclaresLegacyGovernanceAwareness,
   validateGovernancePlan,
   verifyGovernanceAuthorization,
+  createGovernanceAgentJwksResolver,
   REGULATED_HUMAN_REVIEW_CATEGORIES,
   ANNEX_III_POLICY_IDS
 } from "./governance/index.mjs";
@@ -220,6 +221,11 @@ import {
   AccountRequiredError,
   AccountPendingApprovalError,
   AccountAmbiguousError,
+  BuyerSetupError,
+  AccountNotFoundError,
+  AccountSetupRequiredError,
+  AccountPaymentRequiredError,
+  AccountNotProvisionedError,
   SDK_ERROR_TO_PROTOCOL_ERROR_CODE,
   VersionUnsupportedError,
   IdempotencyConflictError,
@@ -800,6 +806,10 @@ export * from "./notifications/account-change-recorded.mjs";
 export * from "./media-buy/actions.mjs";
 import { mediaBuyActionResolver } from "./server/media-buy-action-resolver.mjs";
 export * from "./supply-path/index.mjs";
+import {
+  BuyerAccountRegistry
+} from "./core/buyer-account-registry.mjs";
+import { createProductCache, ProductCache } from "./core/product-cache.mjs";
 export {
   A2AInvocationError,
   A2A_CARD_PATHS,
@@ -819,8 +829,12 @@ export {
   ANNEX_III_POLICY_IDS,
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
   AccountAmbiguousError,
+  AccountNotFoundError,
+  AccountNotProvisionedError,
+  AccountPaymentRequiredError,
   AccountPendingApprovalError,
   AccountRequiredError,
+  AccountSetupRequiredError,
   ActionNotAllowedError,
   AdCPClient,
   AdagentsJsonSchema,
@@ -834,7 +848,9 @@ export {
   BRAND_RIGHTS_TOOLS,
   BrandDomainValidationError,
   BrandJsonSchema,
+  BuyerAccountRegistry,
   BuyerRetryPolicy,
+  BuyerSetupError,
   CATALOG_MACRO_VECTORS,
   COMMON_LOGO_SLOTS,
   COMPATIBLE_ADCP_VERSIONS,
@@ -926,6 +942,7 @@ export {
   PostgresStateStore,
   PostgresTaskStore,
   PreviewFetchError,
+  ProductCache,
   ProductPropertyPolicyError,
   PropertyCrawler,
   PropertyIndex,
@@ -1087,6 +1104,7 @@ export {
   createCreativeAgentClient,
   createDerivedAccountStore,
   createFileOAuthStorage,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   createIdempotencyStore,
   createInMemoryEstablishedProposalStore,
@@ -1098,6 +1116,7 @@ export {
   createMemoryStorageConfig,
   createOAuthPassthroughResolver,
   createOperationId,
+  createProductCache,
   createRosterAccountStore,
   createSeedFixtureCache,
   createSessionedStore,

package/dist/lib/protocols/a2a.js

@@ -39,6 +39,7 @@ var import_fetch = require('../signing/fetch.js');
 var import_fetch_async = require('../signing/fetch-async.js');
 var import_redact_args = require('../utils/redact-args.js');
 var import_rawResponseCapture = require('./rawResponseCapture.js');
+var import_signedRequestRejection = require('./signedRequestRejection.js');
 var import_responseSizeLimit = require('./responseSizeLimit.js');
 var import_transportDiagnostics = require('./transportDiagnostics.js');
 var import_abort = require('./abort.js');
@@ -322,6 +323,7 @@ function buildFetchImpl(authToken, agentUrl) {
   const networkFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)(
     (0, import_responseSizeLimit.wrapFetchWithSizeLimit)((input, init) => pinnedFetch(input, init))
   );
+  const rejectionFetch = signingContext ? (0, import_signedRequestRejection.wrapFetchWithSignedRequestRejection)(networkFetch, agentUrl) : networkFetch;
   const baseFetch = async (url, options) => {
     const context = callContextStorage.getStore();
     const urlString = typeof url === "string" ? url : url instanceof URL ? url.toString() : url.url;
@@ -370,7 +372,11 @@ function buildFetchImpl(authToken, agentUrl) {
     const response = await (0, import_abort.withAbortSignal)(
       [context?.signal, options?.signal],
       requestTimeoutMs,
-      (signal) => networkFetch(url, { ...options, headers, signal })
+      (signal) => rejectionFetch(url, {
+        ...options,
+        headers,
+        signal
+      })
     );
     if (response.status === 401 && context) {
       context.got401Ref.value = true;
@@ -548,6 +554,8 @@ async function callA2AToolImpl(agentUrl, toolName, parameters, authToken, debugL
         message: `A2A: Authentication required for ${agentUrl}`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
+      const signedRejection = (0, import_signedRequestRejection.getSignedRequestRejection)(error);
+      if (signedRejection) throw signedRejection;
       const challenge = await (0, import_authorization_required.probeAuthChallenge)(agentUrl, {
         fetchFn: context.fetchFn,
         allowPrivateIp: context.allowPrivateIp ?? (0, import_address_guards.isLikelyPrivateUrl)(agentUrl)