@adcp/sdk 14.0.0 → 14.2.0

package/dist/lib/registry/types.generated.d.ts

@@ -1756,11 +1756,11 @@ export interface paths {
         put?: never;
         /**
          * Refresh agent snapshot
-         * @description Re-probe the agent and update its registry health (online, tools_count, response_time_ms), capability snapshot (inferred type, discovered tools), and compliance verdict (storyboard pass/fail counts). Use after fixing your agent so the registry shows fresh data without waiting for the periodic heartbeat (~1h).
+         * @description Re-probe the agent and update its registry health (online, tools_count, response_time_ms), capability snapshot (inferred type, discovered tools), and compliance verdict (storyboard pass/fail counts). Use after fixing your agent so the registry shows fresh data without waiting for the periodic heartbeat.
          *
-         *     **Compliance re-run:** when the caller owns the agent or is an AAO admin and the capability probe succeeds, the full storyboard suite can run for several minutes on capability-rich agents with a fresh test session, and `agent_storyboard_status` is updated. Owner-triggered runs use `triggered_by: 'owner_test'`; admin-triggered support runs use `triggered_by: 'manual'`. Badge fan-out reissues verification badges off the new run. If the compliance call fails (timeout, OAuth wall, internal error), the capability/health portion still returns successfully — `compliance.ran` is `false` with an `error` string.
+         *     **Compliance re-run:** when the caller owns the agent or is an AgenticAdvertising.org admin and the capability probe succeeds, the full storyboard suite runs with a fresh test session. Owner-triggered runs use `triggered_by: 'owner_test'`; admin-triggered support runs use `triggered_by: 'manual'`. Only a complete authoritative run can update public grades or badges.
          *
-         *     **Auth:** owner of the agent, AAO admin, or static `ADMIN_API_KEY`. Human submissions are temporarily fenced with HTTP 503 until durable authorization provenance is supported; static admin API key submissions remain available.
+         *     **Auth:** an authenticated owner or administrator credential is checked at admission and throughout execution. Static admin API keys cannot queue a refresh.
          *
          *     **Rate limits:** 60 seconds per agent URL, 30 requests per user per hour.
          */
@@ -2641,7 +2641,7 @@ export interface components {
             verified?: boolean;
             /** @description Canonical badge roles the agent is AgenticAdvertising.org Verified for (e.g. media-buy, creative). */
             verified_roles?: components["schemas"]["BadgeRole"][];
-            /** @description Active AgenticAdvertising.org Verified AdCP releases for each verified role, keyed by canonical badge role and sorted newest-first (e.g. { media-buy: ['3.1', '3.0'] }). Use this when choosing a version-pinned badge URL. */
+            /** @description Active AgenticAdvertising.org Verified AdCP releases for each verified role, keyed by canonical badge role and sorted newest-first (e.g. { media-buy: ['3.2', '3.1'] }). Use this when choosing a version-pinned badge URL. */
             verified_role_versions?: {
                 [key: string]: string[];
             };
@@ -4164,21 +4164,48 @@ export interface components {
             compliance_opt_out?: boolean;
             /** @description True when monitoring is enabled but badges remain suppressed until a fresh passing full-suite run completes. */
             badge_requalification_required?: boolean;
-            /** @description Current human refresh admission state. Monitoring requeue is a separate scheduler operation and is not a retry or ETA for this endpoint. */
+            /** @description Whether authenticated owners and administrators can queue an agent refresh. */
             refresh_availability?: {
                 available: boolean;
-                /** @description Whether retrying the same human refresh request later is expected to succeed without a platform change. */
-                retryable: boolean;
-                /** @enum {string} */
-                scope: "platform";
-                /** @enum {string} */
-                applies_to: "human_session";
-                /** @enum {string} */
-                code: "refresh_authorization_provenance_required";
-                notice: string;
-                /** @enum {string} */
-                alternative_action: "monitoring_requeue";
-                alternative_description: string;
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 */
+                retryable?: boolean;
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 * @enum {string}
+                 */
+                scope?: "platform";
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 * @enum {string}
+                 */
+                applies_to?: "human_session";
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 * @enum {string}
+                 */
+                code?: "refresh_authorization_provenance_required";
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 */
+                notice?: string;
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 * @enum {string}
+                 */
+                alternative_action?: "monitoring_requeue";
+                /**
+                 * @deprecated
+                 * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                 */
+                alternative_description?: string;
             };
             tracks?: {
                 [key: string]: string;
@@ -4200,6 +4227,21 @@ export interface components {
             status_changed_at?: string | null;
             storyboards_passing?: number;
             storyboards_total?: number;
+            /** @description Owner/operator-only newest persisted full assessment, including audit-only timeouts. Null for other viewers. This does not change the public verdict. */
+            latest_attempt?: {
+                /** Format: uuid */
+                id: string;
+                tested_at: string;
+                /** @enum {string} */
+                triggered_by: "heartbeat" | "owner_test" | "manual" | "webhook";
+                /** @enum {string} */
+                completeness: "complete" | "timed_out" | "not_completed";
+                is_authoritative: boolean;
+                requested_compliance_target: string | null;
+                storyboards_completed: number | null;
+                storyboards_total: number | null;
+                first_blocker: string | null;
+            } | null;
             /** @description How often the heartbeat re-tests this agent, in hours */
             check_interval_hours?: number;
             /** @description Specialisms the agent declared in get_adcp_capabilities, from the latest run */
@@ -4329,7 +4371,7 @@ export interface components {
         };
         VerificationBadge: {
             role: components["schemas"]["BadgeRole"] & unknown;
-            /** @description AdCP release this badge was issued against, MAJOR.MINOR (e.g. '3.0', '3.1'). Load-bearing for badge identity — pairs with the (agent_url, role, adcp_version) PK. */
+            /** @description AdCP release this badge was issued against, MAJOR.MINOR (e.g. '3.1', '3.2'). Load-bearing for badge identity — pairs with the (agent_url, role, adcp_version) PK. */
             adcp_version: string;
             verified_at: string;
             /** @description Specialisms demonstrably passed (enums/specialism.json). Preview specialisms are excluded from stable badges. */
@@ -9299,7 +9341,7 @@ export interface operations {
                 encodedUrl: string;
                 /** @description Canonical badge role */
                 role: components["schemas"]["BadgeRole"] & unknown;
-                /** @description AdCP release as MAJOR.MINOR (e.g. '3.0', '3.1') */
+                /** @description AdCP release as MAJOR.MINOR (e.g. '3.1', '3.2') */
                 version: string;
             };
             cookie?: never;
@@ -10208,13 +10250,13 @@ export interface operations {
                             run_id?: string;
                             /** @description Fresh test session id used for the compliance run. Useful when matching seller-side logs to the refresh. */
                             test_session_id?: string;
-                            /** @description Requested compliance target before alias resolution, e.g. 3.1, 3.0, 3.1-rc, or 3.1-beta. Present when `ran` is true. */
+                            /** @description Requested compliance target before alias resolution, e.g. 3.2, 3.1, 3.0, 3.2-rc, or 3.2-beta. Present when `ran` is true. */
                             requested_compliance_target?: string;
-                            /** @description Concrete AdCP compliance bundle version used for the run, e.g. 3.0.12 or 3.1.0-beta.7. Present when `ran` is true. */
+                            /** @description Concrete AdCP compliance bundle version used for the run, e.g. 3.2.1, 3.1.24, or 3.2.0-rc.7. Present when `ran` is true. */
                             adcp_version?: string;
                             /** @description True when this run can update public badge state. */
                             badge_eligible?: boolean;
-                            /** @description Public badge versions this run can issue, e.g. ['3.0']. */
+                            /** @description Public badge versions this run can issue, e.g. ['3.2']. */
                             badge_eligible_adcp_versions?: string[];
                             /** @description Aggregate verdict from the run (passing / failing / partial / unknown). Only present when `ran` is true. */
                             overall_status?: string;
@@ -10327,34 +10369,59 @@ export interface operations {
                     "application/json": components["schemas"]["Error"];
                 };
             };
-            /** @description Refresh queue or authorization unavailable. Human submissions are fenced with refresh_authorization_provenance_required until durable authorization provenance is supported; this response is non-retryable and carries no ETA. Static admin API key submissions remain supported. */
+            /** @description Refresh queue or authorization temporarily unavailable. */
             503: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        /** @enum {string} */
-                        error: "admin_authorization_unavailable";
-                        message: string;
-                    } | {
-                        error: string;
-                        /** @enum {string} */
-                        code: "refresh_authorization_provenance_required";
-                        /** @enum {boolean} */
-                        retryable: false;
-                        /** @enum {string} */
-                        scope: "platform";
-                        /** @enum {string} */
-                        applies_to: "human_session";
-                        /** @enum {string} */
-                        alternative_action: "monitoring_requeue";
-                        alternative_description: string;
+                    "application/json": components["schemas"]["Error"] & {
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         */
+                        message?: string;
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {string}
+                         */
+                        code?: "refresh_authorization_provenance_required";
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {boolean}
+                         */
+                        retryable?: false;
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {string}
+                         */
+                        scope?: "platform";
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {string}
+                         */
+                        applies_to?: "human_session";
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         * @enum {string}
+                         */
+                        alternative_action?: "monitoring_requeue";
+                        /**
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
+                         */
+                        alternative_description?: string;
                         /**
                          * Format: uri
-                         * @description Issue tracking the restoration of human-initiated refresh
+                         * @deprecated
+                         * @description Deprecated: removed from the AgenticAdvertising.org registry OpenAPI and no longer sent. Retained as an optional property for SDK 14.x type compatibility; it will be removed in the next major release.
                          */
-                        tracking_issue: string;
+                        tracking_issue?: string;
                     };
                 };
             };
@@ -10922,7 +10989,7 @@ export interface operations {
             query?: {
                 /** @description Filter by storyboard category */
                 category?: string;
-                /** @description Compliance target to inspect, e.g. 3.1, 3.0, 3.1-rc, or 3.1-beta */
+                /** @description Compliance target to inspect, e.g. 3.2, 3.1, 3.0, 3.2-rc, or 3.2-beta */
                 compliance_target?: string;
             };
             header?: never;
@@ -10959,7 +11026,7 @@ export interface operations {
     getStoryboard: {
         parameters: {
             query?: {
-                /** @description Compliance target to inspect, e.g. 3.1, 3.0, 3.1-rc, or 3.1-beta */
+                /** @description Compliance target to inspect, e.g. 3.2, 3.1, 3.0, 3.2-rc, or 3.2-beta */
                 compliance_target?: string;
             };
             header?: never;
@@ -11342,7 +11409,7 @@ export interface operations {
     getStoryboardFirstStep: {
         parameters: {
             query?: {
-                /** @description Compliance target to inspect, e.g. 3.1, 3.0, 3.1-rc, or 3.1-beta */
+                /** @description Compliance target to inspect, e.g. 3.2, 3.1, 3.0, 3.2-rc, or 3.2-beta */
                 compliance_target?: string;
             };
             header?: never;

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-10-01T12:26:53.290Z"
+  "synced_at": "2026-10-05T13:04:22.439Z"
 }

package/dist/lib/server/account-provisioning.d.mts

@@ -0,0 +1,2 @@
+/** Only spend commitments and account-owned resource creation may provision. */
+export declare function isAccountProvisioningTask(toolName: string | undefined): boolean;

package/dist/lib/server/account-provisioning.d.ts

@@ -0,0 +1,2 @@
+/** Only spend commitments and account-owned resource creation may provision. */
+export declare function isAccountProvisioningTask(toolName: string | undefined): boolean;

package/dist/lib/server/account-provisioning.js

@@ -0,0 +1,30 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var account_provisioning_exports = {};
+__export(account_provisioning_exports, {
+  isAccountProvisioningTask: () => isAccountProvisioningTask
+});
+module.exports = __toCommonJS(account_provisioning_exports);
+function isAccountProvisioningTask(toolName) {
+  return toolName !== void 0 && (toolName.startsWith("sync_") || ["create_media_buy", "buy_products", "accept_proposal", "activate_signal", "acquire_rights"].includes(toolName));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isAccountProvisioningTask
+});

package/dist/lib/server/account-provisioning.mjs

@@ -0,0 +1,6 @@
+function isAccountProvisioningTask(toolName) {
+  return toolName !== void 0 && (toolName.startsWith("sync_") || ["create_media_buy", "buy_products", "accept_proposal", "activate_signal", "acquire_rights"].includes(toolName));
+}
+export {
+  isAccountProvisioningTask
+};

package/dist/lib/server/account-reference-warnings.d.mts

@@ -0,0 +1,12 @@
+import type { AdcpLogger } from './create-adcp-server.mjs';
+/**
+ * Compatibility-window warnings for account-reference behavior that becomes
+ * strict by default in the next major release (`strictAccountReferences`).
+ */
+export type AccountReferenceWarningCode = 'ADCP_UNRESOLVED_ACCOUNT_REFERENCE' | 'ADCP_IMPLICIT_ACCOUNT_IDENTITY_MISMATCH' | 'ADCP_REQUIRED_FOR_PRODUCTS_NOT_ENFORCED' | 'ADCP_LIST_ACCOUNTS_FILTER_RESOLVED';
+/**
+ * Warn once per process per code (`logger.warn`, plus `process.emitWarning`
+ * outside production). Later occurrences go to `logger.debug`. Messages and
+ * metadata are server-side only; never echo them to the buyer.
+ */
+export declare function warnAccountReferenceDeprecation(logger: AdcpLogger, code: AccountReferenceWarningCode, message: string, meta?: Record<string, unknown>): void;

package/dist/lib/server/account-reference-warnings.d.ts

@@ -0,0 +1,12 @@
+import type { AdcpLogger } from './create-adcp-server';
+/**
+ * Compatibility-window warnings for account-reference behavior that becomes
+ * strict by default in the next major release (`strictAccountReferences`).
+ */
+export type AccountReferenceWarningCode = 'ADCP_UNRESOLVED_ACCOUNT_REFERENCE' | 'ADCP_IMPLICIT_ACCOUNT_IDENTITY_MISMATCH' | 'ADCP_REQUIRED_FOR_PRODUCTS_NOT_ENFORCED' | 'ADCP_LIST_ACCOUNTS_FILTER_RESOLVED';
+/**
+ * Warn once per process per code (`logger.warn`, plus `process.emitWarning`
+ * outside production). Later occurrences go to `logger.debug`. Messages and
+ * metadata are server-side only; never echo them to the buyer.
+ */
+export declare function warnAccountReferenceDeprecation(logger: AdcpLogger, code: AccountReferenceWarningCode, message: string, meta?: Record<string, unknown>): void;

package/dist/lib/server/account-reference-warnings.js

@@ -0,0 +1,48 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var account_reference_warnings_exports = {};
+__export(account_reference_warnings_exports, {
+  _resetAccountReferenceWarnings: () => _resetAccountReferenceWarnings,
+  warnAccountReferenceDeprecation: () => warnAccountReferenceDeprecation
+});
+module.exports = __toCommonJS(account_reference_warnings_exports);
+const warnedCodes = /* @__PURE__ */ new Set();
+function warnAccountReferenceDeprecation(logger, code, message, meta = {}) {
+  const fields = { ...meta, code };
+  if (warnedCodes.has(code)) {
+    logger.debug(message, fields);
+    return;
+  }
+  warnedCodes.add(code);
+  logger.warn(message, fields);
+  if (process.env.NODE_ENV !== "production") {
+    try {
+      process.emitWarning(message, { type: "DeprecationWarning", code });
+    } catch {
+    }
+  }
+}
+function _resetAccountReferenceWarnings() {
+  warnedCodes.clear();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  _resetAccountReferenceWarnings,
+  warnAccountReferenceDeprecation
+});

package/dist/lib/server/account-reference-warnings.mjs

@@ -0,0 +1,23 @@
+const warnedCodes = /* @__PURE__ */ new Set();
+function warnAccountReferenceDeprecation(logger, code, message, meta = {}) {
+  const fields = { ...meta, code };
+  if (warnedCodes.has(code)) {
+    logger.debug(message, fields);
+    return;
+  }
+  warnedCodes.add(code);
+  logger.warn(message, fields);
+  if (process.env.NODE_ENV !== "production") {
+    try {
+      process.emitWarning(message, { type: "DeprecationWarning", code });
+    } catch {
+    }
+  }
+}
+function _resetAccountReferenceWarnings() {
+  warnedCodes.clear();
+}
+export {
+  _resetAccountReferenceWarnings,
+  warnAccountReferenceDeprecation
+};

package/dist/lib/server/auth-signature.js

@@ -70,6 +70,7 @@ function verifySignatureAsAuthenticator(options) {
     const signer = {
       keyid: result.keyid,
       verified_at: result.verified_at,
+      ...result.operatorRecord !== void 0 && { operatorRecord: result.operatorRecord },
       ...result.agent_url !== void 0 ? { agent_url: result.agent_url } : {}
     };
     const principal = principalForVerifiedSigner(signer, options.makePrincipal);

package/dist/lib/server/auth-signature.mjs

@@ -49,6 +49,7 @@ function verifySignatureAsAuthenticator(options) {
     const signer = {
       keyid: result.keyid,
       verified_at: result.verified_at,
+      ...result.operatorRecord !== void 0 && { operatorRecord: result.operatorRecord },
       ...result.agent_url !== void 0 ? { agent_url: result.agent_url } : {}
     };
     const principal = principalForVerifiedSigner(signer, options.makePrincipal);

package/dist/lib/server/create-adcp-server.d.mts

@@ -188,6 +188,8 @@ export interface SessionKeyContext<TAccount = unknown> {
  * resolved `TAccount` rather than re-resolving inside every handler.
  */
 export interface ResolveAccountContext {
+    /** Whether this task may create/activate accounts or accept default terms. */
+    readonly provisioning?: boolean;
     /** The AdCP tool being called. */
     toolName: AdcpServerToolName;
     /** Immutable SDK-selected AdCP release for this request. */
@@ -739,6 +741,11 @@ export interface ProtocolHandlers<TAccount = unknown> {
 export interface AccountHandlers<TAccount = unknown> {
     listAccountChanges?: DomainHandler<'list_account_changes', TAccount>;
     listAccounts?: DomainHandler<'list_accounts', TAccount>;
+    /**
+     * Synchronous results must contain one row per dispatched entry in input
+     * order. With schema validation enabled, the framework may withhold invalid
+     * notification entries and merge their failures back into the response.
+     */
     syncAccounts?: DomainHandler<'sync_accounts', TAccount>;
     syncGovernance?: DomainHandler<'sync_governance', TAccount>;
     getAccountFinancials?: DomainHandler<'get_account_financials', TAccount>;
@@ -1264,6 +1271,33 @@ export interface AdcpServerConfig<TAccount = unknown> {
      * principal across requests.
      */
     resolveAccount?: (ref: AccountReference, ctx: ResolveAccountContext) => Promise<TAccount | null>;
+    /**
+     * Opt in to strict buyer-supplied account references. Default `false` in
+     * SDK 14; becomes the default in the next major release.
+     *
+     * When `true`:
+     * - A request that carries `account` on a server without `resolveAccount`
+     *   fails with `ACCOUNT_NOT_FOUND` instead of reaching the handler
+     *   unverified. An auth-only `resolveAccountFromAuth` does not authorize an
+     *   arbitrary reference.
+     * - A seller that declares `capabilities.account.requiredForProducts`
+     *   refuses `get_products` with `ACCOUNT_REQUIRED` when the request carries
+     *   no account and authentication resolves none.
+     * - `list_accounts.account` is treated as a filter: `resolveAccount` is not
+     *   called for it, and `ctx.account` comes from `resolveAccountFromAuth`.
+     * - On `createAdcpServerFromPlatform` with `accounts.resolution: 'implicit'`,
+     *   an account whose returned identity metadata (`brand`, `operator`,
+     *   `operator_unit`, `currency`, `timezone`, `sandbox`) disagrees with the
+     *   supplied natural key is refused with `ACCOUNT_NOT_FOUND`.
+     *
+     * When `false` (default), each case keeps the SDK 14.0 behavior and logs a
+     * deprecation warning once per process per warning code (`logger.warn`, plus
+     * `process.emitWarning` outside `NODE_ENV=production`); later occurrences
+     * log at debug level. Configure a reference-aware `resolveAccount` that
+     * returns `null` for unknown or unauthorized references, then set this
+     * flag. See `docs/guides/account-resolution.md`.
+     */
+    strictAccountReferences?: boolean;
     /**
      * Resolve an account when the wire request doesn't carry one.
      *

package/dist/lib/server/create-adcp-server.d.ts

@@ -188,6 +188,8 @@ export interface SessionKeyContext<TAccount = unknown> {
  * resolved `TAccount` rather than re-resolving inside every handler.
  */
 export interface ResolveAccountContext {
+    /** Whether this task may create/activate accounts or accept default terms. */
+    readonly provisioning?: boolean;
     /** The AdCP tool being called. */
     toolName: AdcpServerToolName;
     /** Immutable SDK-selected AdCP release for this request. */
@@ -739,6 +741,11 @@ export interface ProtocolHandlers<TAccount = unknown> {
 export interface AccountHandlers<TAccount = unknown> {
     listAccountChanges?: DomainHandler<'list_account_changes', TAccount>;
     listAccounts?: DomainHandler<'list_accounts', TAccount>;
+    /**
+     * Synchronous results must contain one row per dispatched entry in input
+     * order. With schema validation enabled, the framework may withhold invalid
+     * notification entries and merge their failures back into the response.
+     */
     syncAccounts?: DomainHandler<'sync_accounts', TAccount>;
     syncGovernance?: DomainHandler<'sync_governance', TAccount>;
     getAccountFinancials?: DomainHandler<'get_account_financials', TAccount>;
@@ -1264,6 +1271,33 @@ export interface AdcpServerConfig<TAccount = unknown> {
      * principal across requests.
      */
     resolveAccount?: (ref: AccountReference, ctx: ResolveAccountContext) => Promise<TAccount | null>;
+    /**
+     * Opt in to strict buyer-supplied account references. Default `false` in
+     * SDK 14; becomes the default in the next major release.
+     *
+     * When `true`:
+     * - A request that carries `account` on a server without `resolveAccount`
+     *   fails with `ACCOUNT_NOT_FOUND` instead of reaching the handler
+     *   unverified. An auth-only `resolveAccountFromAuth` does not authorize an
+     *   arbitrary reference.
+     * - A seller that declares `capabilities.account.requiredForProducts`
+     *   refuses `get_products` with `ACCOUNT_REQUIRED` when the request carries
+     *   no account and authentication resolves none.
+     * - `list_accounts.account` is treated as a filter: `resolveAccount` is not
+     *   called for it, and `ctx.account` comes from `resolveAccountFromAuth`.
+     * - On `createAdcpServerFromPlatform` with `accounts.resolution: 'implicit'`,
+     *   an account whose returned identity metadata (`brand`, `operator`,
+     *   `operator_unit`, `currency`, `timezone`, `sandbox`) disagrees with the
+     *   supplied natural key is refused with `ACCOUNT_NOT_FOUND`.
+     *
+     * When `false` (default), each case keeps the SDK 14.0 behavior and logs a
+     * deprecation warning once per process per warning code (`logger.warn`, plus
+     * `process.emitWarning` outside `NODE_ENV=production`); later occurrences
+     * log at debug level. Configure a reference-aware `resolveAccount` that
+     * returns `null` for unknown or unauthorized references, then set this
+     * flag. See `docs/guides/account-resolution.md`.
+     */
+    strictAccountReferences?: boolean;
     /**
      * Resolve an account when the wire request doesn't carry one.
      *