@adcp/sdk 14.0.0 → 14.2.0

package/dist/lib/server/create-adcp-server.mjs

@@ -91,6 +91,8 @@ function hasIdempotencyClearAll(store) {
   return typeof store.clearAll === "function";
 }
 const IDEMPOTENCY_CLAIM_RENEW_INTERVAL_MS = 6e4;
+import { isAccountProvisioningTask } from "./account-provisioning.mjs";
+import { warnAccountReferenceDeprecation } from "./account-reference-warnings.mjs";
 import { isMutatingTask, requestUsesIdempotency, IDEMPOTENCY_KEY_PATTERN, MUTATING_TASKS } from "../utils/idempotency.mjs";
 import { STATUS_FREE_SYNC_RESPONSE_TOOLS } from "../utils/envelope-status-compat.mjs";
 import { validateRequest, validateResponse, formatIssues } from "../validation/schema-validator.mjs";
@@ -656,6 +658,98 @@ function shallowToolInputHintSchema(toolName) {
   SHALLOW_HINT_SCHEMAS.set(toolName, schema);
   return schema;
 }
+function isAccountNotificationEventIssue(issue) {
+  return issue.keyword === "enum" && /^\/accounts\/\d+\/notification_configs\/\d+\/event_types\/\d+$/.test(issue.pointer);
+}
+function rejectedSyncAccountRow(entry) {
+  const identity = entry.account !== void 0 ? { account: entry.account } : Object.fromEntries(
+    ["brand", "operator", "operator_unit", "currency", "timezone", "sandbox"].filter((key) => entry[key] !== void 0).map((key) => [key, entry[key]])
+  );
+  return {
+    ...identity,
+    action: "failed",
+    // Provisioning was declined. A failed settings update does not establish
+    // the existing account's lifecycle state, so leave that status unknown.
+    ...entry.account === void 0 && { status: "rejected" },
+    errors: []
+  };
+}
+function accountNotificationFailureRows(accounts, issues, deleteMissing) {
+  const rows = /* @__PURE__ */ new Map();
+  for (const issue of issues) {
+    const [, accountIndex, configIndex, eventIndex] = issue.pointer.match(
+      /^\/accounts\/(\d+)\/notification_configs\/(\d+)\/event_types\/(\d+)$/
+    );
+    const index = Number(accountIndex);
+    const entry = accounts[index];
+    let row = rows.get(index);
+    if (row === void 0) {
+      row = rejectedSyncAccountRow(entry);
+      rows.set(index, row);
+    }
+    row.errors.push({
+      code: "VALIDATION_ERROR",
+      recovery: "correctable",
+      message: issue.message,
+      field: `notification_configs[${configIndex}].event_types[${eventIndex}]`
+    });
+  }
+  if (deleteMissing) {
+    for (const [index, entry] of accounts.entries()) {
+      if (rows.has(index)) continue;
+      rows.set(index, {
+        ...rejectedSyncAccountRow(entry),
+        errors: [
+          {
+            code: "VALIDATION_ERROR",
+            recovery: "correctable",
+            message: "delete_missing cannot be applied while account notification event types are invalid. Correct the rejected entries and retry.",
+            field: "delete_missing"
+          }
+        ]
+      });
+    }
+  }
+  return rows;
+}
+function restoreSyncAccountErrorIndices(row, acceptedIndices) {
+  if (!isPlainObject(row)) return row;
+  const restorePath = (path, pointer = false) => {
+    const match = pointer ? /^\/accounts\/(\d+)(?=\/|$)/.exec(path) : /^accounts\[(\d+)\](?=\.|\[|$)/.exec(path);
+    if (match === null) return path;
+    const originalIndex = acceptedIndices[Number(match[1])];
+    if (originalIndex === void 0) return path;
+    return `${pointer ? `/accounts/${originalIndex}` : `accounts[${originalIndex}]`}${path.slice(match[0].length)}`;
+  };
+  const restoreIssues = (issues) => issues.map(
+    (issue) => isPlainObject(issue) && typeof issue.pointer === "string" ? { ...issue, pointer: restorePath(issue.pointer, true) } : issue
+  );
+  const restoreField = (error) => {
+    if (!isPlainObject(error)) return error;
+    return {
+      ...error,
+      ...typeof error.field === "string" && { field: restorePath(error.field) },
+      ...Array.isArray(error.issues) && { issues: restoreIssues(error.issues) },
+      ...isPlainObject(error.details) && Array.isArray(error.details.issues) && {
+        details: { ...error.details, issues: restoreIssues(error.details.issues) }
+      }
+    };
+  };
+  return {
+    ...row,
+    ...Array.isArray(row.errors) && { errors: row.errors.map(restoreField) },
+    ...isPlainObject(row.adcp_error) && { adcp_error: restoreField(row.adcp_error) }
+  };
+}
+function restoreSyncAccountEnvelopeErrorIndices(response, acceptedIndices) {
+  const body = response.structuredContent;
+  if (body === void 0 || !(Array.isArray(body.errors) || isPlainObject(body.adcp_error))) return response;
+  const restored = cloneFormattedResponse(response);
+  const mirrorsStructuredContent = contentTextMirrorsStructuredContent(restored, body);
+  restored.structuredContent = restoreSyncAccountErrorIndices(body, acceptedIndices);
+  syncContentJsonText(restored, restored.structuredContent, mirrorsStructuredContent);
+  return restored;
+}
 function validateFrameworkPayload(toolName, direction, payload, version, proposalCapabilities) {
   if (toolName === "sync_reporting_status" && direction === "request") {
     return validateSyncReportingStatusEnvelope(payload, version);
@@ -1852,6 +1946,7 @@ function createAdcpServer(config) {
     defaultAdcpVersion: configuredDefaultAdcpVersion,
     mcpToolProfile = "auto",
     requireCompactMutationAccountScope = false,
+    strictAccountReferences = false,
     resolveAccount,
     resolveAccountFromAuth,
     resolveSessionKey,
@@ -2567,6 +2662,7 @@ function createAdcpServer(config) {
       const wrap = meta?.wrap ?? ((data, summary) => genericResponse(toolName, data, summary));
       const toolHandler = async (params, extra) => {
         const callRequestValidationMode = effectiveRequestValidationMode(extra);
+        let notificationFailureRows = /* @__PURE__ */ new Map();
         const releaseSelection = selectServedAdcpRelease(params, capConfig, adcpVersion, defaultAdcpVersion);
         let releaseError;
         let requestRelease;
@@ -2814,7 +2910,25 @@ function createAdcpServer(config) {
                 })
               );
             }
-            const issues = idempotencyDisabled && requestIsStateChanging ? outcome.issues.filter((i) => !(i.keyword === "required" && i.pointer === "/idempotency_key")) : outcome.issues;
+            let issues = idempotencyDisabled && requestIsStateChanging ? outcome.issues.filter((i) => !(i.keyword === "required" && i.pointer === "/idempotency_key")) : outcome.issues;
+            if (toolName === "sync_accounts" && effectiveFrameworkRequestValidationMode === "strict") {
+              const eventIssues = issues.filter(isAccountNotificationEventIssue);
+              if (eventIssues.length > 0 && eventIssues.length === issues.length) {
+                const failedRows = accountNotificationFailureRows(
+                  params.accounts,
+                  eventIssues,
+                  params.delete_missing === true
+                );
+                if (validateResponse(
+                  "sync_accounts",
+                  { accounts: [...failedRows.values()] },
+                  requestRelease.validationVersion
+                ).valid) {
+                  notificationFailureRows = failedRows;
+                  issues = [];
+                }
+              }
+            }
             if (issues.length > 0) {
               if (effectiveFrameworkRequestValidationMode === "strict") {
                 const payload = buildAdcpValidationErrorPayload(toolName, "request", issues, {
@@ -2833,13 +2947,24 @@ function createAdcpServer(config) {
             }
           }
         }
-        if (hasAccount && params.account != null && resolveAccount) {
+        let unresolvedAccountPassThrough = false;
+        const suppliedAccountRef = hasAccount && params.account != null && !(strictAccountReferences && toolName === "list_accounts");
+        if (suppliedAccountRef && toolName === "list_accounts") {
+          warnAccountReferenceDeprecation(
+            logger,
+            "ADCP_LIST_ACCOUNTS_FILTER_RESOLVED",
+            "[adcp/createAdcpServer] DEPRECATED: list_accounts.account is resolved as the request account (SDK 14.0 behavior). The next major release, or strictAccountReferences: true, treats it as a filter: resolveAccount is not called for it and ctx.account comes from resolveAccountFromAuth.",
+            { tool: toolName }
+          );
+        }
+        if (suppliedAccountRef && resolveAccount) {
           try {
             const account = await resolveAccount(
               params.account,
               withImmutableServedAdcpVersion(
                 {
                   toolName,
+                  provisioning: isAccountProvisioningTask(toolName),
                   authInfo: ctx.authInfo,
                   ...ctx.agent != null && { agent: ctx.agent },
                   input: params
@@ -2872,20 +2997,32 @@ function createAdcpServer(config) {
               })
             );
           }
-        } else if (hasAccount && toolName === "list_creative_formats" && params.account != null) {
-          return finalize(
-            adcpError("ACCOUNT_NOT_FOUND", {
-              message: "The specified account cannot be resolved",
-              field: "account",
-              suggestion: "Omit account to use the authenticated account"
-            })
-          );
-        } else if ((!hasAccount || params.account == null) && resolveAccountFromAuth) {
+        } else if (suppliedAccountRef) {
+          if (strictAccountReferences || toolName === "list_creative_formats") {
+            return finalize(
+              adcpError("ACCOUNT_NOT_FOUND", {
+                message: "The specified account cannot be resolved",
+                field: "account",
+                suggestion: "The seller must configure resolveAccount to authorize supplied references; use list_accounts to discover an authorized account"
+              })
+            );
+          }
+          if (toolName !== "list_accounts") {
+            warnAccountReferenceDeprecation(
+              logger,
+              "ADCP_UNRESOLVED_ACCOUNT_REFERENCE",
+              "[adcp/createAdcpServer] DEPRECATED: a request carried a buyer-supplied account reference, but no resolveAccount is configured. The reference reached the handler unverified (ctx.account is undefined). The next major release refuses it with ACCOUNT_NOT_FOUND. Configure a reference-aware resolveAccount that returns null for unknown or unauthorized references, then set strictAccountReferences: true. See https://github.com/adcontextprotocol/adcp-client/blob/main/docs/guides/account-resolution.md",
+              { tool: toolName }
+            );
+          }
+          unresolvedAccountPassThrough = true;
+        } else if (!suppliedAccountRef && resolveAccountFromAuth) {
           try {
             const account = await resolveAccountFromAuth(
               withImmutableServedAdcpVersion(
                 {
                   toolName,
+                  provisioning: isAccountProvisioningTask(toolName),
                   authInfo: ctx.authInfo,
                   ...ctx.agent != null && { agent: ctx.agent },
                   input: params
@@ -2916,6 +3053,26 @@ function createAdcpServer(config) {
             }
           }
         }
+        if ((toolName === "get_products" || toolName === "list_products") && capConfig?.account?.requiredForProducts && ctx.account == null && // A supplied reference the compatibility pass-through handed to the
+        // handler satisfies the seller's declared requirement.
+        !unresolvedAccountPassThrough) {
+          if (!strictAccountReferences) {
+            warnAccountReferenceDeprecation(
+              logger,
+              "ADCP_REQUIRED_FOR_PRODUCTS_NOT_ENFORCED",
+              `[adcp/createAdcpServer] DEPRECATED: this seller declares account.required_for_products, but ${toolName} ran without an account (SDK 14.0 behavior). The next major release, or strictAccountReferences: true, refuses it with ACCOUNT_REQUIRED.`,
+              { tool: toolName }
+            );
+          } else {
+            return finalize(
+              adcpError("ACCOUNT_REQUIRED", {
+                message: "This seller requires an account for product discovery",
+                field: "account",
+                suggestion: "Provision an account with sync_accounts or discover one with list_accounts"
+              })
+            );
+          }
+        }
         if (ctx.agent?.sandbox_only === true && ctx.account !== void 0 && ctx.account.sandbox !== true) {
           return finalize(
             adcpError("PERMISSION_DENIED", {
@@ -3177,13 +3334,23 @@ function createAdcpServer(config) {
           if (typeof claimRenewalTimer === "object" && "unref" in claimRenewalTimer) claimRenewalTimer.unref();
         }
         let mutationHandlerCompleted = false;
+        const acceptedAccountIndices = notificationFailureRows.size > 0 ? params.accounts.flatMap(
+          (_entry, index) => notificationFailureRows.has(index) ? [] : [index]
+        ) : void 0;
+        const restoreHandlerErrorIndices = (response) => acceptedAccountIndices === void 0 ? response : restoreSyncAccountEnvelopeErrorIndices(response, acceptedAccountIndices);
         try {
           if (webhookEmitter) {
             const tenantScope = webhookTenantScopeForContext(ctx);
             const scopedEmitter = tenantScope === void 0 ? configuredWebhookEmitter : webhookEmitter.forTenantScope(tenantScope);
             ctx.emitWebhook = scopedEmitter.emit.bind(scopedEmitter);
           }
-          const result = await handler(params, ctx);
+          const handlerParams = notificationFailureRows.size === 0 ? params : {
+            ...params,
+            accounts: params.accounts.filter(
+              (_entry, index) => !notificationFailureRows.has(index)
+            )
+          };
+          const result = notificationFailureRows.size > 0 && handlerParams.accounts.length === 0 ? { accounts: [], ...params.dry_run === true && { dry_run: true } } : await handler(handlerParams, ctx);
           mutationHandlerCompleted = true;
           let formatted;
           if (isFormattedResponse(result)) {
@@ -3220,6 +3387,42 @@ function createAdcpServer(config) {
           } else {
             formatted = wrap(result);
           }
+          formatted = restoreHandlerErrorIndices(formatted);
+          if (notificationFailureRows.size > 0 && !isErrorResponse(formatted) && !(Array.isArray(formatted.structuredContent?.errors) && formatted.structuredContent?.accounts === void 0)) {
+            formatted = cloneFormattedResponse(formatted);
+            const body = formatted.structuredContent;
+            const acceptedRows = Array.isArray(body.accounts) ? body.accounts.map((row) => restoreSyncAccountErrorIndices(row, acceptedAccountIndices)) : body.accounts;
+            const submitted = isSubmittedEnvelope(body);
+            let accounts;
+            if (submitted) {
+              if (acceptedRows !== void 0 && !Array.isArray(acceptedRows)) {
+                throw new Error("sync_accounts submitted accounts must be an array when present");
+              }
+              accounts = [
+                ...Array.isArray(acceptedRows) ? acceptedRows : [],
+                ...[...notificationFailureRows.entries()].sort(([a], [b]) => a - b).map(([, row]) => row)
+              ];
+            } else {
+              if (!Array.isArray(acceptedRows) || acceptedRows.length !== handlerParams.accounts.length) {
+                throw new Error("sync_accounts handler must return one result row for each accepted account entry");
+              }
+              let acceptedIndex = 0;
+              accounts = params.accounts.map(
+                (_entry, index) => notificationFailureRows.get(index) ?? acceptedRows[acceptedIndex++]
+              );
+            }
+            const merged = { ...body, accounts };
+            if (isFormattedResponse(result)) {
+              const mirrorsStructuredContent = contentTextMirrorsStructuredContent(formatted, body);
+              formatted = { ...formatted, structuredContent: wrap(merged).structuredContent };
+              syncContentJsonText(formatted, formatted.structuredContent, mirrorsStructuredContent);
+            } else {
+              const rejected = accounts.filter((row) => row.action === "failed").length;
+              const synced = accounts.length - rejected;
+              const summary = submitted ? typeof body.message === "string" ? body.message : `Task ${body.task_id} submitted` : `Synced ${synced} account${synced === 1 ? "" : "s"}`;
+              formatted = wrap(merged, `${summary}; ${rejected} account${rejected === 1 ? "" : "s"} rejected`);
+            }
+          }
           if (testControllerBridge && !isErrorResponse(formatted) && isSandboxRequestForSeeding(params) && ctx.account !== void 0 && !isSandboxOrMockAccount(ctx.account)) {
             const resolvedAccountId = typeof ctx.account === "object" && ctx.account !== null && typeof ctx.account.account_id === "string" ? ctx.account.account_id : void 0;
             logger.debug(
@@ -3747,6 +3950,9 @@ function createAdcpServer(config) {
               });
               thrownTypedEnvelope = projectThrownAdcpError(err);
             }
+            if (thrownTypedEnvelope !== void 0) {
+              thrownTypedEnvelope = restoreHandlerErrorIndices(thrownTypedEnvelope);
+            }
             const thrownRecovery = thrownTypedEnvelope ? thrownAdcpErrorRecovery(thrownTypedEnvelope) : void 0;
             let stableTypedOutcome = !mutationHandlerCompleted && !!thrownTypedEnvelope && thrownRecovery !== "transient";
             let replayEnvelope;
@@ -3841,7 +4047,7 @@ function createAdcpServer(config) {
               message: env.message,
               stack: err instanceof Error ? err.stack : void 0
             });
-            return finalize(err);
+            return finalize(restoreHandlerErrorIndices(err));
           }
           if (err instanceof AdcpError) {
             logger.warn("Handler threw an AdcpError", {
@@ -3851,7 +4057,7 @@ function createAdcpServer(config) {
               message: err.message,
               stack: err.stack
             });
-            return finalize(projectThrownAdcpError(err));
+            return finalize(restoreHandlerErrorIndices(projectThrownAdcpError(err)));
           }
           const reason = err instanceof Error ? err.message : String(err);
           logger.error("Handler failed", {
@@ -4154,6 +4360,11 @@ function createAdcpServer(config) {
     }
   }
   checkCoherence(registeredToolNames, logger);
+  if (!resolveAccount && process.env.NODE_ENV !== "production" && ["get_products", "get_signals", "request_proposals", "create_media_buy"].some((tool) => registeredToolNames.has(tool))) {
+    logger.warn(
+      strictAccountReferences ? "Account-carrying tools are registered without resolveAccount. Supplied references will fail with ACCOUNT_NOT_FOUND." : "Account-carrying tools are registered without resolveAccount. Supplied references reach handlers unverified; this is deprecated and they will fail with ACCOUNT_NOT_FOUND in the next major release. Configure a reference-aware resolveAccount and set strictAccountReferences: true."
+    );
+  }
   const registeredMutatingTools = [...registeredToolNames].filter((t) => MUTATING_TASKS.has(t));
   if (registeredToolNames.has("get_creative_features") && idempotency && idempotency.ttlSeconds < 86400) {
     throw new TypeError(

package/dist/lib/server/decisioning/account.d.mts

@@ -305,6 +305,8 @@ export interface ResolvedAuthInfo {
     extra?: Record<string, unknown>;
 }
 export interface ResolveContext {
+    /** True only for provisioning tasks. Discovery/negotiation MUST use lookup only. */
+    readonly provisioning?: boolean;
     /** Authenticated principal extracted by `serve({ authenticate })`. Undefined when no `authenticate` is configured. */
     authInfo?: ResolvedAuthInfo;
     /** Tool the buyer is calling — useful for tool-aware tenant routing. */

package/dist/lib/server/decisioning/account.d.ts

@@ -305,6 +305,8 @@ export interface ResolvedAuthInfo {
     extra?: Record<string, unknown>;
 }
 export interface ResolveContext {
+    /** True only for provisioning tasks. Discovery/negotiation MUST use lookup only. */
+    readonly provisioning?: boolean;
     /** Authenticated principal extracted by `serve({ authenticate })`. Undefined when no `authenticate` is configured. */
     authInfo?: ResolvedAuthInfo;
     /** Tool the buyer is calling — useful for tool-aware tenant routing. */

package/dist/lib/server/decisioning/runtime/from-platform.js

@@ -26,6 +26,8 @@ __export(from_platform_exports, {
   getHydratedLegacyFormatIds: () => getHydratedLegacyFormatIds
 });
 module.exports = __toCommonJS(from_platform_exports);
+var import_account_provisioning = require('../../account-provisioning.js');
+var import_account_reference_warnings = require('../../account-reference-warnings.js');
 var import_node_crypto = require("node:crypto");
 var import_types = require("@modelcontextprotocol/sdk/types.js");
 var import_create_adcp_server = require('../../create-adcp-server.js');
@@ -1297,8 +1299,37 @@ function missingAccountError(toolName, resolution) {
     suggestion: accountRequiredSuggestion(toolName, resolution)
   });
 }
-function assertResolvedAccountMatchesRef(resolution, ref, account, logger) {
+const STRICT_IMPLICIT_IDENTITY_POLICY = Object.freeze({ strict: true });
+function implicitIdentityMismatch(identity, ref) {
+  if (identity.brand && identity.brand.domain !== ref.brand.domain) return "brand.domain";
+  if (identity.brand?.brand_id !== void 0 && ref.brand.brand_id !== void 0 && identity.brand.brand_id !== ref.brand.brand_id)
+    return "brand.brand_id";
+  if (identity.brand?.countries !== void 0 && ref.brand.countries !== void 0 && [...identity.brand.countries].sort().join("\0") !== [...ref.brand.countries].sort().join("\0"))
+    return "brand.countries";
+  if (identity.operator !== void 0 && identity.operator !== ref.operator) return "operator";
+  if (identity.operator_unit !== void 0 && ref.operator_unit !== void 0 && identity.operator_unit.id !== ref.operator_unit.id)
+    return "operator_unit";
+  if (identity.currency !== void 0 && ref.currency !== void 0 && identity.currency !== ref.currency)
+    return "currency";
+  if (identity.timezone !== void 0 && ref.timezone !== void 0 && identity.timezone !== ref.timezone)
+    return "timezone";
+  if (identity.sandbox !== void 0 && identity.sandbox !== (ref.sandbox === true)) return "sandbox";
+  return void 0;
+}
+function assertResolvedAccountMatchesRef(resolution, ref, account, logger, implicitIdentity = STRICT_IMPLICIT_IDENTITY_POLICY) {
   if (account == null) return null;
+  if ((0, import_account.normalizeAccountResolution)(resolution) === "implicit" && ref && "brand" in ref) {
+    const field = implicitIdentityMismatch(account, ref);
+    if (field === void 0) return account;
+    if (implicitIdentity.strict) return null;
+    (0, import_account_reference_warnings.warnAccountReferenceDeprecation)(
+      logger,
+      "ADCP_IMPLICIT_ACCOUNT_IDENTITY_MISMATCH",
+      `[adcp/sdk] DEPRECATED: accounts.resolve returned an account whose ${field} does not match the supplied natural key on a resolution: 'implicit' platform. The account was accepted for compatibility; the next major release (or strictAccountReferences: true) refuses it with ACCOUNT_NOT_FOUND. Resolve by the complete natural key and return identity metadata that matches it.`,
+      { field, accountId: account.id }
+    );
+    return account;
+  }
   if ((0, import_account.normalizeAccountResolution)(resolution) !== "derived") return account;
   const requestedId = (0, import_account.refAccountId)(ref);
   if (requestedId === void 0 || account.id === requestedId) return account;
@@ -1329,6 +1360,7 @@ function createAdcpServerFromPlatform(platform, opts) {
     signals: opts.legacyHandlers?.signals ?? runtimeLegacyOptions.signals
   };
   const runtimeOpts = opts;
+  const implicitIdentityPolicy = { strict: runtimeOpts.strictAccountReferences === true };
   const runtimeLegacyHandlers = legacyHandlers;
   (0, import_validate_platform.validatePlatform)(platform, {
     creative: legacyHandlers.creative,
@@ -1671,7 +1703,8 @@ function createAdcpServerFromPlatform(platform, opts) {
           platform.accounts.resolution,
           ref,
           await platform.accounts.resolve(ref, toResolveCtx(ctx, ctx.toolName, ctx.input)),
-          fwLogger
+          fwLogger,
+          implicitIdentityPolicy
         );
         resolved = account != null;
         resolvedAccountId = account?.id;
@@ -1850,7 +1883,7 @@ function createAdcpServerFromPlatform(platform, opts) {
       mergeOpts
     ),
     accounts: (() => {
-      const platformAccountHandlers = buildAccountHandlers(platform, ctxFor, fwLogger);
+      const platformAccountHandlers = buildAccountHandlers(platform, ctxFor, fwLogger, implicitIdentityPolicy);
       const merged = mergeHandlers(opts.accounts, platformAccountHandlers, "accounts", mergeOpts);
       return guardDerivedSyncGovernance(
         guardAdopterSyncAccounts(merged, platform, platformAccountHandlers, fwLogger),
@@ -1871,7 +1904,8 @@ function createAdcpServerFromPlatform(platform, opts) {
         platform.agentRegistry,
         fwLogger,
         runtimeOpts.resolveSessionKey,
-        opts.credentialPolicy
+        opts.credentialPolicy,
+        implicitIdentityPolicy
       );
       return {
         ...opts.customTools,
@@ -2093,7 +2127,8 @@ function createAdcpServerFromPlatform(platform, opts) {
             platform.accounts.resolution,
             accountRef,
             resolvedAccount,
-            fwLogger
+            fwLogger,
+            implicitIdentityPolicy
           );
           (0, import_observed_modes.recordResolvedAccountMode)(resolvedAccount);
           const accountIsSandbox = resolvedAccount != null && (0, import_account_mode.isSandboxOrMockAccount)(resolvedAccount);
@@ -2235,7 +2270,7 @@ function createAdcpServerFromPlatform(platform, opts) {
     statusChange: statusChangeBus
   });
 }
-function buildTasksGetTool(platform, taskRegistry, agentRegistry, logger, resolveSessionKey, credentialPolicy) {
+function buildTasksGetTool(platform, taskRegistry, agentRegistry, logger, resolveSessionKey, credentialPolicy, implicitIdentityPolicy) {
   const credentialPolicyPatterns = credentialPolicy === void 0 || typeof credentialPolicy === "string" ? void 0 : credentialPolicy.patterns;
   const credentialPolicyError = (args, extra) => {
     if (credentialPolicy === void 0) return void 0;
@@ -2360,7 +2395,8 @@ function buildTasksGetTool(platform, taskRegistry, agentRegistry, logger, resolv
             platform.accounts.resolution,
             ref,
             await platform.accounts.resolve(ref, resolveCtx),
-            logger
+            logger,
+            implicitIdentityPolicy
           );
           if (resolved) {
             resolvedAccountId = resolved.id;
@@ -3167,6 +3203,7 @@ function toResolveCtx(ctx, toolName, input) {
     {
       ...ctx.authInfo !== void 0 && { authInfo: ctx.authInfo },
       ...toolName !== void 0 && { toolName },
+      provisioning: (0, import_account_provisioning.isAccountProvisioningTask)(toolName),
       ...ctx.agent != null && { agent: ctx.agent },
       ...input != null && { input }
     },
@@ -5375,7 +5412,7 @@ function enforceSyncAccountsCommercialPolicy(platform, params, resolveCtx) {
     failedRows
   };
 }
-function buildAccountHandlers(platform, ctxFor, logger = DEFAULT_FRAMEWORK_LOGGER) {
+function buildAccountHandlers(platform, ctxFor, logger = DEFAULT_FRAMEWORK_LOGGER, implicitIdentityPolicy = STRICT_IMPLICIT_IDENTITY_POLICY) {
   const accounts = platform.accounts;
   const handlers = {};
   if (accounts.upsert) {
@@ -5462,7 +5499,8 @@ function buildAccountHandlers(platform, ctxFor, logger = DEFAULT_FRAMEWORK_LOGGE
         accounts.resolution,
         accountRef,
         await accounts.resolve(accountRef, resolveCtx),
-        logger
+        logger,
+        implicitIdentityPolicy
       );
       if (!resolved) {
         const suggestion = accountNotFoundSuggestion(accounts.resolution);
@@ -5499,7 +5537,8 @@ function buildAccountHandlers(platform, ctxFor, logger = DEFAULT_FRAMEWORK_LOGGE
         accounts.resolution,
         accountRef,
         await accounts.resolve(accountRef, resolveCtx),
-        logger
+        logger,
+        implicitIdentityPolicy
       );
       if (!resolved) {
         const suggestion = accountNotFoundSuggestion(accounts.resolution);

package/dist/lib/server/decisioning/runtime/from-platform.mjs

@@ -1,3 +1,5 @@
+import { isAccountProvisioningTask } from "../../account-provisioning.mjs";
+import { warnAccountReferenceDeprecation } from "../../account-reference-warnings.mjs";
 import { randomUUID } from "node:crypto";
 import { ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js";
 import {
@@ -1326,8 +1328,37 @@ function missingAccountError(toolName, resolution) {
     suggestion: accountRequiredSuggestion(toolName, resolution)
   });
 }
-function assertResolvedAccountMatchesRef(resolution, ref, account, logger) {
+const STRICT_IMPLICIT_IDENTITY_POLICY = Object.freeze({ strict: true });
+function implicitIdentityMismatch(identity, ref) {
+  if (identity.brand && identity.brand.domain !== ref.brand.domain) return "brand.domain";
+  if (identity.brand?.brand_id !== void 0 && ref.brand.brand_id !== void 0 && identity.brand.brand_id !== ref.brand.brand_id)
+    return "brand.brand_id";
+  if (identity.brand?.countries !== void 0 && ref.brand.countries !== void 0 && [...identity.brand.countries].sort().join("\0") !== [...ref.brand.countries].sort().join("\0"))
+    return "brand.countries";
+  if (identity.operator !== void 0 && identity.operator !== ref.operator) return "operator";
+  if (identity.operator_unit !== void 0 && ref.operator_unit !== void 0 && identity.operator_unit.id !== ref.operator_unit.id)
+    return "operator_unit";
+  if (identity.currency !== void 0 && ref.currency !== void 0 && identity.currency !== ref.currency)
+    return "currency";
+  if (identity.timezone !== void 0 && ref.timezone !== void 0 && identity.timezone !== ref.timezone)
+    return "timezone";
+  if (identity.sandbox !== void 0 && identity.sandbox !== (ref.sandbox === true)) return "sandbox";
+  return void 0;
+}
+function assertResolvedAccountMatchesRef(resolution, ref, account, logger, implicitIdentity = STRICT_IMPLICIT_IDENTITY_POLICY) {
   if (account == null) return null;
+  if (normalizeAccountResolution(resolution) === "implicit" && ref && "brand" in ref) {
+    const field = implicitIdentityMismatch(account, ref);
+    if (field === void 0) return account;
+    if (implicitIdentity.strict) return null;
+    warnAccountReferenceDeprecation(
+      logger,
+      "ADCP_IMPLICIT_ACCOUNT_IDENTITY_MISMATCH",
+      `[adcp/sdk] DEPRECATED: accounts.resolve returned an account whose ${field} does not match the supplied natural key on a resolution: 'implicit' platform. The account was accepted for compatibility; the next major release (or strictAccountReferences: true) refuses it with ACCOUNT_NOT_FOUND. Resolve by the complete natural key and return identity metadata that matches it.`,
+      { field, accountId: account.id }
+    );
+    return account;
+  }
   if (normalizeAccountResolution(resolution) !== "derived") return account;
   const requestedId = refAccountId(ref);
   if (requestedId === void 0 || account.id === requestedId) return account;
@@ -1358,6 +1389,7 @@ function createAdcpServerFromPlatform(platform, opts) {
     signals: opts.legacyHandlers?.signals ?? runtimeLegacyOptions.signals
   };
   const runtimeOpts = opts;
+  const implicitIdentityPolicy = { strict: runtimeOpts.strictAccountReferences === true };
   const runtimeLegacyHandlers = legacyHandlers;
   validatePlatform(platform, {
     creative: legacyHandlers.creative,
@@ -1700,7 +1732,8 @@ function createAdcpServerFromPlatform(platform, opts) {
           platform.accounts.resolution,
           ref,
           await platform.accounts.resolve(ref, toResolveCtx(ctx, ctx.toolName, ctx.input)),
-          fwLogger
+          fwLogger,
+          implicitIdentityPolicy
         );
         resolved = account != null;
         resolvedAccountId = account?.id;
@@ -1879,7 +1912,7 @@ function createAdcpServerFromPlatform(platform, opts) {
       mergeOpts
     ),
     accounts: (() => {
-      const platformAccountHandlers = buildAccountHandlers(platform, ctxFor, fwLogger);
+      const platformAccountHandlers = buildAccountHandlers(platform, ctxFor, fwLogger, implicitIdentityPolicy);
       const merged = mergeHandlers(opts.accounts, platformAccountHandlers, "accounts", mergeOpts);
       return guardDerivedSyncGovernance(
         guardAdopterSyncAccounts(merged, platform, platformAccountHandlers, fwLogger),
@@ -1900,7 +1933,8 @@ function createAdcpServerFromPlatform(platform, opts) {
         platform.agentRegistry,
         fwLogger,
         runtimeOpts.resolveSessionKey,
-        opts.credentialPolicy
+        opts.credentialPolicy,
+        implicitIdentityPolicy
       );
       return {
         ...opts.customTools,
@@ -2122,7 +2156,8 @@ function createAdcpServerFromPlatform(platform, opts) {
             platform.accounts.resolution,
             accountRef,
             resolvedAccount,
-            fwLogger
+            fwLogger,
+            implicitIdentityPolicy
           );
           recordResolvedAccountMode(resolvedAccount);
           const accountIsSandbox = resolvedAccount != null && isSandboxOrMockAccount(resolvedAccount);
@@ -2264,7 +2299,7 @@ function createAdcpServerFromPlatform(platform, opts) {
     statusChange: statusChangeBus
   });
 }
-function buildTasksGetTool(platform, taskRegistry, agentRegistry, logger, resolveSessionKey, credentialPolicy) {
+function buildTasksGetTool(platform, taskRegistry, agentRegistry, logger, resolveSessionKey, credentialPolicy, implicitIdentityPolicy) {
   const credentialPolicyPatterns = credentialPolicy === void 0 || typeof credentialPolicy === "string" ? void 0 : credentialPolicy.patterns;
   const credentialPolicyError = (args, extra) => {
     if (credentialPolicy === void 0) return void 0;
@@ -2389,7 +2424,8 @@ function buildTasksGetTool(platform, taskRegistry, agentRegistry, logger, resolv
             platform.accounts.resolution,
             ref,
             await platform.accounts.resolve(ref, resolveCtx),
-            logger
+            logger,
+            implicitIdentityPolicy
           );
           if (resolved) {
             resolvedAccountId = resolved.id;
@@ -3196,6 +3232,7 @@ function toResolveCtx(ctx, toolName, input) {
     {
       ...ctx.authInfo !== void 0 && { authInfo: ctx.authInfo },
       ...toolName !== void 0 && { toolName },
+      provisioning: isAccountProvisioningTask(toolName),
       ...ctx.agent != null && { agent: ctx.agent },
       ...input != null && { input }
     },
@@ -5404,7 +5441,7 @@ function enforceSyncAccountsCommercialPolicy(platform, params, resolveCtx) {
     failedRows
   };
 }
-function buildAccountHandlers(platform, ctxFor, logger = DEFAULT_FRAMEWORK_LOGGER) {
+function buildAccountHandlers(platform, ctxFor, logger = DEFAULT_FRAMEWORK_LOGGER, implicitIdentityPolicy = STRICT_IMPLICIT_IDENTITY_POLICY) {
   const accounts = platform.accounts;
   const handlers = {};
   if (accounts.upsert) {
@@ -5491,7 +5528,8 @@ function buildAccountHandlers(platform, ctxFor, logger = DEFAULT_FRAMEWORK_LOGGE
         accounts.resolution,
         accountRef,
         await accounts.resolve(accountRef, resolveCtx),
-        logger
+        logger,
+        implicitIdentityPolicy
       );
       if (!resolved) {
         const suggestion = accountNotFoundSuggestion(accounts.resolution);
@@ -5528,7 +5566,8 @@ function buildAccountHandlers(platform, ctxFor, logger = DEFAULT_FRAMEWORK_LOGGE
         accounts.resolution,
         accountRef,
         await accounts.resolve(accountRef, resolveCtx),
-        logger
+        logger,
+        implicitIdentityPolicy
       );
       if (!resolved) {
         const suggestion = accountNotFoundSuggestion(accounts.resolution);