@adcp/sdk 14.0.0 → 14.2.0

package/dist/lib/errors/index.mjs

@@ -1,3 +1,4 @@
+import { RequestSigningErrorCodeMetadata } from "../types/enums.generated.mjs";
 class ADCPError extends Error {
   constructor(message, details) {
     super(message);
@@ -105,6 +106,7 @@ class AccountRequiredError extends ADCPError {
   accountModel;
   taskName;
   code = "ACCOUNT_REQUIRED";
+  fault = "buyer_setup";
 }
 class AccountPendingApprovalError extends ADCPError {
   constructor(account, accountId) {
@@ -116,6 +118,7 @@ class AccountPendingApprovalError extends ADCPError {
   account;
   accountId;
   code = "ACCOUNT_PENDING_APPROVAL";
+  fault = "buyer_setup";
 }
 class AccountAmbiguousError extends ADCPError {
   constructor(candidates) {
@@ -126,6 +129,36 @@ class AccountAmbiguousError extends ADCPError {
   candidates;
   code = "ACCOUNT_AMBIGUOUS";
 }
+class BuyerSetupError extends ADCPError {
+  fault = "buyer_setup";
+}
+class AccountNotFoundError extends BuyerSetupError {
+  code = "ACCOUNT_NOT_FOUND";
+  constructor(message = "The account has not been provisioned at this seller.") {
+    super(message);
+  }
+}
+class AccountSetupRequiredError extends BuyerSetupError {
+  code = "ACCOUNT_SETUP_REQUIRED";
+  constructor(message = "Complete account setup before making account-scoped requests.") {
+    super(message);
+  }
+}
+class AccountPaymentRequiredError extends BuyerSetupError {
+  code = "ACCOUNT_PAYMENT_REQUIRED";
+  constructor(message = "Complete account payment before making account-scoped requests.") {
+    super(message);
+  }
+}
+class AccountNotProvisionedError extends AccountNotFoundError {
+  constructor(account, taskName) {
+    super(`${taskName} requires an account provisioned at this seller. Call client.accounts.ensure first.`);
+    this.account = account;
+    this.taskName = taskName;
+  }
+  account;
+  taskName;
+}
 class ProtocolError extends ADCPError {
   constructor(protocol, message, originalError) {
     super(`${protocol.toUpperCase()} protocol error: ${message}`);
@@ -181,13 +214,21 @@ class ConfigurationError extends ADCPError {
   code = "CONFIGURATION_ERROR";
 }
 class AuthenticationRequiredError extends ADCPError {
-  constructor(agentUrl, oauthMetadata, message, challenge) {
-    const defaultMessage = buildAuthRequiredMessage(agentUrl, oauthMetadata, challenge);
+  constructor(agentUrl, oauthMetadata, message, challenge, signedRejection) {
+    const defaultMessage = buildAuthRequiredMessage(agentUrl, oauthMetadata, challenge, !!signedRejection);
     super(message || defaultMessage);
     this.agentUrl = agentUrl;
     this.oauthMetadata = oauthMetadata;
     this.challenge = challenge;
     this.details = { agentUrl, oauthMetadata, challenge };
+    if (signedRejection) {
+      this.requestSigned = true;
+      this.status = signedRejection.status;
+      const signatureCode = getRequestSignatureRejectionCode(challenge);
+      if (signatureCode) this.signatureErrorCode = signatureCode;
+      Object.defineProperty(this, "responseBody", { value: signedRejection.responseBody, enumerable: false });
+      this.details = { agentUrl, challenge, requestSigned: true, status: this.status };
+    }
   }
   agentUrl;
   oauthMetadata;
@@ -245,7 +286,12 @@ function sanitizeAgentUrlForError(value) {
     return "invalid_url";
   }
 }
-function buildAuthRequiredMessage(agentUrl, oauthMetadata, challenge) {
+function buildAuthRequiredMessage(agentUrl, oauthMetadata, challenge, requestSigned = false) {
+  if (requestSigned || challenge?.scheme === "signature") {
+    const code = getRequestSignatureRejectionCode(challenge);
+    const suggestion = code ? ` ${RequestSigningErrorCodeMetadata[code].suggestion}.` : "";
+    return `Authentication failed with HTTP 401 for ${sanitizeAgentUrlForError(agentUrl)}. ` + (requestSigned ? "The seller rejected an SDK-signed request" : "The seller requires a valid request signature") + (code ? ` (${code})` : "") + ". Check signature verification and key discovery (brand_json_url \u2192 agents[] \u2192 jwks_uri)." + (requestSigned && !challenge ? " No authentication challenge was returned; check configured credentials too." : "") + suggestion + (requestSigned ? " A bounded seller diagnostic is available on responseBody when captured." : "");
+  }
   if (challenge && challenge.scheme !== "bearer") {
     if (challenge.scheme === "basic") {
       return `Authentication required for ${agentUrl}. Agent (or its fronting gateway) speaks HTTP Basic (RFC 7617). Configure via createTestClient({ auth: { type: 'basic', username, password } }) \u2014 or from the CLI, --auth <user:pass> --auth-scheme basic.`;
@@ -258,6 +304,10 @@ function buildAuthRequiredMessage(agentUrl, oauthMetadata, challenge) {
   }
   return `Authentication required for ${agentUrl}. No OAuth metadata available - provide auth_token in agent config.`;
 }
+function getRequestSignatureRejectionCode(challenge) {
+  if (challenge?.scheme !== "signature" || !challenge.error) return void 0;
+  return Object.prototype.hasOwnProperty.call(RequestSigningErrorCodeMetadata, challenge.error) ? challenge.error : void 0;
+}
 class IdempotencyConflictError extends ADCPError {
   code = "IDEMPOTENCY_CONFLICT";
   // Exposed via the getter so `console.log(err)` and JSON.stringify don't
@@ -463,6 +513,12 @@ function is401Error(error, got401Flag = false) {
 }
 function adcpErrorToTypedError(adcpError, idempotencyKey) {
   switch (adcpError.code) {
+    case "ACCOUNT_NOT_FOUND":
+      return new AccountNotFoundError(adcpError.message);
+    case "ACCOUNT_SETUP_REQUIRED":
+      return new AccountSetupRequiredError(adcpError.message);
+    case "ACCOUNT_PAYMENT_REQUIRED":
+      return new AccountPaymentRequiredError(adcpError.message);
     case "IDEMPOTENCY_CONFLICT":
       return new IdempotencyConflictError(idempotencyKey, adcpError.message);
     case "IDEMPOTENCY_EXPIRED":
@@ -540,12 +596,17 @@ function extractErrorInfo(error) {
 export {
   ADCPError,
   AccountAmbiguousError,
+  AccountNotFoundError,
+  AccountNotProvisionedError,
+  AccountPaymentRequiredError,
   AccountPendingApprovalError,
   AccountRequiredError,
+  AccountSetupRequiredError,
   ActionNotAllowedError,
   AgentNotFoundError,
   AuthenticationCredentialsRejectedError,
   AuthenticationRequiredError,
+  BuyerSetupError,
   ConfigurationError,
   DeferredTaskError,
   FeatureUnsupportedError,

package/dist/lib/governance/authorization.d.mts

@@ -12,6 +12,7 @@ import type { CheckGovernanceRequest, GovernancePhase, PlannedDelivery } from '.
 import type { JwksResolver } from '../signing/jwks.mjs';
 import type { ReplayStore } from '../signing/replay.mjs';
 import type { RevocationStore } from '../signing/revocation.mjs';
+import { type HttpsJwksResolverOptions } from '../signing/jwks-https.mjs';
 export declare const GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS: readonly ["authorized_commitment", "authorized_task", "authorized_payload_hash"];
 export type GovernanceAuthorizationCriticalClaim = (typeof GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS)[number];
 export type GovernanceEnforcementMode = 'signed_context' | 'online_execution_check';
@@ -101,6 +102,18 @@ export interface GovernanceRevocationStatus {
 export interface GovernanceRevocationResolver {
     resolve(issuer: string, kid: string, jti: string): GovernanceRevocationStatus | Promise<GovernanceRevocationStatus>;
 }
+/** Authenticated buyer context, never the JWS payload or a sibling brand's record. */
+export interface GovernanceBuyerIdentity {
+    /** For signed buyers, pass AgentResolution.brandJson without refetching its host. */
+    brandJson: unknown;
+    /** Domain of the governed request's brand; portfolio brands require an exact URL hostname match (including www). */
+    brandDomain: string;
+    /** Trusted resolver factory; implementations may cache by canonical JWKS URI. */
+    jwksForUri?: (jwksUri: string) => JwksResolver;
+    /** Reuse this options object across requests to share its bounded resolver cache. */
+    jwksOptions?: HttpsJwksResolverOptions;
+}
+export declare function createGovernanceAgentJwksResolver(issuer: string, buyer: GovernanceBuyerIdentity): JwksResolver;
 export interface VerifyGovernanceAuthorizationOptions {
     token: unknown;
     expectedIssuer: string;
@@ -111,7 +124,9 @@ export interface VerifyGovernanceAuthorizationOptions {
     actualCommitment: GovernanceCommitment;
     /** Defaults to `intent`, the phase accepted by a downstream service. */
     expectedPhase?: 'intent';
-    jwks: JwksResolver;
+    jwks?: JwksResolver;
+    /** When supplied, discover keys from this exact authenticated buyer record. */
+    buyerIdentity?: GovernanceBuyerIdentity;
     replayStore: GovernanceReplayStore;
     /** Optional governance-key revocation source. */
     revocationStore?: RevocationStore;
@@ -178,6 +193,7 @@ export declare class GovernanceAuthorizationError extends Error {
 }
 export interface GovernanceEnforcementMiddlewareInput {
     token: unknown;
+    buyerIdentity?: GovernanceBuyerIdentity;
     authenticatedCaller: string;
     task: string;
     payload: Record<string, unknown>;

package/dist/lib/governance/authorization.d.ts

@@ -12,6 +12,7 @@ import type { CheckGovernanceRequest, GovernancePhase, PlannedDelivery } from '.
 import type { JwksResolver } from '../signing/jwks';
 import type { ReplayStore } from '../signing/replay';
 import type { RevocationStore } from '../signing/revocation';
+import { type HttpsJwksResolverOptions } from '../signing/jwks-https';
 export declare const GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS: readonly ["authorized_commitment", "authorized_task", "authorized_payload_hash"];
 export type GovernanceAuthorizationCriticalClaim = (typeof GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS)[number];
 export type GovernanceEnforcementMode = 'signed_context' | 'online_execution_check';
@@ -101,6 +102,18 @@ export interface GovernanceRevocationStatus {
 export interface GovernanceRevocationResolver {
     resolve(issuer: string, kid: string, jti: string): GovernanceRevocationStatus | Promise<GovernanceRevocationStatus>;
 }
+/** Authenticated buyer context, never the JWS payload or a sibling brand's record. */
+export interface GovernanceBuyerIdentity {
+    /** For signed buyers, pass AgentResolution.brandJson without refetching its host. */
+    brandJson: unknown;
+    /** Domain of the governed request's brand; portfolio brands require an exact URL hostname match (including www). */
+    brandDomain: string;
+    /** Trusted resolver factory; implementations may cache by canonical JWKS URI. */
+    jwksForUri?: (jwksUri: string) => JwksResolver;
+    /** Reuse this options object across requests to share its bounded resolver cache. */
+    jwksOptions?: HttpsJwksResolverOptions;
+}
+export declare function createGovernanceAgentJwksResolver(issuer: string, buyer: GovernanceBuyerIdentity): JwksResolver;
 export interface VerifyGovernanceAuthorizationOptions {
     token: unknown;
     expectedIssuer: string;
@@ -111,7 +124,9 @@ export interface VerifyGovernanceAuthorizationOptions {
     actualCommitment: GovernanceCommitment;
     /** Defaults to `intent`, the phase accepted by a downstream service. */
     expectedPhase?: 'intent';
-    jwks: JwksResolver;
+    jwks?: JwksResolver;
+    /** When supplied, discover keys from this exact authenticated buyer record. */
+    buyerIdentity?: GovernanceBuyerIdentity;
     replayStore: GovernanceReplayStore;
     /** Optional governance-key revocation source. */
     revocationStore?: RevocationStore;
@@ -178,6 +193,7 @@ export declare class GovernanceAuthorizationError extends Error {
 }
 export interface GovernanceEnforcementMiddlewareInput {
     token: unknown;
+    buyerIdentity?: GovernanceBuyerIdentity;
     authenticatedCaller: string;
     task: string;
     payload: Record<string, unknown>;

package/dist/lib/governance/authorization.js

@@ -28,6 +28,7 @@ __export(authorization_exports, {
   buildGovernanceIntentRequest: () => buildGovernanceIntentRequest,
   buildGovernanceProposedCommitment: () => buildGovernanceProposedCommitment,
   computeGovernedPayloadHash: () => computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver: () => createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware: () => createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks: () => getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask: () => governancePurchaseTypeForTask,
@@ -40,6 +41,8 @@ module.exports = __toCommonJS(authorization_exports);
 var import_node_crypto = require("node:crypto");
 var import_jose = require("jose");
 var import_jcs = require('../utils/jcs.js');
+var import_jwks_https = require('../signing/jwks-https.js');
+var import_select_agent = require('../signing/agent-resolver/select-agent.js');
 var import_strict_json = require('../signing/agent-resolver/strict-json.js');
 const GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS = Object.freeze([
   "authorized_commitment",
@@ -99,6 +102,42 @@ class InMemoryGovernanceReplayStore {
     return scope;
   }
 }
+const governanceDefaultResolvers = /* @__PURE__ */ new Map();
+const governanceConfiguredResolvers = /* @__PURE__ */ new WeakMap();
+function createGovernanceAgentJwksResolver(issuer, buyer) {
+  const record = (0, import_select_agent.relyingPartyAgentRecord)(buyer.brandJson, buyer.brandDomain);
+  const entry = (0, import_select_agent.selectAgentByUrl)(record, issuer, { agentType: "governance" });
+  const uri = (0, import_select_agent.agentJwksUri)(entry);
+  if (buyer.jwksForUri) return buyer.jwksForUri(uri);
+  const key = (0, import_select_agent.canonicalAgentUrl)(uri);
+  let cache = governanceDefaultResolvers;
+  if (buyer.jwksOptions) {
+    const existing = governanceConfiguredResolvers.get(buyer.jwksOptions);
+    cache = existing ?? /* @__PURE__ */ new Map();
+    if (!existing) governanceConfiguredResolvers.set(buyer.jwksOptions, cache);
+  }
+  let resolver = cache.get(key);
+  if (!resolver) {
+    const maxAge = buyer.jwksOptions?.maxAgeSeconds ?? 1800;
+    const minCooldown = buyer.jwksOptions?.minCooldownSeconds ?? 30;
+    if (!Number.isFinite(maxAge) || maxAge <= 0) {
+      throw new TypeError("Governance maxAgeSeconds must be a finite positive number");
+    }
+    if (!Number.isFinite(minCooldown) || minCooldown < 0) {
+      throw new TypeError("Governance minCooldownSeconds must be a finite non-negative number");
+    }
+    resolver = new import_jwks_https.HttpsJwksResolver(uri, {
+      ...buyer.jwksOptions,
+      maxAgeSeconds: Math.min(maxAge, 1800),
+      minCooldownSeconds: Math.max(minCooldown, 30),
+      minCacheAgeSeconds: 60,
+      failClosed: true
+    });
+    if (cache.size >= 512) cache.delete(cache.keys().next().value);
+    cache.set(key, resolver);
+  }
+  return resolver;
+}
 function buildGovernanceCommitment(amount, currency) {
   if (!Number.isFinite(amount) || amount < 0) {
     throw new TypeError("Governance commitment amount must be finite and non-negative");
@@ -300,14 +339,21 @@ async function verifyGovernanceAuthorization(options) {
   if (decodedClaims.authorized_task === void 0 !== (decodedClaims.authorized_payload_hash === void 0)) {
     return reject("governance_token_invalid", "authorized_task and authorized_payload_hash must appear together");
   }
-  if (typeof decodedClaims.iss !== "string" || decodedClaims.iss !== options.expectedIssuer) {
+  let canonicalIssuer;
+  try {
+    if (typeof decodedClaims.iss !== "string") throw new TypeError("Missing issuer");
+    canonicalIssuer = (0, import_select_agent.canonicalAgentUrl)(decodedClaims.iss);
+    if (canonicalIssuer !== (0, import_select_agent.canonicalAgentUrl)(options.expectedIssuer)) throw new TypeError("Issuer mismatch");
+  } catch {
     return reject("governance_token_invalid", "Governance token issuer mismatch");
   }
   const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
   if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
   let jwk;
   try {
-    jwk = await options.jwks.resolve(kid);
+    const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
+    if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
+    jwk = await resolver.resolve(kid);
   } catch {
     return reject("governance_key_unknown", "Governance signing key could not be resolved");
   }
@@ -331,7 +377,7 @@ async function verifyGovernanceAuthorization(options) {
     if (options.revocationStore && await options.revocationStore.isRevoked(kid)) {
       return reject("governance_token_revoked", "Governance signing key is revoked");
     }
-    if (options.isJtiRevoked && typeof decodedClaims.jti === "string" && await options.isJtiRevoked(decodedClaims.iss, decodedClaims.jti)) {
+    if (options.isJtiRevoked && typeof decodedClaims.jti === "string" && await options.isJtiRevoked(canonicalIssuer, decodedClaims.jti)) {
       return reject("governance_token_revoked", "Governance token is revoked");
     }
   } catch {
@@ -401,8 +447,8 @@ async function verifyGovernanceAuthorization(options) {
   let hasFreshCombinedRevocation = false;
   if (options.revocationResolver) {
     try {
-      const status = await options.revocationResolver.resolve(decodedClaims.iss, kid, decodedClaims.jti);
-      if (status.issuer !== decodedClaims.iss || typeof status.keyRevoked !== "boolean" || typeof status.jtiRevoked !== "boolean" || !Number.isFinite(status.nextUpdate) || status.nextUpdate < now) {
+      const status = await options.revocationResolver.resolve(canonicalIssuer, kid, decodedClaims.jti);
+      if ((0, import_select_agent.canonicalAgentUrl)(status.issuer) !== canonicalIssuer || typeof status.keyRevoked !== "boolean" || typeof status.jtiRevoked !== "boolean" || !Number.isFinite(status.nextUpdate) || status.nextUpdate < now) {
         return reject("governance_token_revoked", "Governance revocation status is stale or mismatched");
       }
       if (status.keyRevoked || status.jtiRevoked) {
@@ -455,7 +501,7 @@ async function verifyGovernanceAuthorization(options) {
   try {
     const idempotencyKey = typeof options.payload.idempotency_key === "string" ? options.payload.idempotency_key : void 0;
     replayResult = await options.replayStore.consume(
-      decodedClaims.iss,
+      canonicalIssuer,
       decodedClaims.aud,
       decodedClaims.jti,
       decodedClaims.exp + skew,
@@ -500,7 +546,8 @@ function createGovernanceEnforcementMiddleware(config) {
       expectedTask: input.task,
       payload: input.payload,
       actualCommitment: input.actualCommitment,
-      expectedPhase: input.expectedPhase
+      expectedPhase: input.expectedPhase,
+      ...input.buyerIdentity !== void 0 && { buyerIdentity: input.buyerIdentity }
     });
     if (!result.ok) throw new GovernanceAuthorizationError(result);
     return next(result);
@@ -531,6 +578,7 @@ function decodeJsonObject(segment) {
   buildGovernanceIntentRequest,
   buildGovernanceProposedCommitment,
   computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask,

package/dist/lib/governance/authorization.mjs

@@ -1,6 +1,13 @@
 import { createHash } from "node:crypto";
 import { compactVerify, importJWK } from "jose";
 import { canonicalize } from "../utils/jcs.mjs";
+import { HttpsJwksResolver } from "../signing/jwks-https.mjs";
+import {
+  relyingPartyAgentRecord,
+  selectAgentByUrl,
+  agentJwksUri,
+  canonicalAgentUrl
+} from "../signing/agent-resolver/select-agent.mjs";
 import { parseStrictJson } from "../signing/agent-resolver/strict-json.mjs";
 const GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS = Object.freeze([
   "authorized_commitment",
@@ -60,6 +67,42 @@ class InMemoryGovernanceReplayStore {
     return scope;
   }
 }
+const governanceDefaultResolvers = /* @__PURE__ */ new Map();
+const governanceConfiguredResolvers = /* @__PURE__ */ new WeakMap();
+function createGovernanceAgentJwksResolver(issuer, buyer) {
+  const record = relyingPartyAgentRecord(buyer.brandJson, buyer.brandDomain);
+  const entry = selectAgentByUrl(record, issuer, { agentType: "governance" });
+  const uri = agentJwksUri(entry);
+  if (buyer.jwksForUri) return buyer.jwksForUri(uri);
+  const key = canonicalAgentUrl(uri);
+  let cache = governanceDefaultResolvers;
+  if (buyer.jwksOptions) {
+    const existing = governanceConfiguredResolvers.get(buyer.jwksOptions);
+    cache = existing ?? /* @__PURE__ */ new Map();
+    if (!existing) governanceConfiguredResolvers.set(buyer.jwksOptions, cache);
+  }
+  let resolver = cache.get(key);
+  if (!resolver) {
+    const maxAge = buyer.jwksOptions?.maxAgeSeconds ?? 1800;
+    const minCooldown = buyer.jwksOptions?.minCooldownSeconds ?? 30;
+    if (!Number.isFinite(maxAge) || maxAge <= 0) {
+      throw new TypeError("Governance maxAgeSeconds must be a finite positive number");
+    }
+    if (!Number.isFinite(minCooldown) || minCooldown < 0) {
+      throw new TypeError("Governance minCooldownSeconds must be a finite non-negative number");
+    }
+    resolver = new HttpsJwksResolver(uri, {
+      ...buyer.jwksOptions,
+      maxAgeSeconds: Math.min(maxAge, 1800),
+      minCooldownSeconds: Math.max(minCooldown, 30),
+      minCacheAgeSeconds: 60,
+      failClosed: true
+    });
+    if (cache.size >= 512) cache.delete(cache.keys().next().value);
+    cache.set(key, resolver);
+  }
+  return resolver;
+}
 function buildGovernanceCommitment(amount, currency) {
   if (!Number.isFinite(amount) || amount < 0) {
     throw new TypeError("Governance commitment amount must be finite and non-negative");
@@ -261,14 +304,21 @@ async function verifyGovernanceAuthorization(options) {
   if (decodedClaims.authorized_task === void 0 !== (decodedClaims.authorized_payload_hash === void 0)) {
     return reject("governance_token_invalid", "authorized_task and authorized_payload_hash must appear together");
   }
-  if (typeof decodedClaims.iss !== "string" || decodedClaims.iss !== options.expectedIssuer) {
+  let canonicalIssuer;
+  try {
+    if (typeof decodedClaims.iss !== "string") throw new TypeError("Missing issuer");
+    canonicalIssuer = canonicalAgentUrl(decodedClaims.iss);
+    if (canonicalIssuer !== canonicalAgentUrl(options.expectedIssuer)) throw new TypeError("Issuer mismatch");
+  } catch {
     return reject("governance_token_invalid", "Governance token issuer mismatch");
   }
   const kid = typeof protectedHeader.kid === "string" ? protectedHeader.kid : "";
   if (!kid) return reject("governance_key_unknown", "Governance signing kid is missing");
   let jwk;
   try {
-    jwk = await options.jwks.resolve(kid);
+    const resolver = options.buyerIdentity ? createGovernanceAgentJwksResolver(canonicalIssuer, options.buyerIdentity) : options.jwks;
+    if (!resolver) return reject("governance_key_unknown", "No governance key resolver or buyer identity configured");
+    jwk = await resolver.resolve(kid);
   } catch {
     return reject("governance_key_unknown", "Governance signing key could not be resolved");
   }
@@ -292,7 +342,7 @@ async function verifyGovernanceAuthorization(options) {
     if (options.revocationStore && await options.revocationStore.isRevoked(kid)) {
       return reject("governance_token_revoked", "Governance signing key is revoked");
     }
-    if (options.isJtiRevoked && typeof decodedClaims.jti === "string" && await options.isJtiRevoked(decodedClaims.iss, decodedClaims.jti)) {
+    if (options.isJtiRevoked && typeof decodedClaims.jti === "string" && await options.isJtiRevoked(canonicalIssuer, decodedClaims.jti)) {
       return reject("governance_token_revoked", "Governance token is revoked");
     }
   } catch {
@@ -362,8 +412,8 @@ async function verifyGovernanceAuthorization(options) {
   let hasFreshCombinedRevocation = false;
   if (options.revocationResolver) {
     try {
-      const status = await options.revocationResolver.resolve(decodedClaims.iss, kid, decodedClaims.jti);
-      if (status.issuer !== decodedClaims.iss || typeof status.keyRevoked !== "boolean" || typeof status.jtiRevoked !== "boolean" || !Number.isFinite(status.nextUpdate) || status.nextUpdate < now) {
+      const status = await options.revocationResolver.resolve(canonicalIssuer, kid, decodedClaims.jti);
+      if (canonicalAgentUrl(status.issuer) !== canonicalIssuer || typeof status.keyRevoked !== "boolean" || typeof status.jtiRevoked !== "boolean" || !Number.isFinite(status.nextUpdate) || status.nextUpdate < now) {
         return reject("governance_token_revoked", "Governance revocation status is stale or mismatched");
       }
       if (status.keyRevoked || status.jtiRevoked) {
@@ -416,7 +466,7 @@ async function verifyGovernanceAuthorization(options) {
   try {
     const idempotencyKey = typeof options.payload.idempotency_key === "string" ? options.payload.idempotency_key : void 0;
     replayResult = await options.replayStore.consume(
-      decodedClaims.iss,
+      canonicalIssuer,
       decodedClaims.aud,
       decodedClaims.jti,
       decodedClaims.exp + skew,
@@ -461,7 +511,8 @@ function createGovernanceEnforcementMiddleware(config) {
       expectedTask: input.task,
       payload: input.payload,
       actualCommitment: input.actualCommitment,
-      expectedPhase: input.expectedPhase
+      expectedPhase: input.expectedPhase,
+      ...input.buyerIdentity !== void 0 && { buyerIdentity: input.buyerIdentity }
     });
     if (!result.ok) throw new GovernanceAuthorizationError(result);
     return next(result);
@@ -491,6 +542,7 @@ export {
   buildGovernanceIntentRequest,
   buildGovernanceProposedCommitment,
   computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask,

package/dist/lib/governance/index.d.mts

@@ -13,8 +13,8 @@
  * advisory — the authoritative check happens in the governance agent, which
  * resolves category synonyms and custom policies server-side.
  */
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, } from './authorization.mjs';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, } from './authorization.mjs';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from './authorization.mjs';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './authorization.mjs';
 /**
  * `policy_categories` values that MUST set `human_review_required: true`
  * under GDPR Art 22 / EU AI Act Annex III. Matches the schema's `if/then`

package/dist/lib/governance/index.d.ts

@@ -13,8 +13,8 @@
  * advisory — the authoritative check happens in the governance agent, which
  * resolves category synonyms and custom policies server-side.
  */
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, } from './authorization';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, } from './authorization';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from './authorization';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, InMemoryGovernanceReplayStoreOptions, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './authorization';
 /**
  * `policy_categories` values that MUST set `human_review_required: true`
  * under GDPR Art 22 / EU AI Act Annex III. Matches the schema's `if/then`

package/dist/lib/governance/index.js

@@ -32,6 +32,7 @@ __export(governance_exports, {
   buildHumanOverride: () => buildHumanOverride,
   buildHumanReviewPlan: () => buildHumanReviewPlan,
   computeGovernedPayloadHash: () => import_authorization.computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver: () => import_authorization.createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware: () => import_authorization.createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks: () => import_authorization.getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask: () => import_authorization.governancePurchaseTypeForTask,
@@ -156,6 +157,7 @@ function validateGovernancePlan(plan) {
   buildHumanOverride,
   buildHumanReviewPlan,
   computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask,

package/dist/lib/governance/index.mjs

@@ -15,7 +15,8 @@ import {
   governanceTaskRequiresProposedCommitment,
   targetDeclaresGovernanceEnforcement,
   targetDeclaresLegacyGovernanceAwareness,
-  verifyGovernanceAuthorization
+  verifyGovernanceAuthorization,
+  createGovernanceAgentJwksResolver
 } from "./authorization.mjs";
 const REGULATED_HUMAN_REVIEW_CATEGORIES = Object.freeze([
   "fair_housing",
@@ -129,6 +130,7 @@ export {
   buildHumanOverride,
   buildHumanReviewPlan,
   computeGovernedPayloadHash,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   getGovernanceEnforcementTasks,
   governancePurchaseTypeForTask,

package/dist/lib/index.d.mts

@@ -37,12 +37,12 @@ export type { GovernanceConfig, CampaignGovernanceConfig, GovernanceCheckResult,
 export { GovernanceMiddleware } from './core/GovernanceMiddleware.mjs';
 export { isGovernanceApproved, isGovernanceConditions, isGovernanceDenied, normalizeGovernanceVerdict, } from './core/GovernanceTypes.mjs';
 export type { GovernanceDebugEntry } from './core/GovernanceMiddleware.mjs';
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, buildHumanReviewPlan, buildHumanOverride, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, validateGovernancePlan, verifyGovernanceAuthorization, REGULATED_HUMAN_REVIEW_CATEGORIES, ANNEX_III_POLICY_IDS, } from './governance/index.mjs';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, buildHumanReviewPlan, buildHumanOverride, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, validateGovernancePlan, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, REGULATED_HUMAN_REVIEW_CATEGORIES, ANNEX_III_POLICY_IDS, } from './governance/index.mjs';
 export { ssrfSafeFetch, decodeBodyAsJsonOrText, SSRF_TRANSIENT_CODES, SsrfRefusedError, isPrivateIp, isAlwaysBlocked, isLikelyPrivateUrl, type SsrfRefusedCode, type SsrfDnsLookup, type SsrfFetchOptions, type SsrfFetchResult, } from './net/index.mjs';
 export { createCanonicalReferenceCache, createCanonicalReferenceResolver, canonicalReferenceCacheKey, resolveCanonicalReference, resolveFormatSchemaReference, resolvePlatformExtensionsReference, type CanonicalReference, type CanonicalReferenceCache, type CanonicalReferenceCacheOptions, type CanonicalReferenceError, type CanonicalReferenceErrorCode, type CanonicalReferenceFailureResult, type CanonicalReferenceKind, type CanonicalReferenceResolveOptions, type CanonicalReferenceResolvedResult, type CanonicalReferenceResolver, type CanonicalReferenceResolverOptions, type CanonicalReferenceResult, type CanonicalReferenceStatus, type ExternalRefDigestMap, type FormatSchemaReferenceResolvedResult, type FormatSchemaReferenceResult, type PlatformExtensionsReferenceResult, } from './canonical-references/index.mjs';
 export { assessAcceptancePolicy, createAcceptancePolicyCatalogResolver, resolveAcceptancePolicyCatalog, resolveAcceptancePolicyProfiles, resolveVerifiedAcceptancePolicyProfiles, type AcceptancePolicyCatalog, type AcceptancePolicyCatalogErrorCode, type AcceptancePolicyCatalogFailure, type AcceptancePolicyCatalogIssue, type AcceptancePolicyCatalogResolver, type AcceptancePolicyCatalogResult, type AcceptancePolicyCatalogSuccess, type AcceptancePolicyDiscoveryCapability, type AcceptancePolicyProfile, type AcceptancePolicyProfileResolution, type AcceptancePolicyRegistryPolicy, type AcceptancePolicyRegistryResolver, type AcceptancePolicyReference, type AcceptancePolicyRequirement, type AcceptancePolicyRule, type AcceptancePolicySurface, type RegistryAcceptancePolicyProfileReference, type ResolveAcceptancePolicyCatalogOptions, type ResolveVerifiedAcceptancePolicyProfilesOptions, type ResolvedAcceptancePolicyDefault, type VerifiedAcceptancePolicyProfilesResult, type VerifiedAcceptancePolicyProfilesSuccess, } from './acceptance-policy/index.mjs';
 export { type AcceptancePolicyAssessment, type AcceptancePolicyAssessmentDiagnostic, type AcceptancePolicyAssessmentDiagnosticCode, type AcceptancePolicyMatchedRule, type AcceptancePolicyOutcome, type AssessAcceptancePolicyInput, } from './acceptance-policy/evaluator.mjs';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, } from './governance/index.mjs';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './governance/index.mjs';
 export type { BaseTaskEvent, ProtocolRequestEvent, ProtocolResponseEvent, TaskStatusEvent, ObjectEvent, TaskEvent, TaskEventCallbacks, } from './core/TaskEventTypes.mjs';
 export { createOperationId } from './core/TaskEventTypes.mjs';
 export type { AsyncHandlerConfig, WebhookMetadata, Activity, NotificationMetadata, MediaBuyDeliveryNotification, CreateMediaBuyStatusChangeHandler, UpdateMediaBuyStatusChangeHandler, SyncCreativesStatusChangeHandler, GetProductsStatusChangeHandler, ListProductsStatusChangeHandler, } from './core/AsyncHandler.mjs';
@@ -53,7 +53,7 @@ export * from './handlers/types.mjs';
 export type { Storage, AtomicTakeStorage, DeferredTaskStorage, BatchStorage, PatternStorage, AgentCapabilities, ConversationState, DeferredTaskState, StorageConfig, StorageFactory, StorageMiddleware, } from './storage/interfaces.mjs';
 export { MemoryStorage, createMemoryStorage, createMemoryStorageConfig } from './storage/MemoryStorage.mjs';
 export { ADCPError, TaskTimeoutError, MaxClarificationError, DeferredTaskError, TaskAbortedError, AgentNotFoundError, UnsupportedTaskError, ProtocolError, ValidationError as ADCPValidationError, // Rename to avoid conflict
-MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors/index.mjs';
+MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, BuyerSetupError, AccountNotFoundError, AccountSetupRequiredError, AccountPaymentRequiredError, AccountNotProvisionedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors/index.mjs';
 export type { OAuthMetadataInfo, ClientPreflightAdcpErrorInfo, ClientPreflightAdcpErrorRecovery, FeatureUnsupportedErrorOptions, ProtocolFeatureUnsupportedErrorOptions, ActionNotAllowedErrorDetails, ActionNotAllowedReasonValue, ActionNotAllowedAttemptedAction, ActionNotAllowedAvailableAction, ActionNotAllowedRecovery, } from './errors/index.mjs';
 export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionId, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyUpdateFieldAction, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, StructuredOnlyMediaBuyAction, ResolvedTargetingInput, TargetingInputFor, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy/index.mjs';
 export { ACTIONS_BY_FIELD, LEGACY_COARSE_ACTIONS, STRUCTURED_ONLY_MEDIA_BUY_ACTIONS, UPDATE_FIELDS_BY_ACTION, applyTargetingInput, hasTargetingClears, resolveTargetingInput, canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, findAvailableAction, getActionForMutation, getAvailableActions, getRollupParent, ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, preflightUpdateMediaBuy, recoveryForModeMismatch, validateProductsAgainstPropertyPolicy, } from './media-buy/index.mjs';
@@ -237,7 +237,8 @@ export { resolvePreviewAuthority, type PlacementPreviewCandidate, type PreviewAu
 export { isStatusCompleted, isStatusWorking, isStatusInputRequired, isStatusSubmitted, isStatusFailed, isStatusRejected, isGetProductsCompleted, isGetProductsWorking, isGetProductsInputRequired, isGetProductsSubmitted, isGetProductsFailed, isCreateMediaBuyCompleted, isCreateMediaBuyWorking, isCreateMediaBuyInputRequired, isCreateMediaBuySubmitted, isCreateMediaBuyFailed, isUpdateMediaBuyCompleted, isUpdateMediaBuyWorking, isUpdateMediaBuyInputRequired, isUpdateMediaBuySubmitted, isUpdateMediaBuyFailed, isSyncCreativesCompleted, isSyncCreativesWorking, isSyncCreativesInputRequired, isSyncCreativesSubmitted, isSyncCreativesFailed, } from './utils/typeGuards.mjs';
 export { getAdcpVersion, getLibraryVersion, isCompatibleWith, getCompatibleVersions, parseAdcpMajorVersion, ADCP_VERSION, ADCP_MAJOR_VERSION, LIBRARY_VERSION, COMPATIBLE_ADCP_VERSIONS, VERSION_INFO, } from './version.mjs';
 export type { AdcpVersion } from './version.mjs';
-export { listBundledAdcpVersions, resolveAdcpVersion } from './utils/adcp-version-config.mjs';
+export { listBundledAdcpVersions, resolveAdcpVersion, isAdcpVersionAtLeast, sellerAdvertises31, shouldOmit31Fields, } from './utils/adcp-version-config.mjs';
+export { redactSecrets } from './utils/redact-secrets.mjs';
 export { getTracer, isTracingEnabled, injectTraceHeaders, withSpan, addSpanAttributes, recordSpanException, } from './observability/index.mjs';
 export { Agent as LegacyAgent, AgentCollection as LegacyAgentCollection } from './agents/index.generated.mjs';
 export { LegacyContentStandardsAdapter, type LegacyIContentStandardsAdapter, type LegacyContentEvaluationResult, LegacyContentStandardsErrorCodes, isLegacyContentStandardsError, legacyDefaultContentStandardsAdapter, PropertyListAdapter, type IPropertyListAdapter, type ResolvedProperty, PropertyListErrorCodes, isPropertyListError, defaultPropertyListAdapter, SISessionManager, AISISessionManager, type ISISessionManager, type SISession, SIErrorCodes, defaultSISessionManager, GovernanceAdapter, defaultGovernanceAdapter, type IGovernanceAdapter, type GovernanceAdapterConfig, type GovernanceAdapterErrorCode, type CommittedCheckRequest, type LegacyCommittedCheckRequest, type ModernCommittedCheckRequest, GovernanceAdapterError, GovernanceAdapterErrorCodes, isGovernanceAdapterError, InMemoryImplicitAccountStore, defaultImplicitKeyFn, type ImplicitAccountStoreOptions, createOAuthPassthroughResolver, type OAuthPassthroughResolverOptions, createRosterAccountStore, type RosterAccountStoreOptions, createDerivedAccountStore, type DerivedAccountStoreOptions, type DerivedAccountStoreBaseOptions, type DerivedSingletonAccountStoreOptions, type DerivedRosterAccountStoreOptions, } from './adapters/index.mjs';
@@ -272,3 +273,5 @@ export { mediaBuyActionResolver } from './server/media-buy-action-resolver.mjs';
 export type { SellerActionDecision, SellerActionResolutionOptions, SellerActionResolution, } from './server/media-buy-action-resolver.mjs';
 export * from './supply-path/index.mjs';
 export type { AuthorizationCollectionSelector, ProductCollectionSelector, CollectionDistribution, DiscoveryCollection, } from './discovery/types.mjs';
+export { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage, type BuyerAccountRegistryOptions, type BuyerAccountDispatch, type BuyerAccountProvisioningDispatch, type EnsureAccountOptions, type ProvisionedAccount, } from './core/buyer-account-registry.mjs';
+export { createProductCache, ProductCache, type ProductCacheOptions } from './core/product-cache.mjs';