@adcp/sdk 14.0.0 → 14.2.0

package/dist/lib/index.d.ts

@@ -37,12 +37,12 @@ export type { GovernanceConfig, CampaignGovernanceConfig, GovernanceCheckResult,
 export { GovernanceMiddleware } from './core/GovernanceMiddleware';
 export { isGovernanceApproved, isGovernanceConditions, isGovernanceDenied, normalizeGovernanceVerdict, } from './core/GovernanceTypes';
 export type { GovernanceDebugEntry } from './core/GovernanceMiddleware';
-export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, buildHumanReviewPlan, buildHumanOverride, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, validateGovernancePlan, verifyGovernanceAuthorization, REGULATED_HUMAN_REVIEW_CATEGORIES, ANNEX_III_POLICY_IDS, } from './governance';
+export { GOVERNANCE_AUTHORIZATION_CRITICAL_CLAIMS, GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceCommitment, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, buildGovernanceIntentRequest, buildGovernanceProposedCommitment, buildHumanReviewPlan, buildHumanOverride, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, getGovernanceEnforcementTasks, governancePurchaseTypeForTask, governanceTaskRequiresProposedCommitment, targetDeclaresGovernanceEnforcement, targetDeclaresLegacyGovernanceAwareness, validateGovernancePlan, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, REGULATED_HUMAN_REVIEW_CATEGORIES, ANNEX_III_POLICY_IDS, } from './governance';
 export { ssrfSafeFetch, decodeBodyAsJsonOrText, SSRF_TRANSIENT_CODES, SsrfRefusedError, isPrivateIp, isAlwaysBlocked, isLikelyPrivateUrl, type SsrfRefusedCode, type SsrfDnsLookup, type SsrfFetchOptions, type SsrfFetchResult, } from './net';
 export { createCanonicalReferenceCache, createCanonicalReferenceResolver, canonicalReferenceCacheKey, resolveCanonicalReference, resolveFormatSchemaReference, resolvePlatformExtensionsReference, type CanonicalReference, type CanonicalReferenceCache, type CanonicalReferenceCacheOptions, type CanonicalReferenceError, type CanonicalReferenceErrorCode, type CanonicalReferenceFailureResult, type CanonicalReferenceKind, type CanonicalReferenceResolveOptions, type CanonicalReferenceResolvedResult, type CanonicalReferenceResolver, type CanonicalReferenceResolverOptions, type CanonicalReferenceResult, type CanonicalReferenceStatus, type ExternalRefDigestMap, type FormatSchemaReferenceResolvedResult, type FormatSchemaReferenceResult, type PlatformExtensionsReferenceResult, } from './canonical-references';
 export { assessAcceptancePolicy, createAcceptancePolicyCatalogResolver, resolveAcceptancePolicyCatalog, resolveAcceptancePolicyProfiles, resolveVerifiedAcceptancePolicyProfiles, type AcceptancePolicyCatalog, type AcceptancePolicyCatalogErrorCode, type AcceptancePolicyCatalogFailure, type AcceptancePolicyCatalogIssue, type AcceptancePolicyCatalogResolver, type AcceptancePolicyCatalogResult, type AcceptancePolicyCatalogSuccess, type AcceptancePolicyDiscoveryCapability, type AcceptancePolicyProfile, type AcceptancePolicyProfileResolution, type AcceptancePolicyRegistryPolicy, type AcceptancePolicyRegistryResolver, type AcceptancePolicyReference, type AcceptancePolicyRequirement, type AcceptancePolicyRule, type AcceptancePolicySurface, type RegistryAcceptancePolicyProfileReference, type ResolveAcceptancePolicyCatalogOptions, type ResolveVerifiedAcceptancePolicyProfilesOptions, type ResolvedAcceptancePolicyDefault, type VerifiedAcceptancePolicyProfilesResult, type VerifiedAcceptancePolicyProfilesSuccess, } from './acceptance-policy';
 export { type AcceptancePolicyAssessment, type AcceptancePolicyAssessmentDiagnostic, type AcceptancePolicyAssessmentDiagnosticCode, type AcceptancePolicyMatchedRule, type AcceptancePolicyOutcome, type AssessAcceptancePolicyInput, } from './acceptance-policy/evaluator';
-export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, } from './governance';
+export type { BuildGovernanceExecutionRequestInput, BuildGovernanceIntentRequestInput, BuildHumanReviewPlanInput, BuildHumanOverrideInput, DataSubjectContestation, GovernanceAuthorizationClaims, GovernanceAuthorizationCriticalClaim, GovernanceAuthorizationErrorCode, GovernanceAuthorizationFailure, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceEnforcementMode, GovernanceEnforcementTask, GovernancePlan, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, GovernanceValidationIssue, HumanOverride, InMemoryGovernanceReplayStoreOptions, PlanBudget, ReallocationAutonomy, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from './governance';
 export type { BaseTaskEvent, ProtocolRequestEvent, ProtocolResponseEvent, TaskStatusEvent, ObjectEvent, TaskEvent, TaskEventCallbacks, } from './core/TaskEventTypes';
 export { createOperationId } from './core/TaskEventTypes';
 export type { AsyncHandlerConfig, WebhookMetadata, Activity, NotificationMetadata, MediaBuyDeliveryNotification, CreateMediaBuyStatusChangeHandler, UpdateMediaBuyStatusChangeHandler, SyncCreativesStatusChangeHandler, GetProductsStatusChangeHandler, ListProductsStatusChangeHandler, } from './core/AsyncHandler';
@@ -53,7 +53,7 @@ export * from './handlers/types';
 export type { Storage, AtomicTakeStorage, DeferredTaskStorage, BatchStorage, PatternStorage, AgentCapabilities, ConversationState, DeferredTaskState, StorageConfig, StorageFactory, StorageMiddleware, } from './storage/interfaces';
 export { MemoryStorage, createMemoryStorage, createMemoryStorageConfig } from './storage/MemoryStorage';
 export { ADCPError, TaskTimeoutError, MaxClarificationError, DeferredTaskError, TaskAbortedError, AgentNotFoundError, UnsupportedTaskError, ProtocolError, ValidationError as ADCPValidationError, // Rename to avoid conflict
-MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors';
+MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, BuyerSetupError, AccountNotFoundError, AccountSetupRequiredError, AccountPaymentRequiredError, AccountNotProvisionedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors';
 export type { OAuthMetadataInfo, ClientPreflightAdcpErrorInfo, ClientPreflightAdcpErrorRecovery, FeatureUnsupportedErrorOptions, ProtocolFeatureUnsupportedErrorOptions, ActionNotAllowedErrorDetails, ActionNotAllowedReasonValue, ActionNotAllowedAttemptedAction, ActionNotAllowedAvailableAction, ActionNotAllowedRecovery, } from './errors';
 export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionId, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyUpdateFieldAction, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, StructuredOnlyMediaBuyAction, ResolvedTargetingInput, TargetingInputFor, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy';
 export { ACTIONS_BY_FIELD, LEGACY_COARSE_ACTIONS, STRUCTURED_ONLY_MEDIA_BUY_ACTIONS, UPDATE_FIELDS_BY_ACTION, applyTargetingInput, hasTargetingClears, resolveTargetingInput, canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, findAvailableAction, getActionForMutation, getAvailableActions, getRollupParent, ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, preflightUpdateMediaBuy, recoveryForModeMismatch, validateProductsAgainstPropertyPolicy, } from './media-buy';
@@ -237,7 +237,8 @@ export { resolvePreviewAuthority, type PlacementPreviewCandidate, type PreviewAu
 export { isStatusCompleted, isStatusWorking, isStatusInputRequired, isStatusSubmitted, isStatusFailed, isStatusRejected, isGetProductsCompleted, isGetProductsWorking, isGetProductsInputRequired, isGetProductsSubmitted, isGetProductsFailed, isCreateMediaBuyCompleted, isCreateMediaBuyWorking, isCreateMediaBuyInputRequired, isCreateMediaBuySubmitted, isCreateMediaBuyFailed, isUpdateMediaBuyCompleted, isUpdateMediaBuyWorking, isUpdateMediaBuyInputRequired, isUpdateMediaBuySubmitted, isUpdateMediaBuyFailed, isSyncCreativesCompleted, isSyncCreativesWorking, isSyncCreativesInputRequired, isSyncCreativesSubmitted, isSyncCreativesFailed, } from './utils/typeGuards';
 export { getAdcpVersion, getLibraryVersion, isCompatibleWith, getCompatibleVersions, parseAdcpMajorVersion, ADCP_VERSION, ADCP_MAJOR_VERSION, LIBRARY_VERSION, COMPATIBLE_ADCP_VERSIONS, VERSION_INFO, } from './version';
 export type { AdcpVersion } from './version';
-export { listBundledAdcpVersions, resolveAdcpVersion } from './utils/adcp-version-config';
+export { listBundledAdcpVersions, resolveAdcpVersion, isAdcpVersionAtLeast, sellerAdvertises31, shouldOmit31Fields, } from './utils/adcp-version-config';
+export { redactSecrets } from './utils/redact-secrets';
 export { getTracer, isTracingEnabled, injectTraceHeaders, withSpan, addSpanAttributes, recordSpanException, } from './observability';
 export { Agent as LegacyAgent, AgentCollection as LegacyAgentCollection } from './agents/index.generated';
 export { LegacyContentStandardsAdapter, type LegacyIContentStandardsAdapter, type LegacyContentEvaluationResult, LegacyContentStandardsErrorCodes, isLegacyContentStandardsError, legacyDefaultContentStandardsAdapter, PropertyListAdapter, type IPropertyListAdapter, type ResolvedProperty, PropertyListErrorCodes, isPropertyListError, defaultPropertyListAdapter, SISessionManager, AISISessionManager, type ISISessionManager, type SISession, SIErrorCodes, defaultSISessionManager, GovernanceAdapter, defaultGovernanceAdapter, type IGovernanceAdapter, type GovernanceAdapterConfig, type GovernanceAdapterErrorCode, type CommittedCheckRequest, type LegacyCommittedCheckRequest, type ModernCommittedCheckRequest, GovernanceAdapterError, GovernanceAdapterErrorCodes, isGovernanceAdapterError, InMemoryImplicitAccountStore, defaultImplicitKeyFn, type ImplicitAccountStoreOptions, createOAuthPassthroughResolver, type OAuthPassthroughResolverOptions, createRosterAccountStore, type RosterAccountStoreOptions, createDerivedAccountStore, type DerivedAccountStoreOptions, type DerivedAccountStoreBaseOptions, type DerivedSingletonAccountStoreOptions, type DerivedRosterAccountStoreOptions, } from './adapters';
@@ -272,3 +273,5 @@ export { mediaBuyActionResolver } from './server/media-buy-action-resolver';
 export type { SellerActionDecision, SellerActionResolutionOptions, SellerActionResolution, } from './server/media-buy-action-resolver';
 export * from './supply-path';
 export type { AuthorizationCollectionSelector, ProductCollectionSelector, CollectionDistribution, DiscoveryCollection, } from './discovery/types';
+export { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage, type BuyerAccountRegistryOptions, type BuyerAccountDispatch, type BuyerAccountProvisioningDispatch, type EnsureAccountOptions, type ProvisionedAccount, } from './core/buyer-account-registry';
+export { createProductCache, ProductCache, type ProductCacheOptions } from './core/product-cache';

package/dist/lib/index.js

@@ -37,8 +37,12 @@ __export(index_exports, {
   ANNEX_III_POLICY_IDS: () => import_governance.ANNEX_III_POLICY_IDS,
   AUTH_DIAGNOSIS_SCHEMA_VERSION: () => import_oauth2.AUTH_DIAGNOSIS_SCHEMA_VERSION,
   AccountAmbiguousError: () => import_errors.AccountAmbiguousError,
+  AccountNotFoundError: () => import_errors.AccountNotFoundError,
+  AccountNotProvisionedError: () => import_errors.AccountNotProvisionedError,
+  AccountPaymentRequiredError: () => import_errors.AccountPaymentRequiredError,
   AccountPendingApprovalError: () => import_errors.AccountPendingApprovalError,
   AccountRequiredError: () => import_errors.AccountRequiredError,
+  AccountSetupRequiredError: () => import_errors.AccountSetupRequiredError,
   ActionNotAllowedError: () => import_errors.ActionNotAllowedError,
   AdCPClient: () => AdCPClient,
   AdagentsJsonSchema: () => import_wellknown_schemas.AdagentsJsonSchema,
@@ -52,7 +56,9 @@ __export(index_exports, {
   BRAND_RIGHTS_TOOLS: () => import_capabilities.BRAND_RIGHTS_TOOLS,
   BrandDomainValidationError: () => import_brand.BrandDomainValidationError,
   BrandJsonSchema: () => import_wellknown_schemas.BrandJsonSchema,
+  BuyerAccountRegistry: () => import_buyer_account_registry.BuyerAccountRegistry,
   BuyerRetryPolicy: () => import_buyer_retry_policy.BuyerRetryPolicy,
+  BuyerSetupError: () => import_errors.BuyerSetupError,
   CATALOG_MACRO_VECTORS: () => import_substitution.CATALOG_MACRO_VECTORS,
   COMMON_LOGO_SLOTS: () => import_brand.COMMON_LOGO_SLOTS,
   COMPATIBLE_ADCP_VERSIONS: () => import_version.COMPATIBLE_ADCP_VERSIONS,
@@ -144,6 +150,7 @@ __export(index_exports, {
   PostgresStateStore: () => import_server.PostgresStateStore,
   PostgresTaskStore: () => import_server.PostgresTaskStore,
   PreviewFetchError: () => import_substitution.PreviewFetchError,
+  ProductCache: () => import_product_cache.ProductCache,
   ProductPropertyPolicyError: () => import_media_buy.ProductPropertyPolicyError,
   PropertyCrawler: () => import_property_crawler.PropertyCrawler,
   PropertyIndex: () => import_property_index.PropertyIndex,
@@ -305,6 +312,7 @@ __export(index_exports, {
   createCreativeAgentClient: () => import_CreativeAgentClient.createCreativeAgentClient,
   createDerivedAccountStore: () => import_adapters.createDerivedAccountStore,
   createFileOAuthStorage: () => import_oauth3.createFileOAuthStorage,
+  createGovernanceAgentJwksResolver: () => import_governance.createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware: () => import_governance.createGovernanceEnforcementMiddleware,
   createIdempotencyStore: () => import_server.createIdempotencyStore,
   createInMemoryEstablishedProposalStore: () => import_established_proposal_store.createInMemoryEstablishedProposalStore,
@@ -316,6 +324,7 @@ __export(index_exports, {
   createMemoryStorageConfig: () => import_MemoryStorage.createMemoryStorageConfig,
   createOAuthPassthroughResolver: () => import_adapters.createOAuthPassthroughResolver,
   createOperationId: () => import_TaskEventTypes.createOperationId,
+  createProductCache: () => import_product_cache.createProductCache,
   createRosterAccountStore: () => import_adapters.createRosterAccountStore,
   createSeedFixtureCache: () => import_server.createSeedFixtureCache,
   createSessionedStore: () => import_server.createSessionedStore,
@@ -444,6 +453,7 @@ __export(index_exports, {
   isADCPError: () => import_errors.isADCPError,
   isAdcpError: () => import_utils.isAdcpError,
   isAdcpSuccess: () => import_utils.isAdcpSuccess,
+  isAdcpVersionAtLeast: () => import_adcp_version_config.isAdcpVersionAtLeast,
   isAgentCardPath: () => import_utils6.isAgentCardPath,
   isAlwaysBlocked: () => import_net.isAlwaysBlocked,
   isCPAPricing: () => import_utils7.isCPAPricing,
@@ -591,6 +601,7 @@ __export(index_exports, {
   recordSpanException: () => import_observability.recordSpanException,
   recoveryForModeMismatch: () => import_media_buy.recoveryForModeMismatch,
   redactIdempotencyKey: () => import_idempotency.redactIdempotencyKey,
+  redactSecrets: () => import_redact_secrets.redactSecrets,
   redisBackend: () => import_server.redisBackend,
   redisWebhookRegistrationStore: () => import_redis_webhook_registration_store.redisWebhookRegistrationStore,
   registerAdcpTaskTool: () => import_server.registerAdcpTaskTool,
@@ -629,7 +640,9 @@ __export(index_exports, {
   scopedStore: () => import_server.scopedStore,
   segmentIdActivationKey: () => import_activation_key_builders.segmentIdActivationKey,
   selectLogoForSlot: () => import_brand.selectLogoForSlot,
+  sellerAdvertises31: () => import_adcp_version_config.sellerAdvertises31,
   serve: () => import_server.serve,
+  shouldOmit31Fields: () => import_adcp_version_config.shouldOmit31Fields,
   signalId: () => import_signal_id_builders.signalId,
   singleBuildCreativeReturn: () => import_build_creative_return_builders.singleBuildCreativeReturn,
   singleEnvelopedBuildCreativeReturn: () => import_build_creative_return_builders.singleEnvelopedBuildCreativeReturn,
@@ -816,6 +829,7 @@ var import_preview_authority = require('./utils/preview-authority.js');
 var import_typeGuards = require('./utils/typeGuards.js');
 var import_version = require('./version.js');
 var import_adcp_version_config = require('./utils/adcp-version-config.js');
+var import_redact_secrets = require('./utils/redact-secrets.js');
 var import_observability = require('./observability/index.js');
 var import_agents = require('./agents/index.generated.js');
 var import_adapters = require('./adapters/index.js');
@@ -829,6 +843,8 @@ __reExport(index_exports, require('./notifications/account-change-recorded.js'),
 __reExport(index_exports, require('./media-buy/actions.js'), module.exports);
 var import_media_buy_action_resolver = require('./server/media-buy-action-resolver.js');
 __reExport(index_exports, require('./supply-path/index.js'), module.exports);
+var import_buyer_account_registry = require('./core/buyer-account-registry.js');
+var import_product_cache = require('./core/product-cache.js');
 const wireVersion = {
   isSupported: import_protocols2.bundleSupportsAdcpVersionField,
   normalize: import_schema_loader2.toReleasePrecisionWire,
@@ -861,8 +877,12 @@ function createAdCPClientFromEnv() {
   ANNEX_III_POLICY_IDS,
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
   AccountAmbiguousError,
+  AccountNotFoundError,
+  AccountNotProvisionedError,
+  AccountPaymentRequiredError,
   AccountPendingApprovalError,
   AccountRequiredError,
+  AccountSetupRequiredError,
   ActionNotAllowedError,
   AdCPClient,
   AdagentsJsonSchema,
@@ -876,7 +896,9 @@ function createAdCPClientFromEnv() {
   BRAND_RIGHTS_TOOLS,
   BrandDomainValidationError,
   BrandJsonSchema,
+  BuyerAccountRegistry,
   BuyerRetryPolicy,
+  BuyerSetupError,
   CATALOG_MACRO_VECTORS,
   COMMON_LOGO_SLOTS,
   COMPATIBLE_ADCP_VERSIONS,
@@ -968,6 +990,7 @@ function createAdCPClientFromEnv() {
   PostgresStateStore,
   PostgresTaskStore,
   PreviewFetchError,
+  ProductCache,
   ProductPropertyPolicyError,
   PropertyCrawler,
   PropertyIndex,
@@ -1129,6 +1152,7 @@ function createAdCPClientFromEnv() {
   createCreativeAgentClient,
   createDerivedAccountStore,
   createFileOAuthStorage,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   createIdempotencyStore,
   createInMemoryEstablishedProposalStore,
@@ -1140,6 +1164,7 @@ function createAdCPClientFromEnv() {
   createMemoryStorageConfig,
   createOAuthPassthroughResolver,
   createOperationId,
+  createProductCache,
   createRosterAccountStore,
   createSeedFixtureCache,
   createSessionedStore,
@@ -1268,6 +1293,7 @@ function createAdCPClientFromEnv() {
   isADCPError,
   isAdcpError,
   isAdcpSuccess,
+  isAdcpVersionAtLeast,
   isAgentCardPath,
   isAlwaysBlocked,
   isCPAPricing,
@@ -1415,6 +1441,7 @@ function createAdCPClientFromEnv() {
   recordSpanException,
   recoveryForModeMismatch,
   redactIdempotencyKey,
+  redactSecrets,
   redisBackend,
   redisWebhookRegistrationStore,
   registerAdcpTaskTool,
@@ -1453,7 +1480,9 @@ function createAdCPClientFromEnv() {
   scopedStore,
   segmentIdActivationKey,
   selectLogoForSlot,
+  sellerAdvertises31,
   serve,
+  shouldOmit31Fields,
   signalId,
   singleBuildCreativeReturn,
   singleEnvelopedBuildCreativeReturn,

package/dist/lib/index.mjs

@@ -158,6 +158,7 @@ import {
   targetDeclaresLegacyGovernanceAwareness,
   validateGovernancePlan,
   verifyGovernanceAuthorization,
+  createGovernanceAgentJwksResolver,
   REGULATED_HUMAN_REVIEW_CATEGORIES,
   ANNEX_III_POLICY_IDS
 } from "./governance/index.mjs";
@@ -220,6 +221,11 @@ import {
   AccountRequiredError,
   AccountPendingApprovalError,
   AccountAmbiguousError,
+  BuyerSetupError,
+  AccountNotFoundError,
+  AccountSetupRequiredError,
+  AccountPaymentRequiredError,
+  AccountNotProvisionedError,
   SDK_ERROR_TO_PROTOCOL_ERROR_CODE,
   VersionUnsupportedError,
   IdempotencyConflictError,
@@ -702,7 +708,14 @@ import {
   COMPATIBLE_ADCP_VERSIONS,
   VERSION_INFO
 } from "./version.mjs";
-import { listBundledAdcpVersions, resolveAdcpVersion } from "./utils/adcp-version-config.mjs";
+import {
+  listBundledAdcpVersions,
+  resolveAdcpVersion,
+  isAdcpVersionAtLeast,
+  sellerAdvertises31,
+  shouldOmit31Fields
+} from "./utils/adcp-version-config.mjs";
+import { redactSecrets } from "./utils/redact-secrets.mjs";
 import {
   getTracer,
   isTracingEnabled,
@@ -800,6 +813,10 @@ export * from "./notifications/account-change-recorded.mjs";
 export * from "./media-buy/actions.mjs";
 import { mediaBuyActionResolver } from "./server/media-buy-action-resolver.mjs";
 export * from "./supply-path/index.mjs";
+import {
+  BuyerAccountRegistry
+} from "./core/buyer-account-registry.mjs";
+import { createProductCache, ProductCache } from "./core/product-cache.mjs";
 export {
   A2AInvocationError,
   A2A_CARD_PATHS,
@@ -819,8 +836,12 @@ export {
   ANNEX_III_POLICY_IDS,
   AUTH_DIAGNOSIS_SCHEMA_VERSION,
   AccountAmbiguousError,
+  AccountNotFoundError,
+  AccountNotProvisionedError,
+  AccountPaymentRequiredError,
   AccountPendingApprovalError,
   AccountRequiredError,
+  AccountSetupRequiredError,
   ActionNotAllowedError,
   AdCPClient,
   AdagentsJsonSchema,
@@ -834,7 +855,9 @@ export {
   BRAND_RIGHTS_TOOLS,
   BrandDomainValidationError,
   BrandJsonSchema,
+  BuyerAccountRegistry,
   BuyerRetryPolicy,
+  BuyerSetupError,
   CATALOG_MACRO_VECTORS,
   COMMON_LOGO_SLOTS,
   COMPATIBLE_ADCP_VERSIONS,
@@ -926,6 +949,7 @@ export {
   PostgresStateStore,
   PostgresTaskStore,
   PreviewFetchError,
+  ProductCache,
   ProductPropertyPolicyError,
   PropertyCrawler,
   PropertyIndex,
@@ -1087,6 +1111,7 @@ export {
   createCreativeAgentClient,
   createDerivedAccountStore,
   createFileOAuthStorage,
+  createGovernanceAgentJwksResolver,
   createGovernanceEnforcementMiddleware,
   createIdempotencyStore,
   createInMemoryEstablishedProposalStore,
@@ -1098,6 +1123,7 @@ export {
   createMemoryStorageConfig,
   createOAuthPassthroughResolver,
   createOperationId,
+  createProductCache,
   createRosterAccountStore,
   createSeedFixtureCache,
   createSessionedStore,
@@ -1226,6 +1252,7 @@ export {
   isADCPError,
   isAdcpError,
   isAdcpSuccess,
+  isAdcpVersionAtLeast,
   isAgentCardPath,
   isAlwaysBlocked,
   isCPAPricing,
@@ -1373,6 +1400,7 @@ export {
   recordSpanException,
   recoveryForModeMismatch,
   redactIdempotencyKey,
+  redactSecrets,
   redisBackend,
   redisWebhookRegistrationStore,
   registerAdcpTaskTool,
@@ -1411,7 +1439,9 @@ export {
   scopedStore,
   segmentIdActivationKey,
   selectLogoForSlot,
+  sellerAdvertises31,
   serve,
+  shouldOmit31Fields,
   signalId,
   singleBuildCreativeReturn,
   singleEnvelopedBuildCreativeReturn,

package/dist/lib/net/agent-transport-fetch.d.mts

@@ -1,3 +1,7 @@
+export declare class AgentTransportPolicyError extends TypeError {
+    readonly code = "agent_transport_policy_refused";
+    constructor(message: string);
+}
 type ResolvedAddress = {
     address: string;
     family: number;

package/dist/lib/net/agent-transport-fetch.d.ts

@@ -1,3 +1,7 @@
+export declare class AgentTransportPolicyError extends TypeError {
+    readonly code = "agent_transport_policy_refused";
+    constructor(message: string);
+}
 type ResolvedAddress = {
     address: string;
     family: number;

package/dist/lib/net/agent-transport-fetch.js

@@ -18,6 +18,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var agent_transport_fetch_exports = {};
 __export(agent_transport_fetch_exports, {
+  AgentTransportPolicyError: () => AgentTransportPolicyError,
   createAgentTransportFetch: () => createAgentTransportFetch
 });
 module.exports = __toCommonJS(agent_transport_fetch_exports);
@@ -25,14 +26,21 @@ var import_promises = require("node:dns/promises");
 var import_node_net = require("node:net");
 var import_undici = require("undici");
 var import_address_guards = require('./address-guards.js');
+class AgentTransportPolicyError extends TypeError {
+  code = "agent_transport_policy_refused";
+  constructor(message) {
+    super(message);
+    this.name = "AgentTransportPolicyError";
+  }
+}
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 const SENSITIVE_REDIRECT_HEADERS = ["authorization", "cookie", "proxy-authorization", "x-adcp-auth"];
 function createAgentTransportFetch(agentUrl, options = {}) {
   const lookup = options.lookup ?? ((hostname) => (0, import_promises.lookup)(hostname, { all: true }));
   const maxRedirects = options.maxRedirects ?? 5;
   const initialUrl = new URL(agentUrl);
-  const allowPrivateEverywhere = options.allowPrivateIp === true || process.env.ADCP_ALLOW_INTERNAL_PROBES === "1" || process.env.ADCP_ALLOW_PRIVATE_AGENT_URL === "1";
-  const allowPrivateInitialOrigin = (0, import_address_guards.isLikelyPrivateUrl)(initialUrl.toString());
+  const allowPrivateEverywhere = options.allowPrivateIp === true || options.allowPrivateInitialOrigin !== false && (process.env.ADCP_ALLOW_INTERNAL_PROBES === "1" || process.env.ADCP_ALLOW_PRIVATE_AGENT_URL === "1");
+  const allowPrivateInitialOrigin = options.allowPrivateInitialOrigin !== false && (0, import_address_guards.isLikelyPrivateUrl)(initialUrl.toString());
   const dispatchers = /* @__PURE__ */ new Map();
   const privateIpAllowedFor = (url) => allowPrivateEverywhere || allowPrivateInitialOrigin && url.origin === initialUrl.origin;
   const dispatcherFor = (url) => {
@@ -57,6 +65,8 @@ function createAgentTransportFetch(agentUrl, options = {}) {
     const redirectMode = init?.redirect ?? request?.redirect ?? "follow";
     for (let redirects = 0; ; redirects++) {
       assertTransportScheme(url);
+      if (options.requireHttps && url.protocol !== "https:" && !options.allowPrivateIp)
+        throw new AgentTransportPolicyError("Signing discovery requires HTTPS.");
       const hostname = url.hostname.replace(/^\[|\]$/g, "");
       if ((0, import_node_net.isIP)(hostname) !== 0) assertAgentAddressAllowed(hostname, hostname, privateIpAllowedFor(url), false);
       const headerRecord = {};
@@ -124,19 +134,22 @@ async function resolveAndCreateDispatcher(url, lookup, allowPrivateIp) {
 function assertAgentAddressAllowed(address, hostname, allowPrivateIp, resolved) {
   const relationship = resolved ? "resolves to" : "is";
   if ((0, import_address_guards.isAlwaysBlocked)(address)) {
-    throw new Error(`Agent host ${hostname} ${relationship} an always-blocked address`);
+    throw new AgentTransportPolicyError(`Agent host ${hostname} ${relationship} an always-blocked address`);
   }
   if (!allowPrivateIp && (0, import_address_guards.isPrivateIp)(address)) {
     const guidance = resolved ? "set transport.allowPrivateIp=true for an explicitly trusted private agent, or provide a trustedFetchFn that enforces its own hostname address policy" : "set transport.allowPrivateIp=true for an explicitly trusted private agent";
-    throw new Error(`Agent host ${hostname} ${relationship} a private or loopback address; ` + guidance);
+    throw new AgentTransportPolicyError(
+      `Agent host ${hostname} ${relationship} a private or loopback address; ` + guidance
+    );
   }
 }
 function assertTransportScheme(url) {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new TypeError(`Agent transport does not allow ${url.protocol} URLs`);
+    throw new AgentTransportPolicyError(`Agent transport does not allow ${url.protocol} URLs`);
   }
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AgentTransportPolicyError,
   createAgentTransportFetch
 });

package/dist/lib/net/agent-transport-fetch.mjs

@@ -2,14 +2,21 @@ import { lookup as dnsLookup } from "node:dns/promises";
 import { isIP } from "node:net";
 import { Agent, fetch as undiciFetch } from "undici";
 import { isAlwaysBlocked, isLikelyPrivateUrl, isPrivateIp } from "./address-guards.mjs";
+class AgentTransportPolicyError extends TypeError {
+  code = "agent_transport_policy_refused";
+  constructor(message) {
+    super(message);
+    this.name = "AgentTransportPolicyError";
+  }
+}
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 const SENSITIVE_REDIRECT_HEADERS = ["authorization", "cookie", "proxy-authorization", "x-adcp-auth"];
 function createAgentTransportFetch(agentUrl, options = {}) {
   const lookup = options.lookup ?? ((hostname) => dnsLookup(hostname, { all: true }));
   const maxRedirects = options.maxRedirects ?? 5;
   const initialUrl = new URL(agentUrl);
-  const allowPrivateEverywhere = options.allowPrivateIp === true || process.env.ADCP_ALLOW_INTERNAL_PROBES === "1" || process.env.ADCP_ALLOW_PRIVATE_AGENT_URL === "1";
-  const allowPrivateInitialOrigin = isLikelyPrivateUrl(initialUrl.toString());
+  const allowPrivateEverywhere = options.allowPrivateIp === true || options.allowPrivateInitialOrigin !== false && (process.env.ADCP_ALLOW_INTERNAL_PROBES === "1" || process.env.ADCP_ALLOW_PRIVATE_AGENT_URL === "1");
+  const allowPrivateInitialOrigin = options.allowPrivateInitialOrigin !== false && isLikelyPrivateUrl(initialUrl.toString());
   const dispatchers = /* @__PURE__ */ new Map();
   const privateIpAllowedFor = (url) => allowPrivateEverywhere || allowPrivateInitialOrigin && url.origin === initialUrl.origin;
   const dispatcherFor = (url) => {
@@ -34,6 +41,8 @@ function createAgentTransportFetch(agentUrl, options = {}) {
     const redirectMode = init?.redirect ?? request?.redirect ?? "follow";
     for (let redirects = 0; ; redirects++) {
       assertTransportScheme(url);
+      if (options.requireHttps && url.protocol !== "https:" && !options.allowPrivateIp)
+        throw new AgentTransportPolicyError("Signing discovery requires HTTPS.");
       const hostname = url.hostname.replace(/^\[|\]$/g, "");
       if (isIP(hostname) !== 0) assertAgentAddressAllowed(hostname, hostname, privateIpAllowedFor(url), false);
       const headerRecord = {};
@@ -101,18 +110,21 @@ async function resolveAndCreateDispatcher(url, lookup, allowPrivateIp) {
 function assertAgentAddressAllowed(address, hostname, allowPrivateIp, resolved) {
   const relationship = resolved ? "resolves to" : "is";
   if (isAlwaysBlocked(address)) {
-    throw new Error(`Agent host ${hostname} ${relationship} an always-blocked address`);
+    throw new AgentTransportPolicyError(`Agent host ${hostname} ${relationship} an always-blocked address`);
   }
   if (!allowPrivateIp && isPrivateIp(address)) {
     const guidance = resolved ? "set transport.allowPrivateIp=true for an explicitly trusted private agent, or provide a trustedFetchFn that enforces its own hostname address policy" : "set transport.allowPrivateIp=true for an explicitly trusted private agent";
-    throw new Error(`Agent host ${hostname} ${relationship} a private or loopback address; ` + guidance);
+    throw new AgentTransportPolicyError(
+      `Agent host ${hostname} ${relationship} a private or loopback address; ` + guidance
+    );
   }
 }
 function assertTransportScheme(url) {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new TypeError(`Agent transport does not allow ${url.protocol} URLs`);
+    throw new AgentTransportPolicyError(`Agent transport does not allow ${url.protocol} URLs`);
   }
 }
 export {
+  AgentTransportPolicyError,
   createAgentTransportFetch
 };

package/dist/lib/protocols/a2a.js

@@ -39,6 +39,7 @@ var import_fetch = require('../signing/fetch.js');
 var import_fetch_async = require('../signing/fetch-async.js');
 var import_redact_args = require('../utils/redact-args.js');
 var import_rawResponseCapture = require('./rawResponseCapture.js');
+var import_signedRequestRejection = require('./signedRequestRejection.js');
 var import_responseSizeLimit = require('./responseSizeLimit.js');
 var import_transportDiagnostics = require('./transportDiagnostics.js');
 var import_abort = require('./abort.js');
@@ -322,6 +323,7 @@ function buildFetchImpl(authToken, agentUrl) {
   const networkFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)(
     (0, import_responseSizeLimit.wrapFetchWithSizeLimit)((input, init) => pinnedFetch(input, init))
   );
+  const rejectionFetch = signingContext ? (0, import_signedRequestRejection.wrapFetchWithSignedRequestRejection)(networkFetch, agentUrl) : networkFetch;
   const baseFetch = async (url, options) => {
     const context = callContextStorage.getStore();
     const urlString = typeof url === "string" ? url : url instanceof URL ? url.toString() : url.url;
@@ -370,7 +372,11 @@ function buildFetchImpl(authToken, agentUrl) {
     const response = await (0, import_abort.withAbortSignal)(
       [context?.signal, options?.signal],
       requestTimeoutMs,
-      (signal) => networkFetch(url, { ...options, headers, signal })
+      (signal) => rejectionFetch(url, {
+        ...options,
+        headers,
+        signal
+      })
     );
     if (response.status === 401 && context) {
       context.got401Ref.value = true;
@@ -548,6 +554,8 @@ async function callA2AToolImpl(agentUrl, toolName, parameters, authToken, debugL
         message: `A2A: Authentication required for ${agentUrl}`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
+      const signedRejection = (0, import_signedRequestRejection.getSignedRequestRejection)(error);
+      if (signedRejection) throw signedRejection;
       const challenge = await (0, import_authorization_required.probeAuthChallenge)(agentUrl, {
         fetchFn: context.fetchFn,
         allowPrivateIp: context.allowPrivateIp ?? (0, import_address_guards.isLikelyPrivateUrl)(agentUrl)

package/dist/lib/protocols/a2a.mjs

@@ -23,6 +23,7 @@ import { createSigningFetch } from "../signing/fetch.mjs";
 import { createSigningFetchAsync } from "../signing/fetch-async.mjs";
 import { redactArgsForLog } from "../utils/redact-args.mjs";
 import { wrapFetchWithCapture } from "./rawResponseCapture.mjs";
+import { getSignedRequestRejection, wrapFetchWithSignedRequestRejection } from "./signedRequestRejection.mjs";
 import { wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
 import { wrapFetchWithTransportDiagnostics } from "./transportDiagnostics.mjs";
 import { DEFAULT_REQUEST_TIMEOUT_MS, resolveRequestTimeoutMs, withAbortSignal } from "./abort.mjs";
@@ -306,6 +307,7 @@ function buildFetchImpl(authToken, agentUrl) {
   const networkFetch = wrapFetchWithTransportDiagnostics(
     wrapFetchWithSizeLimit((input, init) => pinnedFetch(input, init))
   );
+  const rejectionFetch = signingContext ? wrapFetchWithSignedRequestRejection(networkFetch, agentUrl) : networkFetch;
   const baseFetch = async (url, options) => {
     const context = callContextStorage.getStore();
     const urlString = typeof url === "string" ? url : url instanceof URL ? url.toString() : url.url;
@@ -354,7 +356,11 @@ function buildFetchImpl(authToken, agentUrl) {
     const response = await withAbortSignal(
       [context?.signal, options?.signal],
       requestTimeoutMs,
-      (signal) => networkFetch(url, { ...options, headers, signal })
+      (signal) => rejectionFetch(url, {
+        ...options,
+        headers,
+        signal
+      })
     );
     if (response.status === 401 && context) {
       context.got401Ref.value = true;
@@ -532,6 +538,8 @@ async function callA2AToolImpl(agentUrl, toolName, parameters, authToken, debugL
         message: `A2A: Authentication required for ${agentUrl}`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
+      const signedRejection = getSignedRequestRejection(error);
+      if (signedRejection) throw signedRejection;
       const challenge = await probeAuthChallenge(agentUrl, {
         fetchFn: context.fetchFn,
         allowPrivateIp: context.allowPrivateIp ?? isLikelyPrivateUrl(agentUrl)

package/dist/lib/protocols/index.js

@@ -68,6 +68,7 @@ var import_oauth = require('../auth/oauth/index.js');
 var import_authorization_required = require('../auth/oauth/authorization-required.js');
 var import_provider_cache = require('../auth/oauth/provider-cache.js');
 var import_errors = require('../errors/index.js');
+var import_signedRequestRejection = require('./signedRequestRejection.js');
 var import_net = require('../net/index.js');
 var import_validation = require('../validation/index.js');
 var import_tracing = require('../observability/tracing.js');
@@ -369,7 +370,7 @@ class ProtocolClient {
                   }
                 );
               } catch (err) {
-                if (agent.oauth_client_credentials && (0, import_errors.is401Error)(err)) {
+                if (agent.oauth_client_credentials && (0, import_errors.is401Error)(err) && (0, import_signedRequestRejection.getSignedRequestRejection)(err)?.challenge?.scheme !== "signature") {
                   const ccStorage = (0, import_oauth.getAgentStorage)(agent);
                   const allowPrivateIp = transport?.allowPrivateIp ?? (0, import_net.isLikelyPrivateUrl)(agent.agent_uri);
                   await (0, import_oauth.ensureClientCredentialsTokens)(agent, {
@@ -401,6 +402,8 @@ class ProtocolClient {
                       }
                     );
                   } catch (retryErr) {
+                    const rejection = (0, import_signedRequestRejection.getSignedRequestRejection)(retryErr) ?? ((0, import_errors.is401Error)(retryErr) ? (0, import_signedRequestRejection.getSignedRequestRejection)(err) : void 0);
+                    if (rejection) throw rejection;
                     await rethrowAsNeedsAuthorization(
                       retryErr,
                       agent.agent_uri,
@@ -441,7 +444,7 @@ class ProtocolClient {
                   transport?.legacyCompat
                 );
               } catch (err) {
-                if (agent.oauth_client_credentials && (0, import_errors.is401Error)(err)) {
+                if (agent.oauth_client_credentials && (0, import_errors.is401Error)(err) && (0, import_signedRequestRejection.getSignedRequestRejection)(err)?.challenge?.scheme !== "signature") {
                   const ccStorage = (0, import_oauth.getAgentStorage)(agent);
                   const allowPrivateIp = transport?.allowPrivateIp ?? (0, import_net.isLikelyPrivateUrl)(agent.agent_uri);
                   await (0, import_oauth.ensureClientCredentialsTokens)(agent, {
@@ -470,6 +473,8 @@ class ProtocolClient {
                       transport?.legacyCompat
                     );
                   } catch (retryErr) {
+                    const rejection = (0, import_signedRequestRejection.getSignedRequestRejection)(retryErr) ?? ((0, import_errors.is401Error)(retryErr) ? (0, import_signedRequestRejection.getSignedRequestRejection)(err) : void 0);
+                    if (rejection) throw rejection;
                     await rethrowAsNeedsAuthorization(
                       retryErr,
                       agent.agent_uri,
@@ -501,6 +506,8 @@ class ProtocolClient {
   }
 }
 async function rethrowAsNeedsAuthorization(err, agentUrl, fetchFn, signal, configuredAllowPrivateIp, recoveryMode = "discover") {
+  const signedRejection = (0, import_signedRequestRejection.getSignedRequestRejection)(err);
+  if (signedRejection) throw signedRejection;
   if (err instanceof import_oauth.NeedsAuthorizationError) throw err;
   if (!(0, import_errors.is401Error)(err)) return;
   if (recoveryMode === "static") {