@adcp/sdk 14.1.0 → 14.2.0

package/dist/lib/index.d.mts

@@ -237,7 +237,8 @@ export { resolvePreviewAuthority, type PlacementPreviewCandidate, type PreviewAu
 export { isStatusCompleted, isStatusWorking, isStatusInputRequired, isStatusSubmitted, isStatusFailed, isStatusRejected, isGetProductsCompleted, isGetProductsWorking, isGetProductsInputRequired, isGetProductsSubmitted, isGetProductsFailed, isCreateMediaBuyCompleted, isCreateMediaBuyWorking, isCreateMediaBuyInputRequired, isCreateMediaBuySubmitted, isCreateMediaBuyFailed, isUpdateMediaBuyCompleted, isUpdateMediaBuyWorking, isUpdateMediaBuyInputRequired, isUpdateMediaBuySubmitted, isUpdateMediaBuyFailed, isSyncCreativesCompleted, isSyncCreativesWorking, isSyncCreativesInputRequired, isSyncCreativesSubmitted, isSyncCreativesFailed, } from './utils/typeGuards.mjs';
 export { getAdcpVersion, getLibraryVersion, isCompatibleWith, getCompatibleVersions, parseAdcpMajorVersion, ADCP_VERSION, ADCP_MAJOR_VERSION, LIBRARY_VERSION, COMPATIBLE_ADCP_VERSIONS, VERSION_INFO, } from './version.mjs';
 export type { AdcpVersion } from './version.mjs';
-export { listBundledAdcpVersions, resolveAdcpVersion } from './utils/adcp-version-config.mjs';
+export { listBundledAdcpVersions, resolveAdcpVersion, isAdcpVersionAtLeast, sellerAdvertises31, shouldOmit31Fields, } from './utils/adcp-version-config.mjs';
+export { redactSecrets } from './utils/redact-secrets.mjs';
 export { getTracer, isTracingEnabled, injectTraceHeaders, withSpan, addSpanAttributes, recordSpanException, } from './observability/index.mjs';
 export { Agent as LegacyAgent, AgentCollection as LegacyAgentCollection } from './agents/index.generated.mjs';
 export { LegacyContentStandardsAdapter, type LegacyIContentStandardsAdapter, type LegacyContentEvaluationResult, LegacyContentStandardsErrorCodes, isLegacyContentStandardsError, legacyDefaultContentStandardsAdapter, PropertyListAdapter, type IPropertyListAdapter, type ResolvedProperty, PropertyListErrorCodes, isPropertyListError, defaultPropertyListAdapter, SISessionManager, AISISessionManager, type ISISessionManager, type SISession, SIErrorCodes, defaultSISessionManager, GovernanceAdapter, defaultGovernanceAdapter, type IGovernanceAdapter, type GovernanceAdapterConfig, type GovernanceAdapterErrorCode, type CommittedCheckRequest, type LegacyCommittedCheckRequest, type ModernCommittedCheckRequest, GovernanceAdapterError, GovernanceAdapterErrorCodes, isGovernanceAdapterError, InMemoryImplicitAccountStore, defaultImplicitKeyFn, type ImplicitAccountStoreOptions, createOAuthPassthroughResolver, type OAuthPassthroughResolverOptions, createRosterAccountStore, type RosterAccountStoreOptions, createDerivedAccountStore, type DerivedAccountStoreOptions, type DerivedAccountStoreBaseOptions, type DerivedSingletonAccountStoreOptions, type DerivedRosterAccountStoreOptions, } from './adapters/index.mjs';
@@ -272,5 +273,5 @@ export { mediaBuyActionResolver } from './server/media-buy-action-resolver.mjs';
 export type { SellerActionDecision, SellerActionResolutionOptions, SellerActionResolution, } from './server/media-buy-action-resolver.mjs';
 export * from './supply-path/index.mjs';
 export type { AuthorizationCollectionSelector, ProductCollectionSelector, CollectionDistribution, DiscoveryCollection, } from './discovery/types.mjs';
-export { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage, type BuyerAccountRegistryOptions, type EnsureAccountOptions, type ProvisionedAccount, } from './core/buyer-account-registry.mjs';
+export { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage, type BuyerAccountRegistryOptions, type BuyerAccountDispatch, type BuyerAccountProvisioningDispatch, type EnsureAccountOptions, type ProvisionedAccount, } from './core/buyer-account-registry.mjs';
 export { createProductCache, ProductCache, type ProductCacheOptions } from './core/product-cache.mjs';

package/dist/lib/index.d.ts

@@ -237,7 +237,8 @@ export { resolvePreviewAuthority, type PlacementPreviewCandidate, type PreviewAu
 export { isStatusCompleted, isStatusWorking, isStatusInputRequired, isStatusSubmitted, isStatusFailed, isStatusRejected, isGetProductsCompleted, isGetProductsWorking, isGetProductsInputRequired, isGetProductsSubmitted, isGetProductsFailed, isCreateMediaBuyCompleted, isCreateMediaBuyWorking, isCreateMediaBuyInputRequired, isCreateMediaBuySubmitted, isCreateMediaBuyFailed, isUpdateMediaBuyCompleted, isUpdateMediaBuyWorking, isUpdateMediaBuyInputRequired, isUpdateMediaBuySubmitted, isUpdateMediaBuyFailed, isSyncCreativesCompleted, isSyncCreativesWorking, isSyncCreativesInputRequired, isSyncCreativesSubmitted, isSyncCreativesFailed, } from './utils/typeGuards';
 export { getAdcpVersion, getLibraryVersion, isCompatibleWith, getCompatibleVersions, parseAdcpMajorVersion, ADCP_VERSION, ADCP_MAJOR_VERSION, LIBRARY_VERSION, COMPATIBLE_ADCP_VERSIONS, VERSION_INFO, } from './version';
 export type { AdcpVersion } from './version';
-export { listBundledAdcpVersions, resolveAdcpVersion } from './utils/adcp-version-config';
+export { listBundledAdcpVersions, resolveAdcpVersion, isAdcpVersionAtLeast, sellerAdvertises31, shouldOmit31Fields, } from './utils/adcp-version-config';
+export { redactSecrets } from './utils/redact-secrets';
 export { getTracer, isTracingEnabled, injectTraceHeaders, withSpan, addSpanAttributes, recordSpanException, } from './observability';
 export { Agent as LegacyAgent, AgentCollection as LegacyAgentCollection } from './agents/index.generated';
 export { LegacyContentStandardsAdapter, type LegacyIContentStandardsAdapter, type LegacyContentEvaluationResult, LegacyContentStandardsErrorCodes, isLegacyContentStandardsError, legacyDefaultContentStandardsAdapter, PropertyListAdapter, type IPropertyListAdapter, type ResolvedProperty, PropertyListErrorCodes, isPropertyListError, defaultPropertyListAdapter, SISessionManager, AISISessionManager, type ISISessionManager, type SISession, SIErrorCodes, defaultSISessionManager, GovernanceAdapter, defaultGovernanceAdapter, type IGovernanceAdapter, type GovernanceAdapterConfig, type GovernanceAdapterErrorCode, type CommittedCheckRequest, type LegacyCommittedCheckRequest, type ModernCommittedCheckRequest, GovernanceAdapterError, GovernanceAdapterErrorCodes, isGovernanceAdapterError, InMemoryImplicitAccountStore, defaultImplicitKeyFn, type ImplicitAccountStoreOptions, createOAuthPassthroughResolver, type OAuthPassthroughResolverOptions, createRosterAccountStore, type RosterAccountStoreOptions, createDerivedAccountStore, type DerivedAccountStoreOptions, type DerivedAccountStoreBaseOptions, type DerivedSingletonAccountStoreOptions, type DerivedRosterAccountStoreOptions, } from './adapters';
@@ -272,5 +273,5 @@ export { mediaBuyActionResolver } from './server/media-buy-action-resolver';
 export type { SellerActionDecision, SellerActionResolutionOptions, SellerActionResolution, } from './server/media-buy-action-resolver';
 export * from './supply-path';
 export type { AuthorizationCollectionSelector, ProductCollectionSelector, CollectionDistribution, DiscoveryCollection, } from './discovery/types';
-export { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage, type BuyerAccountRegistryOptions, type EnsureAccountOptions, type ProvisionedAccount, } from './core/buyer-account-registry';
+export { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage, type BuyerAccountRegistryOptions, type BuyerAccountDispatch, type BuyerAccountProvisioningDispatch, type EnsureAccountOptions, type ProvisionedAccount, } from './core/buyer-account-registry';
 export { createProductCache, ProductCache, type ProductCacheOptions } from './core/product-cache';

package/dist/lib/index.js

@@ -453,6 +453,7 @@ __export(index_exports, {
   isADCPError: () => import_errors.isADCPError,
   isAdcpError: () => import_utils.isAdcpError,
   isAdcpSuccess: () => import_utils.isAdcpSuccess,
+  isAdcpVersionAtLeast: () => import_adcp_version_config.isAdcpVersionAtLeast,
   isAgentCardPath: () => import_utils6.isAgentCardPath,
   isAlwaysBlocked: () => import_net.isAlwaysBlocked,
   isCPAPricing: () => import_utils7.isCPAPricing,
@@ -600,6 +601,7 @@ __export(index_exports, {
   recordSpanException: () => import_observability.recordSpanException,
   recoveryForModeMismatch: () => import_media_buy.recoveryForModeMismatch,
   redactIdempotencyKey: () => import_idempotency.redactIdempotencyKey,
+  redactSecrets: () => import_redact_secrets.redactSecrets,
   redisBackend: () => import_server.redisBackend,
   redisWebhookRegistrationStore: () => import_redis_webhook_registration_store.redisWebhookRegistrationStore,
   registerAdcpTaskTool: () => import_server.registerAdcpTaskTool,
@@ -638,7 +640,9 @@ __export(index_exports, {
   scopedStore: () => import_server.scopedStore,
   segmentIdActivationKey: () => import_activation_key_builders.segmentIdActivationKey,
   selectLogoForSlot: () => import_brand.selectLogoForSlot,
+  sellerAdvertises31: () => import_adcp_version_config.sellerAdvertises31,
   serve: () => import_server.serve,
+  shouldOmit31Fields: () => import_adcp_version_config.shouldOmit31Fields,
   signalId: () => import_signal_id_builders.signalId,
   singleBuildCreativeReturn: () => import_build_creative_return_builders.singleBuildCreativeReturn,
   singleEnvelopedBuildCreativeReturn: () => import_build_creative_return_builders.singleEnvelopedBuildCreativeReturn,
@@ -825,6 +829,7 @@ var import_preview_authority = require('./utils/preview-authority.js');
 var import_typeGuards = require('./utils/typeGuards.js');
 var import_version = require('./version.js');
 var import_adcp_version_config = require('./utils/adcp-version-config.js');
+var import_redact_secrets = require('./utils/redact-secrets.js');
 var import_observability = require('./observability/index.js');
 var import_agents = require('./agents/index.generated.js');
 var import_adapters = require('./adapters/index.js');
@@ -1288,6 +1293,7 @@ function createAdCPClientFromEnv() {
   isADCPError,
   isAdcpError,
   isAdcpSuccess,
+  isAdcpVersionAtLeast,
   isAgentCardPath,
   isAlwaysBlocked,
   isCPAPricing,
@@ -1435,6 +1441,7 @@ function createAdCPClientFromEnv() {
   recordSpanException,
   recoveryForModeMismatch,
   redactIdempotencyKey,
+  redactSecrets,
   redisBackend,
   redisWebhookRegistrationStore,
   registerAdcpTaskTool,
@@ -1473,7 +1480,9 @@ function createAdCPClientFromEnv() {
   scopedStore,
   segmentIdActivationKey,
   selectLogoForSlot,
+  sellerAdvertises31,
   serve,
+  shouldOmit31Fields,
   signalId,
   singleBuildCreativeReturn,
   singleEnvelopedBuildCreativeReturn,

package/dist/lib/index.mjs

@@ -708,7 +708,14 @@ import {
   COMPATIBLE_ADCP_VERSIONS,
   VERSION_INFO
 } from "./version.mjs";
-import { listBundledAdcpVersions, resolveAdcpVersion } from "./utils/adcp-version-config.mjs";
+import {
+  listBundledAdcpVersions,
+  resolveAdcpVersion,
+  isAdcpVersionAtLeast,
+  sellerAdvertises31,
+  shouldOmit31Fields
+} from "./utils/adcp-version-config.mjs";
+import { redactSecrets } from "./utils/redact-secrets.mjs";
 import {
   getTracer,
   isTracingEnabled,
@@ -1245,6 +1252,7 @@ export {
   isADCPError,
   isAdcpError,
   isAdcpSuccess,
+  isAdcpVersionAtLeast,
   isAgentCardPath,
   isAlwaysBlocked,
   isCPAPricing,
@@ -1392,6 +1400,7 @@ export {
   recordSpanException,
   recoveryForModeMismatch,
   redactIdempotencyKey,
+  redactSecrets,
   redisBackend,
   redisWebhookRegistrationStore,
   registerAdcpTaskTool,
@@ -1430,7 +1439,9 @@ export {
   scopedStore,
   segmentIdActivationKey,
   selectLogoForSlot,
+  sellerAdvertises31,
   serve,
+  shouldOmit31Fields,
   signalId,
   singleBuildCreativeReturn,
   singleEnvelopedBuildCreativeReturn,

package/dist/lib/net/agent-transport-fetch.d.mts

@@ -1,3 +1,7 @@
+export declare class AgentTransportPolicyError extends TypeError {
+    readonly code = "agent_transport_policy_refused";
+    constructor(message: string);
+}
 type ResolvedAddress = {
     address: string;
     family: number;

package/dist/lib/net/agent-transport-fetch.d.ts

@@ -1,3 +1,7 @@
+export declare class AgentTransportPolicyError extends TypeError {
+    readonly code = "agent_transport_policy_refused";
+    constructor(message: string);
+}
 type ResolvedAddress = {
     address: string;
     family: number;

package/dist/lib/net/agent-transport-fetch.js

@@ -18,6 +18,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var agent_transport_fetch_exports = {};
 __export(agent_transport_fetch_exports, {
+  AgentTransportPolicyError: () => AgentTransportPolicyError,
   createAgentTransportFetch: () => createAgentTransportFetch
 });
 module.exports = __toCommonJS(agent_transport_fetch_exports);
@@ -25,14 +26,21 @@ var import_promises = require("node:dns/promises");
 var import_node_net = require("node:net");
 var import_undici = require("undici");
 var import_address_guards = require('./address-guards.js');
+class AgentTransportPolicyError extends TypeError {
+  code = "agent_transport_policy_refused";
+  constructor(message) {
+    super(message);
+    this.name = "AgentTransportPolicyError";
+  }
+}
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 const SENSITIVE_REDIRECT_HEADERS = ["authorization", "cookie", "proxy-authorization", "x-adcp-auth"];
 function createAgentTransportFetch(agentUrl, options = {}) {
   const lookup = options.lookup ?? ((hostname) => (0, import_promises.lookup)(hostname, { all: true }));
   const maxRedirects = options.maxRedirects ?? 5;
   const initialUrl = new URL(agentUrl);
-  const allowPrivateEverywhere = options.allowPrivateIp === true || process.env.ADCP_ALLOW_INTERNAL_PROBES === "1" || process.env.ADCP_ALLOW_PRIVATE_AGENT_URL === "1";
-  const allowPrivateInitialOrigin = (0, import_address_guards.isLikelyPrivateUrl)(initialUrl.toString());
+  const allowPrivateEverywhere = options.allowPrivateIp === true || options.allowPrivateInitialOrigin !== false && (process.env.ADCP_ALLOW_INTERNAL_PROBES === "1" || process.env.ADCP_ALLOW_PRIVATE_AGENT_URL === "1");
+  const allowPrivateInitialOrigin = options.allowPrivateInitialOrigin !== false && (0, import_address_guards.isLikelyPrivateUrl)(initialUrl.toString());
   const dispatchers = /* @__PURE__ */ new Map();
   const privateIpAllowedFor = (url) => allowPrivateEverywhere || allowPrivateInitialOrigin && url.origin === initialUrl.origin;
   const dispatcherFor = (url) => {
@@ -57,6 +65,8 @@ function createAgentTransportFetch(agentUrl, options = {}) {
     const redirectMode = init?.redirect ?? request?.redirect ?? "follow";
     for (let redirects = 0; ; redirects++) {
       assertTransportScheme(url);
+      if (options.requireHttps && url.protocol !== "https:" && !options.allowPrivateIp)
+        throw new AgentTransportPolicyError("Signing discovery requires HTTPS.");
       const hostname = url.hostname.replace(/^\[|\]$/g, "");
       if ((0, import_node_net.isIP)(hostname) !== 0) assertAgentAddressAllowed(hostname, hostname, privateIpAllowedFor(url), false);
       const headerRecord = {};
@@ -124,19 +134,22 @@ async function resolveAndCreateDispatcher(url, lookup, allowPrivateIp) {
 function assertAgentAddressAllowed(address, hostname, allowPrivateIp, resolved) {
   const relationship = resolved ? "resolves to" : "is";
   if ((0, import_address_guards.isAlwaysBlocked)(address)) {
-    throw new Error(`Agent host ${hostname} ${relationship} an always-blocked address`);
+    throw new AgentTransportPolicyError(`Agent host ${hostname} ${relationship} an always-blocked address`);
   }
   if (!allowPrivateIp && (0, import_address_guards.isPrivateIp)(address)) {
     const guidance = resolved ? "set transport.allowPrivateIp=true for an explicitly trusted private agent, or provide a trustedFetchFn that enforces its own hostname address policy" : "set transport.allowPrivateIp=true for an explicitly trusted private agent";
-    throw new Error(`Agent host ${hostname} ${relationship} a private or loopback address; ` + guidance);
+    throw new AgentTransportPolicyError(
+      `Agent host ${hostname} ${relationship} a private or loopback address; ` + guidance
+    );
   }
 }
 function assertTransportScheme(url) {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new TypeError(`Agent transport does not allow ${url.protocol} URLs`);
+    throw new AgentTransportPolicyError(`Agent transport does not allow ${url.protocol} URLs`);
   }
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AgentTransportPolicyError,
   createAgentTransportFetch
 });

package/dist/lib/net/agent-transport-fetch.mjs

@@ -2,14 +2,21 @@ import { lookup as dnsLookup } from "node:dns/promises";
 import { isIP } from "node:net";
 import { Agent, fetch as undiciFetch } from "undici";
 import { isAlwaysBlocked, isLikelyPrivateUrl, isPrivateIp } from "./address-guards.mjs";
+class AgentTransportPolicyError extends TypeError {
+  code = "agent_transport_policy_refused";
+  constructor(message) {
+    super(message);
+    this.name = "AgentTransportPolicyError";
+  }
+}
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 const SENSITIVE_REDIRECT_HEADERS = ["authorization", "cookie", "proxy-authorization", "x-adcp-auth"];
 function createAgentTransportFetch(agentUrl, options = {}) {
   const lookup = options.lookup ?? ((hostname) => dnsLookup(hostname, { all: true }));
   const maxRedirects = options.maxRedirects ?? 5;
   const initialUrl = new URL(agentUrl);
-  const allowPrivateEverywhere = options.allowPrivateIp === true || process.env.ADCP_ALLOW_INTERNAL_PROBES === "1" || process.env.ADCP_ALLOW_PRIVATE_AGENT_URL === "1";
-  const allowPrivateInitialOrigin = isLikelyPrivateUrl(initialUrl.toString());
+  const allowPrivateEverywhere = options.allowPrivateIp === true || options.allowPrivateInitialOrigin !== false && (process.env.ADCP_ALLOW_INTERNAL_PROBES === "1" || process.env.ADCP_ALLOW_PRIVATE_AGENT_URL === "1");
+  const allowPrivateInitialOrigin = options.allowPrivateInitialOrigin !== false && isLikelyPrivateUrl(initialUrl.toString());
   const dispatchers = /* @__PURE__ */ new Map();
   const privateIpAllowedFor = (url) => allowPrivateEverywhere || allowPrivateInitialOrigin && url.origin === initialUrl.origin;
   const dispatcherFor = (url) => {
@@ -34,6 +41,8 @@ function createAgentTransportFetch(agentUrl, options = {}) {
     const redirectMode = init?.redirect ?? request?.redirect ?? "follow";
     for (let redirects = 0; ; redirects++) {
       assertTransportScheme(url);
+      if (options.requireHttps && url.protocol !== "https:" && !options.allowPrivateIp)
+        throw new AgentTransportPolicyError("Signing discovery requires HTTPS.");
       const hostname = url.hostname.replace(/^\[|\]$/g, "");
       if (isIP(hostname) !== 0) assertAgentAddressAllowed(hostname, hostname, privateIpAllowedFor(url), false);
       const headerRecord = {};
@@ -101,18 +110,21 @@ async function resolveAndCreateDispatcher(url, lookup, allowPrivateIp) {
 function assertAgentAddressAllowed(address, hostname, allowPrivateIp, resolved) {
   const relationship = resolved ? "resolves to" : "is";
   if (isAlwaysBlocked(address)) {
-    throw new Error(`Agent host ${hostname} ${relationship} an always-blocked address`);
+    throw new AgentTransportPolicyError(`Agent host ${hostname} ${relationship} an always-blocked address`);
   }
   if (!allowPrivateIp && isPrivateIp(address)) {
     const guidance = resolved ? "set transport.allowPrivateIp=true for an explicitly trusted private agent, or provide a trustedFetchFn that enforces its own hostname address policy" : "set transport.allowPrivateIp=true for an explicitly trusted private agent";
-    throw new Error(`Agent host ${hostname} ${relationship} a private or loopback address; ` + guidance);
+    throw new AgentTransportPolicyError(
+      `Agent host ${hostname} ${relationship} a private or loopback address; ` + guidance
+    );
   }
 }
 function assertTransportScheme(url) {
   if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new TypeError(`Agent transport does not allow ${url.protocol} URLs`);
+    throw new AgentTransportPolicyError(`Agent transport does not allow ${url.protocol} URLs`);
   }
 }
 export {
+  AgentTransportPolicyError,
   createAgentTransportFetch
 };

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-10-04T04:04:58.987Z"
+  "synced_at": "2026-10-05T13:04:22.439Z"
 }

package/dist/lib/signing/agent-resolver/errors.d.mts

@@ -46,6 +46,8 @@ export interface AgentResolverErrorDetail {
 export declare class AgentResolverError extends Error {
     readonly code: AgentResolverErrorCode;
     readonly detail: AgentResolverErrorDetail;
+    /** Local, cause-aware recovery. Wire codes retain the protocol taxonomy. */
+    readonly recovery: 'transient' | 'correctable' | 'terminal';
     readonly [ATTACKER_INFLUENCED]: ReadonlyArray<keyof AgentResolverErrorDetail>;
     constructor(code: AgentResolverErrorCode, message: string, detail?: AgentResolverErrorDetail, attackerInfluencedFields?: ReadonlyArray<keyof AgentResolverErrorDetail>);
 }

package/dist/lib/signing/agent-resolver/errors.d.ts

@@ -46,6 +46,8 @@ export interface AgentResolverErrorDetail {
 export declare class AgentResolverError extends Error {
     readonly code: AgentResolverErrorCode;
     readonly detail: AgentResolverErrorDetail;
+    /** Local, cause-aware recovery. Wire codes retain the protocol taxonomy. */
+    readonly recovery: 'transient' | 'correctable' | 'terminal';
     readonly [ATTACKER_INFLUENCED]: ReadonlyArray<keyof AgentResolverErrorDetail>;
     constructor(code: AgentResolverErrorCode, message: string, detail?: AgentResolverErrorDetail, attackerInfluencedFields?: ReadonlyArray<keyof AgentResolverErrorDetail>);
 }

package/dist/lib/signing/agent-resolver/errors.js

@@ -23,16 +23,22 @@ __export(errors_exports, {
   attackerInfluencedFields: () => attackerInfluencedFields
 });
 module.exports = __toCommonJS(errors_exports);
+var import_fetch_helpers = require('./fetch-helpers.js');
+var import_enums = require('../../types/enums.generated.js');
 const ATTACKER_INFLUENCED = /* @__PURE__ */ Symbol.for("adcp.attacker-influenced");
 class AgentResolverError extends Error {
   code;
   detail;
+  /** Local, cause-aware recovery. Wire codes retain the protocol taxonomy. */
+  recovery;
   [ATTACKER_INFLUENCED];
   constructor(code, message, detail = {}, attackerInfluencedFields2 = []) {
     super(message);
     this.name = "AgentResolverError";
     this.code = code;
     this.detail = detail;
+    const discovery = code === "request_signature_capabilities_unreachable" || code === "request_signature_brand_json_unreachable";
+    this.recovery = discovery && (0, import_fetch_helpers.isPermanentDiscoveryFailure)(detail) ? "terminal" : import_enums.RequestSigningErrorCodeMetadata[code].recovery;
     this[ATTACKER_INFLUENCED] = attackerInfluencedFields2;
   }
 }

package/dist/lib/signing/agent-resolver/errors.mjs

@@ -1,13 +1,19 @@
+import { isPermanentDiscoveryFailure } from "./fetch-helpers.mjs";
+import { RequestSigningErrorCodeMetadata } from "../../types/enums.generated.mjs";
 const ATTACKER_INFLUENCED = /* @__PURE__ */ Symbol.for("adcp.attacker-influenced");
 class AgentResolverError extends Error {
   code;
   detail;
+  /** Local, cause-aware recovery. Wire codes retain the protocol taxonomy. */
+  recovery;
   [ATTACKER_INFLUENCED];
   constructor(code, message, detail = {}, attackerInfluencedFields2 = []) {
     super(message);
     this.name = "AgentResolverError";
     this.code = code;
     this.detail = detail;
+    const discovery = code === "request_signature_capabilities_unreachable" || code === "request_signature_brand_json_unreachable";
+    this.recovery = discovery && isPermanentDiscoveryFailure(detail) ? "terminal" : RequestSigningErrorCodeMetadata[code].recovery;
     this[ATTACKER_INFLUENCED] = attackerInfluencedFields2;
   }
 }

package/dist/lib/signing/agent-resolver/fetch-helpers.d.mts

@@ -40,3 +40,12 @@ export declare function safeFetchJson(url: string, kind: FetchKind, options: {
     maxBodyBytes: number;
     lookup?: SsrfDnsLookup;
 }): Promise<SafeFetchJsonResult>;
+/** Coarse causes only: never expose messages, resolved addresses, or topology. */
+export declare function classifyDiscoveryFailure(error: unknown): {
+    dns_error: SafeFetchError['transport'];
+    http_status?: number;
+};
+export declare function isPermanentDiscoveryFailure(detail: {
+    dns_error?: string;
+    http_status?: number;
+}): boolean;

package/dist/lib/signing/agent-resolver/fetch-helpers.d.ts

@@ -40,3 +40,12 @@ export declare function safeFetchJson(url: string, kind: FetchKind, options: {
     maxBodyBytes: number;
     lookup?: SsrfDnsLookup;
 }): Promise<SafeFetchJsonResult>;
+/** Coarse causes only: never expose messages, resolved addresses, or topology. */
+export declare function classifyDiscoveryFailure(error: unknown): {
+    dns_error: SafeFetchError['transport'];
+    http_status?: number;
+};
+export declare function isPermanentDiscoveryFailure(detail: {
+    dns_error?: string;
+    http_status?: number;
+}): boolean;

package/dist/lib/signing/agent-resolver/fetch-helpers.js

@@ -24,10 +24,13 @@ __export(fetch_helpers_exports, {
   MAX_CAPABILITIES_BYTES: () => MAX_CAPABILITIES_BYTES,
   MAX_JWKS_BYTES: () => MAX_JWKS_BYTES,
   SafeFetchError: () => SafeFetchError,
+  classifyDiscoveryFailure: () => classifyDiscoveryFailure,
+  isPermanentDiscoveryFailure: () => isPermanentDiscoveryFailure,
   safeFetchJson: () => safeFetchJson
 });
 module.exports = __toCommonJS(fetch_helpers_exports);
 var import_net = require('../../net/index.js');
+var import_agent_transport_fetch = require('../../net/agent-transport-fetch.js');
 var import_strict_json = require('./strict-json.js');
 const MAX_CAPABILITIES_BYTES = 65536;
 const MAX_BRAND_JSON_BYTES = 262144;
@@ -60,7 +63,11 @@ async function safeFetchJson(url, kind, options) {
     res = await (0, import_net.ssrfSafeFetch)(url, fetchOpts);
   } catch (err) {
     if (err instanceof import_net.SsrfRefusedError) {
-      throw new SafeFetchError(kind, "ssrf_refused", `${kind} fetch refused: ${err.code}`);
+      throw new SafeFetchError(
+        kind,
+        import_net.SSRF_TRANSIENT_CODES.has(err.code) ? err.code === "body_exceeds_limit" ? "body_cap" : "dns_error" : "ssrf_refused",
+        `${kind} fetch refused: ${err.code}`
+      );
     }
     const message = err instanceof Error ? err.message : String(err);
     if (/abort|timed?\s*out/i.test(message)) {
@@ -88,6 +95,31 @@ async function safeFetchJson(url, kind, options) {
     fetchedAt: Math.floor(Date.now() / 1e3)
   };
 }
+function classifyDiscoveryFailure(error) {
+  const seen = /* @__PURE__ */ new Set();
+  for (let depth = 0; error && typeof error === "object" && depth < 8 && !seen.has(error); depth++) {
+    seen.add(error);
+    if (error instanceof SafeFetchError)
+      return { dns_error: error.transport, ...error.httpStatus !== void 0 && { http_status: error.httpStatus } };
+    if (error instanceof import_agent_transport_fetch.AgentTransportPolicyError) return { dns_error: "ssrf_refused" };
+    if (error instanceof import_net.SsrfRefusedError)
+      return {
+        dns_error: import_net.SSRF_TRANSIENT_CODES.has(error.code) ? error.code === "body_exceeds_limit" ? "body_cap" : "dns_error" : "ssrf_refused"
+      };
+    const obj = error;
+    const status = obj.httpStatus ?? obj.status ?? obj.statusCode;
+    if (typeof status === "number" && status >= 400 && status <= 599)
+      return { dns_error: "fetch_failed", http_status: status };
+    if (obj.code === "ENOTFOUND" || obj.code === "EAI_AGAIN") return { dns_error: "dns_error" };
+    if (obj.name === "AbortError" || obj.name === "TimeoutError" || obj.code === "ETIMEDOUT" || typeof obj.code === "string" && obj.code.startsWith("UND_ERR_") && obj.code.endsWith("_TIMEOUT"))
+      return { dns_error: "timeout" };
+    error = obj.cause;
+  }
+  return { dns_error: "fetch_failed" };
+}
+function isPermanentDiscoveryFailure(detail) {
+  return detail.dns_error === "ssrf_refused" || detail.http_status !== void 0 && detail.http_status >= 400 && detail.http_status < 500;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_CONNECT_TIMEOUT_MS,
@@ -96,5 +128,7 @@ async function safeFetchJson(url, kind, options) {
   MAX_CAPABILITIES_BYTES,
   MAX_JWKS_BYTES,
   SafeFetchError,
+  classifyDiscoveryFailure,
+  isPermanentDiscoveryFailure,
   safeFetchJson
 });

package/dist/lib/signing/agent-resolver/fetch-helpers.mjs

@@ -1,4 +1,9 @@
-import { ssrfSafeFetch, SsrfRefusedError } from "../../net/index.mjs";
+import {
+  ssrfSafeFetch,
+  SsrfRefusedError,
+  SSRF_TRANSIENT_CODES
+} from "../../net/index.mjs";
+import { AgentTransportPolicyError } from "../../net/agent-transport-fetch.mjs";
 import { parseStrictJson, StrictJsonError } from "./strict-json.mjs";
 const MAX_CAPABILITIES_BYTES = 65536;
 const MAX_BRAND_JSON_BYTES = 262144;
@@ -31,7 +36,11 @@ async function safeFetchJson(url, kind, options) {
     res = await ssrfSafeFetch(url, fetchOpts);
   } catch (err) {
     if (err instanceof SsrfRefusedError) {
-      throw new SafeFetchError(kind, "ssrf_refused", `${kind} fetch refused: ${err.code}`);
+      throw new SafeFetchError(
+        kind,
+        SSRF_TRANSIENT_CODES.has(err.code) ? err.code === "body_exceeds_limit" ? "body_cap" : "dns_error" : "ssrf_refused",
+        `${kind} fetch refused: ${err.code}`
+      );
     }
     const message = err instanceof Error ? err.message : String(err);
     if (/abort|timed?\s*out/i.test(message)) {
@@ -59,6 +68,31 @@ async function safeFetchJson(url, kind, options) {
     fetchedAt: Math.floor(Date.now() / 1e3)
   };
 }
+function classifyDiscoveryFailure(error) {
+  const seen = /* @__PURE__ */ new Set();
+  for (let depth = 0; error && typeof error === "object" && depth < 8 && !seen.has(error); depth++) {
+    seen.add(error);
+    if (error instanceof SafeFetchError)
+      return { dns_error: error.transport, ...error.httpStatus !== void 0 && { http_status: error.httpStatus } };
+    if (error instanceof AgentTransportPolicyError) return { dns_error: "ssrf_refused" };
+    if (error instanceof SsrfRefusedError)
+      return {
+        dns_error: SSRF_TRANSIENT_CODES.has(error.code) ? error.code === "body_exceeds_limit" ? "body_cap" : "dns_error" : "ssrf_refused"
+      };
+    const obj = error;
+    const status = obj.httpStatus ?? obj.status ?? obj.statusCode;
+    if (typeof status === "number" && status >= 400 && status <= 599)
+      return { dns_error: "fetch_failed", http_status: status };
+    if (obj.code === "ENOTFOUND" || obj.code === "EAI_AGAIN") return { dns_error: "dns_error" };
+    if (obj.name === "AbortError" || obj.name === "TimeoutError" || obj.code === "ETIMEDOUT" || typeof obj.code === "string" && obj.code.startsWith("UND_ERR_") && obj.code.endsWith("_TIMEOUT"))
+      return { dns_error: "timeout" };
+    error = obj.cause;
+  }
+  return { dns_error: "fetch_failed" };
+}
+function isPermanentDiscoveryFailure(detail) {
+  return detail.dns_error === "ssrf_refused" || detail.http_status !== void 0 && detail.http_status >= 400 && detail.http_status < 500;
+}
 export {
   DEFAULT_CONNECT_TIMEOUT_MS,
   DEFAULT_TOTAL_TIMEOUT_MS,
@@ -66,5 +100,7 @@ export {
   MAX_CAPABILITIES_BYTES,
   MAX_JWKS_BYTES,
   SafeFetchError,
+  classifyDiscoveryFailure,
+  isPermanentDiscoveryFailure,
   safeFetchJson
 };

package/dist/lib/signing/agent-resolver/legacy-brand.js

@@ -42,7 +42,7 @@ async function fetchLegacyBrandJson(agentUrl, options) {
   } catch (err) {
     throw new import_fetch_helpers.SafeFetchError(
       "brand.json",
-      "fetch_failed",
+      (0, import_fetch_helpers.classifyDiscoveryFailure)(err).dns_error,
       err instanceof import_brand_jwks.BrandJsonResolverError && err.code === "invalid_body" ? "brand.json body failed strict-JSON parse" : "Legacy brand.json discovery failed",
       err instanceof import_brand_jwks.BrandJsonResolverError ? err.httpStatus : void 0
     );

package/dist/lib/signing/agent-resolver/legacy-brand.mjs

@@ -1,6 +1,6 @@
 import { fetchBrandJson, BrandJsonResolverError } from "../brand-jwks.mjs";
 import { eTldPlusOne } from "./etld.mjs";
-import { SafeFetchError } from "./fetch-helpers.mjs";
+import { SafeFetchError, classifyDiscoveryFailure } from "./fetch-helpers.mjs";
 async function fetchLegacyBrandJson(agentUrl, options) {
   const agent = new URL(agentUrl);
   let startUrl = `${agent.origin}/.well-known/brand.json`;
@@ -19,7 +19,7 @@ async function fetchLegacyBrandJson(agentUrl, options) {
   } catch (err) {
     throw new SafeFetchError(
       "brand.json",
-      "fetch_failed",
+      classifyDiscoveryFailure(err).dns_error,
       err instanceof BrandJsonResolverError && err.code === "invalid_body" ? "brand.json body failed strict-JSON parse" : "Legacy brand.json discovery failed",
       err instanceof BrandJsonResolverError ? err.httpStatus : void 0
     );

package/dist/lib/signing/agent-resolver/resolve-agent.d.mts

@@ -28,7 +28,7 @@
  *     `SsrfRefusedError` carries.
  */
 import type { IdentityKeyOriginPurpose, IdentityPosture } from './capabilities-types.mjs';
-import type { SsrfDnsLookup } from '../../net/index.mjs';
+import { type SsrfDnsLookup } from '../../net/index.mjs';
 import { type ConsistencyResult } from './consistency.mjs';
 import { type AgentResolverErrorDetail } from './errors.mjs';
 import { type AgentEntry } from './select-agent.mjs';

package/dist/lib/signing/agent-resolver/resolve-agent.d.ts

@@ -28,7 +28,7 @@
  *     `SsrfRefusedError` carries.
  */
 import type { IdentityKeyOriginPurpose, IdentityPosture } from './capabilities-types';
-import type { SsrfDnsLookup } from '../../net';
+import { type SsrfDnsLookup } from '../../net';
 import { type ConsistencyResult } from './consistency';
 import { type AgentResolverErrorDetail } from './errors';
 import { type AgentEntry } from './select-agent';