@adcp/sdk 14.1.0 → 14.3.0

package/dist/lib/signing/canonicalize.d.mts

@@ -68,5 +68,7 @@ export declare function formatSignatureParams(components: ReadonlyArray<string>,
  * non-transitional produce different A-labels for the same input, which
  * would open a signer/verifier canonicalization differential. Accepts
  * both absolute (`scheme://…`) and scheme-relative (`//…`) URL shapes.
+ * The transport taxonomy classifies the received URI as malformed. Diagnostic
+ * step 1 is SDK-local parsing, not the checklist's signature-header parser.
  */
 export declare function rejectNonAsciiHost(rawUrl: string): void;

package/dist/lib/signing/canonicalize.d.ts

@@ -68,5 +68,7 @@ export declare function formatSignatureParams(components: ReadonlyArray<string>,
  * non-transitional produce different A-labels for the same input, which
  * would open a signer/verifier canonicalization differential. Accepts
  * both absolute (`scheme://…`) and scheme-relative (`//…`) URL shapes.
+ * The transport taxonomy classifies the received URI as malformed. Diagnostic
+ * step 1 is SDK-local parsing, not the checklist's signature-header parser.
  */
 export declare function rejectNonAsciiHost(rawUrl: string): void;

package/dist/lib/signing/canonicalize.js

@@ -269,7 +269,7 @@ function rejectNonAsciiHost(rawUrl) {
   for (let i = 0; i < authority.length; i++) {
     if (authority.charCodeAt(i) > 127) {
       throw new import_errors.RequestSignatureError(
-        "request_signature_header_malformed",
+        "request_target_uri_malformed",
         1,
         "URL authority contains non-ASCII bytes; use the A-label (Punycode) form"
       );

package/dist/lib/signing/canonicalize.mjs

@@ -239,7 +239,7 @@ function rejectNonAsciiHost(rawUrl) {
   for (let i = 0; i < authority.length; i++) {
     if (authority.charCodeAt(i) > 127) {
       throw new RequestSignatureError(
-        "request_signature_header_malformed",
+        "request_target_uri_malformed",
         1,
         "URL authority contains non-ASCII bytes; use the A-label (Punycode) form"
       );

package/dist/lib/signing/errors.d.mts

@@ -1,12 +1,14 @@
 import { ADCPError } from '../errors/index.mjs';
 import type { RequestSigningErrorCode } from '../types/core.generated.mjs';
-export { RequestSigningErrorCodeMetadata } from '../types/enums.generated.mjs';
+import { RequestSigningErrorCodeMetadata } from '../types/enums.generated.mjs';
+export { RequestSigningErrorCodeMetadata };
 /** Canonical rc.6 request-signing transport vocabulary. */
 export type RequestSignatureErrorCode = RequestSigningErrorCode;
 export declare class RequestSignatureError extends ADCPError {
     readonly code: RequestSignatureErrorCode;
     readonly failedStep: number;
-    constructor(code: RequestSignatureErrorCode, failedStep: number, message: string, details?: unknown);
+    readonly recovery: 'transient' | 'correctable' | 'terminal';
+    constructor(code: RequestSignatureErrorCode, failedStep: number, message: string, details?: unknown, recovery?: 'transient' | 'correctable' | 'terminal');
 }
 /**
  * Error codes surfaced by the RFC 9421 webhook-signing verifier. Maps onto

package/dist/lib/signing/errors.d.ts

@@ -1,12 +1,14 @@
 import { ADCPError } from '../errors';
 import type { RequestSigningErrorCode } from '../types/core.generated';
-export { RequestSigningErrorCodeMetadata } from '../types/enums.generated';
+import { RequestSigningErrorCodeMetadata } from '../types/enums.generated';
+export { RequestSigningErrorCodeMetadata };
 /** Canonical rc.6 request-signing transport vocabulary. */
 export type RequestSignatureErrorCode = RequestSigningErrorCode;
 export declare class RequestSignatureError extends ADCPError {
     readonly code: RequestSignatureErrorCode;
     readonly failedStep: number;
-    constructor(code: RequestSignatureErrorCode, failedStep: number, message: string, details?: unknown);
+    readonly recovery: 'transient' | 'correctable' | 'terminal';
+    constructor(code: RequestSignatureErrorCode, failedStep: number, message: string, details?: unknown, recovery?: 'transient' | 'correctable' | 'terminal');
 }
 /**
  * Error codes surfaced by the RFC 9421 webhook-signing verifier. Maps onto

package/dist/lib/signing/errors.js

@@ -30,10 +30,12 @@ var import_enums = require('../types/enums.generated.js');
 class RequestSignatureError extends import_errors.ADCPError {
   code;
   failedStep;
-  constructor(code, failedStep, message, details) {
+  recovery;
+  constructor(code, failedStep, message, details, recovery) {
     super(message, details);
     this.code = code;
     this.failedStep = failedStep;
+    this.recovery = recovery ?? import_enums.RequestSigningErrorCodeMetadata[code].recovery;
   }
 }
 class WebhookSignatureError extends import_errors.ADCPError {

package/dist/lib/signing/errors.mjs

@@ -3,10 +3,12 @@ import { RequestSigningErrorCodeMetadata } from "../types/enums.generated.mjs";
 class RequestSignatureError extends ADCPError {
   code;
   failedStep;
-  constructor(code, failedStep, message, details) {
+  recovery;
+  constructor(code, failedStep, message, details, recovery) {
     super(message, details);
     this.code = code;
     this.failedStep = failedStep;
+    this.recovery = recovery ?? RequestSigningErrorCodeMetadata[code].recovery;
   }
 }
 class WebhookSignatureError extends ADCPError {

package/dist/lib/signing/verifier.js

@@ -99,7 +99,7 @@ async function verifyRequestSignature(request, options) {
   if (!parsedSig) throw parseError;
   const effectiveEncoding = pinnedBinaryEncoding ?? parsedEncoding;
   const canonicalizationProfile = effectiveEncoding === "rfc8941-base64" ? "3.2" : "legacy";
-  if (canonicalizationProfile === "legacy") (0, import_canonicalize.rejectNonAsciiHost)(request.url);
+  (0, import_canonicalize.rejectNonAsciiHost)(request.url);
   validateSingleValuedCoveredHeaders(parsedInput.components, request);
   requireParams(parsedInput);
   if (parsedInput.params.tag !== import_types.REQUEST_SIGNING_TAG) {
@@ -141,7 +141,7 @@ async function verifyRequestSignature(request, options) {
     }
   } catch (err) {
     if (err instanceof import_errors2.AgentResolverError) {
-      throw new import_errors.RequestSignatureError(err.code, 7, err.message, err.detail);
+      throw new import_errors.RequestSignatureError(err.code, 7, err.message, err.detail, err.recovery);
     }
     throw err;
   }

package/dist/lib/signing/verifier.mjs

@@ -92,7 +92,7 @@ async function verifyRequestSignature(request, options) {
   if (!parsedSig) throw parseError;
   const effectiveEncoding = pinnedBinaryEncoding ?? parsedEncoding;
   const canonicalizationProfile = effectiveEncoding === "rfc8941-base64" ? "3.2" : "legacy";
-  if (canonicalizationProfile === "legacy") rejectNonAsciiHost(request.url);
+  rejectNonAsciiHost(request.url);
   validateSingleValuedCoveredHeaders(parsedInput.components, request);
   requireParams(parsedInput);
   if (parsedInput.params.tag !== REQUEST_SIGNING_TAG) {
@@ -134,7 +134,7 @@ async function verifyRequestSignature(request, options) {
     }
   } catch (err) {
     if (err instanceof AgentResolverError) {
-      throw new RequestSignatureError(err.code, 7, err.message, err.detail);
+      throw new RequestSignatureError(err.code, 7, err.message, err.detail, err.recovery);
     }
     throw err;
   }

package/dist/lib/signing/webhook-verifier.js

@@ -37,8 +37,8 @@ var import_replay = require('./replay.js');
 var import_revocation = require('./revocation.js');
 var import_types = require('./types.js');
 function keyDiscoveryRetryable(error) {
-  if (error instanceof import_errors2.AgentResolverError) return import_errors.RequestSigningErrorCodeMetadata[error.code].recovery === "transient";
-  if (error instanceof import_brand_jwks.BrandJsonResolverError) return error.code === "fetch_failed";
+  if (error instanceof import_errors2.AgentResolverError) return error.recovery === "transient";
+  if (error instanceof import_brand_jwks.BrandJsonResolverError) return error.recovery === "transient";
   return true;
 }
 const WEBHOOK_SIGNING_TAG = "adcp/webhook-signing/v1";

package/dist/lib/signing/webhook-verifier.mjs

@@ -1,6 +1,6 @@
 import { buildSignatureBase, canonicalTargetUri, getHeaderValue } from "./canonicalize.mjs";
 import { contentDigestMatches } from "./content-digest.mjs";
-import { RequestSignatureError, WebhookSignatureError, RequestSigningErrorCodeMetadata } from "./errors.mjs";
+import { RequestSignatureError, WebhookSignatureError } from "./errors.mjs";
 import { AgentResolverError } from "./agent-resolver/errors.mjs";
 import { BrandJsonResolverError } from "./brand-jwks.mjs";
 import { parseSignature, parseSignatureInput } from "./parser.mjs";
@@ -10,8 +10,8 @@ import { InMemoryReplayStore } from "./replay.mjs";
 import { InMemoryRevocationStore } from "./revocation.mjs";
 import { ALLOWED_ALGS, CLOCK_SKEW_TOLERANCE_SECONDS, MAX_SIGNATURE_WINDOW_SECONDS } from "./types.mjs";
 function keyDiscoveryRetryable(error) {
-  if (error instanceof AgentResolverError) return RequestSigningErrorCodeMetadata[error.code].recovery === "transient";
-  if (error instanceof BrandJsonResolverError) return error.code === "fetch_failed";
+  if (error instanceof AgentResolverError) return error.recovery === "transient";
+  if (error instanceof BrandJsonResolverError) return error.recovery === "transient";
   return true;
 }
 const WEBHOOK_SIGNING_TAG = "adcp/webhook-signing/v1";

package/dist/lib/testing/storyboard/request-signing/builder.js

@@ -192,6 +192,7 @@ const MUTATIONS = {
   // transport-ungradable by the live probe because no HTTP client can route
   // to that intentionally invalid host spelling.
   "profile-3.2/negative/001-base64url-sf-binary": (vector, _keys, options) => passthrough(vector, options),
+  "profile-3.2/negative/001-no-signature-header": delegateToRoot("001-no-signature-header"),
   "profile-3.2/negative/002-multiple-trailing-dots": (vector, _keys, options) => passthrough(vector, options),
   "profile-3.2/negative/002-wrong-tag": delegateToRoot("002-wrong-tag"),
   "profile-3.2/negative/003-expired-signature": delegateToRoot("003-expired-signature"),
@@ -208,6 +209,7 @@ const MUTATIONS = {
   "profile-3.2/negative/008-unknown-keyid": delegateToRoot("008-unknown-keyid"),
   "profile-3.2/negative/009-key-ops-missing-verify": delegateToRoot("009-key-ops-missing-verify"),
   "profile-3.2/negative/010-content-digest-mismatch": delegateToRoot("010-content-digest-mismatch"),
+  "profile-3.2/negative/011-malformed-header": delegateToRoot("011-malformed-header"),
   "profile-3.2/negative/012-missing-expires-param": delegateToRoot("012-missing-expires-param"),
   "profile-3.2/negative/013-expires-le-created": delegateToRoot("013-expires-le-created"),
   "profile-3.2/negative/014-missing-nonce-param": delegateToRoot("014-missing-nonce-param"),
@@ -220,8 +222,18 @@ const MUTATIONS = {
   },
   "profile-3.2/negative/016-replayed-nonce": delegateToRoot("016-replayed-nonce"),
   "profile-3.2/negative/017-key-revoked": delegateToRoot("017-key-revoked"),
+  "profile-3.2/negative/019-signature-without-signature-input": delegateToRoot("019-signature-without-signature-input"),
   "profile-3.2/negative/020-rate-abuse": delegateToRoot("020-rate-abuse"),
-  "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch")
+  "profile-3.2/negative/021-duplicate-signature-input-label": delegateToRoot("021-duplicate-signature-input-label"),
+  "profile-3.2/negative/022-multi-valued-content-type": delegateToRoot("022-multi-valued-content-type"),
+  "profile-3.2/negative/023-multi-valued-content-digest": delegateToRoot("023-multi-valued-content-digest"),
+  "profile-3.2/negative/024-unquoted-string-param": delegateToRoot("024-unquoted-string-param"),
+  "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch"),
+  "profile-3.2/negative/026-non-ascii-host": delegateToRoot("026-non-ascii-host"),
+  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": delegateToRoot(
+    "027-webhook-registration-authentication-unsigned"
+  ),
+  "profile-3.2/negative/028-unsigned-protocol-method-required": delegateToRoot("028-unsigned-protocol-method-required")
 };
 function delegateToRoot(rootId) {
   return (vector, keys, options) => {

package/dist/lib/testing/storyboard/request-signing/builder.mjs

@@ -175,6 +175,7 @@ const MUTATIONS = {
   // transport-ungradable by the live probe because no HTTP client can route
   // to that intentionally invalid host spelling.
   "profile-3.2/negative/001-base64url-sf-binary": (vector, _keys, options) => passthrough(vector, options),
+  "profile-3.2/negative/001-no-signature-header": delegateToRoot("001-no-signature-header"),
   "profile-3.2/negative/002-multiple-trailing-dots": (vector, _keys, options) => passthrough(vector, options),
   "profile-3.2/negative/002-wrong-tag": delegateToRoot("002-wrong-tag"),
   "profile-3.2/negative/003-expired-signature": delegateToRoot("003-expired-signature"),
@@ -191,6 +192,7 @@ const MUTATIONS = {
   "profile-3.2/negative/008-unknown-keyid": delegateToRoot("008-unknown-keyid"),
   "profile-3.2/negative/009-key-ops-missing-verify": delegateToRoot("009-key-ops-missing-verify"),
   "profile-3.2/negative/010-content-digest-mismatch": delegateToRoot("010-content-digest-mismatch"),
+  "profile-3.2/negative/011-malformed-header": delegateToRoot("011-malformed-header"),
   "profile-3.2/negative/012-missing-expires-param": delegateToRoot("012-missing-expires-param"),
   "profile-3.2/negative/013-expires-le-created": delegateToRoot("013-expires-le-created"),
   "profile-3.2/negative/014-missing-nonce-param": delegateToRoot("014-missing-nonce-param"),
@@ -203,8 +205,18 @@ const MUTATIONS = {
   },
   "profile-3.2/negative/016-replayed-nonce": delegateToRoot("016-replayed-nonce"),
   "profile-3.2/negative/017-key-revoked": delegateToRoot("017-key-revoked"),
+  "profile-3.2/negative/019-signature-without-signature-input": delegateToRoot("019-signature-without-signature-input"),
   "profile-3.2/negative/020-rate-abuse": delegateToRoot("020-rate-abuse"),
-  "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch")
+  "profile-3.2/negative/021-duplicate-signature-input-label": delegateToRoot("021-duplicate-signature-input-label"),
+  "profile-3.2/negative/022-multi-valued-content-type": delegateToRoot("022-multi-valued-content-type"),
+  "profile-3.2/negative/023-multi-valued-content-digest": delegateToRoot("023-multi-valued-content-digest"),
+  "profile-3.2/negative/024-unquoted-string-param": delegateToRoot("024-unquoted-string-param"),
+  "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch"),
+  "profile-3.2/negative/026-non-ascii-host": delegateToRoot("026-non-ascii-host"),
+  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": delegateToRoot(
+    "027-webhook-registration-authentication-unsigned"
+  ),
+  "profile-3.2/negative/028-unsigned-protocol-method-required": delegateToRoot("028-unsigned-protocol-method-required")
 };
 function delegateToRoot(rootId) {
   return (vector, keys, options) => {

package/dist/lib/testing/storyboard/request-signing/grader.js

@@ -134,6 +134,7 @@ const TRANSPORT_UNGRADABLE = {
   // agent as Punycode, defeating the parse-time check. Direct verifier
   // tests exercise this edge.
   "026-non-ascii-host": "HTTP transport punycodes U-labels before the request leaves the client; verified at the library level.",
+  "profile-3.2/negative/026-non-ascii-host": "HTTP transport punycodes U-labels before the request leaves the client; verified at the library level.",
   "profile-3.2/negative/002-multiple-trailing-dots": "HTTP transport cannot route to an intentionally malformed DNS authority; verified at the library level."
 };
 function semanticVectorExclusion(vector, declaredCapability) {

package/dist/lib/testing/storyboard/request-signing/grader.mjs

@@ -113,6 +113,7 @@ const TRANSPORT_UNGRADABLE = {
   // agent as Punycode, defeating the parse-time check. Direct verifier
   // tests exercise this edge.
   "026-non-ascii-host": "HTTP transport punycodes U-labels before the request leaves the client; verified at the library level.",
+  "profile-3.2/negative/026-non-ascii-host": "HTTP transport punycodes U-labels before the request leaves the client; verified at the library level.",
   "profile-3.2/negative/002-multiple-trailing-dots": "HTTP transport cannot route to an intentionally malformed DNS authority; verified at the library level."
 };
 function semanticVectorExclusion(vector, declaredCapability) {

package/dist/lib/testing/storyboard/request-signing/vector-loader.js

@@ -39,7 +39,7 @@ function selectRequestSigningVectors(loaded, signingProfileVersion) {
 }
 function signingProfileForAdcpVersion(version) {
   const match = /^(\d+)\.(\d+)/.exec(version ?? "");
-  return match && Number(match[1]) === 3 && Number(match[2]) === 2 ? "3.2" : void 0;
+  return match && (Number(match[1]) > 3 || Number(match[1]) === 3 && Number(match[2]) >= 2) ? "3.2" : void 0;
 }
 const ERROR_CODES = /* @__PURE__ */ new Set([
   "request_signature_required",

package/dist/lib/testing/storyboard/request-signing/vector-loader.mjs

@@ -11,7 +11,7 @@ function selectRequestSigningVectors(loaded, signingProfileVersion) {
 }
 function signingProfileForAdcpVersion(version) {
   const match = /^(\d+)\.(\d+)/.exec(version ?? "");
-  return match && Number(match[1]) === 3 && Number(match[2]) === 2 ? "3.2" : void 0;
+  return match && (Number(match[1]) > 3 || Number(match[1]) === 3 && Number(match[2]) >= 2) ? "3.2" : void 0;
 }
 const ERROR_CODES = /* @__PURE__ */ new Set([
   "request_signature_required",

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "14.1.0";
+export declare const RUNNER_CAPABILITY_VERSION = "14.3.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "14.1.0";
+export declare const RUNNER_CAPABILITY_VERSION = "14.3.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/types/accept-proposal.d.ts

@@ -145,6 +145,11 @@ export type ActivationKey = {
  */
 export type AdvertiserIndustry = 'automotive' | 'automotive.electric_vehicles' | 'automotive.parts_accessories' | 'automotive.luxury' | 'beauty_cosmetics' | 'beauty_cosmetics.skincare' | 'beauty_cosmetics.fragrance' | 'beauty_cosmetics.haircare' | 'cannabis' | 'cpg' | 'cpg.personal_care' | 'cpg.household' | 'dating' | 'education' | 'education.higher_education' | 'education.online_learning' | 'education.k12' | 'energy_utilities' | 'energy_utilities.renewable' | 'fashion_apparel' | 'fashion_apparel.luxury' | 'fashion_apparel.sportswear' | 'finance' | 'finance.banking' | 'finance.insurance' | 'finance.investment' | 'finance.cryptocurrency' | 'food_beverage' | 'food_beverage.alcohol' | 'food_beverage.restaurants' | 'food_beverage.packaged_goods' | 'gambling_betting' | 'gambling_betting.sports_betting' | 'gambling_betting.casino' | 'gaming' | 'gaming.mobile' | 'gaming.console_pc' | 'gaming.esports' | 'government_nonprofit' | 'government_nonprofit.political' | 'government_nonprofit.charity' | 'healthcare' | 'healthcare.pharmaceutical' | 'healthcare.medical_devices' | 'healthcare.wellness' | 'home_garden' | 'home_garden.furniture' | 'home_garden.home_improvement' | 'media_entertainment' | 'media_entertainment.podcasts' | 'media_entertainment.music' | 'media_entertainment.film_tv' | 'media_entertainment.publishing' | 'media_entertainment.live_events' | 'pets' | 'professional_services' | 'professional_services.legal' | 'professional_services.consulting' | 'real_estate' | 'real_estate.residential' | 'real_estate.commercial' | 'recruitment_hr' | 'retail' | 'retail.ecommerce' | 'retail.department_stores' | 'sports_fitness' | 'sports_fitness.equipment' | 'sports_fitness.teams_leagues' | 'technology' | 'technology.software' | 'technology.hardware' | 'technology.ai_ml' | 'telecom' | 'telecom.mobile_carriers' | 'telecom.internet_providers' | 'transportation_logistics' | 'travel_hospitality' | 'travel_hospitality.airlines' | 'travel_hospitality.hotels' | 'travel_hospitality.cruise' | 'travel_hospitality.tourism';
 
+/**
+ * User-level bases that may resolve age for demographic targeting execution. Population estimates are deliberately absent because aggregate composition cannot establish an individual impression's age.
+ */
+export type AgeDeterminationBasis = 'verified' | 'declared' | 'inferred';
+
 /**
  * Methods for verifying user age for compliance. Does not include 'inferred' as it is not accepted for regulatory compliance.
  */
@@ -1083,7 +1088,20 @@ export type DemographicSystem = 'nielsen' | 'nielsen_audio' | 'barb' | 'agf' | '
  * Canonical demographic audience targeting intent with optional constraints on how age may be determined. This is distinct from age_restriction: demographics selects an audience, while age_restriction expresses a legal eligibility or verification floor. Fresh create/update targeting MUST compile exactly or be rejected. During get_products, a seller may offer a different configured predicate only through sparse targeting_resolution modifications on a distinguishable product_id; selecting that product accepts the alternative. Sellers never silently broaden, narrow, default, drop, or substitute the basis.
  */
 export interface DemographicTargetingIntent {
-    age: DemographicAgeRange & {};
+    age: DemographicAgeRange & {
+        /**
+         * User-level age determination bases the buyer permits for this predicate. Sellers MUST use only these bases or reject the request; they MUST NOT silently fall back to another basis. When omitted, the buyer imposes no determination-basis constraint beyond product capability and any age_restriction. population_estimate is structurally unavailable because aggregate evidence cannot identify an eligible user.
+         *
+         * @minItems 1
+         */
+        accepted_bases?: [AgeDeterminationBasis, ...AgeDeterminationBasis[]];
+        /**
+         * Verification methods acceptable when verified is an accepted basis. This field narrows verified demographic execution; age_restriction.accepted_methods independently governs legal eligibility and the two sets are intersected when both are present.
+         *
+         * @minItems 1
+         */
+        accepted_verification_methods?: [AgeVerificationMethod, ...AgeVerificationMethod[]];
+    };
 }
 
 /**

package/dist/lib/types/buy-products.d.ts

@@ -145,6 +145,11 @@ export type ActivationKey = {
  */
 export type AdvertiserIndustry = 'automotive' | 'automotive.electric_vehicles' | 'automotive.parts_accessories' | 'automotive.luxury' | 'beauty_cosmetics' | 'beauty_cosmetics.skincare' | 'beauty_cosmetics.fragrance' | 'beauty_cosmetics.haircare' | 'cannabis' | 'cpg' | 'cpg.personal_care' | 'cpg.household' | 'dating' | 'education' | 'education.higher_education' | 'education.online_learning' | 'education.k12' | 'energy_utilities' | 'energy_utilities.renewable' | 'fashion_apparel' | 'fashion_apparel.luxury' | 'fashion_apparel.sportswear' | 'finance' | 'finance.banking' | 'finance.insurance' | 'finance.investment' | 'finance.cryptocurrency' | 'food_beverage' | 'food_beverage.alcohol' | 'food_beverage.restaurants' | 'food_beverage.packaged_goods' | 'gambling_betting' | 'gambling_betting.sports_betting' | 'gambling_betting.casino' | 'gaming' | 'gaming.mobile' | 'gaming.console_pc' | 'gaming.esports' | 'government_nonprofit' | 'government_nonprofit.political' | 'government_nonprofit.charity' | 'healthcare' | 'healthcare.pharmaceutical' | 'healthcare.medical_devices' | 'healthcare.wellness' | 'home_garden' | 'home_garden.furniture' | 'home_garden.home_improvement' | 'media_entertainment' | 'media_entertainment.podcasts' | 'media_entertainment.music' | 'media_entertainment.film_tv' | 'media_entertainment.publishing' | 'media_entertainment.live_events' | 'pets' | 'professional_services' | 'professional_services.legal' | 'professional_services.consulting' | 'real_estate' | 'real_estate.residential' | 'real_estate.commercial' | 'recruitment_hr' | 'retail' | 'retail.ecommerce' | 'retail.department_stores' | 'sports_fitness' | 'sports_fitness.equipment' | 'sports_fitness.teams_leagues' | 'technology' | 'technology.software' | 'technology.hardware' | 'technology.ai_ml' | 'telecom' | 'telecom.mobile_carriers' | 'telecom.internet_providers' | 'transportation_logistics' | 'travel_hospitality' | 'travel_hospitality.airlines' | 'travel_hospitality.hotels' | 'travel_hospitality.cruise' | 'travel_hospitality.tourism';
 
+/**
+ * User-level bases that may resolve age for demographic targeting execution. Population estimates are deliberately absent because aggregate composition cannot establish an individual impression's age.
+ */
+export type AgeDeterminationBasis = 'verified' | 'declared' | 'inferred';
+
 /**
  * Age restriction for compliance. Use for legal requirements (alcohol, gambling), not audience targeting.
  */
@@ -1152,7 +1157,20 @@ export type DemographicSystem = 'nielsen' | 'nielsen_audio' | 'barb' | 'agf' | '
  * Canonical demographic audience targeting intent with optional constraints on how age may be determined. This is distinct from age_restriction: demographics selects an audience, while age_restriction expresses a legal eligibility or verification floor. Fresh create/update targeting MUST compile exactly or be rejected. During get_products, a seller may offer a different configured predicate only through sparse targeting_resolution modifications on a distinguishable product_id; selecting that product accepts the alternative. Sellers never silently broaden, narrow, default, drop, or substitute the basis.
  */
 export interface DemographicTargetingIntent {
-    age: DemographicAgeRange & {};
+    age: DemographicAgeRange & {
+        /**
+         * User-level age determination bases the buyer permits for this predicate. Sellers MUST use only these bases or reject the request; they MUST NOT silently fall back to another basis. When omitted, the buyer imposes no determination-basis constraint beyond product capability and any age_restriction. population_estimate is structurally unavailable because aggregate evidence cannot identify an eligible user.
+         *
+         * @minItems 1
+         */
+        accepted_bases?: [AgeDeterminationBasis, ...AgeDeterminationBasis[]];
+        /**
+         * Verification methods acceptable when verified is an accepted basis. This field narrows verified demographic execution; age_restriction.accepted_methods independently governs legal eligibility and the two sets are intersected when both are present.
+         *
+         * @minItems 1
+         */
+        accepted_verification_methods?: [AgeVerificationMethod, ...AgeVerificationMethod[]];
+    };
 }
 
 /**

package/dist/lib/types/check-governance.d.ts

@@ -445,6 +445,11 @@ export type ActivationKey = {
  */
 export type AdvertiserIndustry = 'automotive' | 'automotive.electric_vehicles' | 'automotive.parts_accessories' | 'automotive.luxury' | 'beauty_cosmetics' | 'beauty_cosmetics.skincare' | 'beauty_cosmetics.fragrance' | 'beauty_cosmetics.haircare' | 'cannabis' | 'cpg' | 'cpg.personal_care' | 'cpg.household' | 'dating' | 'education' | 'education.higher_education' | 'education.online_learning' | 'education.k12' | 'energy_utilities' | 'energy_utilities.renewable' | 'fashion_apparel' | 'fashion_apparel.luxury' | 'fashion_apparel.sportswear' | 'finance' | 'finance.banking' | 'finance.insurance' | 'finance.investment' | 'finance.cryptocurrency' | 'food_beverage' | 'food_beverage.alcohol' | 'food_beverage.restaurants' | 'food_beverage.packaged_goods' | 'gambling_betting' | 'gambling_betting.sports_betting' | 'gambling_betting.casino' | 'gaming' | 'gaming.mobile' | 'gaming.console_pc' | 'gaming.esports' | 'government_nonprofit' | 'government_nonprofit.political' | 'government_nonprofit.charity' | 'healthcare' | 'healthcare.pharmaceutical' | 'healthcare.medical_devices' | 'healthcare.wellness' | 'home_garden' | 'home_garden.furniture' | 'home_garden.home_improvement' | 'media_entertainment' | 'media_entertainment.podcasts' | 'media_entertainment.music' | 'media_entertainment.film_tv' | 'media_entertainment.publishing' | 'media_entertainment.live_events' | 'pets' | 'professional_services' | 'professional_services.legal' | 'professional_services.consulting' | 'real_estate' | 'real_estate.residential' | 'real_estate.commercial' | 'recruitment_hr' | 'retail' | 'retail.ecommerce' | 'retail.department_stores' | 'sports_fitness' | 'sports_fitness.equipment' | 'sports_fitness.teams_leagues' | 'technology' | 'technology.software' | 'technology.hardware' | 'technology.ai_ml' | 'telecom' | 'telecom.mobile_carriers' | 'telecom.internet_providers' | 'transportation_logistics' | 'travel_hospitality' | 'travel_hospitality.airlines' | 'travel_hospitality.hotels' | 'travel_hospitality.cruise' | 'travel_hospitality.tourism';
 
+/**
+ * User-level bases that may resolve age for demographic targeting execution. Population estimates are deliberately absent because aggregate composition cannot establish an individual impression's age.
+ */
+export type AgeDeterminationBasis = 'verified' | 'declared' | 'inferred';
+
 /**
  * Methods for verifying user age for compliance. Does not include 'inferred' as it is not accepted for regulatory compliance.
  */
@@ -1585,7 +1590,20 @@ export type DemographicSystem = 'nielsen' | 'nielsen_audio' | 'barb' | 'agf' | '
  * Canonical demographic audience targeting intent with optional constraints on how age may be determined. This is distinct from age_restriction: demographics selects an audience, while age_restriction expresses a legal eligibility or verification floor. Fresh create/update targeting MUST compile exactly or be rejected. During get_products, a seller may offer a different configured predicate only through sparse targeting_resolution modifications on a distinguishable product_id; selecting that product accepts the alternative. Sellers never silently broaden, narrow, default, drop, or substitute the basis.
  */
 export interface DemographicTargetingIntent {
-    age: DemographicAgeRange & {};
+    age: DemographicAgeRange & {
+        /**
+         * User-level age determination bases the buyer permits for this predicate. Sellers MUST use only these bases or reject the request; they MUST NOT silently fall back to another basis. When omitted, the buyer imposes no determination-basis constraint beyond product capability and any age_restriction. population_estimate is structurally unavailable because aggregate evidence cannot identify an eligible user.
+         *
+         * @minItems 1
+         */
+        accepted_bases?: [AgeDeterminationBasis, ...AgeDeterminationBasis[]];
+        /**
+         * Verification methods acceptable when verified is an accepted basis. This field narrows verified demographic execution; age_restriction.accepted_methods independently governs legal eligibility and the two sets are intersected when both are present.
+         *
+         * @minItems 1
+         */
+        accepted_verification_methods?: [AgeVerificationMethod, ...AgeVerificationMethod[]];
+    };
 }
 
 /**

package/dist/lib/types/comply-test-controller.d.ts

@@ -486,6 +486,11 @@ export interface AdInventoryConfiguration {
     supported_formats?: string[];
 }
 
+/**
+ * User-level bases that may resolve age for demographic targeting execution. Population estimates are deliberately absent because aggregate composition cannot establish an individual impression's age.
+ */
+export type AgeDeterminationBasis = 'verified' | 'declared' | 'inferred';
+
 /**
  * Methods for verifying user age for compliance. Does not include 'inferred' as it is not accepted for regulatory compliance.
  */
@@ -5526,7 +5531,20 @@ export interface DemographicTargetingCapability {
  * Canonical demographic audience targeting intent with optional constraints on how age may be determined. This is distinct from age_restriction: demographics selects an audience, while age_restriction expresses a legal eligibility or verification floor. Fresh create/update targeting MUST compile exactly or be rejected. During get_products, a seller may offer a different configured predicate only through sparse targeting_resolution modifications on a distinguishable product_id; selecting that product accepts the alternative. Sellers never silently broaden, narrow, default, drop, or substitute the basis.
  */
 export interface DemographicTargetingIntent {
-    age: DemographicAgeRange & {};
+    age: DemographicAgeRange & {
+        /**
+         * User-level age determination bases the buyer permits for this predicate. Sellers MUST use only these bases or reject the request; they MUST NOT silently fall back to another basis. When omitted, the buyer imposes no determination-basis constraint beyond product capability and any age_restriction. population_estimate is structurally unavailable because aggregate evidence cannot identify an eligible user.
+         *
+         * @minItems 1
+         */
+        accepted_bases?: [AgeDeterminationBasis, ...AgeDeterminationBasis[]];
+        /**
+         * Verification methods acceptable when verified is an accepted basis. This field narrows verified demographic execution; age_restriction.accepted_methods independently governs legal eligibility and the two sets are intersected when both are present.
+         *
+         * @minItems 1
+         */
+        accepted_verification_methods?: [AgeVerificationMethod, ...AgeVerificationMethod[]];
+    };
 }
 
 /**

package/dist/lib/types/control-media-buy.d.ts

@@ -129,6 +129,11 @@ export type ActivationKey = {
     value: string;
 };
 
+/**
+ * User-level bases that may resolve age for demographic targeting execution. Population estimates are deliberately absent because aggregate composition cannot establish an individual impression's age.
+ */
+export type AgeDeterminationBasis = 'verified' | 'declared' | 'inferred';
+
 /**
  * Age restriction for compliance. Use for legal requirements (alcohol, gambling), not audience targeting.
  */
@@ -583,7 +588,20 @@ export type DemographicAgeRange = {} & {
  * Canonical demographic audience targeting intent with optional constraints on how age may be determined. This is distinct from age_restriction: demographics selects an audience, while age_restriction expresses a legal eligibility or verification floor. Fresh create/update targeting MUST compile exactly or be rejected. During get_products, a seller may offer a different configured predicate only through sparse targeting_resolution modifications on a distinguishable product_id; selecting that product accepts the alternative. Sellers never silently broaden, narrow, default, drop, or substitute the basis.
  */
 export interface DemographicTargetingIntent {
-    age: DemographicAgeRange & {};
+    age: DemographicAgeRange & {
+        /**
+         * User-level age determination bases the buyer permits for this predicate. Sellers MUST use only these bases or reject the request; they MUST NOT silently fall back to another basis. When omitted, the buyer imposes no determination-basis constraint beyond product capability and any age_restriction. population_estimate is structurally unavailable because aggregate evidence cannot identify an eligible user.
+         *
+         * @minItems 1
+         */
+        accepted_bases?: [AgeDeterminationBasis, ...AgeDeterminationBasis[]];
+        /**
+         * Verification methods acceptable when verified is an accepted basis. This field narrows verified demographic execution; age_restriction.accepted_methods independently governs legal eligibility and the two sets are intersected when both are present.
+         *
+         * @minItems 1
+         */
+        accepted_verification_methods?: [AgeVerificationMethod, ...AgeVerificationMethod[]];
+    };
 }
 
 /**

package/dist/lib/types/core.generated.d.mts

@@ -6388,7 +6388,20 @@ export interface PackageSignalTargetingGroup {
  * Canonical demographic audience targeting intent with optional constraints on how age may be determined. This is distinct from age_restriction: demographics selects an audience, while age_restriction expresses a legal eligibility or verification floor. Fresh create/update targeting MUST compile exactly or be rejected. During get_products, a seller may offer a different configured predicate only through sparse targeting_resolution modifications on a distinguishable product_id; selecting that product accepts the alternative. Sellers never silently broaden, narrow, default, drop, or substitute the basis.
  */
 export interface DemographicTargetingIntent {
-    age: DemographicAgeRange & {};
+    age: DemographicAgeRange & {
+        /**
+         * User-level age determination bases the buyer permits for this predicate. Sellers MUST use only these bases or reject the request; they MUST NOT silently fall back to another basis. When omitted, the buyer imposes no determination-basis constraint beyond product capability and any age_restriction. population_estimate is structurally unavailable because aggregate evidence cannot identify an eligible user.
+         *
+         * @minItems 1
+         */
+        accepted_bases?: [AgeDeterminationBasis, ...AgeDeterminationBasis[]];
+        /**
+         * Verification methods acceptable when verified is an accepted basis. This field narrows verified demographic execution; age_restriction.accepted_methods independently governs legal eligibility and the two sets are intersected when both are present.
+         *
+         * @minItems 1
+         */
+        accepted_verification_methods?: [AgeVerificationMethod, ...AgeVerificationMethod[]];
+    };
 }
 /**
  * Reference to a property list for targeting specific properties within this product. The package runs on the intersection of the product's publisher_properties and this list. Sellers SHOULD return a validation error if the product has property_targeting_allowed: false.

package/dist/lib/types/core.generated.d.ts

@@ -6388,7 +6388,20 @@ export interface PackageSignalTargetingGroup {
  * Canonical demographic audience targeting intent with optional constraints on how age may be determined. This is distinct from age_restriction: demographics selects an audience, while age_restriction expresses a legal eligibility or verification floor. Fresh create/update targeting MUST compile exactly or be rejected. During get_products, a seller may offer a different configured predicate only through sparse targeting_resolution modifications on a distinguishable product_id; selecting that product accepts the alternative. Sellers never silently broaden, narrow, default, drop, or substitute the basis.
  */
 export interface DemographicTargetingIntent {
-    age: DemographicAgeRange & {};
+    age: DemographicAgeRange & {
+        /**
+         * User-level age determination bases the buyer permits for this predicate. Sellers MUST use only these bases or reject the request; they MUST NOT silently fall back to another basis. When omitted, the buyer imposes no determination-basis constraint beyond product capability and any age_restriction. population_estimate is structurally unavailable because aggregate evidence cannot identify an eligible user.
+         *
+         * @minItems 1
+         */
+        accepted_bases?: [AgeDeterminationBasis, ...AgeDeterminationBasis[]];
+        /**
+         * Verification methods acceptable when verified is an accepted basis. This field narrows verified demographic execution; age_restriction.accepted_methods independently governs legal eligibility and the two sets are intersected when both are present.
+         *
+         * @minItems 1
+         */
+        accepted_verification_methods?: [AgeVerificationMethod, ...AgeVerificationMethod[]];
+    };
 }
 /**
  * Reference to a property list for targeting specific properties within this product. The package runs on the intersection of the product's publisher_properties and this list. Sellers SHOULD return a validation error if the product has property_targeting_allowed: false.

package/dist/lib/types/create-media-buy.d.ts

@@ -5771,7 +5771,20 @@ export interface DemographicPredicate {
  * Canonical demographic audience targeting intent with optional constraints on how age may be determined. This is distinct from age_restriction: demographics selects an audience, while age_restriction expresses a legal eligibility or verification floor. Fresh create/update targeting MUST compile exactly or be rejected. During get_products, a seller may offer a different configured predicate only through sparse targeting_resolution modifications on a distinguishable product_id; selecting that product accepts the alternative. Sellers never silently broaden, narrow, default, drop, or substitute the basis.
  */
 export interface DemographicTargetingIntent {
-    age: DemographicAgeRange & {};
+    age: DemographicAgeRange & {
+        /**
+         * User-level age determination bases the buyer permits for this predicate. Sellers MUST use only these bases or reject the request; they MUST NOT silently fall back to another basis. When omitted, the buyer imposes no determination-basis constraint beyond product capability and any age_restriction. population_estimate is structurally unavailable because aggregate evidence cannot identify an eligible user.
+         *
+         * @minItems 1
+         */
+        accepted_bases?: [AgeDeterminationBasis, ...AgeDeterminationBasis[]];
+        /**
+         * Verification methods acceptable when verified is an accepted basis. This field narrows verified demographic execution; age_restriction.accepted_methods independently governs legal eligibility and the two sets are intersected when both are present.
+         *
+         * @minItems 1
+         */
+        accepted_verification_methods?: [AgeVerificationMethod, ...AgeVerificationMethod[]];
+    };
 }
 
 /**

package/dist/lib/types/get-media-buys.d.ts

@@ -4598,7 +4598,20 @@ export type DemographicSystem = 'nielsen' | 'nielsen_audio' | 'barb' | 'agf' | '
  * Canonical demographic audience targeting intent with optional constraints on how age may be determined. This is distinct from age_restriction: demographics selects an audience, while age_restriction expresses a legal eligibility or verification floor. Fresh create/update targeting MUST compile exactly or be rejected. During get_products, a seller may offer a different configured predicate only through sparse targeting_resolution modifications on a distinguishable product_id; selecting that product accepts the alternative. Sellers never silently broaden, narrow, default, drop, or substitute the basis.
  */
 export interface DemographicTargetingIntent {
-    age: DemographicAgeRange & {};
+    age: DemographicAgeRange & {
+        /**
+         * User-level age determination bases the buyer permits for this predicate. Sellers MUST use only these bases or reject the request; they MUST NOT silently fall back to another basis. When omitted, the buyer imposes no determination-basis constraint beyond product capability and any age_restriction. population_estimate is structurally unavailable because aggregate evidence cannot identify an eligible user.
+         *
+         * @minItems 1
+         */
+        accepted_bases?: [AgeDeterminationBasis, ...AgeDeterminationBasis[]];
+        /**
+         * Verification methods acceptable when verified is an accepted basis. This field narrows verified demographic execution; age_restriction.accepted_methods independently governs legal eligibility and the two sets are intersected when both are present.
+         *
+         * @minItems 1
+         */
+        accepted_verification_methods?: [AgeVerificationMethod, ...AgeVerificationMethod[]];
+    };
 }
 
 /**