@adcp/sdk 15.2.0 → 15.2.2

package/dist/lib/server/wire-spec-fields.generated.mjs

@@ -1,160 +1,160 @@
 const WIRE_SPEC_FIELDS = Object.freeze({
-  /** schemas/cache/3.2.1/brand/acquire-rights-request.json */
+  /** schemas/cache/3.2.3/brand/acquire-rights-request.json */
   AcquireRightsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "buyer", "campaign", "context", "ext", "governance_context", "idempotency_key", "pricing_option_id", "push_notification_config", "revocation_webhook", "rights_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/signals/activate-signal-request.json */
+  /** schemas/cache/3.2.3/signals/activate-signal-request.json */
   ActivateSignalRequest: Object.freeze({
     fields: Object.freeze(["account", "action", "adcp_major_version", "adcp_version", "context", "destinations", "ext", "governance_context", "idempotency_key", "pricing_option_id", "signal_agent_segment_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/build-creative-request.json */
+  /** schemas/cache/3.2.3/media-buy/build-creative-request.json */
   BuildCreativeRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "brand", "concept_id", "config", "context", "creative_id", "creative_manifest", "creative_representation_set", "evaluator", "ext", "governance_context", "idempotency_key", "include_preview", "item_limit", "keep_mode", "macro_values", "max_creatives", "max_spend", "max_variants", "media_buy_id", "message", "mode", "package_id", "preview_inputs", "preview_output_format", "preview_quality", "push_notification_config", "quality", "refine_from_build_variant_id", "representation_destination", "representation_selection_strategy", "selection_strategy", "signal_conditions", "target_capability_id", "target_capability_ids", "target_format_id", "target_format_ids", "transformer_id", "variant_axis"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/content-standards/calibrate-content-request.json */
+  /** schemas/cache/3.2.3/content-standards/calibrate-content-request.json */
   CalibrateContentRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "artifact", "context", "ext", "idempotency_key", "standards_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/collection/create-collection-list-request.json */
+  /** schemas/cache/3.2.3/collection/create-collection-list-request.json */
   CreateCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_collections", "brand", "context", "description", "ext", "filters", "idempotency_key", "name"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/content-standards/create-content-standards-request.json */
+  /** schemas/cache/3.2.3/content-standards/create-content-standards-request.json */
   CreateContentStandardsRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "calibration_exemplars", "context", "ext", "idempotency_key", "policies", "registry_policy_ids", "scope"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/create-media-buy-request.json */
+  /** schemas/cache/3.2.3/media-buy/create-media-buy-request.json */
   CreateMediaBuyRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "advertiser_industry", "agency_estimate_number", "artifact_webhook", "bidding", "brand", "budget_allocation", "budget_cap_timezone", "context", "daily_budget_cap", "end_time", "ext", "frequency_cap", "governance_context", "idempotency_key", "invoice_recipient", "io_acceptance", "name", "opportunity", "pacing", "packages", "paused", "plan_id", "po_number", "proposal_id", "push_notification_config", "reporting_webhook", "start_time", "total_budget"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/property/create-property-list-request.json */
+  /** schemas/cache/3.2.3/property/create-property-list-request.json */
   CreatePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_properties", "brand", "context", "description", "ext", "filters", "idempotency_key", "name"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/collection/delete-collection-list-request.json */
+  /** schemas/cache/3.2.3/collection/delete-collection-list-request.json */
   DeleteCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "list_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/property/delete-property-list-request.json */
+  /** schemas/cache/3.2.3/property/delete-property-list-request.json */
   DeletePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "list_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/get-media-buy-delivery-request.json */
+  /** schemas/cache/3.2.3/media-buy/get-media-buy-delivery-request.json */
   GetMediaBuyDeliveryRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "attribution_window", "context", "end_date", "ext", "include_package_daily_breakdown", "include_window_breakdown", "media_buy_ids", "pagination", "reporting_dimensions", "reporting_revision_id", "requested_metrics", "start_date", "status_filter", "time_granularity"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/get-reporting-status-request.json */
+  /** schemas/cache/3.2.3/media-buy/get-reporting-status-request.json */
   GetReportingStatusRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "changes_after", "context", "delivery_config_ids", "ext", "feed_purposes", "finality", "health", "media_buy_ids", "pagination", "period", "reporting_revision_id", "view"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/log-event-request.json */
+  /** schemas/cache/3.2.3/media-buy/log-event-request.json */
   LogEventRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "event_source_id", "events", "ext", "idempotency_key", "test_event_code"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/provide-performance-feedback-request.json */
+  /** schemas/cache/3.2.3/media-buy/provide-performance-feedback-request.json */
   ProvidePerformanceFeedbackRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "as_of", "baseline", "context", "creative_id", "evidence", "evidence_ref", "ext", "feedback_source", "final", "idempotency_key", "measurement_period", "media_buy_id", "methodology", "methodology_version", "metric", "metric_type", "package_id", "performance_index", "producer", "study_ref", "supersedes_feedback_id", "vendor"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/governance/report-plan-outcome-request.json */
+  /** schemas/cache/3.2.3/governance/report-plan-outcome-request.json */
   ReportPlanOutcomeRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "check_id", "context", "delivery", "error", "ext", "governance_context", "idempotency_key", "outcome", "plan_id", "purchase_type", "seller_response"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/account/report-usage-request.json */
+  /** schemas/cache/3.2.3/account/report-usage-request.json */
   ReportUsageRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "reporting_period", "usage"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/sponsored-intelligence/si-initiate-session-request.json */
+  /** schemas/cache/3.2.3/sponsored-intelligence/si-initiate-session-request.json */
   SIInitiateSessionRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "identity", "intent", "media_buy_id", "offering_id", "offering_token", "placement", "sponsored_context_receipt", "supported_capabilities"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/sponsored-intelligence/si-send-message-request.json */
+  /** schemas/cache/3.2.3/sponsored-intelligence/si-send-message-request.json */
   SISendMessageRequest: Object.freeze({
     fields: Object.freeze(["action_response", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "message", "session_id", "sponsored_context_receipt"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/account/sync-accounts-request.json */
+  /** schemas/cache/3.2.3/account/sync-accounts-request.json */
   SyncAccountsRequest: Object.freeze({
     fields: Object.freeze(["accounts", "adcp_major_version", "adcp_version", "context", "delete_missing", "dry_run", "ext", "idempotency_key", "push_notification_config"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-audiences-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-audiences-request.json */
   SyncAudiencesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "audiences", "context", "delete_missing", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-catalogs-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-catalogs-request.json */
   SyncCatalogsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "catalog_ids", "catalogs", "context", "delete_missing", "dry_run", "ext", "idempotency_key", "item_availability_queries", "item_availability_updates", "push_notification_config", "validation_mode"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/creative/sync-creatives-request.json */
+  /** schemas/cache/3.2.3/creative/sync-creatives-request.json */
   SyncCreativesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "assignment_operations", "assignments", "context", "creative_ids", "creatives", "delete_missing", "dry_run", "ext", "idempotency_key", "push_notification_config", "validation_mode"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-event-sources-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-event-sources-request.json */
   SyncEventSourcesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "delete_missing", "event_sources", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/account/sync-governance-request.json */
+  /** schemas/cache/3.2.3/account/sync-governance-request.json */
   SyncGovernanceRequest: Object.freeze({
     fields: Object.freeze(["accounts", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/governance/sync-plans-request.json */
+  /** schemas/cache/3.2.3/governance/sync-plans-request.json */
   SyncPlansRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "plans"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-reporting-receipts-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-reporting-receipts-request.json */
   SyncReportingReceiptsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "adjustment_receipts", "context", "ext", "idempotency_key", "receipts"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-reporting-status-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-reporting-status-request.json */
   SyncReportingStatusRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "statuses"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/collection/update-collection-list-request.json */
+  /** schemas/cache/3.2.3/collection/update-collection-list-request.json */
   UpdateCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_collections", "brand", "context", "description", "ext", "filters", "idempotency_key", "list_id", "name", "webhook_url"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/content-standards/update-content-standards-request.json */
+  /** schemas/cache/3.2.3/content-standards/update-content-standards-request.json */
   UpdateContentStandardsRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "calibration_exemplars", "context", "ext", "idempotency_key", "policies", "registry_policy_ids", "scope", "standards_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/update-media-buy-request.json */
+  /** schemas/cache/3.2.3/media-buy/update-media-buy-request.json */
   UpdateMediaBuyRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "bidding", "budget_allocation", "budget_cap_timezone", "canceled", "cancellation_reason", "context", "daily_budget_cap", "end_time", "ext", "frequency_cap", "governance_context", "idempotency_key", "invoice_recipient", "media_buy_id", "name", "new_packages", "pacing", "packages", "paused", "push_notification_config", "reporting_webhook", "revision", "start_time", "total_budget"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/property/update-property-list-request.json */
+  /** schemas/cache/3.2.3/property/update-property-list-request.json */
   UpdatePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_properties", "brand", "context", "description", "ext", "filters", "idempotency_key", "list_id", "name", "webhook_url"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/brand/update-rights-request.json */
+  /** schemas/cache/3.2.3/brand/update-rights-request.json */
   UpdateRightsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "end_date", "ext", "governance_context", "idempotency_key", "impression_cap", "paused", "pricing_option_id", "push_notification_config", "rights_id"]),
     __type: null

package/dist/lib/signing/agent-resolver/fetch-helpers.js

@@ -118,7 +118,7 @@ function classifyDiscoveryFailure(error) {
   return { dns_error: "fetch_failed" };
 }
 function isPermanentDiscoveryFailure(detail) {
-  return detail.dns_error === "ssrf_refused" || detail.http_status !== void 0 && detail.http_status >= 400 && detail.http_status < 500;
+  return detail.dns_error === "ssrf_refused" || detail.http_status !== void 0 && detail.http_status >= 400 && detail.http_status < 500 && detail.http_status !== 408 && detail.http_status !== 429;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/lib/signing/agent-resolver/fetch-helpers.mjs

@@ -91,7 +91,7 @@ function classifyDiscoveryFailure(error) {
   return { dns_error: "fetch_failed" };
 }
 function isPermanentDiscoveryFailure(detail) {
-  return detail.dns_error === "ssrf_refused" || detail.http_status !== void 0 && detail.http_status >= 400 && detail.http_status < 500;
+  return detail.dns_error === "ssrf_refused" || detail.http_status !== void 0 && detail.http_status >= 400 && detail.http_status < 500 && detail.http_status !== 408 && detail.http_status !== 429;
 }
 export {
   DEFAULT_CONNECT_TIMEOUT_MS,

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.2.0";
+export declare const RUNNER_CAPABILITY_VERSION = "15.2.2";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.2.0";
+export declare const RUNNER_CAPABILITY_VERSION = "15.2.2";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/types/accept-proposal.d.ts

@@ -2264,7 +2264,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/acquire-rights.d.ts

@@ -159,7 +159,7 @@ export interface AcquireRightsError {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/activate-signal.d.ts

@@ -140,7 +140,7 @@ export interface ActivateSignalError {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/build-creative.d.ts

@@ -381,7 +381,7 @@ export interface BuildCreativeSubmitted {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/buy-products.d.ts

@@ -2504,7 +2504,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/control-media-buy.d.ts

@@ -1330,7 +1330,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/core.generated.d.mts

@@ -10912,7 +10912,7 @@ export type None2 = None;
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {
@@ -22999,7 +22999,7 @@ export interface CollectionListChangedWebhook {
      */
     cache_valid_until?: string;
     /**
-     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/implementation/security#webhook-security.
+     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/by-layer/L1/security#webhook-security.
      */
     signature: string;
     ext?: ExtensionObject;
@@ -25202,7 +25202,7 @@ export type AudienceSelector = {
  */
 export interface AuthorizedAgentBaseFields {
     /**
-     * The authorized agent's API endpoint URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
+     * The authorized agent's protocol endpoint URL: the exact agent URL buyers are given and send AdCP requests to, including the path (e.g., `https://agent.example.com/mcp`). A bare origin matches only an agent served at the root. An agent reachable at more than one agent URL (for example, separate MCP and A2A endpoints) needs one entry per URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
      */
     url: string;
     /**
@@ -32304,7 +32304,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**
@@ -37714,7 +37714,7 @@ export type TMPProviderRegistration = ({
      */
     provider_id: string;
     /**
-     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/implementation/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
+     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/by-layer/L1/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
      */
     endpoint: string;
     /**

package/dist/lib/types/core.generated.d.ts

@@ -10912,7 +10912,7 @@ export type None2 = None;
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {
@@ -22999,7 +22999,7 @@ export interface CollectionListChangedWebhook {
      */
     cache_valid_until?: string;
     /**
-     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/implementation/security#webhook-security.
+     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/by-layer/L1/security#webhook-security.
      */
     signature: string;
     ext?: ExtensionObject;
@@ -25202,7 +25202,7 @@ export type AudienceSelector = {
  */
 export interface AuthorizedAgentBaseFields {
     /**
-     * The authorized agent's API endpoint URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
+     * The authorized agent's protocol endpoint URL: the exact agent URL buyers are given and send AdCP requests to, including the path (e.g., `https://agent.example.com/mcp`). A bare origin matches only an agent served at the root. An agent reachable at more than one agent URL (for example, separate MCP and A2A endpoints) needs one entry per URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
      */
     url: string;
     /**
@@ -32304,7 +32304,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**
@@ -37714,7 +37714,7 @@ export type TMPProviderRegistration = ({
      */
     provider_id: string;
     /**
-     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/implementation/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
+     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/by-layer/L1/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
      */
     endpoint: string;
     /**

package/dist/lib/types/create-collection-list.d.ts

@@ -109,7 +109,7 @@ export interface CreateCollectionListResponse {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/create-media-buy.d.ts

@@ -160,7 +160,7 @@ export type CreateMediaBuyRequest = (ExplicitPackagesWithFixedAllocation | Expli
         token?: string;
         /**
          * @deprecated
-         * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+         * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
          */
         authentication: {
             /**
@@ -562,7 +562,7 @@ export interface AccountIdentityChangeRejected {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {
@@ -10501,7 +10501,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/create-property-list.d.ts

@@ -109,7 +109,7 @@ export interface CreatePropertyListResponse {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/delete-collection-list.d.ts

@@ -102,7 +102,7 @@ export interface DeleteCollectionListResponse {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/delete-property-list.d.ts

@@ -102,7 +102,7 @@ export interface DeletePropertyListResponse {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/enums.generated.d.mts

@@ -331,7 +331,7 @@ export declare const RequestSigningErrorCodeMetadata: Readonly<{
     };
     readonly request_body_malformed: {
         readonly recovery: "correctable";
-        readonly suggestion: "emit strict unambiguous JSON without duplicate keys and re-sign the body";
+        readonly suggestion: "emit strict unambiguous JSON without duplicate keys, with exactly one A2A DataPart carrying a skill, and sign the body again if the request is signed";
     };
     readonly request_signature_replayed: {
         readonly recovery: "correctable";

package/dist/lib/types/enums.generated.d.ts

@@ -331,7 +331,7 @@ export declare const RequestSigningErrorCodeMetadata: Readonly<{
     };
     readonly request_body_malformed: {
         readonly recovery: "correctable";
-        readonly suggestion: "emit strict unambiguous JSON without duplicate keys and re-sign the body";
+        readonly suggestion: "emit strict unambiguous JSON without duplicate keys, with exactly one A2A DataPart carrying a skill, and sign the body again if the request is signed";
     };
     readonly request_signature_replayed: {
         readonly recovery: "correctable";

package/dist/lib/types/enums.generated.js

@@ -586,7 +586,7 @@ const requestSigningErrorCodeMetadata = {
   },
   "request_body_malformed": {
     "recovery": "correctable",
-    "suggestion": "emit strict unambiguous JSON without duplicate keys and re-sign the body"
+    "suggestion": "emit strict unambiguous JSON without duplicate keys, with exactly one A2A DataPart carrying a skill, and sign the body again if the request is signed"
   },
   "request_signature_replayed": {
     "recovery": "correctable",

package/dist/lib/types/enums.generated.mjs

@@ -330,7 +330,7 @@ const requestSigningErrorCodeMetadata = {
   },
   "request_body_malformed": {
     "recovery": "correctable",
-    "suggestion": "emit strict unambiguous JSON without duplicate keys and re-sign the body"
+    "suggestion": "emit strict unambiguous JSON without duplicate keys, with exactly one A2A DataPart carrying a skill, and sign the body again if the request is signed"
   },
   "request_signature_replayed": {
     "recovery": "correctable",

package/dist/lib/types/error-codes.d.mts

@@ -80,9 +80,9 @@ export declare const STANDARD_ERROR_CODES: {
         readonly suggestion: "replace the stale reference with error.details.current_account, refresh through list_accounts, and retry with a fresh idempotency key";
     };
     ACCOUNT_NOT_FOUND: {
-        readonly description: "The account reference could not be resolved.";
+        readonly description: "The account reference could not be resolved: an account_id that does not exist, a buyer-declared natural key the seller has not provisioned, or an account outside the caller's authorized set. Sellers return it on tasks where account is optional too, rather than ignoring the reference, unless the seller lazily provisions it.";
         readonly recovery: "terminal";
-        readonly suggestion: "verify account via list_accounts or contact seller";
+        readonly suggestion: "for a natural key, provision through sync_accounts or omit account for public discovery; for an account_id, verify via list_accounts or contact seller";
     };
     ACCOUNT_PAYMENT_REQUIRED: {
         readonly description: "Account has an outstanding balance requiring payment before new buys.";

package/dist/lib/types/error-codes.d.ts

@@ -80,9 +80,9 @@ export declare const STANDARD_ERROR_CODES: {
         readonly suggestion: "replace the stale reference with error.details.current_account, refresh through list_accounts, and retry with a fresh idempotency key";
     };
     ACCOUNT_NOT_FOUND: {
-        readonly description: "The account reference could not be resolved.";
+        readonly description: "The account reference could not be resolved: an account_id that does not exist, a buyer-declared natural key the seller has not provisioned, or an account outside the caller's authorized set. Sellers return it on tasks where account is optional too, rather than ignoring the reference, unless the seller lazily provisions it.";
         readonly recovery: "terminal";
-        readonly suggestion: "verify account via list_accounts or contact seller";
+        readonly suggestion: "for a natural key, provision through sync_accounts or omit account for public discovery; for an account_id, verify via list_accounts or contact seller";
     };
     ACCOUNT_PAYMENT_REQUIRED: {
         readonly description: "Account has an outstanding balance requiring payment before new buys.";

package/dist/lib/types/get-account-financials.d.ts

@@ -209,7 +209,7 @@ export interface GetAccountFinancialsError {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {