@adcp/sdk 15.2.0 → 15.3.0

package/dist/lib/server/wire-spec-fields.generated.mjs

@@ -1,160 +1,160 @@
 const WIRE_SPEC_FIELDS = Object.freeze({
-  /** schemas/cache/3.2.1/brand/acquire-rights-request.json */
+  /** schemas/cache/3.2.3/brand/acquire-rights-request.json */
   AcquireRightsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "buyer", "campaign", "context", "ext", "governance_context", "idempotency_key", "pricing_option_id", "push_notification_config", "revocation_webhook", "rights_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/signals/activate-signal-request.json */
+  /** schemas/cache/3.2.3/signals/activate-signal-request.json */
   ActivateSignalRequest: Object.freeze({
     fields: Object.freeze(["account", "action", "adcp_major_version", "adcp_version", "context", "destinations", "ext", "governance_context", "idempotency_key", "pricing_option_id", "signal_agent_segment_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/build-creative-request.json */
+  /** schemas/cache/3.2.3/media-buy/build-creative-request.json */
   BuildCreativeRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "brand", "concept_id", "config", "context", "creative_id", "creative_manifest", "creative_representation_set", "evaluator", "ext", "governance_context", "idempotency_key", "include_preview", "item_limit", "keep_mode", "macro_values", "max_creatives", "max_spend", "max_variants", "media_buy_id", "message", "mode", "package_id", "preview_inputs", "preview_output_format", "preview_quality", "push_notification_config", "quality", "refine_from_build_variant_id", "representation_destination", "representation_selection_strategy", "selection_strategy", "signal_conditions", "target_capability_id", "target_capability_ids", "target_format_id", "target_format_ids", "transformer_id", "variant_axis"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/content-standards/calibrate-content-request.json */
+  /** schemas/cache/3.2.3/content-standards/calibrate-content-request.json */
   CalibrateContentRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "artifact", "context", "ext", "idempotency_key", "standards_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/collection/create-collection-list-request.json */
+  /** schemas/cache/3.2.3/collection/create-collection-list-request.json */
   CreateCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_collections", "brand", "context", "description", "ext", "filters", "idempotency_key", "name"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/content-standards/create-content-standards-request.json */
+  /** schemas/cache/3.2.3/content-standards/create-content-standards-request.json */
   CreateContentStandardsRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "calibration_exemplars", "context", "ext", "idempotency_key", "policies", "registry_policy_ids", "scope"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/create-media-buy-request.json */
+  /** schemas/cache/3.2.3/media-buy/create-media-buy-request.json */
   CreateMediaBuyRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "advertiser_industry", "agency_estimate_number", "artifact_webhook", "bidding", "brand", "budget_allocation", "budget_cap_timezone", "context", "daily_budget_cap", "end_time", "ext", "frequency_cap", "governance_context", "idempotency_key", "invoice_recipient", "io_acceptance", "name", "opportunity", "pacing", "packages", "paused", "plan_id", "po_number", "proposal_id", "push_notification_config", "reporting_webhook", "start_time", "total_budget"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/property/create-property-list-request.json */
+  /** schemas/cache/3.2.3/property/create-property-list-request.json */
   CreatePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_properties", "brand", "context", "description", "ext", "filters", "idempotency_key", "name"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/collection/delete-collection-list-request.json */
+  /** schemas/cache/3.2.3/collection/delete-collection-list-request.json */
   DeleteCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "list_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/property/delete-property-list-request.json */
+  /** schemas/cache/3.2.3/property/delete-property-list-request.json */
   DeletePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "list_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/get-media-buy-delivery-request.json */
+  /** schemas/cache/3.2.3/media-buy/get-media-buy-delivery-request.json */
   GetMediaBuyDeliveryRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "attribution_window", "context", "end_date", "ext", "include_package_daily_breakdown", "include_window_breakdown", "media_buy_ids", "pagination", "reporting_dimensions", "reporting_revision_id", "requested_metrics", "start_date", "status_filter", "time_granularity"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/get-reporting-status-request.json */
+  /** schemas/cache/3.2.3/media-buy/get-reporting-status-request.json */
   GetReportingStatusRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "changes_after", "context", "delivery_config_ids", "ext", "feed_purposes", "finality", "health", "media_buy_ids", "pagination", "period", "reporting_revision_id", "view"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/log-event-request.json */
+  /** schemas/cache/3.2.3/media-buy/log-event-request.json */
   LogEventRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "event_source_id", "events", "ext", "idempotency_key", "test_event_code"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/provide-performance-feedback-request.json */
+  /** schemas/cache/3.2.3/media-buy/provide-performance-feedback-request.json */
   ProvidePerformanceFeedbackRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "as_of", "baseline", "context", "creative_id", "evidence", "evidence_ref", "ext", "feedback_source", "final", "idempotency_key", "measurement_period", "media_buy_id", "methodology", "methodology_version", "metric", "metric_type", "package_id", "performance_index", "producer", "study_ref", "supersedes_feedback_id", "vendor"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/governance/report-plan-outcome-request.json */
+  /** schemas/cache/3.2.3/governance/report-plan-outcome-request.json */
   ReportPlanOutcomeRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "check_id", "context", "delivery", "error", "ext", "governance_context", "idempotency_key", "outcome", "plan_id", "purchase_type", "seller_response"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/account/report-usage-request.json */
+  /** schemas/cache/3.2.3/account/report-usage-request.json */
   ReportUsageRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "reporting_period", "usage"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/sponsored-intelligence/si-initiate-session-request.json */
+  /** schemas/cache/3.2.3/sponsored-intelligence/si-initiate-session-request.json */
   SIInitiateSessionRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "identity", "intent", "media_buy_id", "offering_id", "offering_token", "placement", "sponsored_context_receipt", "supported_capabilities"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/sponsored-intelligence/si-send-message-request.json */
+  /** schemas/cache/3.2.3/sponsored-intelligence/si-send-message-request.json */
   SISendMessageRequest: Object.freeze({
     fields: Object.freeze(["action_response", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "message", "session_id", "sponsored_context_receipt"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/account/sync-accounts-request.json */
+  /** schemas/cache/3.2.3/account/sync-accounts-request.json */
   SyncAccountsRequest: Object.freeze({
     fields: Object.freeze(["accounts", "adcp_major_version", "adcp_version", "context", "delete_missing", "dry_run", "ext", "idempotency_key", "push_notification_config"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-audiences-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-audiences-request.json */
   SyncAudiencesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "audiences", "context", "delete_missing", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-catalogs-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-catalogs-request.json */
   SyncCatalogsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "catalog_ids", "catalogs", "context", "delete_missing", "dry_run", "ext", "idempotency_key", "item_availability_queries", "item_availability_updates", "push_notification_config", "validation_mode"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/creative/sync-creatives-request.json */
+  /** schemas/cache/3.2.3/creative/sync-creatives-request.json */
   SyncCreativesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "assignment_operations", "assignments", "context", "creative_ids", "creatives", "delete_missing", "dry_run", "ext", "idempotency_key", "push_notification_config", "validation_mode"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-event-sources-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-event-sources-request.json */
   SyncEventSourcesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "delete_missing", "event_sources", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/account/sync-governance-request.json */
+  /** schemas/cache/3.2.3/account/sync-governance-request.json */
   SyncGovernanceRequest: Object.freeze({
     fields: Object.freeze(["accounts", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/governance/sync-plans-request.json */
+  /** schemas/cache/3.2.3/governance/sync-plans-request.json */
   SyncPlansRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "plans"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-reporting-receipts-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-reporting-receipts-request.json */
   SyncReportingReceiptsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "adjustment_receipts", "context", "ext", "idempotency_key", "receipts"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/sync-reporting-status-request.json */
+  /** schemas/cache/3.2.3/media-buy/sync-reporting-status-request.json */
   SyncReportingStatusRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "statuses"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/collection/update-collection-list-request.json */
+  /** schemas/cache/3.2.3/collection/update-collection-list-request.json */
   UpdateCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_collections", "brand", "context", "description", "ext", "filters", "idempotency_key", "list_id", "name", "webhook_url"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/content-standards/update-content-standards-request.json */
+  /** schemas/cache/3.2.3/content-standards/update-content-standards-request.json */
   UpdateContentStandardsRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "calibration_exemplars", "context", "ext", "idempotency_key", "policies", "registry_policy_ids", "scope", "standards_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/media-buy/update-media-buy-request.json */
+  /** schemas/cache/3.2.3/media-buy/update-media-buy-request.json */
   UpdateMediaBuyRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "bidding", "budget_allocation", "budget_cap_timezone", "canceled", "cancellation_reason", "context", "daily_budget_cap", "end_time", "ext", "frequency_cap", "governance_context", "idempotency_key", "invoice_recipient", "media_buy_id", "name", "new_packages", "pacing", "packages", "paused", "push_notification_config", "reporting_webhook", "revision", "start_time", "total_budget"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/property/update-property-list-request.json */
+  /** schemas/cache/3.2.3/property/update-property-list-request.json */
   UpdatePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_properties", "brand", "context", "description", "ext", "filters", "idempotency_key", "list_id", "name", "webhook_url"]),
     __type: null
   }),
-  /** schemas/cache/3.2.1/brand/update-rights-request.json */
+  /** schemas/cache/3.2.3/brand/update-rights-request.json */
   UpdateRightsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "end_date", "ext", "governance_context", "idempotency_key", "impression_cap", "paused", "pricing_option_id", "push_notification_config", "rights_id"]),
     __type: null

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.2.0";
+export declare const RUNNER_CAPABILITY_VERSION = "15.3.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.2.0";
+export declare const RUNNER_CAPABILITY_VERSION = "15.3.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/types/accept-proposal.d.ts

@@ -2264,7 +2264,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/acquire-rights.d.ts

@@ -159,7 +159,7 @@ export interface AcquireRightsError {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/activate-signal.d.ts

@@ -140,7 +140,7 @@ export interface ActivateSignalError {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/build-creative.d.ts

@@ -381,7 +381,7 @@ export interface BuildCreativeSubmitted {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/buy-products.d.ts

@@ -2504,7 +2504,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/control-media-buy.d.ts

@@ -1330,7 +1330,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/core.generated.d.mts

@@ -10912,7 +10912,7 @@ export type None2 = None;
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {
@@ -22999,7 +22999,7 @@ export interface CollectionListChangedWebhook {
      */
     cache_valid_until?: string;
     /**
-     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/implementation/security#webhook-security.
+     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/by-layer/L1/security#webhook-security.
      */
     signature: string;
     ext?: ExtensionObject;
@@ -25202,7 +25202,7 @@ export type AudienceSelector = {
  */
 export interface AuthorizedAgentBaseFields {
     /**
-     * The authorized agent's API endpoint URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
+     * The authorized agent's protocol endpoint URL: the exact agent URL buyers are given and send AdCP requests to, including the path (e.g., `https://agent.example.com/mcp`). A bare origin matches only an agent served at the root. An agent reachable at more than one agent URL (for example, separate MCP and A2A endpoints) needs one entry per URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
      */
     url: string;
     /**
@@ -32304,7 +32304,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**
@@ -37714,7 +37714,7 @@ export type TMPProviderRegistration = ({
      */
     provider_id: string;
     /**
-     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/implementation/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
+     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/by-layer/L1/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
      */
     endpoint: string;
     /**

package/dist/lib/types/core.generated.d.ts

@@ -10912,7 +10912,7 @@ export type None2 = None;
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {
@@ -22999,7 +22999,7 @@ export interface CollectionListChangedWebhook {
      */
     cache_valid_until?: string;
     /**
-     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/implementation/security#webhook-security.
+     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/by-layer/L1/security#webhook-security.
      */
     signature: string;
     ext?: ExtensionObject;
@@ -25202,7 +25202,7 @@ export type AudienceSelector = {
  */
 export interface AuthorizedAgentBaseFields {
     /**
-     * The authorized agent's API endpoint URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
+     * The authorized agent's protocol endpoint URL: the exact agent URL buyers are given and send AdCP requests to, including the path (e.g., `https://agent.example.com/mcp`). A bare origin matches only an agent served at the root. An agent reachable at more than one agent URL (for example, separate MCP and A2A endpoints) needs one entry per URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
      */
     url: string;
     /**
@@ -32304,7 +32304,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**
@@ -37714,7 +37714,7 @@ export type TMPProviderRegistration = ({
      */
     provider_id: string;
     /**
-     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/implementation/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
+     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/by-layer/L1/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
      */
     endpoint: string;
     /**

package/dist/lib/types/create-collection-list.d.ts

@@ -109,7 +109,7 @@ export interface CreateCollectionListResponse {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/create-media-buy.d.ts

@@ -160,7 +160,7 @@ export type CreateMediaBuyRequest = (ExplicitPackagesWithFixedAllocation | Expli
         token?: string;
         /**
          * @deprecated
-         * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+         * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
          */
         authentication: {
             /**
@@ -562,7 +562,7 @@ export interface AccountIdentityChangeRejected {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {
@@ -10501,7 +10501,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/create-property-list.d.ts

@@ -109,7 +109,7 @@ export interface CreatePropertyListResponse {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/delete-collection-list.d.ts

@@ -102,7 +102,7 @@ export interface DeleteCollectionListResponse {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/delete-property-list.d.ts

@@ -102,7 +102,7 @@ export interface DeletePropertyListResponse {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/enums.generated.d.mts

@@ -331,7 +331,7 @@ export declare const RequestSigningErrorCodeMetadata: Readonly<{
     };
     readonly request_body_malformed: {
         readonly recovery: "correctable";
-        readonly suggestion: "emit strict unambiguous JSON without duplicate keys and re-sign the body";
+        readonly suggestion: "emit strict unambiguous JSON without duplicate keys, with exactly one A2A DataPart carrying a skill, and sign the body again if the request is signed";
     };
     readonly request_signature_replayed: {
         readonly recovery: "correctable";

package/dist/lib/types/enums.generated.d.ts

@@ -331,7 +331,7 @@ export declare const RequestSigningErrorCodeMetadata: Readonly<{
     };
     readonly request_body_malformed: {
         readonly recovery: "correctable";
-        readonly suggestion: "emit strict unambiguous JSON without duplicate keys and re-sign the body";
+        readonly suggestion: "emit strict unambiguous JSON without duplicate keys, with exactly one A2A DataPart carrying a skill, and sign the body again if the request is signed";
     };
     readonly request_signature_replayed: {
         readonly recovery: "correctable";

package/dist/lib/types/enums.generated.js

@@ -586,7 +586,7 @@ const requestSigningErrorCodeMetadata = {
   },
   "request_body_malformed": {
     "recovery": "correctable",
-    "suggestion": "emit strict unambiguous JSON without duplicate keys and re-sign the body"
+    "suggestion": "emit strict unambiguous JSON without duplicate keys, with exactly one A2A DataPart carrying a skill, and sign the body again if the request is signed"
   },
   "request_signature_replayed": {
     "recovery": "correctable",

package/dist/lib/types/enums.generated.mjs

@@ -330,7 +330,7 @@ const requestSigningErrorCodeMetadata = {
   },
   "request_body_malformed": {
     "recovery": "correctable",
-    "suggestion": "emit strict unambiguous JSON without duplicate keys and re-sign the body"
+    "suggestion": "emit strict unambiguous JSON without duplicate keys, with exactly one A2A DataPart carrying a skill, and sign the body again if the request is signed"
   },
   "request_signature_replayed": {
     "recovery": "correctable",

package/dist/lib/types/error-codes.d.mts

@@ -80,9 +80,9 @@ export declare const STANDARD_ERROR_CODES: {
         readonly suggestion: "replace the stale reference with error.details.current_account, refresh through list_accounts, and retry with a fresh idempotency key";
     };
     ACCOUNT_NOT_FOUND: {
-        readonly description: "The account reference could not be resolved.";
+        readonly description: "The account reference could not be resolved: an account_id that does not exist, a buyer-declared natural key the seller has not provisioned, or an account outside the caller's authorized set. Sellers return it on tasks where account is optional too, rather than ignoring the reference, unless the seller lazily provisions it.";
         readonly recovery: "terminal";
-        readonly suggestion: "verify account via list_accounts or contact seller";
+        readonly suggestion: "for a natural key, provision through sync_accounts or omit account for public discovery; for an account_id, verify via list_accounts or contact seller";
     };
     ACCOUNT_PAYMENT_REQUIRED: {
         readonly description: "Account has an outstanding balance requiring payment before new buys.";

package/dist/lib/types/error-codes.d.ts

@@ -80,9 +80,9 @@ export declare const STANDARD_ERROR_CODES: {
         readonly suggestion: "replace the stale reference with error.details.current_account, refresh through list_accounts, and retry with a fresh idempotency key";
     };
     ACCOUNT_NOT_FOUND: {
-        readonly description: "The account reference could not be resolved.";
+        readonly description: "The account reference could not be resolved: an account_id that does not exist, a buyer-declared natural key the seller has not provisioned, or an account outside the caller's authorized set. Sellers return it on tasks where account is optional too, rather than ignoring the reference, unless the seller lazily provisions it.";
         readonly recovery: "terminal";
-        readonly suggestion: "verify account via list_accounts or contact seller";
+        readonly suggestion: "for a natural key, provision through sync_accounts or omit account for public discovery; for an account_id, verify via list_accounts or contact seller";
     };
     ACCOUNT_PAYMENT_REQUIRED: {
         readonly description: "Account has an outstanding balance requiring payment before new buys.";

package/dist/lib/types/get-account-financials.d.ts

@@ -209,7 +209,7 @@ export interface GetAccountFinancialsError {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/get-adcp-capabilities.d.ts

@@ -261,7 +261,7 @@ export interface GetAdCPCapabilitiesResponse {
         supported_account_currency_modes?: AccountCurrencyMode[];
         timezone?: AccountTimezoneCapability;
         /**
-         * Whether an account reference is required for get_products. When true, the buyer must establish an account before browsing products. When false (default), the buyer can browse products without an account — useful for price comparison and discovery before committing to a seller.
+         * Whether an account reference is required for get_products. When true, the buyer must establish an account before browsing products. When false (default), the buyer can browse products without an account — useful for price comparison and discovery before committing to a seller. Before an account is provisioned, the buyer omits account rather than sending a natural key that does not resolve yet. See /docs/accounts/overview#account-references-before-provisioning.
          */
         required_for_products?: boolean;
         /**
@@ -1191,7 +1191,7 @@ export interface GetAdCPCapabilitiesResponse {
          */
         covers_content_digest?: 'required' | 'forbidden' | 'either';
         /**
-         * AdCP protocol operation names (e.g., 'create_media_buy') for which this agent rejects an unsigned request with request_signature_required unless an independently valid configured fallback authenticator succeeds. Not MCP tool names, A2A skill names, or any transport-specific rename — verifiers MUST NOT accept operation names that are not defined by the AdCP protocol spec. JSON-RPC protocol method names like `tasks/cancel` belong in `protocol_methods_required_for`, not here. Empty in 3.0 by default; sellers populate selectively during per-counterparty pilots. In 4.0 this list MUST include all spend-committing operations the agent supports (create_media_buy, acquire_*, etc.). Every operation listed MUST also appear in `supported_for`; see `x-adcp-validation`.
+         * AdCP protocol operation names (e.g., 'create_media_buy') for which this agent rejects an unsigned request with request_signature_required unless an independently valid configured fallback authenticator succeeds. A transport-specific rename of an operation is not a valid entry (MCP tools and the AdCP A2A profile use the operation name verbatim, so those names coincide with it) — verifiers MUST NOT accept operation names that are not defined by the AdCP protocol spec. Over MCP the verifier matches the tools/call params.name; over A2A it matches the skill of the sole DataPart of the message (SendMessage, SendStreamingMessage, message/send, message/stream, and the HTTP+JSON and gRPC equivalents). The A2A profile uses the AdCP operation name verbatim as skill, so that is the same name space. A request that does not resolve to exactly one operation is rejected with request_body_malformed; see docs/building/by-layer/L1/security.mdx#operation-resolution-over-a2a. JSON-RPC protocol method names like `tasks/cancel` belong in `protocol_methods_required_for`, not here. Empty in 3.0 by default; sellers populate selectively during per-counterparty pilots. In 4.0 this list MUST include all spend-committing operations the agent supports (create_media_buy, acquire_*, etc.). Every operation listed MUST also appear in `supported_for`; see `x-adcp-validation`.
          */
         required_for?: string[];
         /**
@@ -1258,7 +1258,7 @@ export interface GetAdCPCapabilitiesResponse {
          */
         per_principal_key_isolation?: boolean;
         /**
-         * Map of signing-key surface/purpose → publishing origin, so counterparties can verify origin separation (e.g., governance keys served from a separate origin than transport/webhook keys) at onboarding. Absent means the operator has not declared a separation scheme; receivers SHOULD assume shared-origin. Every entry listed MUST have a corresponding signing posture declared elsewhere — `request_signing` requires non-empty `request_signing.supported_for`/`required_for`/`protocol_methods_supported_for`/`protocol_methods_required_for`; `webhook_signing` requires `webhook_signing.supported === true` and names the webhook delivery surface, not a required live `adcp_use: "webhook-signing"` key purpose — otherwise the consistency check at signature-verification time has nothing to anchor against. See `x-adcp-validation` and docs/building/implementation/security.mdx §Origin separation.
+         * Map of signing-key surface/purpose → publishing origin, so counterparties can verify origin separation (e.g., governance keys served from a separate origin than transport/webhook keys) at onboarding. Absent means the operator has not declared a separation scheme; receivers SHOULD assume shared-origin. Every entry listed MUST have a corresponding signing posture declared elsewhere — `request_signing` requires non-empty `request_signing.supported_for`/`required_for`/`protocol_methods_supported_for`/`protocol_methods_required_for`; `webhook_signing` requires `webhook_signing.supported === true` and names the webhook delivery surface, not a required live `adcp_use: "webhook-signing"` key purpose — otherwise the consistency check at signature-verification time has nothing to anchor against. See `x-adcp-validation` and docs/building/by-layer/L1/security.mdx §Origin separation.
          */
         key_origins?: {
             /**