@adcp/sdk 15.8.1 → 16.0.0-beta.1

package/dist/lib/core/SingleAgentClient.js

@@ -34,6 +34,8 @@ __export(SingleAgentClient_exports, {
   createSingleAgentClient: () => createSingleAgentClient
 });
 module.exports = __toCommonJS(SingleAgentClient_exports);
+var import_schema_loader = require('../validation/schema-loader.js');
+var import_canonicalize = require('../signing/agent-resolver/canonicalize.js');
 var import_products = require('../supply-path/products.js');
 var import_node_crypto = require("node:crypto");
 var import_adcp = require('../types/adcp.js');
@@ -41,7 +43,7 @@ var import_version = require('../version.js');
 var import_adcp_version_config = require('../utils/adcp-version-config.js');
 var import_reporting_version = require('../media-buy/reporting-version.js');
 var import_version2 = require('../adapters/version/index.js');
-var import_schema_loader = require('../validation/schema-loader.js');
+var import_schema_loader2 = require('../validation/schema-loader.js');
 var import_idempotency = require('../utils/idempotency.js');
 var import_a2a = require('../protocols/a2a.js');
 var import_TaskExecutor = require('./TaskExecutor.js');
@@ -82,11 +84,15 @@ var import_v2_5 = require('../adapters/legacy/v2-5/index.js');
 var import_property_policy = require('../media-buy/property-policy.js');
 var import_targeting_helpers = require('../server/targeting-helpers.js');
 var import_creative_delivery = require('../v2/projection/creative-delivery.js');
+var import_legacy_routes = require('../v2/projection/legacy-routes.js');
 var import_catalog_snapshot = require('../v2/projection/catalog-snapshot.js');
 var import_augment_response = require('../v2/projection/augment-response.js');
 var import_legacy_metadata = require('../v2/projection/legacy-metadata.js');
 var import_types = require('../v2/projection/types.js');
 var import_jcs = require('../utils/jcs.js');
+function loadWebBotAuth() {
+  return require('../signing/web-bot-auth.js');
+}
 const SKIP_PRODUCT_CACHE = /* @__PURE__ */ Symbol("adcp.skipProductCache");
 const SKIP_ACCOUNT_REGISTRY_OBSERVATION = /* @__PURE__ */ Symbol("adcp.skipAccountRegistryObservation");
 function presentedStaticTransportCredential(authToken, headers, authProvider) {
@@ -741,6 +747,11 @@ class SingleAgentClient {
   constructor(agent, config = {}) {
     this.agent = agent;
     this.config = config;
+    if (config.experimentalIdentity33 === true !== (0, import_schema_loader.isIdentity33SchemaScope)())
+      return (0, import_schema_loader.withIdentity33SchemaScope)(() => {
+        const instance = Reflect.construct(SingleAgentClient, [agent, config], new.target);
+        return config.experimentalIdentity33 ? (0, import_schema_loader.bindIdentity33SchemaScope)(instance) : instance;
+      }, config.experimentalIdentity33 === true);
     const configuredTransport = config.transport === void 0 ? void 0 : { ...config.transport };
     const configuredWebhookVerification = config.webhookVerification === void 0 ? void 0 : {
       ...config.webhookVerification,
@@ -755,7 +766,9 @@ class SingleAgentClient {
     };
     config = this.config;
     (0, import_agent_discovery_cache.validateAgentDiscoveryCacheConfig)(config.discoveryCache);
-    this.resolvedAdcpVersion = (0, import_adcp_version_config.resolveAdcpVersion)(config.adcpVersion);
+    this.resolvedAdcpVersion = (0, import_adcp_version_config.resolveAdcpVersion)(
+      config.adcpVersion ?? (config.experimentalIdentity33 ? "3.3" : void 0)
+    );
     this.webhookRegistrationStore = config.webhookRegistrationStore ?? new import_webhook_registration.InMemoryWebhookRegistrationStore();
     this.webhookReplayStore = config.webhookVerification?.replayStore ?? new import_server.InMemoryReplayStore();
     this.webhookRevocationStore = config.webhookVerification?.revocationStore ?? new import_server.InMemoryRevocationStore();
@@ -814,6 +827,10 @@ class SingleAgentClient {
       webhookUrlTemplate: config.webhookUrlTemplate,
       agentId: agent.id,
       webhookSecret: config.webhookSecret,
+      identity33SchemaExperiment: config.experimentalIdentity33,
+      experimentalIdentity33: () => this.config.experimentalIdentity33 === true && this.usesIdentity33Schemas(),
+      signedIdentity33Webhooks: () => this.usesSigned33Webhooks(),
+      webhookSigningProfile: () => this.selectedWebhookSigningProfile(),
       onWebhookRegistration: (registration) => this.persistWebhookRegistration(registration),
       onDurableSettlementRequired: (operationId) => this.markWebhookDurableSettlementRequired(operationId),
       externalTaskSettlementRetentionMs: registrationTtl * 1e3,
@@ -940,6 +957,7 @@ class SingleAgentClient {
         ...this.config.accountRegistryOptions,
         provisionOwnsDispatchBoundary: true,
         maxEntries: this.config.accountRegistryMaxEntries,
+        evictAtCapacity: () => !this.accountRegistryOptedIn(),
         normalizeOptions: async (options, taskOptions) => {
           if (options.billing) return options;
           const caps = await this.getCapabilities(taskOptions);
@@ -978,24 +996,65 @@ class SingleAgentClient {
       }
     };
   }
+  usesStableAccountIds(capabilities) {
+    if (capabilities._synthetic) return false;
+    return capabilities.account?.stableAccountId === true || (0, import_adcp_version_config.isAdcpVersionAtLeast)(this.config.wireAdcpVersion ?? this.resolvedAdcpVersion, "4.0.0") && ((0, import_adcp_version_config.isAdcpVersionAtLeast)(capabilities.servedVersion, "4.0.0") || !capabilities.servedVersion && capabilities.supportedVersions?.some((version) => (0, import_adcp_version_config.isAdcpVersionAtLeast)(version, "4.0.0")) === true);
+  }
+  accountWireReference(account, accountId, capabilities) {
+    if ("account_id" in account || this.config.accountReferenceMode === "natural-key" || !this.usesStableAccountIds(capabilities))
+      return account;
+    if (!accountId)
+      throw new import_errors3.AccountSetupRequiredError(
+        "The seller declares stable account IDs but did not return an account_id. Reconcile with syncAccounts."
+      );
+    return { account_id: accountId };
+  }
   async applyAccountPolicy(task, params, options) {
     const policy = this.config.accountPolicy ?? "off";
     const ref = params?.account ?? (typeof params?.account_id === "string" ? { account_id: params.account_id } : void 0);
-    if (policy === "off" || options?.skipAccountValidation || options?.preserveGovernedPayload || !ref || task === "list_accounts")
+    if (options?.skipAccountValidation || options?.preserveGovernedPayload || task === "list_accounts" || task === "sync_accounts")
       return params;
+    if (!ref) {
+      if (policy === "strict" && ["get_products", "list_products"].includes(task) && this.usesStableAccountIds(await this.getCapabilities(options)))
+        throw new import_errors3.AccountNotProvisionedError(void 0, task);
+      return params;
+    }
+    if (policy === "off" && !this._accounts) return params;
     if (typeof ref !== "object" || ref === null || !("account_id" in ref) && (typeof ref.brand?.domain !== "string" || typeof ref.operator !== "string"))
       return params;
-    const known = await this.getAccountRegistry().get(ref);
+    const registry = this.getAccountRegistry();
+    let known = await registry.get(ref);
+    let capabilities;
+    if (known && !["unknown", "provisioning", "failed_provisioning"].includes(known.status) && !("account_id" in ref) && this.config.accountReferenceMode !== "natural-key") {
+      const scope = this.accountScope();
+      capabilities = await this.getCapabilities(options);
+      if (scope !== this.accountScope()) throw new import_errors3.AccountNotProvisionedError(ref, task);
+      known = await registry.get(ref);
+      if (scope !== this.accountScope()) throw new import_errors3.AccountNotProvisionedError(ref, task);
+    }
     if (known && !["unknown", "provisioning", "failed_provisioning"].includes(known.status)) {
-      if (["create_media_buy", "buy_products", "accept_proposal", "activate_signal", "acquire_rights"].includes(task) && known.status !== "active") {
+      const commitsSpend = [
+        "create_media_buy",
+        "buy_products",
+        "accept_proposal",
+        "activate_signal",
+        "acquire_rights"
+      ].includes(task);
+      const allowedStatuses = task === "sync_creatives" ? ["active", "payment_required"] : ["active"];
+      if (policy !== "off" && (commitsSpend || task === "sync_creatives") && !allowedStatuses.includes(known.status)) {
         if (known.status === "pending_approval") throw new import_errors3.AccountPendingApprovalError(ref, known.account_id);
         if (known.status === "payment_required") throw new import_errors3.AccountPaymentRequiredError();
         throw new import_errors3.AccountSetupRequiredError(
           `Account status is ${known.status}. Refresh it with client.accounts.applyStatusChange or complete seller setup.`
         );
       }
+      if (capabilities) {
+        const account2 = this.accountWireReference(ref, known.account_id, capabilities);
+        if (account2 !== ref) return { ...params, account: account2 };
+      }
       return params;
     }
+    if (policy === "off") return params;
     if (policy === "strict" || ![
       "get_products",
       "list_products",
@@ -1007,7 +1066,7 @@ class SingleAgentClient {
       throw new import_errors3.AccountNotProvisionedError(ref, task);
     }
     const caps = await this.getCapabilities(options);
-    if (caps._synthetic || ["get_products", "list_products"].includes(task) && caps.account?.requiredForProducts || params.push_notification_config || !(0, import_schema_loader.schemaAllowsTopLevelField)(task, "brand")) {
+    if (caps._synthetic || ["get_products", "list_products"].includes(task) && caps.account?.requiredForProducts || params.push_notification_config || !(0, import_schema_loader2.schemaAllowsTopLevelField)(task, "brand")) {
       throw new import_errors3.AccountNotProvisionedError(ref, task);
     }
     if (!("brand" in ref)) throw new import_errors3.AccountNotProvisionedError(ref, task);
@@ -1027,6 +1086,7 @@ class SingleAgentClient {
   // Cache canonical base URL (from agent card or stripped /mcp)
   cachedCapabilities;
   // Cache detected server capabilities
+  runAgentInfo;
   cachedToolSchemas;
   // inputSchema.properties per tool name
   primedCapabilitiesExpiresAt;
@@ -1083,18 +1143,18 @@ class SingleAgentClient {
     persistedAgentUrl.username = "";
     persistedAgentUrl.password = "";
     persistedAgentUrl.hash = "";
-    const delegatedOperatorAuthorization = this.effectiveDelegatedOperatorAuthorization(
-      args.delegatedOperatorAuthorization
-    );
+    const delegatedOperatorAuthorization = args.deliveryKind ? void 0 : this.effectiveDelegatedOperatorAuthorization(args.delegatedOperatorAuthorization);
     const registration = {
       agentId: args.agent.id,
       agentUrl: persistedAgentUrl.toString(),
       protocol: args.agent.protocol,
       operationId: args.operationId,
       taskType: args.taskType,
-      callbackUrl: args.callbackUrl,
+      callbackUrl: args.deliveryKind ? (0, import_server.canonicalTargetUri)(args.callbackUrl, "3.2") : args.callbackUrl,
       method: "POST",
       mode: args.mode,
+      ...args.signingProfile && { signingProfile: args.signingProfile },
+      ...args.deliveryKind && { deliveryKind: args.deliveryKind },
       authorizationContextVersion: 1,
       ...delegatedOperatorAuthorization !== void 0 && { delegatedOperatorAuthorization },
       ...previewMode && { previewMode },
@@ -1103,6 +1163,14 @@ class SingleAgentClient {
     };
     (0, import_webhook_registration.validateWebhookRegistrationAuthorization)(registration);
     try {
+      if (args.deliveryKind) {
+        const previous = await this.webhookRegistrationStore.get(args.agent.id, args.operationId);
+        if (previous && previous.expiresAt > nowMs && (previous.signingProfile ?? "adcp/webhook-signing/v1") !== (registration.signingProfile ?? "adcp/webhook-signing/v1"))
+          throw new import_errors.ConfigurationError(
+            `${args.deliveryKind} callback is already registered with ${previous.signingProfile ?? "adcp/webhook-signing/v1"}. Use a new callback URL or delete its old registration after outstanding deliveries finish.`,
+            `${args.deliveryKind}_webhook.signing_profile`
+          );
+      }
       await this.webhookRegistrationStore.putIfAbsent(registration);
       const persisted = await this.webhookRegistrationStore.get(args.agent.id, args.operationId);
       if (!persisted || !(0, import_webhook_registration.sameWebhookRegistration)(
@@ -1114,6 +1182,8 @@ class SingleAgentClient {
         );
       }
     } catch (cause) {
+      if (args.deliveryKind && cause instanceof import_errors.ConfigurationError && cause.configField === `${args.deliveryKind}_webhook.signing_profile`)
+        throw cause;
       if (args.mode === "rfc9421" || !RECORDLESS_HMAC_READ_ONLY_TASKS.has(args.taskType)) {
         const error = new import_errors.ConfigurationError("Could not persist trusted webhook registration for this operation.");
         Object.defineProperty(error, "cause", { value: cause, configurable: true });
@@ -1275,7 +1345,7 @@ class SingleAgentClient {
     return (0, import_jcs.canonicalize)([this.canonicalAccountScope(account), "package", packageId]);
   }
   sameCanonicalOptionRef(left, right) {
-    return left.scope === right.scope && left.format_option_id === right.format_option_id && (left.scope !== "publisher" || right.scope === "publisher" && left.publisher_domain.toLowerCase() === right.publisher_domain.toLowerCase());
+    return (0, import_legacy_routes.sameFormatOptionRef)(left, right);
   }
   rememberCanonicalLegacyRoute(key, route) {
     this.canonicalLegacyRoutes.delete(key);
@@ -1322,7 +1392,6 @@ class SingleAgentClient {
           format_option_id: option.format_option_id
         } : { scope: "product", format_option_id: option.format_option_id };
         const refs = (0, import_legacy_metadata.legacyFormatRefsForDeclaration)(option);
-        if (refs.length === 0) continue;
         const declared = declaredOptions ? declaredOptions.get(product.product_id)?.some((declaredRef) => this.sameCanonicalOptionRef(declaredRef, ref)) : (0, import_legacy_metadata.sellerDeclaredFormatOption)(option);
         if (declared !== void 0) (0, import_legacy_metadata.rememberSellerDeclaredFormatOption)(option, declared);
         this.rememberCanonicalLegacyRoute(this.canonicalLegacyRouteKey(account, product.product_id, ref), {
@@ -1331,13 +1400,7 @@ class SingleAgentClient {
           productId: product.product_id,
           optionRef: ref,
           refs,
-          ...declared === false ? {
-            undeclaredSelector: {
-              format_kind: typeof option.format_kind === "string" ? option.format_kind : "",
-              ...option.params !== void 0 && { params: structuredClone(option.params) },
-              ...(typeof option.format_kind !== "string" || option.format_kind === "custom" || option.format_shape !== void 0 || option.format_schema !== void 0) && { unrepresentable: true }
-            }
-          } : {}
+          ...declared === false ? { undeclaredSelector: (0, import_legacy_routes.undeclaredFormatOptionSelector)(option) } : {}
         });
       }
     }
@@ -1353,46 +1416,44 @@ class SingleAgentClient {
       if (!value || typeof value !== "object" || Array.isArray(value)) continue;
       const product = value;
       if (typeof product.product_id !== "string") continue;
-      const refs = [];
-      for (const optionValue of Array.isArray(product.format_options) ? product.format_options : []) {
-        if (!optionValue || typeof optionValue !== "object" || Array.isArray(optionValue)) continue;
-        const option = optionValue;
-        if (typeof option.format_option_id !== "string") continue;
-        refs.push(
-          typeof option.publisher_domain === "string" ? {
-            scope: "publisher",
-            publisher_domain: option.publisher_domain,
-            format_option_id: option.format_option_id
-          } : { scope: "product", format_option_id: option.format_option_id }
-        );
-      }
-      declared.set(product.product_id, refs);
+      declared.set(product.product_id, (0, import_legacy_routes.sellerDeclaredFormatOptionRefs)(product));
     }
     return declared;
   }
   /**
-   * The direct selector for an option this client derived from the seller's
-   * legacy `format_ids`. Without a product id, every remembered route for the
-   * option must agree that the seller did not declare it.
+   * What this client's own discovery recorded about an option's origin.
+   * Without a product id, every remembered route for the option must agree
+   * that the seller did not declare it.
    */
-  undeclaredFormatOptionSelector(account, ref, productId) {
+  cachedFormatOptionOrigin(account, ref, productId) {
+    const originOf = (route) => route.undeclaredSelector ? { seller_declared: false, selector: route.undeclaredSelector } : { seller_declared: true };
     if (productId !== void 0) {
       const route = this.routeForOption(account, productId, ref);
-      return route?.kind === "product" ? route.undeclaredSelector : void 0;
+      return route?.kind === "product" ? originOf(route) : void 0;
     }
     const accountScope = this.canonicalAccountScope(account);
     const routes = [...this.canonicalLegacyRoutes.values()].filter(
       (route) => route.kind === "product" && (route.accountScope === accountScope || route.accountScope === "none") && this.sameCanonicalOptionRef(route.optionRef, ref)
     );
-    if (routes.length === 0 || routes.some((route) => route.undeclaredSelector === void 0)) return void 0;
-    return routes[0].undeclaredSelector;
+    if (routes.length === 0) return void 0;
+    return originOf(routes.find((route) => route.undeclaredSelector === void 0) ?? routes[0]);
   }
-  projectUndeclaredFormatOptions(request, operation, wireMode, account) {
+  /**
+   * The direct selector for an option the seller did not declare, from the
+   * first source that knows the option's origin: the per-call resolver, this
+   * client's discovery, then the configured resolver. Resolvers carry origin
+   * only when built from persisted routes.
+   */
+  undeclaredSelectorFor(account, ref, productId, override) {
+    const origin = (0, import_legacy_routes.formatOptionOriginFromRoutes)(override, ref, productId) ?? this.cachedFormatOptionOrigin(account, ref, productId) ?? (0, import_legacy_routes.formatOptionOriginFromRoutes)(this.config.canonicalFormatLegacyResolver, ref, productId);
+    return origin && !origin.seller_declared ? origin.selector : void 0;
+  }
+  projectUndeclaredFormatOptions(request, operation, wireMode, account, override) {
     if (wireMode !== "canonical") return request;
     return (0, import_creative_delivery.projectUndeclaredFormatOptionSelectors)(
       request,
       operation,
-      (ref, productId) => this.undeclaredFormatOptionSelector(account, ref, productId)
+      (ref, productId) => this.undeclaredSelectorFor(account, ref, productId, override)
     );
   }
   rememberCanonicalProductRoutesForCompletion(taskType, data, legacyFormatConverter, account) {
@@ -1490,7 +1551,7 @@ class SingleAgentClient {
     const resolved = [];
     for (const ref of optionRefs) {
       const route = this.routeForOption(account, productId, ref);
-      if (!route) return void 0;
+      if (!route || route.refs.length === 0) return void 0;
       resolved.push(...route.refs.map((value) => ({ ...value })));
     }
     return resolved;
@@ -1775,9 +1836,10 @@ class SingleAgentClient {
    */
   async ensureEndpointDiscovered(options) {
     (0, import_abort2.throwIfAborted)(options?.signal);
+    if (this.config._reuseConfiguredDiscovery?.()) this.synchronizeCapabilityEvidenceAuthorizationScope();
     const needsDiscovery = this.normalizedAgent._needsDiscovery;
     const transport = (0, import_protocols.normalizeTransportOptions)(options?.transport ?? this.config.transport);
-    const usesScopedFetch = transport?.trustedFetchFn !== void 0;
+    const usesScopedFetch = this.usesScopedDiscoveryTransport(options);
     if (!needsDiscovery) {
       return this.normalizedAgent;
     }
@@ -1883,7 +1945,7 @@ class SingleAgentClient {
     (0, import_abort2.throwIfAborted)(options?.signal);
     const needsCanonicalUrl = this.normalizedAgent._needsCanonicalUrl;
     const transport = (0, import_protocols.normalizeTransportOptions)(options?.transport ?? this.config.transport);
-    const usesScopedFetch = transport?.trustedFetchFn !== void 0;
+    const usesScopedFetch = this.usesScopedDiscoveryTransport(options);
     if (!needsCanonicalUrl) {
       return this.normalizedAgent;
     }
@@ -1902,8 +1964,11 @@ class SingleAgentClient {
         signal: options?.signal
       });
     }
+    const canonicalEpoch = this.discoveryEpochSnapshot(options);
     const canonicalUrl = await this.fetchA2ACanonicalUrl(this.normalizedAgent.agent_uri, options);
-    if (!usesScopedFetch) this.canonicalBaseUrl = canonicalUrl;
+    if (!usesScopedFetch && (!canonicalEpoch || this.discoveryEpochIs(canonicalEpoch))) {
+      this.canonicalBaseUrl = canonicalUrl;
+    }
     return {
       ...this.normalizedAgent,
       agent_uri: canonicalUrl
@@ -2028,7 +2093,9 @@ class SingleAgentClient {
     const { connectMCPWithFallback } = await import("../protocols/mcp.js");
     const { probeModernMCPConnection } = await import("../protocols/mcp-modern.js");
     const transport = (0, import_protocols.normalizeTransportOptions)(options?.transport ?? this.config.transport);
-    const usesScopedFetch = transport?.trustedFetchFn !== void 0;
+    const usesScopedFetch = this.usesScopedDiscoveryTransport(options);
+    const endpointEpoch = this.discoveryEpochSnapshot(options);
+    const mayRetain = () => !usesScopedFetch && (!endpointEpoch || this.discoveryEpochIs(endpointEpoch));
     const authToken = this.normalizedAgent.oauth_client_credentials ? this.normalizedAgent.oauth_tokens?.access_token : this.agent.auth_token;
     const agentHeaders = this.agent.headers;
     const authHeaders = (0, import_auth.createMCPRequestHeaders)(agentHeaders, authToken);
@@ -2048,7 +2115,7 @@ class SingleAgentClient {
           allowPrivateIp: transport?.allowPrivateIp
         });
         if (modern.connected) {
-          if (!usesScopedFetch) {
+          if (mayRetain()) {
             this.discoveredMcpEra = modern.era;
             this.discoveredMcpEraAt = Date.now();
           }
@@ -2067,7 +2134,7 @@ class SingleAgentClient {
           }
         );
         await client.close();
-        if (!usesScopedFetch) {
+        if (mayRetain()) {
           this.discoveredMcpEra = "legacy";
           this.discoveredMcpEraAt = Date.now();
         }
@@ -2244,7 +2311,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
   async verifyAndParseWebhook(options) {
     const rawBody = options.rawBody ?? rawBodyFromUnknown(options.body);
     const authHeaders = inspectWebhookAuthenticationHeaders(options.headers, options.signature, options.timestamp);
-    const trustedOperationId = options.operationId && options.operationId !== "unknown" ? options.operationId : void 0;
+    let trustedOperationId = options.operationId && options.operationId !== "unknown" ? options.operationId : void 0;
     let registration;
     if (trustedOperationId) {
       let stored;
@@ -2285,6 +2352,24 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         }
       }
     }
+    if (!registration && options.requestUrl && ["media_buy_delivery", "artifact_delivery"].includes(options.taskType ?? "")) {
+      const kind = options.taskType === "artifact_delivery" ? "artifact" : "reporting";
+      const routeId = (0, import_webhook_registration.deliveryWebhookRegistrationId)(kind, options.requestUrl);
+      try {
+        const stored = await this.webhookRegistrationStore.get(this.agent.id, routeId);
+        if (stored) {
+          registration = (0, import_webhook_registration.parseWebhookRegistration)(stored, { agentId: this.agent.id, operationId: routeId });
+          trustedOperationId = routeId;
+        }
+      } catch (cause) {
+        return {
+          ok: false,
+          code: "webhook_registration_store_unavailable",
+          message: "Delivery registration state is unavailable",
+          cause
+        };
+      }
+    }
     if (registration) {
       const nowMs = this.config.webhookVerification?.now ? Math.floor(this.config.webhookVerification.now() * 1e3) : Date.now();
       if (registration.expiresAt <= nowMs) registration = void 0;
@@ -2365,6 +2450,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       }
     }
     if (registration?.mode === "rfc9421") {
+      const { verifyWebBotAuth, selectSignatureProfile, WebBotAuthError } = loadWebBotAuth();
       const requestMethod = options.requestMethod;
       const requestUrl = options.requestUrl;
       if (rawBody === void 0 || !options.headers || !trustedOperationId || !requestMethod || !requestUrl) {
@@ -2377,28 +2463,65 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       const normalizedHeaders = normalizeRfc9421WebhookHeaders(options.headers);
       if (!normalizedHeaders.ok) return normalizedHeaders.failure;
       try {
-        const delegatedOperatorAuthorization = this.delegatedOperatorAuthorizationForRegistration(registration);
-        await (0, import_server.verifyWebhookSignature)(
-          {
-            method: requestMethod,
-            url: requestUrl,
-            headers: normalizedHeaders.headers,
-            body: rawBody
-          },
-          {
-            jwks: this.webhookJwksFor(registration),
-            publisherPins: await this.config.webhookVerification?.publisherPins?.(registration),
-            onKeyResolutionError: this.config.webhookVerification?.onKeyResolutionError,
-            replayStore: this.webhookReplayStore,
-            revocationStore: this.webhookRevocationStore,
-            ...this.config.webhookVerification?.now && { now: this.config.webhookVerification.now },
-            agentUrlForKeyid: () => registration.agentUrl,
-            ...registration.authorizationContextVersion === 1 && {
-              replayScopeBinding: `delegated-operator:v1:${crypto.createHash("sha256").update((0, import_webhook_registration.canonicalDelegatedOperatorAuthorization)(delegatedOperatorAuthorization)).digest("base64url")}`
+        const actualProfile = selectSignatureProfile({ headers: normalizedHeaders.headers });
+        if (registration.signingProfile === "web-bot-auth") {
+          if (registration.delegatedOperatorAuthorization || await this.config.webhookVerification?.publisherPins?.(registration))
+            throw new WebBotAuthError(403, "legacy_webhook_authorization_requires_rfc_profile");
+          const config = this.config.webhookVerification?.webBotAuth;
+          if (!config) throw new WebBotAuthError(403, "webhook_profile_not_configured");
+          const signers = await verifyWebBotAuth(
+            {
+              method: requestMethod,
+              url: requestUrl,
+              headers: normalizedHeaders.headers,
+              body: typeof rawBody === "string" ? rawBody : new TextDecoder("utf-8", { fatal: true }).decode(rawBody)
+            },
+            {
+              directory: config.directory,
+              replayStore: this.webhookReplayStore,
+              isRevoked: config.isRevoked,
+              now: this.config.webhookVerification?.now
             }
-          }
-        );
+          );
+          if (signers.length !== 1 || signers[0].origin !== (0, import_canonicalize.canonicalAgentOrigin)(registration.agentUrl))
+            throw new WebBotAuthError(403, "webhook_signer_mismatch");
+        } else {
+          if (actualProfile === "web-bot-auth") throw new WebBotAuthError(403, "webhook_profile_mismatch");
+          const delegatedOperatorAuthorization = this.delegatedOperatorAuthorizationForRegistration(registration);
+          await (0, import_server.verifyWebhookSignature)(
+            {
+              method: requestMethod,
+              url: requestUrl,
+              headers: normalizedHeaders.headers,
+              body: rawBody
+            },
+            {
+              jwks: this.webhookJwksFor(registration),
+              publisherPins: await this.config.webhookVerification?.publisherPins?.(registration),
+              onKeyResolutionError: this.config.webhookVerification?.onKeyResolutionError,
+              replayStore: this.webhookReplayStore,
+              revocationStore: this.webhookRevocationStore,
+              ...this.config.webhookVerification?.now && { now: this.config.webhookVerification.now },
+              agentUrlForKeyid: () => registration.agentUrl,
+              ...registration.authorizationContextVersion === 1 && {
+                replayScopeBinding: `delegated-operator:v1:${crypto.createHash("sha256").update((0, import_webhook_registration.canonicalDelegatedOperatorAuthorization)(delegatedOperatorAuthorization)).digest("base64url")}`
+              }
+            }
+          );
+        }
       } catch (cause) {
+        if (cause instanceof WebBotAuthError)
+          return {
+            ok: false,
+            code: [
+              "directory_unavailable",
+              "revocation_unavailable",
+              "verification_unavailable",
+              "directory_fetch_limit"
+            ].includes(cause.reason) ? "webhook_verification_unavailable" : "webhook_signature_invalid",
+            message: cause.message,
+            cause
+          };
         if (cause instanceof import_server.WebhookSignatureError) {
           if (cause.retryable)
             return {
@@ -2478,6 +2601,45 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     if (!parsedPayload.ok) {
       return parsedPayload;
     }
+    if (registration?.deliveryKind) {
+      const loader = require('../validation/schema-loader.js');
+      const body = parsedPayload.payload;
+      const isReport = registration.deliveryKind === "reporting";
+      const payload = isReport ? body.result : body;
+      const schemaRef = isReport ? "media-buy/media-buy-delivery-webhook-result.json" : "content-standards/artifact-webhook-payload.json";
+      const validator = loader.getSchemaValidatorByRef(schemaRef, this.resolvedAdcpVersion);
+      const envelopeValidator = isReport ? loader.getSchemaValidatorByRef("core/mcp-webhook-payload.json", this.resolvedAdcpVersion) : void 0;
+      if (!validator || !validator(payload) || isReport && (!envelopeValidator || !envelopeValidator(body) || body.task_type !== "media_buy_delivery"))
+        return {
+          ok: false,
+          code: "webhook_envelope_invalid",
+          message: "Authenticated delivery does not match its registered payload kind"
+        };
+      const taskId = isReport && typeof body.task_id === "string" ? body.task_id : typeof body.media_buy_id === "string" ? body.media_buy_id : registration.operationId;
+      const operationId = isReport && typeof body.operation_id === "string" ? body.operation_id : registration.operationId;
+      const status = isReport && (0, import_task_status.isAdcpStatus)(body.status) ? body.status : "completed";
+      return {
+        ok: true,
+        protocol: registration.protocol,
+        envelope: isReport ? body : {
+          ...body,
+          task_type: registration.taskType,
+          operation_id: operationId,
+          task_id: taskId,
+          status,
+          result: payload
+        },
+        result: payload,
+        metadata: {
+          taskId,
+          taskType: registration.taskType,
+          operationId,
+          status,
+          ...typeof body.timestamp === "string" && { timestamp: body.timestamp },
+          ...typeof body.idempotency_key === "string" && { idempotencyKey: body.idempotency_key }
+        }
+      };
+    }
     const topLevelTaskType = isObjectRecord(parsedPayload.payload) && typeof parsedPayload.payload.task_type === "string" ? parsedPayload.payload.task_type : void 0;
     const payloadRecord = isObjectRecord(parsedPayload.payload) ? parsedPayload.payload : void 0;
     const signedRoute = extractSignedWebhookRoute(parsedPayload.payload);
@@ -3239,7 +3401,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     if (!options?.skipIdempotencyAutoInject && !options?.preserveGovernedPayload && (0, import_idempotency.requestUsesIdempotency)(taskType, normalizedParams) && normalizedParams && typeof normalizedParams === "object" && !normalizedParams.idempotency_key) {
       normalizedParams = { ...normalizedParams, idempotency_key: (0, import_idempotency.generateIdempotencyKey)() };
     }
-    if (!options?.skipIdempotencyAutoInject && !options?.skipAccountValidation && !options?.skipRequestValidation && !options?.preserveGovernedPayload && !(0, import_schema_loader.isExternalSchemaRootActive)(this.resolvedAdcpVersion)) {
+    if (!options?.skipIdempotencyAutoInject && !options?.skipAccountValidation && !options?.skipRequestValidation && !options?.preserveGovernedPayload && !(0, import_schema_loader2.isExternalSchemaRootActive)(this.resolvedAdcpVersion)) {
       this.validateRequest(taskType, normalizedParams);
     }
     await this.validateTaskFeatures(taskType, options);
@@ -4332,7 +4494,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       const filtered = {};
       const schemaStripped = [];
       for (const [key, value] of Object.entries(adapted)) {
-        if (declaredFields.has(key) || envelopeFields.has(key) || (0, import_schema_loader.schemaAllowsTopLevelField)(taskType, key, this.resolvedAdcpVersion)) {
+        if (declaredFields.has(key) || envelopeFields.has(key) || (0, import_schema_loader2.schemaAllowsTopLevelField)(taskType, key, this.resolvedAdcpVersion)) {
           filtered[key] = value;
         } else {
           schemaStripped.push(key);
@@ -4667,6 +4829,8 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       params.account
     );
     const hasCreativeFormatData = hasMediaBuyCreativeFormatData(params);
+    if (this.config.experimentalIdentity33) await this.getCapabilities(taskOptions);
+    const signed33Webhooks = this.usesSigned33Webhooks();
     if (this.config.webhookUrlTemplate && !options?.disableWebhook) {
       const now = /* @__PURE__ */ new Date();
       const year = now.getUTCFullYear();
@@ -4687,12 +4851,12 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
           const consumerAuth = consumerReportingWebhook?.authentication;
           const consumerUrl = consumerReportingWebhook?.url;
           const consumerFrequency = consumerReportingWebhook?.reporting_frequency;
-          const defaultAuth = this.config.webhookSecret ? { schemes: ["HMAC-SHA256"], credentials: this.config.webhookSecret } : void 0;
+          const defaultAuth = !signed33Webhooks && this.config.webhookSecret ? { schemes: ["HMAC-SHA256"], credentials: this.config.webhookSecret } : void 0;
           const resolvedAuth = consumerAuth !== void 0 ? consumerAuth : consumerUrl === void 0 ? defaultAuth : void 0;
-          if (resolvedAuth === void 0 || resolvedAuth === null) {
+          if (!signed33Webhooks && resolvedAuth === void 0 || resolvedAuth === null) {
             if (consumerReportingWebhook) {
               throw new Error(
-                "reporting_webhook requires an `authentication` block for all of AdCP 3.x, and no credential is available: set `webhookSecret` on the client, or pass `reporting_webhook.authentication` explicitly. Remove `reporting_webhook` from the request if you do not need automated delivery reports \u2014 the media buy itself does not require it."
+                "reporting_webhook requires an `authentication` block without positively negotiated 3.3 signed webhooks, and no credential is available: set `webhookSecret` on the client, or pass `reporting_webhook.authentication` explicitly. Remove `reporting_webhook` from the request if you do not need automated delivery reports \u2014 the media buy itself does not require it."
               );
             }
             warnReportingWebhookNeedsSecret();
@@ -4708,9 +4872,20 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
                 ...consumerReportingWebhook,
                 url: consumerUrl !== void 0 ? consumerUrl : deliveryWebhookUrl,
                 reporting_frequency: consumerFrequency !== void 0 ? consumerFrequency : libraryDefaults.reporting_frequency,
-                authentication: resolvedAuth
+                ...resolvedAuth !== void 0 && { authentication: resolvedAuth },
+                ...resolvedAuth === void 0 && this.selectedWebhookSigningProfile() && { signing_profile: this.selectedWebhookSigningProfile() }
               }
             };
+            if (signed33Webhooks && resolvedAuth === void 0) {
+              await this.persistWebhookRegistration({
+                agent: this.normalizedAgent,
+                taskType: "media_buy_delivery",
+                operationId,
+                callbackUrl: consumerUrl ?? deliveryWebhookUrl,
+                mode: "rfc9421",
+                signingProfile: this.selectedWebhookSigningProfile()
+              });
+            }
           }
         }
       }
@@ -4733,7 +4908,8 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         ),
         "create_media_buy",
         wireMode,
-        wireParams.account
+        wireParams.account,
+        canonicalFormatLegacyResolver
       ),
       inputHandler,
       taskOptions,
@@ -4819,7 +4995,8 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         ),
         "update_media_buy",
         wireMode,
-        params.account
+        params.account,
+        canonicalFormatLegacyResolver
       ),
       inputHandler,
       taskOptions,
@@ -4915,7 +5092,8 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       ),
       "sync_creatives",
       wireMode,
-      params.account
+      params.account,
+      canonicalFormatLegacyResolver
     );
     return this.executeAndHandle(
       "sync_creatives",
@@ -4962,7 +5140,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       ...options,
       [CAPABILITY_DISCOVERY_CONTEXT]: discoveryContext
     });
-    const usesScopedFetch = (0, import_protocols.normalizeTransportOptions)(options?.transport ?? this.config.transport)?.trustedFetchFn !== void 0;
+    const usesScopedFetch = this.usesScopedDiscoveryTransport(options);
     const toolSchemas = discoveryContext.toolSchemas ?? (usesScopedFetch ? void 0 : this.cachedToolSchemas);
     const wireRelease = this.config.wireAdcpVersion ?? this.resolvedAdcpVersion;
     const declared = (0, import_creative_delivery.resolveCreativeFormatWireMode)(capabilities, wireRelease);
@@ -4996,7 +5174,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     if ((0, import_idempotency.requestUsesIdempotency)(taskType, normalizedParams) && normalizedParams && typeof normalizedParams === "object" && !normalizedParams.idempotency_key) {
       normalizedParams = { ...normalizedParams, idempotency_key: (0, import_idempotency.generateIdempotencyKey)() };
     }
-    if (!(0, import_schema_loader.isExternalSchemaRootActive)(this.resolvedAdcpVersion)) {
+    if (!(0, import_schema_loader2.isExternalSchemaRootActive)(this.resolvedAdcpVersion)) {
       this.validateRequest(taskType, normalizedParams);
     }
   }
@@ -5277,15 +5455,23 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     );
   }
   async getAdcpCapabilitiesWithinDeadline(params, inputHandler, options) {
+    const scopeKey = this.config._reuseConfiguredDiscovery?.() ? this.getCapabilityEvidenceScope().scopeKey : void 0;
     const agent = await this.ensureEndpointDiscovered(options);
     this.executor.validateRequest("get_adcp_capabilities", params);
-    return this.executor.executeTask(
+    const result = await this.executor.executeTask(
       agent,
       "get_adcp_capabilities",
       params,
       inputHandler,
       options
     );
+    if (this.config._reuseConfiguredDiscovery?.() && !this.usesScopedDiscoveryTransport(options) && scopeKey === this.getCapabilityEvidenceScope().scopeKey && Object.keys(params).length === 0 && this.runAgentInfo !== void 0 && result.success && result.data && (0, import_capabilities.looksLikeV3Capabilities)(result.data)) {
+      const capabilities = (0, import_capabilities.parseCapabilitiesResponse)(structuredClone(result.data));
+      if (!capabilities._synthetic) {
+        this.cachedCapabilities = (0, import_capabilities.augmentCapabilitiesFromTools)(capabilities, this.runAgentInfo.tools);
+      }
+    }
+    return result;
   }
   // ====== CREATIVE BUILD TASKS ======
   /**
@@ -5344,11 +5530,6 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       options
     );
   }
-  /**
-   * Resolve an account for the authenticated caller. Explicit-account sellers
-   * are discovered with list_accounts; implicit-account sellers are registered
-   * with sync_accounts and addressed by their natural key.
-   */
   async resolveAccount(hints = {}, options, onTaskResult) {
     return (0, import_task_deadline.withTaskDeadline)(snapshotTaskOptions(options), async (effectiveOptions) => {
       const capabilities = await this.getCapabilities(effectiveOptions);
@@ -5359,6 +5540,14 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
           "The seller did not provide an account contract. Probe get_adcp_capabilities or pass an account reference explicitly."
         );
       }
+      const resolved = (account2, accountId) => {
+        const reference = this.accountWireReference(account2, accountId, capabilities);
+        return hints.includeDetails ? {
+          reference,
+          ...accountId && { account_id: accountId },
+          ...!("account_id" in account2) && { naturalKey: structuredClone(account2) }
+        } : reference;
+      };
       if (capabilities.account.requireOperatorAuth) {
         const accounts = [];
         const seenCursors = /* @__PURE__ */ new Set();
@@ -5378,7 +5567,10 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
             throw new Error("list_accounts did not return a completed account list.");
           }
           accounts.push(...result.data.accounts);
-          if (!result.data.pagination?.has_more) return (0, import_account_resolution.selectListedAccount)(accounts, hints);
+          if (!result.data.pagination?.has_more) {
+            const selected = (0, import_account_resolution.selectListedAccount)(accounts, hints);
+            return resolved(selected, "account_id" in selected ? selected.account_id : void 0);
+          }
           const nextCursor = result.data.pagination.cursor;
           if (!nextCursor || seenCursors.has(nextCursor)) break;
           seenCursors.add(nextCursor);
@@ -5447,6 +5639,9 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         );
       }
       if (!this.accountRegistryOptedIn()) {
+        const registry = this.usesStableAccountIds(capabilities) ? this.getAccountRegistry() : void 0;
+        const registryScope = registry ? this.accountScope() : void 0;
+        const observationEpoch = registry?.captureObservation();
         const result = await this.syncAccounts(
           {
             accounts: [
@@ -5465,20 +5660,62 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         if (!result.success || result.status !== "completed" || !result.data || !("accounts" in result.data) || !Array.isArray(result.data.accounts)) {
           throw new Error("sync_accounts did not return a completed account result.");
         }
-        const syncedRow = result.data.accounts.find(
+        if (registry) {
+          if (registryScope !== this.accountScope())
+            throw new import_errors3.AccountRequiredError(
+              "implicit",
+              "resolveAccount",
+              "Caller credentials changed during provisioning."
+            );
+          await registry.observeSync([account], result.data.accounts, false, observationEpoch);
+          if (registryScope !== this.accountScope())
+            throw new import_errors3.AccountRequiredError(
+              "implicit",
+              "resolveAccount",
+              "Caller credentials changed during provisioning."
+            );
+        }
+        const matchingRows = result.data.accounts.filter(
           (row) => row.brand?.domain === hints.brand.domain && row.operator === hints.operator && (!hints.brand.brand_id || row.brand.brand_id === hints.brand.brand_id) && (0, import_account_resolution.sameCountrySet)(hints.brand.countries, row.brand.countries) && (!hints.operatorUnit || row.operator_unit?.id === hints.operatorUnit.id) && (!hints.currency || row.currency === hints.currency) && (!hints.timezone || row.timezone === hints.timezone) && (row.sandbox === void 0 || row.sandbox === true === (hints.sandbox === true))
         );
-        if (syncedRow?.status === "pending_approval") {
-          throw new import_errors3.AccountPendingApprovalError(account, syncedRow.account_id);
-        }
-        if (!syncedRow || syncedRow.action === "failed" || syncedRow.status !== "active") {
+        if (registry && matchingRows.length > 1)
+          throw new import_errors3.AccountRequiredError(
+            "implicit",
+            "resolveAccount",
+            "sync_accounts returned ambiguous rows for the requested account."
+          );
+        const syncedRow = matchingRows[0];
+        if (!syncedRow || syncedRow.action === "failed") {
           throw new import_errors3.AccountRequiredError(
             "implicit",
             "resolveAccount",
             "sync_accounts did not establish an active account for the requested brand and operator."
           );
         }
-        return account;
+        let current = registry ? await registry.get(account) : syncedRow;
+        if (registry && registryScope !== this.accountScope())
+          throw new import_errors3.AccountRequiredError(
+            "implicit",
+            "resolveAccount",
+            "Caller credentials changed during provisioning."
+          );
+        if (registry && !current && registry.captureObservation() === observationEpoch) {
+          current = syncedRow;
+        }
+        if (current && current.account_id !== syncedRow.account_id && registry?.captureObservation() === observationEpoch)
+          throw new import_errors3.AccountRequiredError(
+            "implicit",
+            "resolveAccount",
+            "The seller account binding changed during resolution. Resolve the account again."
+          );
+        if (current?.status === "pending_approval") throw new import_errors3.AccountPendingApprovalError(account, current.account_id);
+        if (current?.status !== "active")
+          throw new import_errors3.AccountRequiredError(
+            "implicit",
+            "resolveAccount",
+            "sync_accounts did not establish an active account for the requested brand and operator."
+          );
+        return resolved(account, current.account_id);
       }
       let synced;
       try {
@@ -5500,7 +5737,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       if (synced.status === "pending_approval") throw new import_errors3.AccountPendingApprovalError(account, synced.account_id);
       if (synced.status !== "active")
         throw new import_errors3.AccountRequiredError("implicit", "resolveAccount", "The account is not active.");
-      return account;
+      return resolved(account, synced.account_id);
     });
   }
   /**
@@ -6332,6 +6569,25 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    * ```
    */
   async getAgentInfo(options) {
+    (0, import_abort2.throwIfAborted)(options?.signal);
+    const reuse = this.config._reuseConfiguredDiscovery?.() && !this.usesScopedDiscoveryTransport(options);
+    if (!reuse) return this.getAgentInfoLive(options);
+    const scopeKey = this.getCapabilityEvidenceScope().scopeKey;
+    if (this.runAgentInfo) return structuredClone(this.runAgentInfo);
+    const info = await this.getAgentInfoLive(options);
+    if (reuse && scopeKey === this.getCapabilityEvidenceScope().scopeKey) {
+      this.runAgentInfo = structuredClone(info);
+      const documents = new Map(
+        this.runAgentInfo.tools.filter((tool) => tool.inputSchema).map((tool) => [tool.name, tool.inputSchema])
+      );
+      this.cachedToolSchemas = new Map(
+        [...documents].map(([name, schema]) => [name, schema.properties ?? {}])
+      );
+      toolInputSchemasByProperties.set(this.cachedToolSchemas, documents);
+    }
+    return info;
+  }
+  async getAgentInfoLive(options) {
     const { withResponseSizeLimit } = await import("../protocols/responseSizeLimit.js");
     (0, import_abort2.throwIfAborted)(options?.signal);
     const transport = (0, import_protocols.normalizeTransportOptions)(options?.transport ?? this.config.transport);
@@ -6565,7 +6821,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     this.synchronizeCapabilityEvidenceAuthorizationScope();
     const discoveryContext = options?.[CAPABILITY_DISCOVERY_CONTEXT];
     const transport = (0, import_protocols.normalizeTransportOptions)(options?.transport ?? this.config.transport);
-    const usesScopedFetch = transport?.trustedFetchFn !== void 0;
+    const usesScopedFetch = this.usesScopedDiscoveryTransport(options);
     if (this.primedCapabilitiesExpiresAt !== void 0 && this.primedCapabilitiesExpiresAt <= Date.now()) {
       this.cachedCapabilities = void 0;
       this.cachedToolSchemas = void 0;
@@ -6844,10 +7100,25 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     }
     if (current === this.capabilityEvidenceAuthMaterial) return;
     this.capabilityEvidenceAuthMaterial = current;
+    this.discoveryEpoch++;
+    this.runAgentInfo = void 0;
     this.cachedCapabilities = void 0;
     this.cachedToolSchemas = void 0;
     this.primedCapabilitiesExpiresAt = void 0;
     this.capabilityEvidenceScopeKey = (0, import_node_crypto.randomUUID)();
+    if (this.config._reuseConfiguredDiscovery?.()) {
+      this.discoveredEndpoint = void 0;
+      this.discoveredAgent = void 0;
+      this.canonicalBaseUrl = void 0;
+      this.discoveredMcpEra = void 0;
+    }
+  }
+  /** A comply() run owns its configured fetch; per-call transport changes still discover separately. */
+  usesScopedDiscoveryTransport(options) {
+    const transport = (0, import_protocols.normalizeTransportOptions)(options?.transport ?? this.config.transport);
+    if (!this.config._reuseConfiguredDiscovery?.()) return transport?.trustedFetchFn !== void 0;
+    const configured = (0, import_protocols.normalizeTransportOptions)(this.config.transport);
+    return transport?.trustedFetchFn !== configured?.trustedFetchFn || transport?.allowPrivateIp !== configured?.allowPrivateIp || transport?.maxResponseBytes !== configured?.maxResponseBytes || transport?.requestTimeoutMs !== configured?.requestTimeoutMs || transport?.legacyCompat?.enabled !== configured?.legacyCompat?.enabled;
   }
   /**
    * Reuse a fresh capability observation made by the embedding application.
@@ -6870,7 +7141,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     const hasValidToolSchemas = snapshot?.toolSchemas === void 0 || typeof snapshot.toolSchemas === "object" && snapshot.toolSchemas !== null && Object.values(snapshot.toolSchemas).every(
       (properties) => typeof properties === "object" && properties !== null && !Array.isArray(properties)
     );
-    const configuredScopedFetch = (0, import_protocols.normalizeTransportOptions)(this.config.transport)?.trustedFetchFn !== void 0;
+    const configuredScopedFetch = this.usesScopedDiscoveryTransport();
     const hasToolEvidence = snapshot?.toolSchemas !== void 0 || Array.isArray(capabilities?.discoveredTools);
     if (!matchesScope || !isFresh || !hasCapabilities || !hasValidToolSchemas || !hasToolEvidence || configuredScopedFetch) {
       this.cachedCapabilities = void 0;
@@ -6913,11 +7184,13 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
   /** Epoch of this client's evidence for the call's effective shared key; `undefined` without a shared cache. */
   discoveryEpochSnapshot(options) {
     const key = this.sharedDiscoveryKey(options);
-    if (!key || !this.config.discoveryCache) return void 0;
+    if (!key || !this.config.discoveryCache) {
+      return this.config._reuseConfiguredDiscovery?.() ? { local: this.discoveryEpoch, shared: 0, key: "" } : void 0;
+    }
     return { local: this.discoveryEpoch, shared: this.sharedInvalidationEpoch(key), key };
   }
   discoveryEpochIs(epoch) {
-    return epoch.local === this.discoveryEpoch && epoch.shared === this.sharedInvalidationEpoch(epoch.key);
+    return epoch.local === this.discoveryEpoch && (!epoch.key || epoch.shared === this.sharedInvalidationEpoch(epoch.key));
   }
   /** The latest invalidation that applies to `key`: its own, combined with the cache's floor of forgotten ones. */
   sharedInvalidationRecord(key) {
@@ -7226,6 +7499,8 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    * seller answers with a version or capability error.
    */
   async invalidateDiscoveryCache(options) {
+    this.runAgentInfo = void 0;
+    if (this.config._reuseConfiguredDiscovery?.()) this.canonicalBaseUrl = void 0;
     this.cachedCapabilities = void 0;
     this.cachedToolSchemas = void 0;
     this.primedCapabilitiesExpiresAt = void 0;
@@ -7773,7 +8048,29 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    * injected fields before the adapter gets a chance to clean them up, so
    * the two passes have to agree on "extra keys are fine."
    */
+  usesIdentity33Schemas() {
+    return this.config.experimentalIdentity33 === true && this.cachedCapabilities?._synthetic === false && (0, import_adcp_version_config.isAdcpVersionAtLeast)(this.cachedCapabilities.servedVersion, "3.3.0");
+  }
+  usesSigned33Webhooks() {
+    const capabilities = this.cachedCapabilities;
+    return this.config.experimentalIdentity33 === true && capabilities?._synthetic === false && (0, import_adcp_version_config.isAdcpVersionAtLeast)(capabilities.servedVersion, "3.3.0") && capabilities._raw?.webhook_signing?.supported === true;
+  }
+  selectedWebhookSigningProfile() {
+    if (!this.usesSigned33Webhooks()) return void 0;
+    const advertisement = this.cachedCapabilities?._raw?.webhook_signing;
+    const profile = this.config.webhookSigningProfile ?? (advertisement?.profile === "web-bot-auth" || advertisement?.profiles?.length === 1 && advertisement.profiles[0] === "web-bot-auth" ? "web-bot-auth" : "adcp/webhook-signing/v1");
+    if (profile === "web-bot-auth" && !advertisement?.profiles?.includes(profile))
+      throw new import_errors.ConfigurationError(
+        "Seller did not advertise the selected Web Bot Auth webhook profile",
+        "webhookSigningProfile"
+      );
+    return profile;
+  }
   validateRequest(taskType, params) {
+    if (this.config.experimentalIdentity33 && this.usesIdentity33Schemas()) {
+      this.executor.validateRequest(taskType, params);
+      return;
+    }
     const schema = this.getRequestSchema(taskType);
     if (!schema) {
       return;
@@ -7890,6 +8187,7 @@ function normalizeRfc9421WebhookHeaders(headers) {
   const singletonHeaders = /* @__PURE__ */ new Set([
     "signature",
     "signature-input",
+    "signature-agent",
     "content-digest",
     "content-type",
     "x-adcp-signature",