@adcp/sdk 15.9.1 → 16.0.0-beta.2

package/bin/adcp-identity.js

@@ -0,0 +1,74 @@
+'use strict';
+const { readFileSync, writeFileSync } = require('node:fs');
+const { parseStrictJson } = require('../dist/lib/signing/agent-resolver/strict-json.js');
+const {
+  createSignedSignatureDirectory,
+  createSignedOriginRevocationList,
+  validateTrustRecord,
+} = require('../dist/lib/identity-3.3/index.js');
+
+async function handleIdentityCommand(args) {
+  const command = args[0];
+  const option = name => {
+    const index = args.indexOf(name);
+    return index >= 0 ? args[index + 1] : undefined;
+  };
+  if (command === 'trust-validate') {
+    if (!args[1]) throw new Error('Usage: adcp identity trust-validate trust.json');
+    const bytes = readFileSync(args[1]);
+    if (bytes.length > 2 * 1024 * 1024) throw new Error('trust.json exceeds 2 MiB');
+    validateTrustRecord(parseStrictJson(new TextDecoder('utf-8', { fatal: true }).decode(bytes), 32));
+    process.stdout.write('Valid experimental trust v1 record\n');
+    return;
+  }
+  if (command === 'revocations') {
+    const origin = option('--origin'),
+      keyFile = option('--keys'),
+      output = option('--output'),
+      snapshotFile = option('--snapshot');
+    if (!origin || !keyFile || !output)
+      throw new Error(
+        'Usage: adcp identity revocations --origin https://agent.example.com --keys private-jwks.json --output revocations.jws [--snapshot revocations.json]'
+      );
+    const input = parseStrictJson(readFileSync(keyFile, 'utf8'), 32);
+    if (!input?.keys?.length) throw new Error('Key file must contain a private JWK Set');
+    const now = Date.now();
+    const snapshot = snapshotFile
+      ? parseStrictJson(readFileSync(snapshotFile, 'utf8'), 32)
+      : {
+          issuer: origin,
+          updated: new Date(now).toISOString(),
+          next_update: new Date(now + 300000).toISOString(),
+          revoked_kids: [],
+        };
+    if (snapshot.issuer !== origin) throw new Error('Snapshot issuer must match --origin');
+    const body = await createSignedOriginRevocationList(snapshot, input.keys[0]);
+    writeFileSync(output, body + '\n', { mode: 0o600 });
+    process.stdout.write(
+      'Signed list written; serve at /.well-known/governance-revocations.json and refresh before next_update.\n'
+    );
+    return;
+  }
+  if (command === 'directory') {
+    const origin = option('--origin'),
+      keyFile = option('--keys'),
+      output = option('--output');
+    if (!origin || !keyFile || !output)
+      throw new Error(
+        'Usage: adcp identity directory --origin https://agent.example.com --keys private-jwks.json --output directory-response.json'
+      );
+    const input = parseStrictJson(readFileSync(keyFile, 'utf8'), 32);
+    if (!input || !Array.isArray(input.keys)) throw new Error('Key file must contain a private JWK Set');
+    const response = await createSignedSignatureDirectory(
+      origin,
+      input.keys.map(privateKey => ({ privateKey }))
+    );
+    writeFileSync(output, JSON.stringify(response, null, 2) + '\n', { mode: 0o600 });
+    process.stdout.write(
+      'Signed directory response written; serve its exact body and headers at the well-known path.\n'
+    );
+    return;
+  }
+  throw new Error('Identity commands: trust-validate, revocations, directory (generate or re-sign after rotation)');
+}
+module.exports = { handleIdentityCommand };

package/bin/adcp.js

@@ -1975,6 +1975,7 @@ COMMANDS:
                               the per-step trace. Triages request_signature_brand_*
                               rejections.
   signing <subcommand>        RFC 9421 signing key tools (generate, verify)
+  identity <subcommand>       Experimental 3.3 trust validation and signed directory authoring
   check-network               Validate managed publisher network deployment
   diagnose-auth <alias|url>   Diagnose OAuth handshake with ranked hypotheses
                               (alias: "adcp diagnose oauth <alias|url>")
@@ -5835,6 +5836,7 @@ function formatVerdict(verdict) {
 
 async function main() {
   const args = process.argv.slice(2);
+  if (args[0] === 'identity') return require('./adcp-identity.js').handleIdentityCommand(args.slice(1));
 
   // `--version` / `-v` is handled before subcommands and before the
   // staleness probe — it should be a fast, side-effect-free identity

package/dist/lib/adapters/keyed-account-backend.d.mts

@@ -0,0 +1,37 @@
+import type { Account } from '../server/decisioning/account.mjs';
+import type { AccountReference } from '../types/index.mjs';
+import type { PgQueryable } from '../server/postgres-task-store.mjs';
+export interface KeyedAccountRecord<TCtxMeta = Record<string, unknown>> {
+    key: string;
+    ref: AccountReference;
+    account: Account<TCtxMeta>;
+}
+export interface KeyedAccountSnapshot<TCtxMeta = Record<string, unknown>> {
+    version: string;
+    records: KeyedAccountRecord<TCtxMeta>[];
+}
+/** Persistent, non-expiring storage. KV adapters must implement atomic CAS. */
+export interface KeyedAccountBackend<TCtxMeta = Record<string, unknown>> {
+    load(scope: string): Promise<KeyedAccountSnapshot<TCtxMeta> | null>;
+    /** Null expects absence; otherwise replace only the exact loaded version. */
+    compareAndSwap(scope: string, version: string | null, records: KeyedAccountRecord<TCtxMeta>[]): Promise<boolean>;
+}
+/** Single-process backend; share the instance between server factories. No TTL. */
+export declare function memoryKeyedAccountBackend<TCtxMeta = Record<string, unknown>>(): KeyedAccountBackend<TCtxMeta>;
+export interface PgKeyedAccountBackendOptions {
+    tableName?: string;
+}
+export declare function getKeyedAccountMigration(options?: PgKeyedAccountBackendOptions): string;
+/** Atomic SQL CAS works across processes, without an account expiry window. */
+export declare function pgKeyedAccountBackend<TCtxMeta = Record<string, unknown>>(db: PgQueryable, options?: PgKeyedAccountBackendOptions): KeyedAccountBackend<TCtxMeta>;
+/** Minimal node-redis compatible API. Keys must never expire or be evicted. */
+export interface KeyedAccountRedisClient {
+    get(key: string): Promise<string | null>;
+    eval(script: string, options: {
+        keys: string[];
+        arguments: string[];
+    }): Promise<unknown>;
+}
+export declare function redisKeyedAccountBackend<TCtxMeta = Record<string, unknown>>(client: KeyedAccountRedisClient, options?: {
+    keyPrefix?: string;
+}): KeyedAccountBackend<TCtxMeta>;

package/dist/lib/adapters/keyed-account-backend.d.ts

@@ -0,0 +1,37 @@
+import type { Account } from '../server/decisioning/account';
+import type { AccountReference } from '../types';
+import type { PgQueryable } from '../server/postgres-task-store';
+export interface KeyedAccountRecord<TCtxMeta = Record<string, unknown>> {
+    key: string;
+    ref: AccountReference;
+    account: Account<TCtxMeta>;
+}
+export interface KeyedAccountSnapshot<TCtxMeta = Record<string, unknown>> {
+    version: string;
+    records: KeyedAccountRecord<TCtxMeta>[];
+}
+/** Persistent, non-expiring storage. KV adapters must implement atomic CAS. */
+export interface KeyedAccountBackend<TCtxMeta = Record<string, unknown>> {
+    load(scope: string): Promise<KeyedAccountSnapshot<TCtxMeta> | null>;
+    /** Null expects absence; otherwise replace only the exact loaded version. */
+    compareAndSwap(scope: string, version: string | null, records: KeyedAccountRecord<TCtxMeta>[]): Promise<boolean>;
+}
+/** Single-process backend; share the instance between server factories. No TTL. */
+export declare function memoryKeyedAccountBackend<TCtxMeta = Record<string, unknown>>(): KeyedAccountBackend<TCtxMeta>;
+export interface PgKeyedAccountBackendOptions {
+    tableName?: string;
+}
+export declare function getKeyedAccountMigration(options?: PgKeyedAccountBackendOptions): string;
+/** Atomic SQL CAS works across processes, without an account expiry window. */
+export declare function pgKeyedAccountBackend<TCtxMeta = Record<string, unknown>>(db: PgQueryable, options?: PgKeyedAccountBackendOptions): KeyedAccountBackend<TCtxMeta>;
+/** Minimal node-redis compatible API. Keys must never expire or be evicted. */
+export interface KeyedAccountRedisClient {
+    get(key: string): Promise<string | null>;
+    eval(script: string, options: {
+        keys: string[];
+        arguments: string[];
+    }): Promise<unknown>;
+}
+export declare function redisKeyedAccountBackend<TCtxMeta = Record<string, unknown>>(client: KeyedAccountRedisClient, options?: {
+    keyPrefix?: string;
+}): KeyedAccountBackend<TCtxMeta>;

package/dist/lib/adapters/keyed-account-backend.js

@@ -0,0 +1,121 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var keyed_account_backend_exports = {};
+__export(keyed_account_backend_exports, {
+  getKeyedAccountMigration: () => getKeyedAccountMigration,
+  memoryKeyedAccountBackend: () => memoryKeyedAccountBackend,
+  pgKeyedAccountBackend: () => pgKeyedAccountBackend,
+  redisKeyedAccountBackend: () => redisKeyedAccountBackend
+});
+module.exports = __toCommonJS(keyed_account_backend_exports);
+var import_node_crypto = require("node:crypto");
+function memoryKeyedAccountBackend() {
+  const data = /* @__PURE__ */ new Map();
+  return {
+    async load(scope) {
+      return structuredClone(data.get(scope) ?? null);
+    },
+    async compareAndSwap(scope, version, records) {
+      if ((data.get(scope)?.version ?? null) !== version) return false;
+      data.set(scope, structuredClone({ version: (0, import_node_crypto.randomUUID)(), records }));
+      return true;
+    }
+  };
+}
+async function backendOperation(name, run) {
+  try {
+    return await run();
+  } catch (cause) {
+    throw new Error(`Keyed account backend ${name} failed`, { cause });
+  }
+}
+function tableFor(options) {
+  const name = options.tableName ?? "adcp_keyed_accounts";
+  if (!/^[a-z_][a-z0-9_]{0,62}$/.test(name)) throw new TypeError("Invalid keyed account table name");
+  return `"${name}"`;
+}
+function getKeyedAccountMigration(options = {}) {
+  return `CREATE TABLE IF NOT EXISTS ${tableFor(options)} (scope TEXT PRIMARY KEY, version TEXT NOT NULL, records JSONB NOT NULL);`;
+}
+function pgKeyedAccountBackend(db, options = {}) {
+  const table = tableFor(options);
+  return {
+    async load(scope) {
+      const result = await backendOperation(
+        "load",
+        () => db.query(`SELECT version, records FROM ${table} WHERE scope = $1`, [scope])
+      );
+      const row = result.rows[0];
+      return row ? { version: row.version, records: row.records } : null;
+    },
+    async compareAndSwap(scope, version, records) {
+      const next = (0, import_node_crypto.randomUUID)();
+      const result = await backendOperation(
+        "compareAndSwap",
+        async () => version === null ? await db.query(
+          `INSERT INTO ${table} (scope, version, records) VALUES ($1, $2, $3::jsonb) ON CONFLICT (scope) DO NOTHING`,
+          [scope, next, JSON.stringify(records)]
+        ) : await db.query(`UPDATE ${table} SET version = $2, records = $3::jsonb WHERE scope = $1 AND version = $4`, [
+          scope,
+          next,
+          JSON.stringify(records),
+          version
+        ])
+      );
+      return result.rowCount === 1;
+    }
+  };
+}
+const CAS = `
+local current = redis.call('GET', KEYS[1])
+if ARGV[1] == '' then
+  if current then return 0 end
+else
+  if not current or cjson.decode(current).version ~= ARGV[1] then return 0 end
+end
+redis.call('SET', KEYS[1], ARGV[2])
+return 1`;
+function redisKeyedAccountBackend(client, options = {}) {
+  const prefix = options.keyPrefix ?? "adcp:keyed-accounts:";
+  return {
+    async load(scope) {
+      return backendOperation("load", async () => {
+        const value = await client.get(prefix + scope);
+        return value === null ? null : JSON.parse(value);
+      });
+    },
+    async compareAndSwap(scope, version, records) {
+      const result = await backendOperation(
+        "compareAndSwap",
+        () => client.eval(CAS, {
+          keys: [prefix + scope],
+          arguments: [version ?? "", JSON.stringify({ version: (0, import_node_crypto.randomUUID)(), records })]
+        })
+      );
+      return Number(result) === 1;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getKeyedAccountMigration,
+  memoryKeyedAccountBackend,
+  pgKeyedAccountBackend,
+  redisKeyedAccountBackend
+});

package/dist/lib/adapters/keyed-account-backend.mjs

@@ -0,0 +1,94 @@
+import { randomUUID } from "node:crypto";
+function memoryKeyedAccountBackend() {
+  const data = /* @__PURE__ */ new Map();
+  return {
+    async load(scope) {
+      return structuredClone(data.get(scope) ?? null);
+    },
+    async compareAndSwap(scope, version, records) {
+      if ((data.get(scope)?.version ?? null) !== version) return false;
+      data.set(scope, structuredClone({ version: randomUUID(), records }));
+      return true;
+    }
+  };
+}
+async function backendOperation(name, run) {
+  try {
+    return await run();
+  } catch (cause) {
+    throw new Error(`Keyed account backend ${name} failed`, { cause });
+  }
+}
+function tableFor(options) {
+  const name = options.tableName ?? "adcp_keyed_accounts";
+  if (!/^[a-z_][a-z0-9_]{0,62}$/.test(name)) throw new TypeError("Invalid keyed account table name");
+  return `"${name}"`;
+}
+function getKeyedAccountMigration(options = {}) {
+  return `CREATE TABLE IF NOT EXISTS ${tableFor(options)} (scope TEXT PRIMARY KEY, version TEXT NOT NULL, records JSONB NOT NULL);`;
+}
+function pgKeyedAccountBackend(db, options = {}) {
+  const table = tableFor(options);
+  return {
+    async load(scope) {
+      const result = await backendOperation(
+        "load",
+        () => db.query(`SELECT version, records FROM ${table} WHERE scope = $1`, [scope])
+      );
+      const row = result.rows[0];
+      return row ? { version: row.version, records: row.records } : null;
+    },
+    async compareAndSwap(scope, version, records) {
+      const next = randomUUID();
+      const result = await backendOperation(
+        "compareAndSwap",
+        async () => version === null ? await db.query(
+          `INSERT INTO ${table} (scope, version, records) VALUES ($1, $2, $3::jsonb) ON CONFLICT (scope) DO NOTHING`,
+          [scope, next, JSON.stringify(records)]
+        ) : await db.query(`UPDATE ${table} SET version = $2, records = $3::jsonb WHERE scope = $1 AND version = $4`, [
+          scope,
+          next,
+          JSON.stringify(records),
+          version
+        ])
+      );
+      return result.rowCount === 1;
+    }
+  };
+}
+const CAS = `
+local current = redis.call('GET', KEYS[1])
+if ARGV[1] == '' then
+  if current then return 0 end
+else
+  if not current or cjson.decode(current).version ~= ARGV[1] then return 0 end
+end
+redis.call('SET', KEYS[1], ARGV[2])
+return 1`;
+function redisKeyedAccountBackend(client, options = {}) {
+  const prefix = options.keyPrefix ?? "adcp:keyed-accounts:";
+  return {
+    async load(scope) {
+      return backendOperation("load", async () => {
+        const value = await client.get(prefix + scope);
+        return value === null ? null : JSON.parse(value);
+      });
+    },
+    async compareAndSwap(scope, version, records) {
+      const result = await backendOperation(
+        "compareAndSwap",
+        () => client.eval(CAS, {
+          keys: [prefix + scope],
+          arguments: [version ?? "", JSON.stringify({ version: randomUUID(), records })]
+        })
+      );
+      return Number(result) === 1;
+    }
+  };
+}
+export {
+  getKeyedAccountMigration,
+  memoryKeyedAccountBackend,
+  pgKeyedAccountBackend,
+  redisKeyedAccountBackend
+};

package/dist/lib/adapters/keyed-account-store.d.mts

@@ -0,0 +1,28 @@
+import type { Account, AccountStore, ResolveContext } from '../server/decisioning/account.mjs';
+import type { SyncAccountsRequest } from '../types/index.mjs';
+import type { KeyedAccountBackend } from './keyed-account-backend.mjs';
+export interface KeyedAccountStoreOptions<TCtxMeta = Record<string, unknown>> {
+    backend: KeyedAccountBackend<TCtxMeta>;
+    /** Trusted namespace for this seller/deployment; required even with a shared backend. */
+    namespace: string;
+    resolution?: 'explicit' | 'implicit';
+    /** Maximum records per authenticated principal. Default 1000. */
+    maxAccounts?: number;
+    /** Stable, non-secret authorization partition. Must be deterministic; may run several times per request. Defaults to the authenticated credential identity. */
+    principalKey?: (ctx?: ResolveContext) => string | undefined | Promise<string | undefined>;
+    /**
+     * Accept/reject commercial terms and return the real account record.
+     * MUST use accountId as its ID. May run again after a concurrent CAS;
+     * upstream side effects must be idempotent on accountId. Never persist
+     * credentials in ctx_metadata (authInfo is stripped automatically).
+     * When dryRun is true, preview only: no upstream writes or other side effects.
+     */
+    buildAccount: (ref: SyncAccountsRequest['accounts'][number], context: {
+        accountId: string;
+        existing: Account<TCtxMeta> | null;
+        dryRun: boolean;
+        ctx?: ResolveContext;
+    }) => Account<TCtxMeta> | Promise<Account<TCtxMeta>>;
+}
+/** Durable natural-key identity, additive syncs, principal isolation, no TTL. */
+export declare function createKeyedAccountStore<TCtxMeta = Record<string, unknown>>(options: KeyedAccountStoreOptions<TCtxMeta>): AccountStore<TCtxMeta>;

package/dist/lib/adapters/keyed-account-store.d.ts

@@ -0,0 +1,28 @@
+import type { Account, AccountStore, ResolveContext } from '../server/decisioning/account';
+import type { SyncAccountsRequest } from '../types';
+import type { KeyedAccountBackend } from './keyed-account-backend';
+export interface KeyedAccountStoreOptions<TCtxMeta = Record<string, unknown>> {
+    backend: KeyedAccountBackend<TCtxMeta>;
+    /** Trusted namespace for this seller/deployment; required even with a shared backend. */
+    namespace: string;
+    resolution?: 'explicit' | 'implicit';
+    /** Maximum records per authenticated principal. Default 1000. */
+    maxAccounts?: number;
+    /** Stable, non-secret authorization partition. Must be deterministic; may run several times per request. Defaults to the authenticated credential identity. */
+    principalKey?: (ctx?: ResolveContext) => string | undefined | Promise<string | undefined>;
+    /**
+     * Accept/reject commercial terms and return the real account record.
+     * MUST use accountId as its ID. May run again after a concurrent CAS;
+     * upstream side effects must be idempotent on accountId. Never persist
+     * credentials in ctx_metadata (authInfo is stripped automatically).
+     * When dryRun is true, preview only: no upstream writes or other side effects.
+     */
+    buildAccount: (ref: SyncAccountsRequest['accounts'][number], context: {
+        accountId: string;
+        existing: Account<TCtxMeta> | null;
+        dryRun: boolean;
+        ctx?: ResolveContext;
+    }) => Account<TCtxMeta> | Promise<Account<TCtxMeta>>;
+}
+/** Durable natural-key identity, additive syncs, principal isolation, no TTL. */
+export declare function createKeyedAccountStore<TCtxMeta = Record<string, unknown>>(options: KeyedAccountStoreOptions<TCtxMeta>): AccountStore<TCtxMeta>;

package/dist/lib/adapters/keyed-account-store.js

@@ -0,0 +1,227 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var keyed_account_store_exports = {};
+__export(keyed_account_store_exports, {
+  createKeyedAccountStore: () => createKeyedAccountStore
+});
+module.exports = __toCommonJS(keyed_account_store_exports);
+var import_node_crypto = require("node:crypto");
+var import_node_util = require("node:util");
+var import_account_key = require('../core/account-key.js');
+var import_implicit_account_store = require('./implicit-account-store.js');
+var import_async_outcome = require('../server/decisioning/async-outcome.js');
+var import_account = require('../server/decisioning/account.js');
+var import_account_mode = require('../server/account-mode.js');
+var import_account_sync_contract = require('../server/account-sync-contract.js');
+function entryRef(entry) {
+  return entry.account ?? entry;
+}
+function recordFor(records, ref) {
+  return "account_id" in ref ? records.find((row) => row.account.id === ref.account_id) : records.find((row) => row.key === (0, import_account_key.accountReferenceKey)(ref));
+}
+function resultRow(account, action) {
+  const wire = (0, import_account.toWireAccount)(account);
+  return { ...wire, brand: account.brand, operator: account.operator, action };
+}
+function createKeyedAccountStore(options) {
+  if (!options.namespace) throw new TypeError("A keyed account store requires a namespace");
+  const maxAccounts = options.maxAccounts ?? 1e3;
+  if (!Number.isSafeInteger(maxAccounts) || maxAccounts < 1)
+    throw new TypeError("maxAccounts must be a positive integer");
+  const principalKey = options.principalKey ?? ((ctx) => ctx?.authInfo ? (0, import_implicit_account_store.defaultImplicitKeyFn)(ctx.authInfo) : void 0);
+  const scopeFor = async (ctx) => {
+    const principal = await principalKey(options.principalKey && ctx ? (0, import_account_sync_contract.isolateAccountCallbackInput)(ctx) : ctx);
+    if (typeof principal !== "string" || !principal.trim())
+      throw new import_async_outcome.AdcpError("AUTH_MISSING", {
+        message: "An authenticated account principal is required.",
+        recovery: "terminal"
+      });
+    return JSON.stringify([options.namespace, principal]);
+  };
+  return {
+    resolution: options.resolution ?? "explicit",
+    strictIdempotency: true,
+    async resolve(ref, ctx) {
+      const records = (await options.backend.load(await scopeFor(ctx)))?.records ?? [];
+      return ref ? recordFor(records, ref)?.account ?? null : records.length === 1 ? records[0].account : null;
+    },
+    async upsert(entries, ctx) {
+      const dryRun = ctx?.input?.dry_run === true;
+      const deleteMissing = ctx?.input?.delete_missing === true;
+      const input = ctx?.input === void 0 ? void 0 : structuredClone(ctx.input);
+      entries = structuredClone(entries);
+      const scope = await scopeFor(ctx);
+      if (deleteMissing)
+        throw new import_async_outcome.AdcpError("UNSUPPORTED_FEATURE", {
+          message: "The keyed account store uses additive syncs; close accounts explicitly.",
+          recovery: "terminal"
+        });
+      for (let attempt = 0; attempt < 10; attempt++) {
+        const snapshot = await options.backend.load(scope);
+        const records = structuredClone(snapshot?.records ?? []);
+        const rows = [];
+        for (const entry of entries) {
+          const ref = entryRef(entry);
+          if ("account_id" in ref && !recordFor(records, ref))
+            throw new import_async_outcome.AdcpError("ACCOUNT_NOT_FOUND", { message: "Account not found", recovery: "terminal" });
+        }
+        for (const entry of entries) {
+          const ref = entryRef(entry);
+          const hit = recordFor(records, ref);
+          const source = hit?.ref ?? ref;
+          const natural = {
+            brand: source.brand,
+            operator: source.operator,
+            ...source.operator_unit !== void 0 && { operator_unit: source.operator_unit },
+            ...source.currency !== void 0 && { currency: source.currency },
+            ...source.timezone !== void 0 && { timezone: source.timezone },
+            ...source.sandbox !== void 0 && { sandbox: source.sandbox }
+          };
+          const key = (0, import_account_key.accountReferenceKey)(natural);
+          const accountId = hit?.account.id ?? `acct_${(0, import_node_crypto.createHash)("sha256").update(JSON.stringify([scope, key])).digest("hex")}`;
+          try {
+            if (!hit && records.length >= maxAccounts)
+              throw new import_async_outcome.AdcpError("INVALID_REQUEST", {
+                message: "The account limit for this principal has been reached.",
+                recovery: "correctable"
+              });
+            if ("account" in entry && !hit)
+              throw new import_async_outcome.AdcpError("UNSUPPORTED_PROVISIONING", {
+                message: "Settings updates require an existing account.",
+                recovery: "correctable"
+              });
+            if ("operator_identity" in entry)
+              throw new import_async_outcome.AdcpError("UNSUPPORTED_FEATURE", {
+                message: "The keyed account store does not implement identity reconciliation.",
+                recovery: "terminal"
+              });
+            const built = await options.buildAccount(
+              structuredClone(entry),
+              {
+                accountId,
+                existing: hit ? structuredClone(hit.account) : null,
+                dryRun,
+                ctx: ctx && (0, import_account_sync_contract.isolateAccountCallbackInput)({ ...ctx, ...input !== void 0 && { input } })
+              }
+            );
+            if (built.id !== accountId) throw new Error("buildAccount must preserve the supplied accountId");
+            const { authInfo: _authInfo, ...persisted } = built;
+            const account = JSON.parse(
+              JSON.stringify({
+                ...persisted,
+                brand: natural.brand,
+                operator: natural.operator
+              })
+            );
+            if (natural.sandbox === true && !(0, import_account_mode.isSandboxOrMockAccount)(account))
+              throw new import_async_outcome.AdcpError("UNSUPPORTED_FEATURE", {
+                message: "The seller did not authorize a sandbox account.",
+                recovery: "terminal"
+              });
+            const request = entry;
+            if (request.billing === "agent" && account.billing?.invoicedTo !== "agent") {
+              throw new import_async_outcome.AdcpError("BILLING_NOT_SUPPORTED", {
+                message: "The seller did not accept agent billing.",
+                recovery: "correctable"
+              });
+            }
+            if (account.status === "active" && request.payment_terms !== void 0 && account.payment_terms !== request.payment_terms) {
+              throw new import_async_outcome.AdcpError("PAYMENT_TERMS_NOT_SUPPORTED", {
+                message: "The seller did not accept the requested payment terms.",
+                recovery: "correctable"
+              });
+            }
+            if (account.billing?.invoicedTo === "agent" && account.payment_terms === void 0) {
+              throw new import_async_outcome.AdcpError("PAYMENT_TERMS_NOT_SUPPORTED", {
+                message: "Agent-billed accounts require explicit payment terms.",
+                recovery: "correctable"
+              });
+            }
+            const action = !hit ? "created" : (0, import_node_util.isDeepStrictEqual)(hit.account, account) ? "unchanged" : "updated";
+            rows.push(resultRow(account, action));
+            const record = { key, ref: natural, account };
+            if (hit) records[records.indexOf(hit)] = record;
+            else records.push(record);
+          } catch (error) {
+            if (!(error instanceof import_async_outcome.AdcpError)) throw error;
+            rows.push({
+              brand: natural.brand,
+              operator: natural.operator,
+              ...hit && { account_id: hit.account.id },
+              action: "failed",
+              status: hit?.account.status ?? "rejected",
+              errors: [error.toStructuredError()]
+            });
+          }
+        }
+        if (dryRun || (0, import_node_util.isDeepStrictEqual)(snapshot?.records ?? [], records)) return rows;
+        if (await options.backend.compareAndSwap(scope, snapshot?.version ?? null, records)) return rows;
+      }
+      throw new import_async_outcome.AdcpError("CONFLICT", {
+        message: "Concurrent account sync; retry the request.",
+        recovery: "correctable"
+      });
+    },
+    async list(request, ctx) {
+      const scope = await scopeFor(ctx);
+      const snapshot = await options.backend.load(scope);
+      let records = snapshot?.records ?? [];
+      if (request.account) records = records.filter((record) => recordFor([record], request.account) !== void 0);
+      if (request.status) records = records.filter((record) => record.account.status === request.status);
+      if (request.sandbox !== void 0)
+        records = records.filter((record) => (0, import_account_mode.isSandboxOrMockAccount)(record.account) === request.sandbox);
+      const cursor = request.pagination?.cursor;
+      let offset = 0;
+      if (cursor !== void 0) {
+        try {
+          const parsed = JSON.parse(Buffer.from(cursor, "base64url").toString());
+          const binding2 = (0, import_node_crypto.createHash)("sha256").update(JSON.stringify([scope, snapshot?.version, request.account, request.status, request.sandbox])).digest("hex");
+          if (parsed.binding !== binding2 || !Number.isSafeInteger(parsed.offset) || parsed.offset < 0)
+            throw new Error();
+          offset = parsed.offset;
+        } catch {
+          throw new import_async_outcome.AdcpError("INVALID_REQUEST", {
+            message: "Invalid or stale account cursor.",
+            recovery: "correctable"
+          });
+        }
+      }
+      const limit = request.pagination?.max_results ?? 100;
+      if (!Number.isSafeInteger(limit) || limit < 1)
+        throw new import_async_outcome.AdcpError("INVALID_REQUEST", {
+          message: "max_results must be a positive integer.",
+          recovery: "correctable"
+        });
+      const items = records.slice(offset, offset + limit).map((record) => record.account);
+      const next = offset + items.length;
+      const binding = (0, import_node_crypto.createHash)("sha256").update(JSON.stringify([scope, snapshot?.version, request.account, request.status, request.sandbox])).digest("hex");
+      return {
+        items,
+        totalCount: records.length,
+        ...next < records.length && {
+          nextCursor: Buffer.from(JSON.stringify({ binding, offset: next })).toString("base64url")
+        }
+      };
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createKeyedAccountStore
+});