@adcp/sdk 15.9.1 → 16.0.0-beta.2

package/dist/lib/adapters/keyed-account-store.mjs

@@ -0,0 +1,203 @@
+import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { accountReferenceKey } from "../core/account-key.mjs";
+import { defaultImplicitKeyFn } from "./implicit-account-store.mjs";
+import { AdcpError } from "../server/decisioning/async-outcome.mjs";
+import { toWireAccount } from "../server/decisioning/account.mjs";
+import { isSandboxOrMockAccount } from "../server/account-mode.mjs";
+import { isolateAccountCallbackInput } from "../server/account-sync-contract.mjs";
+function entryRef(entry) {
+  return entry.account ?? entry;
+}
+function recordFor(records, ref) {
+  return "account_id" in ref ? records.find((row) => row.account.id === ref.account_id) : records.find((row) => row.key === accountReferenceKey(ref));
+}
+function resultRow(account, action) {
+  const wire = toWireAccount(account);
+  return { ...wire, brand: account.brand, operator: account.operator, action };
+}
+function createKeyedAccountStore(options) {
+  if (!options.namespace) throw new TypeError("A keyed account store requires a namespace");
+  const maxAccounts = options.maxAccounts ?? 1e3;
+  if (!Number.isSafeInteger(maxAccounts) || maxAccounts < 1)
+    throw new TypeError("maxAccounts must be a positive integer");
+  const principalKey = options.principalKey ?? ((ctx) => ctx?.authInfo ? defaultImplicitKeyFn(ctx.authInfo) : void 0);
+  const scopeFor = async (ctx) => {
+    const principal = await principalKey(options.principalKey && ctx ? isolateAccountCallbackInput(ctx) : ctx);
+    if (typeof principal !== "string" || !principal.trim())
+      throw new AdcpError("AUTH_MISSING", {
+        message: "An authenticated account principal is required.",
+        recovery: "terminal"
+      });
+    return JSON.stringify([options.namespace, principal]);
+  };
+  return {
+    resolution: options.resolution ?? "explicit",
+    strictIdempotency: true,
+    async resolve(ref, ctx) {
+      const records = (await options.backend.load(await scopeFor(ctx)))?.records ?? [];
+      return ref ? recordFor(records, ref)?.account ?? null : records.length === 1 ? records[0].account : null;
+    },
+    async upsert(entries, ctx) {
+      const dryRun = ctx?.input?.dry_run === true;
+      const deleteMissing = ctx?.input?.delete_missing === true;
+      const input = ctx?.input === void 0 ? void 0 : structuredClone(ctx.input);
+      entries = structuredClone(entries);
+      const scope = await scopeFor(ctx);
+      if (deleteMissing)
+        throw new AdcpError("UNSUPPORTED_FEATURE", {
+          message: "The keyed account store uses additive syncs; close accounts explicitly.",
+          recovery: "terminal"
+        });
+      for (let attempt = 0; attempt < 10; attempt++) {
+        const snapshot = await options.backend.load(scope);
+        const records = structuredClone(snapshot?.records ?? []);
+        const rows = [];
+        for (const entry of entries) {
+          const ref = entryRef(entry);
+          if ("account_id" in ref && !recordFor(records, ref))
+            throw new AdcpError("ACCOUNT_NOT_FOUND", { message: "Account not found", recovery: "terminal" });
+        }
+        for (const entry of entries) {
+          const ref = entryRef(entry);
+          const hit = recordFor(records, ref);
+          const source = hit?.ref ?? ref;
+          const natural = {
+            brand: source.brand,
+            operator: source.operator,
+            ...source.operator_unit !== void 0 && { operator_unit: source.operator_unit },
+            ...source.currency !== void 0 && { currency: source.currency },
+            ...source.timezone !== void 0 && { timezone: source.timezone },
+            ...source.sandbox !== void 0 && { sandbox: source.sandbox }
+          };
+          const key = accountReferenceKey(natural);
+          const accountId = hit?.account.id ?? `acct_${createHash("sha256").update(JSON.stringify([scope, key])).digest("hex")}`;
+          try {
+            if (!hit && records.length >= maxAccounts)
+              throw new AdcpError("INVALID_REQUEST", {
+                message: "The account limit for this principal has been reached.",
+                recovery: "correctable"
+              });
+            if ("account" in entry && !hit)
+              throw new AdcpError("UNSUPPORTED_PROVISIONING", {
+                message: "Settings updates require an existing account.",
+                recovery: "correctable"
+              });
+            if ("operator_identity" in entry)
+              throw new AdcpError("UNSUPPORTED_FEATURE", {
+                message: "The keyed account store does not implement identity reconciliation.",
+                recovery: "terminal"
+              });
+            const built = await options.buildAccount(
+              structuredClone(entry),
+              {
+                accountId,
+                existing: hit ? structuredClone(hit.account) : null,
+                dryRun,
+                ctx: ctx && isolateAccountCallbackInput({ ...ctx, ...input !== void 0 && { input } })
+              }
+            );
+            if (built.id !== accountId) throw new Error("buildAccount must preserve the supplied accountId");
+            const { authInfo: _authInfo, ...persisted } = built;
+            const account = JSON.parse(
+              JSON.stringify({
+                ...persisted,
+                brand: natural.brand,
+                operator: natural.operator
+              })
+            );
+            if (natural.sandbox === true && !isSandboxOrMockAccount(account))
+              throw new AdcpError("UNSUPPORTED_FEATURE", {
+                message: "The seller did not authorize a sandbox account.",
+                recovery: "terminal"
+              });
+            const request = entry;
+            if (request.billing === "agent" && account.billing?.invoicedTo !== "agent") {
+              throw new AdcpError("BILLING_NOT_SUPPORTED", {
+                message: "The seller did not accept agent billing.",
+                recovery: "correctable"
+              });
+            }
+            if (account.status === "active" && request.payment_terms !== void 0 && account.payment_terms !== request.payment_terms) {
+              throw new AdcpError("PAYMENT_TERMS_NOT_SUPPORTED", {
+                message: "The seller did not accept the requested payment terms.",
+                recovery: "correctable"
+              });
+            }
+            if (account.billing?.invoicedTo === "agent" && account.payment_terms === void 0) {
+              throw new AdcpError("PAYMENT_TERMS_NOT_SUPPORTED", {
+                message: "Agent-billed accounts require explicit payment terms.",
+                recovery: "correctable"
+              });
+            }
+            const action = !hit ? "created" : isDeepStrictEqual(hit.account, account) ? "unchanged" : "updated";
+            rows.push(resultRow(account, action));
+            const record = { key, ref: natural, account };
+            if (hit) records[records.indexOf(hit)] = record;
+            else records.push(record);
+          } catch (error) {
+            if (!(error instanceof AdcpError)) throw error;
+            rows.push({
+              brand: natural.brand,
+              operator: natural.operator,
+              ...hit && { account_id: hit.account.id },
+              action: "failed",
+              status: hit?.account.status ?? "rejected",
+              errors: [error.toStructuredError()]
+            });
+          }
+        }
+        if (dryRun || isDeepStrictEqual(snapshot?.records ?? [], records)) return rows;
+        if (await options.backend.compareAndSwap(scope, snapshot?.version ?? null, records)) return rows;
+      }
+      throw new AdcpError("CONFLICT", {
+        message: "Concurrent account sync; retry the request.",
+        recovery: "correctable"
+      });
+    },
+    async list(request, ctx) {
+      const scope = await scopeFor(ctx);
+      const snapshot = await options.backend.load(scope);
+      let records = snapshot?.records ?? [];
+      if (request.account) records = records.filter((record) => recordFor([record], request.account) !== void 0);
+      if (request.status) records = records.filter((record) => record.account.status === request.status);
+      if (request.sandbox !== void 0)
+        records = records.filter((record) => isSandboxOrMockAccount(record.account) === request.sandbox);
+      const cursor = request.pagination?.cursor;
+      let offset = 0;
+      if (cursor !== void 0) {
+        try {
+          const parsed = JSON.parse(Buffer.from(cursor, "base64url").toString());
+          const binding2 = createHash("sha256").update(JSON.stringify([scope, snapshot?.version, request.account, request.status, request.sandbox])).digest("hex");
+          if (parsed.binding !== binding2 || !Number.isSafeInteger(parsed.offset) || parsed.offset < 0)
+            throw new Error();
+          offset = parsed.offset;
+        } catch {
+          throw new AdcpError("INVALID_REQUEST", {
+            message: "Invalid or stale account cursor.",
+            recovery: "correctable"
+          });
+        }
+      }
+      const limit = request.pagination?.max_results ?? 100;
+      if (!Number.isSafeInteger(limit) || limit < 1)
+        throw new AdcpError("INVALID_REQUEST", {
+          message: "max_results must be a positive integer.",
+          recovery: "correctable"
+        });
+      const items = records.slice(offset, offset + limit).map((record) => record.account);
+      const next = offset + items.length;
+      const binding = createHash("sha256").update(JSON.stringify([scope, snapshot?.version, request.account, request.status, request.sandbox])).digest("hex");
+      return {
+        items,
+        totalCount: records.length,
+        ...next < records.length && {
+          nextCursor: Buffer.from(JSON.stringify({ binding, offset: next })).toString("base64url")
+        }
+      };
+    }
+  };
+}
+export {
+  createKeyedAccountStore
+};

package/dist/lib/core/SingleAgentClient.d.mts

@@ -1,7 +1,7 @@
 import { type ListProductsResponseWithSupplyPath, type ProductSupplyPathOptions } from '../supply-path/products.mjs';
 import type { AccountReference, AgentConfig } from '../types/index.mjs';
 import { type AdcpVersion } from '../version.mjs';
-import type { GetProductsRequest, GetProductsResponse, ListProductsRequest, ListCreativeFormatsRequest, ListCreativeFormatsResponse, ListTransformersRequest, ListTransformersResponse, CreateMediaBuyRequest, CreateMediaBuyResponse, UpdateMediaBuyRequest, UpdateMediaBuyResponse, SyncCreativesRequest, SyncCreativesResponse, ListCreativesRequest, ListCreativesResponse, GetMediaBuysRequest, GetMediaBuysResponse, GetMediaBuyDeliveryRequest, GetMediaBuyDeliveryResponse, GetCreativeDeliveryRequest, GetCreativeDeliveryResponse, ProvidePerformanceFeedbackRequest, ProvidePerformanceFeedbackResponse, GetSignalsRequest, GetSignalsResponse, ActivateSignalRequest, ActivateSignalResponse, PreviewCreativeRequest, PreviewCreativeResponse, BuildCreativeRequest, BuildCreativeResponse, Format, GetAdCPCapabilitiesRequest, GetAdCPCapabilitiesResponse, ListAccountChangesRequest, ListAccountChangesResponse, ListAccountsRequest, ListAccountsResponse, SyncAccountsRequest, SyncAccountsResponse, SyncAudiencesRequest, SyncAudiencesResponse, CreatePropertyListRequest, CreatePropertyListResponse, GetPropertyListRequest, GetPropertyListResponse, UpdatePropertyListRequest, UpdatePropertyListResponse, ListPropertyListsRequest, ListPropertyListsResponse, DeletePropertyListRequest, DeletePropertyListResponse, ListContentStandardsRequest, ListContentStandardsResponse, GetContentStandardsRequest, GetContentStandardsResponse, CalibrateContentRequest, CalibrateContentResponse, ValidateContentDeliveryRequest, ValidateContentDeliveryResponse, SIGetOfferingRequest, SIGetOfferingResponse, SIInitiateSessionRequest, SIInitiateSessionResponse, SISendMessageRequest, SISendMessageResponse, SITerminateSessionRequest, SITerminateSessionResponse, SyncPlansRequest, SyncPlansResponse, GetPlanAuditLogsRequest, GetPlanAuditLogsResponse, GetPrincipalRequest, GetPrincipalResponse, SyncPrincipalRequest, SyncPrincipalResponse, OutcomeType } from '../types/tools.generated.mjs';
+import type { GetProductsRequest, GetProductsResponse, ListProductsRequest, ListCreativeFormatsRequest, ListCreativeFormatsResponse, ListTransformersRequest, ListTransformersResponse, CreateMediaBuyRequest, CreateMediaBuyResponse, UpdateMediaBuyRequest, UpdateMediaBuyResponse, SyncCreativesRequest, SyncCreativesResponse, ListCreativesRequest, ListCreativesResponse, GetMediaBuysRequest, GetMediaBuysResponse, GetMediaBuyDeliveryRequest, GetMediaBuyDeliveryResponse, GetCreativeDeliveryRequest, GetCreativeDeliveryResponse, ProvidePerformanceFeedbackRequest, ProvidePerformanceFeedbackResponse, GetSignalsRequest, GetSignalsResponse, ActivateSignalRequest, ActivateSignalResponse, PreviewCreativeRequest, PreviewCreativeResponse, BuildCreativeRequest, BuildCreativeResponse, Format, GetAdCPCapabilitiesRequest, GetAdCPCapabilitiesResponse, ListAccountChangesRequest, ListAccountChangesResponse, ListAccountsRequest, ListAccountsResponse, SyncAccountsRequest, SyncAccountsResponse, SyncAudiencesRequest, SyncAudiencesResponse, CreatePropertyListRequest, CreatePropertyListResponse, GetPropertyListRequest, GetPropertyListResponse, UpdatePropertyListRequest, UpdatePropertyListResponse, ListPropertyListsRequest, ListPropertyListsResponse, DeletePropertyListRequest, DeletePropertyListResponse, ListContentStandardsRequest, ListContentStandardsResponse, GetContentStandardsRequest, GetContentStandardsResponse, CalibrateContentRequest, CalibrateContentResponse, ValidateContentDeliveryRequest, ValidateContentDeliveryResponse, SIGetOfferingRequest, SIGetOfferingResponse, SIInitiateSessionRequest, SIInitiateSessionResponse, SISendMessageRequest, SISendMessageResponse, SITerminateSessionRequest, SITerminateSessionResponse, SyncPlansRequest, SyncPlansResponse, GetPlanAuditLogsRequest, GetPlanAuditLogsResponse, GetPrincipalRequest, SyncPrincipalRequest, SyncPrincipalResponse, OutcomeType } from '../types/tools.generated.mjs';
 import { type MutatingRequestInput } from '../utils/idempotency.mjs';
 import type { MCPWebhookPayload, TaskStatus } from '../types/core.generated.mjs';
 type A2ATask = Record<string, any>;
@@ -96,6 +96,19 @@ export type WebhookParseErrorCode = WebhookSignatureErrorCode | 'webhook_signatu
  */
  | 'webhook_unverifiable' | 'webhook_registration_not_found' | 'webhook_registration_mismatch' | 'webhook_verification_context_missing' | 'webhook_registration_store_unavailable' | 'webhook_durable_settlement_unavailable' | 'webhook_publication_in_progress' | 'webhook_idempotency_conflict' | 'webhook_verification_unavailable';
 export interface WebhookVerificationConfig {
+    webBotAuth?: {
+        directory: import('../signing/web-bot-auth.mjs').SignatureDirectoryResolver;
+        /**
+         * Seller origin revocation, checked after verification. A revoked key is
+         * refused; unknown status is retryable; a seller that serves no list is
+         * accepted (webhooks do not spend). Usually an `OriginRevocationResolver`.
+         */
+        revocation?: {
+            status(origin: string, keyid: string): Promise<import('../identity-3.3/revocation.mjs').OriginRevocationStatus>;
+        };
+        /** @deprecated Use `revocation`. Conservative: a seller that serves no list is refused. */
+        isRevoked?: (origin: string, keyid: string) => Promise<boolean>;
+    };
     /** Applicable pins from persisted media-buy records. Reuse refresh callbacks bound to the seller/publisher/tenant across deliveries to share their cooldown. Never use webhook payload fields. */
     publisherPins?: (registration: Readonly<WebhookRegistration>) => Promise<readonly import('../signing/publisher-pins.mjs').PublisherSigningKeyPin[]>;
     /** Local diagnostics for request_signature_* discovery causes. */
@@ -201,6 +214,9 @@ export interface StatusHandlerErrorContext {
  * Configuration for SingleAgentClient (and multi-agent client)
  */
 export interface SingleAgentClientConfig extends ConversationConfig {
+    /** Enable pinned draft identity schemas and positively negotiated 3.3 webhook rules. */
+    experimentalIdentity33?: boolean;
+    webhookSigningProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     /** Default off disables provisioning gates; auto/strict use the provisioning registry. */
     accountPolicy?: AccountPolicy;
     /** Auto selects seller IDs only with stable_account_id or an AdCP 4+ wire contract. Natural-key preserves legacy implicit references. */
@@ -553,6 +569,7 @@ export declare class SingleAgentClient {
     private discoveredMcpEraAt;
     private canonicalBaseUrl?;
     private cachedCapabilities?;
+    private runAgentInfo?;
     private cachedToolSchemas?;
     private primedCapabilitiesExpiresAt?;
     private capabilityEvidenceScopeKey;
@@ -1136,7 +1153,7 @@ export declare class SingleAgentClient {
     /** Read the durable change feed for one account. */
     listAccountChanges(params: ListAccountChangesRequest, inputHandler?: InputHandler, options?: TaskOptions): Promise<TaskResult<ListAccountChangesResponse>>;
     /** Read the authenticated caller's durable principal configuration. */
-    getPrincipal(params?: GetPrincipalRequest, inputHandler?: InputHandler, options?: TaskOptions): Promise<TaskResult<GetPrincipalResponse>>;
+    getPrincipal(params?: GetPrincipalRequest, inputHandler?: InputHandler, options?: TaskOptions): Promise<TaskResult<import('../identity-3.3/types.mjs').Identity33GetPrincipalResponse>>;
     /** Atomically replace selected sections of the authenticated caller's principal configuration. */
     syncPrincipal(params: MutatingRequestInput<SyncPrincipalRequest>, inputHandler?: InputHandler, options?: TaskOptions): Promise<TaskResult<SyncPrincipalResponse>>;
     /**
@@ -1492,6 +1509,7 @@ export declare class SingleAgentClient {
             parameters?: string[];
         }>;
     }>;
+    private getAgentInfoLive;
     /**
      * Get agent capabilities, including AdCP version support
      *
@@ -1535,6 +1553,8 @@ export declare class SingleAgentClient {
     getCapabilityEvidenceScope(): CapabilityEvidenceScope;
     private currentCapabilityEvidenceAuthMaterial;
     private synchronizeCapabilityEvidenceAuthorizationScope;
+    /** A comply() run owns its configured fetch; per-call transport changes still discover separately. */
+    private usesScopedDiscoveryTransport;
     /**
      * Reuse a fresh capability observation made by the embedding application.
      *
@@ -1858,6 +1878,9 @@ export declare class SingleAgentClient {
      * injected fields before the adapter gets a chance to clean them up, so
      * the two passes have to agree on "extra keys are fine."
      */
+    private usesIdentity33Schemas;
+    private usesSigned33Webhooks;
+    private selectedWebhookSigningProfile;
     private validateRequest;
 }
 /**

package/dist/lib/core/SingleAgentClient.d.ts

@@ -1,7 +1,7 @@
 import { type ListProductsResponseWithSupplyPath, type ProductSupplyPathOptions } from '../supply-path/products';
 import type { AccountReference, AgentConfig } from '../types';
 import { type AdcpVersion } from '../version';
-import type { GetProductsRequest, GetProductsResponse, ListProductsRequest, ListCreativeFormatsRequest, ListCreativeFormatsResponse, ListTransformersRequest, ListTransformersResponse, CreateMediaBuyRequest, CreateMediaBuyResponse, UpdateMediaBuyRequest, UpdateMediaBuyResponse, SyncCreativesRequest, SyncCreativesResponse, ListCreativesRequest, ListCreativesResponse, GetMediaBuysRequest, GetMediaBuysResponse, GetMediaBuyDeliveryRequest, GetMediaBuyDeliveryResponse, GetCreativeDeliveryRequest, GetCreativeDeliveryResponse, ProvidePerformanceFeedbackRequest, ProvidePerformanceFeedbackResponse, GetSignalsRequest, GetSignalsResponse, ActivateSignalRequest, ActivateSignalResponse, PreviewCreativeRequest, PreviewCreativeResponse, BuildCreativeRequest, BuildCreativeResponse, Format, GetAdCPCapabilitiesRequest, GetAdCPCapabilitiesResponse, ListAccountChangesRequest, ListAccountChangesResponse, ListAccountsRequest, ListAccountsResponse, SyncAccountsRequest, SyncAccountsResponse, SyncAudiencesRequest, SyncAudiencesResponse, CreatePropertyListRequest, CreatePropertyListResponse, GetPropertyListRequest, GetPropertyListResponse, UpdatePropertyListRequest, UpdatePropertyListResponse, ListPropertyListsRequest, ListPropertyListsResponse, DeletePropertyListRequest, DeletePropertyListResponse, ListContentStandardsRequest, ListContentStandardsResponse, GetContentStandardsRequest, GetContentStandardsResponse, CalibrateContentRequest, CalibrateContentResponse, ValidateContentDeliveryRequest, ValidateContentDeliveryResponse, SIGetOfferingRequest, SIGetOfferingResponse, SIInitiateSessionRequest, SIInitiateSessionResponse, SISendMessageRequest, SISendMessageResponse, SITerminateSessionRequest, SITerminateSessionResponse, SyncPlansRequest, SyncPlansResponse, GetPlanAuditLogsRequest, GetPlanAuditLogsResponse, GetPrincipalRequest, GetPrincipalResponse, SyncPrincipalRequest, SyncPrincipalResponse, OutcomeType } from '../types/tools.generated';
+import type { GetProductsRequest, GetProductsResponse, ListProductsRequest, ListCreativeFormatsRequest, ListCreativeFormatsResponse, ListTransformersRequest, ListTransformersResponse, CreateMediaBuyRequest, CreateMediaBuyResponse, UpdateMediaBuyRequest, UpdateMediaBuyResponse, SyncCreativesRequest, SyncCreativesResponse, ListCreativesRequest, ListCreativesResponse, GetMediaBuysRequest, GetMediaBuysResponse, GetMediaBuyDeliveryRequest, GetMediaBuyDeliveryResponse, GetCreativeDeliveryRequest, GetCreativeDeliveryResponse, ProvidePerformanceFeedbackRequest, ProvidePerformanceFeedbackResponse, GetSignalsRequest, GetSignalsResponse, ActivateSignalRequest, ActivateSignalResponse, PreviewCreativeRequest, PreviewCreativeResponse, BuildCreativeRequest, BuildCreativeResponse, Format, GetAdCPCapabilitiesRequest, GetAdCPCapabilitiesResponse, ListAccountChangesRequest, ListAccountChangesResponse, ListAccountsRequest, ListAccountsResponse, SyncAccountsRequest, SyncAccountsResponse, SyncAudiencesRequest, SyncAudiencesResponse, CreatePropertyListRequest, CreatePropertyListResponse, GetPropertyListRequest, GetPropertyListResponse, UpdatePropertyListRequest, UpdatePropertyListResponse, ListPropertyListsRequest, ListPropertyListsResponse, DeletePropertyListRequest, DeletePropertyListResponse, ListContentStandardsRequest, ListContentStandardsResponse, GetContentStandardsRequest, GetContentStandardsResponse, CalibrateContentRequest, CalibrateContentResponse, ValidateContentDeliveryRequest, ValidateContentDeliveryResponse, SIGetOfferingRequest, SIGetOfferingResponse, SIInitiateSessionRequest, SIInitiateSessionResponse, SISendMessageRequest, SISendMessageResponse, SITerminateSessionRequest, SITerminateSessionResponse, SyncPlansRequest, SyncPlansResponse, GetPlanAuditLogsRequest, GetPlanAuditLogsResponse, GetPrincipalRequest, SyncPrincipalRequest, SyncPrincipalResponse, OutcomeType } from '../types/tools.generated';
 import { type MutatingRequestInput } from '../utils/idempotency';
 import type { MCPWebhookPayload, TaskStatus } from '../types/core.generated';
 type A2ATask = Record<string, any>;
@@ -96,6 +96,19 @@ export type WebhookParseErrorCode = WebhookSignatureErrorCode | 'webhook_signatu
  */
  | 'webhook_unverifiable' | 'webhook_registration_not_found' | 'webhook_registration_mismatch' | 'webhook_verification_context_missing' | 'webhook_registration_store_unavailable' | 'webhook_durable_settlement_unavailable' | 'webhook_publication_in_progress' | 'webhook_idempotency_conflict' | 'webhook_verification_unavailable';
 export interface WebhookVerificationConfig {
+    webBotAuth?: {
+        directory: import('../signing/web-bot-auth').SignatureDirectoryResolver;
+        /**
+         * Seller origin revocation, checked after verification. A revoked key is
+         * refused; unknown status is retryable; a seller that serves no list is
+         * accepted (webhooks do not spend). Usually an `OriginRevocationResolver`.
+         */
+        revocation?: {
+            status(origin: string, keyid: string): Promise<import('../identity-3.3/revocation').OriginRevocationStatus>;
+        };
+        /** @deprecated Use `revocation`. Conservative: a seller that serves no list is refused. */
+        isRevoked?: (origin: string, keyid: string) => Promise<boolean>;
+    };
     /** Applicable pins from persisted media-buy records. Reuse refresh callbacks bound to the seller/publisher/tenant across deliveries to share their cooldown. Never use webhook payload fields. */
     publisherPins?: (registration: Readonly<WebhookRegistration>) => Promise<readonly import('../signing/publisher-pins').PublisherSigningKeyPin[]>;
     /** Local diagnostics for request_signature_* discovery causes. */
@@ -201,6 +214,9 @@ export interface StatusHandlerErrorContext {
  * Configuration for SingleAgentClient (and multi-agent client)
  */
 export interface SingleAgentClientConfig extends ConversationConfig {
+    /** Enable pinned draft identity schemas and positively negotiated 3.3 webhook rules. */
+    experimentalIdentity33?: boolean;
+    webhookSigningProfile?: 'adcp/webhook-signing/v1' | 'web-bot-auth';
     /** Default off disables provisioning gates; auto/strict use the provisioning registry. */
     accountPolicy?: AccountPolicy;
     /** Auto selects seller IDs only with stable_account_id or an AdCP 4+ wire contract. Natural-key preserves legacy implicit references. */
@@ -553,6 +569,7 @@ export declare class SingleAgentClient {
     private discoveredMcpEraAt;
     private canonicalBaseUrl?;
     private cachedCapabilities?;
+    private runAgentInfo?;
     private cachedToolSchemas?;
     private primedCapabilitiesExpiresAt?;
     private capabilityEvidenceScopeKey;
@@ -1136,7 +1153,7 @@ export declare class SingleAgentClient {
     /** Read the durable change feed for one account. */
     listAccountChanges(params: ListAccountChangesRequest, inputHandler?: InputHandler, options?: TaskOptions): Promise<TaskResult<ListAccountChangesResponse>>;
     /** Read the authenticated caller's durable principal configuration. */
-    getPrincipal(params?: GetPrincipalRequest, inputHandler?: InputHandler, options?: TaskOptions): Promise<TaskResult<GetPrincipalResponse>>;
+    getPrincipal(params?: GetPrincipalRequest, inputHandler?: InputHandler, options?: TaskOptions): Promise<TaskResult<import('../identity-3.3/types').Identity33GetPrincipalResponse>>;
     /** Atomically replace selected sections of the authenticated caller's principal configuration. */
     syncPrincipal(params: MutatingRequestInput<SyncPrincipalRequest>, inputHandler?: InputHandler, options?: TaskOptions): Promise<TaskResult<SyncPrincipalResponse>>;
     /**
@@ -1492,6 +1509,7 @@ export declare class SingleAgentClient {
             parameters?: string[];
         }>;
     }>;
+    private getAgentInfoLive;
     /**
      * Get agent capabilities, including AdCP version support
      *
@@ -1535,6 +1553,8 @@ export declare class SingleAgentClient {
     getCapabilityEvidenceScope(): CapabilityEvidenceScope;
     private currentCapabilityEvidenceAuthMaterial;
     private synchronizeCapabilityEvidenceAuthorizationScope;
+    /** A comply() run owns its configured fetch; per-call transport changes still discover separately. */
+    private usesScopedDiscoveryTransport;
     /**
      * Reuse a fresh capability observation made by the embedding application.
      *
@@ -1858,6 +1878,9 @@ export declare class SingleAgentClient {
      * injected fields before the adapter gets a chance to clean them up, so
      * the two passes have to agree on "extra keys are fine."
      */
+    private usesIdentity33Schemas;
+    private usesSigned33Webhooks;
+    private selectedWebhookSigningProfile;
     private validateRequest;
 }
 /**