@adcp/sdk 16.0.0-beta.6 → 16.0.0-beta.8

package/dist/lib/identifiers.js

@@ -0,0 +1,212 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var identifiers_exports = {};
+__export(identifiers_exports, {
+  IdentifierValidationError: () => IdentifierValidationError,
+  normalizeAndroidPackageIdentifier: () => normalizeAndroidPackageIdentifier,
+  normalizeAppleAppStoreIdentifier: () => normalizeAppleAppStoreIdentifier,
+  normalizeAppleTvBundleIdentifier: () => normalizeAppleTvBundleIdentifier,
+  normalizeBundleIdentifier: () => normalizeBundleIdentifier,
+  normalizeDomainIdentifier: () => normalizeDomainIdentifier,
+  normalizeFireTvAsinIdentifier: () => normalizeFireTvAsinIdentifier,
+  normalizeGooglePlayIdentifier: () => normalizeGooglePlayIdentifier,
+  normalizeIosBundleIdentifier: () => normalizeIosBundleIdentifier,
+  normalizePropertyIdentifier: () => normalizePropertyIdentifier,
+  normalizeRokuStoreIdentifier: () => normalizeRokuStoreIdentifier,
+  normalizeSamsungAppIdentifier: () => normalizeSamsungAppIdentifier,
+  normalizeSubdomainIdentifier: () => normalizeSubdomainIdentifier,
+  validateAndroidPackageIdentifier: () => validateAndroidPackageIdentifier,
+  validateAppleAppStoreIdentifier: () => validateAppleAppStoreIdentifier,
+  validateAppleTvBundleIdentifier: () => validateAppleTvBundleIdentifier,
+  validateBundleIdentifier: () => validateBundleIdentifier,
+  validateDomainIdentifier: () => validateDomainIdentifier,
+  validateFireTvAsinIdentifier: () => validateFireTvAsinIdentifier,
+  validateGooglePlayIdentifier: () => validateGooglePlayIdentifier,
+  validateIosBundleIdentifier: () => validateIosBundleIdentifier,
+  validatePropertyIdentifier: () => validatePropertyIdentifier,
+  validatePublisherDomain: () => validatePublisherDomain,
+  validateRokuStoreIdentifier: () => validateRokuStoreIdentifier,
+  validateSamsungAppIdentifier: () => validateSamsungAppIdentifier,
+  validateSubdomainIdentifier: () => validateSubdomainIdentifier
+});
+module.exports = __toCommonJS(identifiers_exports);
+var import_node_net = require("node:net");
+var import_node_url = require("node:url");
+class IdentifierValidationError extends TypeError {
+  constructor(code, identifierType, message) {
+    super(message);
+    this.code = code;
+    this.identifierType = identifierType;
+  }
+  code;
+  identifierType;
+  name = "IdentifierValidationError";
+}
+const PUBLISHER_DOMAIN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+function isDomain(value) {
+  if (value.length > 253 || !PUBLISHER_DOMAIN.test(value) || value.split(".").some((label) => label.length > 63) || (0, import_node_net.isIP)(value))
+    return false;
+  try {
+    return !(0, import_node_net.isIP)(new URL(`https://${value}`).hostname);
+  } catch {
+    return false;
+  }
+}
+function accepted(input, value) {
+  return { ok: true, value, ...input === value ? {} : { rewrite: { from: input, to: value } } };
+}
+function rejected(type, code = "invalid_identifier") {
+  return {
+    ok: false,
+    error: new IdentifierValidationError(
+      code,
+      type,
+      code === "invalid_publisher_domain" ? "publisher_domain must be a canonical lowercase hostname without wildcards, URLs, or IP addresses" : `Invalid ${type} identifier`
+    )
+  };
+}
+function validatePublisherDomain(value) {
+  return typeof value === "string" && isDomain(value) ? accepted(value, value) : rejected("publisher_domain", "invalid_publisher_domain");
+}
+function normalizeHostname(input, type) {
+  if (typeof input !== "string") return rejected(type);
+  let value = input.trim();
+  if (/^https?:\/\//i.test(value)) {
+    try {
+      const url = new URL(value);
+      if (url.username || url.password) return rejected(type);
+      value = url.hostname;
+    } catch {
+      return rejected(type);
+    }
+  }
+  const wildcard = value.startsWith("*.");
+  if (wildcard && type !== "domain") return rejected(type);
+  if (/[\s/\\:@?#%]/.test(wildcard ? value.slice(2) : value)) return rejected(type);
+  const host = (0, import_node_url.domainToASCII)((wildcard ? value.slice(2) : value).toLowerCase().replace(/\.$/, ""));
+  if (!isDomain(host)) return rejected(type);
+  return accepted(input, `${wildcard ? "*." : ""}${host}`);
+}
+const normalizeDomainIdentifier = (value) => normalizeHostname(value, "domain");
+const normalizeSubdomainIdentifier = (value) => normalizeHostname(value, "subdomain");
+function normalizePattern(type, input, pattern, uppercase = false) {
+  if (typeof input !== "string") return rejected(type);
+  const value = uppercase ? input.trim().toUpperCase() : input.trim();
+  return pattern.test(value) ? accepted(input, value) : rejected(type);
+}
+const normalizeIosBundleIdentifier = (value) => normalizePattern("ios_bundle", value, /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/);
+const normalizeAndroidPackageIdentifier = (value) => normalizePattern("android_package", value, /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/);
+const normalizeAppleAppStoreIdentifier = (value) => normalizePattern("apple_app_store_id", value, /^[1-9][0-9]*$/);
+const normalizeGooglePlayIdentifier = (value) => normalizePattern("google_play_id", value, /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/);
+const normalizeRokuStoreIdentifier = (value) => normalizePattern("roku_store_id", value, /^[1-9][0-9]*$/);
+const normalizeFireTvAsinIdentifier = (value) => normalizePattern("fire_tv_asin", value, /^[A-Z0-9]{10}$/, true);
+const normalizeSamsungAppIdentifier = (value) => normalizePattern("samsung_app_id", value, /^[A-Za-z0-9._-]+$/);
+const normalizeAppleTvBundleIdentifier = (value) => normalizePattern("apple_tv_bundle", value, /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/);
+const normalizeBundleIdentifier = (value) => normalizePattern("bundle_id", value, /^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)+$/);
+function normalizePropertyIdentifier(type, value) {
+  switch (type) {
+    case "domain":
+      return normalizeDomainIdentifier(value);
+    case "subdomain":
+      return normalizeSubdomainIdentifier(value);
+    case "ios_bundle":
+      return normalizeIosBundleIdentifier(value);
+    case "android_package":
+      return normalizeAndroidPackageIdentifier(value);
+    case "apple_app_store_id":
+      return normalizeAppleAppStoreIdentifier(value);
+    case "google_play_id":
+      return normalizeGooglePlayIdentifier(value);
+    case "roku_store_id":
+      return normalizeRokuStoreIdentifier(value);
+    case "fire_tv_asin":
+      return normalizeFireTvAsinIdentifier(value);
+    case "samsung_app_id":
+      return normalizeSamsungAppIdentifier(value);
+    case "apple_tv_bundle":
+      return normalizeAppleTvBundleIdentifier(value);
+    case "bundle_id":
+      return normalizeBundleIdentifier(value);
+    case "apple_podcast_id":
+      return normalizePattern(type, value, /^[1-9][0-9]*$/);
+    case "rss_url": {
+      if (typeof value !== "string") return rejected(type);
+      try {
+        const url = new URL(value.trim());
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || !isDomain(url.hostname))
+          return rejected(type);
+        return accepted(value, url.toString());
+      } catch {
+        return rejected(type);
+      }
+    }
+    case "network_id":
+    case "venue_id":
+    case "screen_id":
+    case "openooh_venue_type":
+    case "spotify_collection_id":
+    case "podcast_guid":
+    case "station_id":
+    case "facility_id":
+      return normalizePattern(type, value, /^[^\x00-\x1f\x7f]+$/);
+    default:
+      return rejected(type, "unsupported_identifier_type");
+  }
+}
+const validatePropertyIdentifier = normalizePropertyIdentifier;
+const validateDomainIdentifier = normalizeDomainIdentifier;
+const validateSubdomainIdentifier = normalizeSubdomainIdentifier;
+const validateIosBundleIdentifier = normalizeIosBundleIdentifier;
+const validateAndroidPackageIdentifier = normalizeAndroidPackageIdentifier;
+const validateAppleAppStoreIdentifier = normalizeAppleAppStoreIdentifier;
+const validateGooglePlayIdentifier = normalizeGooglePlayIdentifier;
+const validateRokuStoreIdentifier = normalizeRokuStoreIdentifier;
+const validateFireTvAsinIdentifier = normalizeFireTvAsinIdentifier;
+const validateSamsungAppIdentifier = normalizeSamsungAppIdentifier;
+const validateAppleTvBundleIdentifier = normalizeAppleTvBundleIdentifier;
+const validateBundleIdentifier = normalizeBundleIdentifier;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  IdentifierValidationError,
+  normalizeAndroidPackageIdentifier,
+  normalizeAppleAppStoreIdentifier,
+  normalizeAppleTvBundleIdentifier,
+  normalizeBundleIdentifier,
+  normalizeDomainIdentifier,
+  normalizeFireTvAsinIdentifier,
+  normalizeGooglePlayIdentifier,
+  normalizeIosBundleIdentifier,
+  normalizePropertyIdentifier,
+  normalizeRokuStoreIdentifier,
+  normalizeSamsungAppIdentifier,
+  normalizeSubdomainIdentifier,
+  validateAndroidPackageIdentifier,
+  validateAppleAppStoreIdentifier,
+  validateAppleTvBundleIdentifier,
+  validateBundleIdentifier,
+  validateDomainIdentifier,
+  validateFireTvAsinIdentifier,
+  validateGooglePlayIdentifier,
+  validateIosBundleIdentifier,
+  validatePropertyIdentifier,
+  validatePublisherDomain,
+  validateRokuStoreIdentifier,
+  validateSamsungAppIdentifier,
+  validateSubdomainIdentifier
+});

package/dist/lib/identifiers.mjs

@@ -0,0 +1,163 @@
+import { isIP } from "node:net";
+import { domainToASCII } from "node:url";
+class IdentifierValidationError extends TypeError {
+  constructor(code, identifierType, message) {
+    super(message);
+    this.code = code;
+    this.identifierType = identifierType;
+  }
+  code;
+  identifierType;
+  name = "IdentifierValidationError";
+}
+const PUBLISHER_DOMAIN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/;
+function isDomain(value) {
+  if (value.length > 253 || !PUBLISHER_DOMAIN.test(value) || value.split(".").some((label) => label.length > 63) || isIP(value))
+    return false;
+  try {
+    return !isIP(new URL(`https://${value}`).hostname);
+  } catch {
+    return false;
+  }
+}
+function accepted(input, value) {
+  return { ok: true, value, ...input === value ? {} : { rewrite: { from: input, to: value } } };
+}
+function rejected(type, code = "invalid_identifier") {
+  return {
+    ok: false,
+    error: new IdentifierValidationError(
+      code,
+      type,
+      code === "invalid_publisher_domain" ? "publisher_domain must be a canonical lowercase hostname without wildcards, URLs, or IP addresses" : `Invalid ${type} identifier`
+    )
+  };
+}
+function validatePublisherDomain(value) {
+  return typeof value === "string" && isDomain(value) ? accepted(value, value) : rejected("publisher_domain", "invalid_publisher_domain");
+}
+function normalizeHostname(input, type) {
+  if (typeof input !== "string") return rejected(type);
+  let value = input.trim();
+  if (/^https?:\/\//i.test(value)) {
+    try {
+      const url = new URL(value);
+      if (url.username || url.password) return rejected(type);
+      value = url.hostname;
+    } catch {
+      return rejected(type);
+    }
+  }
+  const wildcard = value.startsWith("*.");
+  if (wildcard && type !== "domain") return rejected(type);
+  if (/[\s/\\:@?#%]/.test(wildcard ? value.slice(2) : value)) return rejected(type);
+  const host = domainToASCII((wildcard ? value.slice(2) : value).toLowerCase().replace(/\.$/, ""));
+  if (!isDomain(host)) return rejected(type);
+  return accepted(input, `${wildcard ? "*." : ""}${host}`);
+}
+const normalizeDomainIdentifier = (value) => normalizeHostname(value, "domain");
+const normalizeSubdomainIdentifier = (value) => normalizeHostname(value, "subdomain");
+function normalizePattern(type, input, pattern, uppercase = false) {
+  if (typeof input !== "string") return rejected(type);
+  const value = uppercase ? input.trim().toUpperCase() : input.trim();
+  return pattern.test(value) ? accepted(input, value) : rejected(type);
+}
+const normalizeIosBundleIdentifier = (value) => normalizePattern("ios_bundle", value, /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/);
+const normalizeAndroidPackageIdentifier = (value) => normalizePattern("android_package", value, /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/);
+const normalizeAppleAppStoreIdentifier = (value) => normalizePattern("apple_app_store_id", value, /^[1-9][0-9]*$/);
+const normalizeGooglePlayIdentifier = (value) => normalizePattern("google_play_id", value, /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/);
+const normalizeRokuStoreIdentifier = (value) => normalizePattern("roku_store_id", value, /^[1-9][0-9]*$/);
+const normalizeFireTvAsinIdentifier = (value) => normalizePattern("fire_tv_asin", value, /^[A-Z0-9]{10}$/, true);
+const normalizeSamsungAppIdentifier = (value) => normalizePattern("samsung_app_id", value, /^[A-Za-z0-9._-]+$/);
+const normalizeAppleTvBundleIdentifier = (value) => normalizePattern("apple_tv_bundle", value, /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+$/);
+const normalizeBundleIdentifier = (value) => normalizePattern("bundle_id", value, /^[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)+$/);
+function normalizePropertyIdentifier(type, value) {
+  switch (type) {
+    case "domain":
+      return normalizeDomainIdentifier(value);
+    case "subdomain":
+      return normalizeSubdomainIdentifier(value);
+    case "ios_bundle":
+      return normalizeIosBundleIdentifier(value);
+    case "android_package":
+      return normalizeAndroidPackageIdentifier(value);
+    case "apple_app_store_id":
+      return normalizeAppleAppStoreIdentifier(value);
+    case "google_play_id":
+      return normalizeGooglePlayIdentifier(value);
+    case "roku_store_id":
+      return normalizeRokuStoreIdentifier(value);
+    case "fire_tv_asin":
+      return normalizeFireTvAsinIdentifier(value);
+    case "samsung_app_id":
+      return normalizeSamsungAppIdentifier(value);
+    case "apple_tv_bundle":
+      return normalizeAppleTvBundleIdentifier(value);
+    case "bundle_id":
+      return normalizeBundleIdentifier(value);
+    case "apple_podcast_id":
+      return normalizePattern(type, value, /^[1-9][0-9]*$/);
+    case "rss_url": {
+      if (typeof value !== "string") return rejected(type);
+      try {
+        const url = new URL(value.trim());
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || !isDomain(url.hostname))
+          return rejected(type);
+        return accepted(value, url.toString());
+      } catch {
+        return rejected(type);
+      }
+    }
+    case "network_id":
+    case "venue_id":
+    case "screen_id":
+    case "openooh_venue_type":
+    case "spotify_collection_id":
+    case "podcast_guid":
+    case "station_id":
+    case "facility_id":
+      return normalizePattern(type, value, /^[^\x00-\x1f\x7f]+$/);
+    default:
+      return rejected(type, "unsupported_identifier_type");
+  }
+}
+const validatePropertyIdentifier = normalizePropertyIdentifier;
+const validateDomainIdentifier = normalizeDomainIdentifier;
+const validateSubdomainIdentifier = normalizeSubdomainIdentifier;
+const validateIosBundleIdentifier = normalizeIosBundleIdentifier;
+const validateAndroidPackageIdentifier = normalizeAndroidPackageIdentifier;
+const validateAppleAppStoreIdentifier = normalizeAppleAppStoreIdentifier;
+const validateGooglePlayIdentifier = normalizeGooglePlayIdentifier;
+const validateRokuStoreIdentifier = normalizeRokuStoreIdentifier;
+const validateFireTvAsinIdentifier = normalizeFireTvAsinIdentifier;
+const validateSamsungAppIdentifier = normalizeSamsungAppIdentifier;
+const validateAppleTvBundleIdentifier = normalizeAppleTvBundleIdentifier;
+const validateBundleIdentifier = normalizeBundleIdentifier;
+export {
+  IdentifierValidationError,
+  normalizeAndroidPackageIdentifier,
+  normalizeAppleAppStoreIdentifier,
+  normalizeAppleTvBundleIdentifier,
+  normalizeBundleIdentifier,
+  normalizeDomainIdentifier,
+  normalizeFireTvAsinIdentifier,
+  normalizeGooglePlayIdentifier,
+  normalizeIosBundleIdentifier,
+  normalizePropertyIdentifier,
+  normalizeRokuStoreIdentifier,
+  normalizeSamsungAppIdentifier,
+  normalizeSubdomainIdentifier,
+  validateAndroidPackageIdentifier,
+  validateAppleAppStoreIdentifier,
+  validateAppleTvBundleIdentifier,
+  validateBundleIdentifier,
+  validateDomainIdentifier,
+  validateFireTvAsinIdentifier,
+  validateGooglePlayIdentifier,
+  validateIosBundleIdentifier,
+  validatePropertyIdentifier,
+  validatePublisherDomain,
+  validateRokuStoreIdentifier,
+  validateSamsungAppIdentifier,
+  validateSubdomainIdentifier
+};

package/dist/lib/identity-3.3/revocation.js

@@ -225,7 +225,8 @@ class OriginRevocationResolver {
       for (const token of tokens) {
         try {
           const header = (0, import_jose.decodeProtectedHeader)(token);
-          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || typeof header.alg !== "string" || !["EdDSA", "ES256"].includes(header.alg))
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || // Directory keys are Ed25519 or RSA-PSS under the profile (adcp#7894).
+          header.alg !== "EdDSA" && header.alg !== "PS512")
             continue;
           await this.options.directory.resolve(header.kid, origin);
           const checked = this.options.directory.getVerifiedDirectory(origin);
@@ -234,7 +235,7 @@ class OriginRevocationResolver {
           const jwk = checked.keys.find((key) => key.kid === header.kid);
           if (!jwk) continue;
           const result = await (0, import_jose.compactVerify)(token, await (0, import_jose.importJWK)(jwk, header.alg), {
-            algorithms: ["EdDSA", "ES256"]
+            algorithms: [header.alg]
           });
           verifiedPayload = result.payload;
           break;
@@ -295,8 +296,8 @@ async function createSignedOriginRevocationList(snapshot, privateKey) {
   const kid = (0, import_web_bot_auth.jwkThumbprint)(privateKey);
   if (privateKey.kid && privateKey.kid !== kid)
     throw new TypeError("Revocation signing kid must be the JWK thumbprint");
-  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.crv === "P-256" ? "ES256" : void 0;
-  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or P-256 key");
+  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.kty === "RSA" ? "PS512" : void 0;
+  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or RSA key");
   return new import_jose.CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await (0, import_jose.importJWK)(privateKey, alg));
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/lib/identity-3.3/revocation.mjs

@@ -204,7 +204,8 @@ class OriginRevocationResolver {
       for (const token of tokens) {
         try {
           const header = decodeProtectedHeader(token);
-          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || typeof header.alg !== "string" || !["EdDSA", "ES256"].includes(header.alg))
+          if (header.typ !== "adcp-gov-revocation+jws" || typeof header.kid !== "string" || // Directory keys are Ed25519 or RSA-PSS under the profile (adcp#7894).
+          header.alg !== "EdDSA" && header.alg !== "PS512")
             continue;
           await this.options.directory.resolve(header.kid, origin);
           const checked = this.options.directory.getVerifiedDirectory(origin);
@@ -213,7 +214,7 @@ class OriginRevocationResolver {
           const jwk = checked.keys.find((key) => key.kid === header.kid);
           if (!jwk) continue;
           const result = await compactVerify(token, await importJWK(jwk, header.alg), {
-            algorithms: ["EdDSA", "ES256"]
+            algorithms: [header.alg]
           });
           verifiedPayload = result.payload;
           break;
@@ -274,8 +275,8 @@ async function createSignedOriginRevocationList(snapshot, privateKey) {
   const kid = jwkThumbprint(privateKey);
   if (privateKey.kid && privateKey.kid !== kid)
     throw new TypeError("Revocation signing kid must be the JWK thumbprint");
-  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.crv === "P-256" ? "ES256" : void 0;
-  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or P-256 key");
+  const alg = privateKey.crv === "Ed25519" ? "EdDSA" : privateKey.kty === "RSA" ? "PS512" : void 0;
+  if (!alg || !privateKey.d) throw new TypeError("Revocations require a private Ed25519 or RSA key");
   return new CompactSign(Buffer.from(JSON.stringify(snapshot))).setProtectedHeader({ alg, kid, typ: "adcp-gov-revocation+jws" }).sign(await importJWK(privateKey, alg));
 }
 export {

package/dist/lib/index.d.mts

@@ -1,3 +1,5 @@
+export * from './identifiers.mjs';
+export type { ResolveIdentifiersAllOptions, ResolveIdentifierOutcome } from './registry/index.mjs';
 export { RegistryClient, RegistryRequestError, isRegistryRequestError, RegistrySync, PropertyRegistry, InMemoryCursorStore, FileCursorStore, buildCommunityMirrorAdagents, } from './registry/index.mjs';
 export type { RegistrySyncConfig, RegistrySyncState, RegistrySyncTransport, RegistrySyncEvents, AgentFilter, RegistrySyncProperty, CursorStore, PropertyRegistryConfig, FeedStreamQuery, FeedStreamMessage, FeedHeartbeat, FeedStreamErrorData, OpenFeedStreamOptions, FeedFreshness, } from './registry/index.mjs';
 export { openFeedStream, parseSseStream, sanitizeStreamText, DEFAULT_MAX_SSE_FRAME_BYTES, FeedStreamError, FeedStreamUnsupportedError, FeedStreamCursorExpiredError, FeedStreamHttpError, FeedStreamParseError, } from './registry/index.mjs';
@@ -57,7 +59,7 @@ export { MemoryStorage, createMemoryStorage, createMemoryStorageConfig } from '.
 export { ADCPError, TaskTimeoutError, MaxClarificationError, DeferredTaskError, TaskAbortedError, AgentNotFoundError, UnsupportedTaskError, ProtocolError, ValidationError as ADCPValidationError, // Rename to avoid conflict
 MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, BuyerSetupError, AccountNotFoundError, AccountSetupRequiredError, AccountPaymentRequiredError, AccountNotProvisionedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors/index.mjs';
 export type { OAuthMetadataInfo, ClientPreflightAdcpErrorInfo, ClientPreflightAdcpErrorRecovery, FeatureUnsupportedErrorOptions, ProtocolFeatureUnsupportedErrorOptions, ActionNotAllowedErrorDetails, ActionNotAllowedReasonValue, ActionNotAllowedAttemptedAction, ActionNotAllowedAvailableAction, ActionNotAllowedRecovery, } from './errors/index.mjs';
-export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionId, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyUpdateFieldAction, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, StructuredOnlyMediaBuyAction, ResolvedTargetingInput, TargetingInputFor, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy/index.mjs';
+export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionId, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyUpdateFieldAction, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPolicyResolvedProperty, ProductPropertyPolicyIdentifier, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, StructuredOnlyMediaBuyAction, ResolvedTargetingInput, TargetingInputFor, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy/index.mjs';
 export { ACTIONS_BY_FIELD, LEGACY_COARSE_ACTIONS, STRUCTURED_ONLY_MEDIA_BUY_ACTIONS, UPDATE_FIELDS_BY_ACTION, applyTargetingInput, hasTargetingClears, resolveTargetingInput, canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, findAvailableAction, getActionForMutation, getAvailableActions, getRollupParent, ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, preflightUpdateMediaBuy, recoveryForModeMismatch, validateProductsAgainstPropertyPolicy, } from './media-buy/index.mjs';
 export { InputRequiredError } from './core/TaskExecutor.mjs';
 export { generateIdempotencyKey, isMutatingTask, requestUsesIdempotency, isValidIdempotencyKey, useIdempotencyKey, redactIdempotencyKey, IDEMPOTENCY_KEY_PATTERN, MUTATING_TASKS, } from './utils/idempotency.mjs';

package/dist/lib/index.d.ts

@@ -1,3 +1,5 @@
+export * from './identifiers';
+export type { ResolveIdentifiersAllOptions, ResolveIdentifierOutcome } from './registry';
 export { RegistryClient, RegistryRequestError, isRegistryRequestError, RegistrySync, PropertyRegistry, InMemoryCursorStore, FileCursorStore, buildCommunityMirrorAdagents, } from './registry';
 export type { RegistrySyncConfig, RegistrySyncState, RegistrySyncTransport, RegistrySyncEvents, AgentFilter, RegistrySyncProperty, CursorStore, PropertyRegistryConfig, FeedStreamQuery, FeedStreamMessage, FeedHeartbeat, FeedStreamErrorData, OpenFeedStreamOptions, FeedFreshness, } from './registry';
 export { openFeedStream, parseSseStream, sanitizeStreamText, DEFAULT_MAX_SSE_FRAME_BYTES, FeedStreamError, FeedStreamUnsupportedError, FeedStreamCursorExpiredError, FeedStreamHttpError, FeedStreamParseError, } from './registry';
@@ -57,7 +59,7 @@ export { MemoryStorage, createMemoryStorage, createMemoryStorageConfig } from '.
 export { ADCPError, TaskTimeoutError, MaxClarificationError, DeferredTaskError, TaskAbortedError, AgentNotFoundError, UnsupportedTaskError, ProtocolError, ValidationError as ADCPValidationError, // Rename to avoid conflict
 MissingInputHandlerError, InvalidContextError, ConfigurationError, AuthenticationCredentialsRejectedError, AuthenticationRequiredError, FeatureUnsupportedError, ProtocolFeatureUnsupportedError, UnsupportedBuyingModeError, AccountRequiredError, AccountPendingApprovalError, AccountAmbiguousError, BuyerSetupError, AccountNotFoundError, AccountSetupRequiredError, AccountPaymentRequiredError, AccountNotProvisionedError, SDK_ERROR_TO_PROTOCOL_ERROR_CODE, VersionUnsupportedError, IdempotencyConflictError, IdempotencyExpiredError, ResponseTooLargeError, ActionNotAllowedError, adcpErrorToTypedError, getClientPreflightAdcpError, isADCPError, isErrorOfType, extractErrorInfo, is401Error, mapSdkErrorCodeToProtocolErrorCode, } from './errors';
 export type { OAuthMetadataInfo, ClientPreflightAdcpErrorInfo, ClientPreflightAdcpErrorRecovery, FeatureUnsupportedErrorOptions, ProtocolFeatureUnsupportedErrorOptions, ActionNotAllowedErrorDetails, ActionNotAllowedReasonValue, ActionNotAllowedAttemptedAction, ActionNotAllowedAvailableAction, ActionNotAllowedRecovery, } from './errors';
-export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionId, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyUpdateFieldAction, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, StructuredOnlyMediaBuyAction, ResolvedTargetingInput, TargetingInputFor, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy';
+export type { ActionNotAllowedDetails, ActionNotAllowedReason, AvailableActionsResult, AvailableActionsSource, DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, LegacyCoarseAction, MediaBuyActionContext, MediaBuyActionId, MediaBuyActionMode, MediaBuyAvailableAction, MediaBuyMutationDirection, MediaBuyMutationScope, MediaBuyUpdateFieldAction, MediaBuyValidAction, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPolicyResolvedProperty, ProductPropertyPolicyIdentifier, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, PreflightResult, ResolvedAction, SLAWindow, SlaWindow, StructuredOnlyMediaBuyAction, ResolvedTargetingInput, TargetingInputFor, ValidateProductsAgainstPropertyPolicyOptions, UpdateFieldEntry, UpdateMediaBuyRequestLike, } from './media-buy';
 export { ACTIONS_BY_FIELD, LEGACY_COARSE_ACTIONS, STRUCTURED_ONLY_MEDIA_BUY_ACTIONS, UPDATE_FIELDS_BY_ACTION, applyTargetingInput, hasTargetingClears, resolveTargetingInput, canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, findAvailableAction, getActionForMutation, getAvailableActions, getRollupParent, ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, preflightUpdateMediaBuy, recoveryForModeMismatch, validateProductsAgainstPropertyPolicy, } from './media-buy';
 export { InputRequiredError } from './core/TaskExecutor';
 export { generateIdempotencyKey, isMutatingTask, requestUsesIdempotency, isValidIdempotencyKey, useIdempotencyKey, redactIdempotencyKey, IDEMPOTENCY_KEY_PATTERN, MUTATING_TASKS, } from './utils/idempotency';

package/dist/lib/index.js

@@ -735,6 +735,7 @@ __export(index_exports, {
   withSpan: () => import_observability.withSpan
 });
 module.exports = __toCommonJS(index_exports);
+__reExport(index_exports, require('./identifiers.js'), module.exports);
 var import_registry = require('./registry/index.js');
 var import_registry2 = require('./registry/index.js');
 var import_brand = require('./brand/index.js');
@@ -1583,6 +1584,7 @@ function createAdCPClientFromEnv() {
   withAdditiveCanonicalFormatOptions,
   withMCPConnectionScope,
   withSpan,
+  ...require('./identifiers.js'),
   ...require('./principal/index.js'),
   ...require('./handlers/types.js'),
   ...require('./negotiation/index.js'),

package/dist/lib/index.mjs

@@ -1,3 +1,4 @@
+export * from "./identifiers.mjs";
 import {
   RegistryClient,
   RegistryRequestError,

package/dist/lib/media-buy/index.d.mts

@@ -4,7 +4,7 @@ export { LEGACY_COARSE_ACTIONS } from './types.mjs';
 export type { LiveMediaBuyAction } from './action-types.mjs';
 export type { AvailableActionsResult, AvailableActionsSource } from './available-actions.mjs';
 export { findAvailableAction, getAvailableActions, getRollupParent, __resetValidActionsWarningForTests, } from './available-actions.mjs';
-export type { BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, ValidateProductsAgainstPropertyPolicyOptions, } from './property-policy.mjs';
+export type { BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPolicyResolvedProperty, ProductPropertyPolicyIdentifier, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, ValidateProductsAgainstPropertyPolicyOptions, } from './property-policy.mjs';
 export { ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, validateProductsAgainstPropertyPolicy, } from './property-policy.mjs';
 export type { DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, MediaBuyMutationDirection, MediaBuyMutationScope, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, PreflightResult, ResolvedAction, } from './preflight.mjs';
 export { canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, getActionForMutation, preflightUpdateMediaBuy, recoveryForModeMismatch, } from './preflight.mjs';

package/dist/lib/media-buy/index.d.ts

@@ -4,7 +4,7 @@ export { LEGACY_COARSE_ACTIONS } from './types';
 export type { LiveMediaBuyAction } from './action-types';
 export type { AvailableActionsResult, AvailableActionsSource } from './available-actions';
 export { findAvailableAction, getAvailableActions, getRollupParent, __resetValidActionsWarningForTests, } from './available-actions';
-export type { BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, ValidateProductsAgainstPropertyPolicyOptions, } from './property-policy';
+export type { BuyerPropertyPolicy, NormalizedPolicyDomain, ProductPolicyProductLike, ProductPolicyResolvedProperty, ProductPropertyPolicyIdentifier, ProductPropertyPolicyDiagnostic, ProductPropertyPolicyDiagnosticCode, ProductPropertyPolicyDiagnosticSeverity, ProductPropertyPolicyMode, ProductPropertyPolicySelectorBehavior, ProductPropertyPolicyValidationResult, ValidateProductsAgainstPropertyPolicyOptions, } from './property-policy';
 export { ProductPropertyPolicyError, normalizeDomainForPropertyPolicy, validateProductsAgainstPropertyPolicy, } from './property-policy';
 export type { DecomposedUpdateMediaBuy, DecomposedUpdateMediaBuyMutation, MediaBuyMutationDirection, MediaBuyMutationScope, ModeMismatchRecovery, PreflightAllowed, PreflightDenial, PreflightDenied, PreflightResult, ResolvedAction, } from './preflight';
 export { canAddPackages, canCancel, canDecreaseBudget, canExtendFlight, canIncreaseBudget, canPause, canReallocateBudget, canRemoveCreative, canRemovePackages, canReplaceCreative, canResume, canShortenFlight, canUpdateCreativeAssignments, canUpdateFlightDates, canUpdateFrequencyCaps, canUpdatePacing, canUpdateTargeting, decomposeUpdateMediaBuy, getActionForMutation, preflightUpdateMediaBuy, recoveryForModeMismatch, } from './preflight';

package/dist/lib/media-buy/property-policy.d.mts

@@ -1,3 +1,4 @@
+export declare function isSupportedPropertyIdentifierType(type: string): boolean;
 export type ProductPropertyPolicyMode = 'audit' | 'filter' | 'reject_response';
 export type ProductPropertyPolicySelectorBehavior = 'allow' | 'flag' | 'reject';
 export interface BuyerPropertyPolicy {
@@ -10,6 +11,13 @@ export interface BuyerPropertyPolicy {
      * `*.example.com` matches subdomains only).
      */
     allowedPropertyIdentifiers?: readonly ProductPropertyPolicyIdentifier[];
+    /**
+     * Complete publisher catalogs, keyed by canonical publisher domain. Enables
+     * app/CTV identifier matching for all/by_id/by_tag selectors. Omitted keys
+     * mean unresolved metadata; an empty array means a known empty catalog.
+     * Property IDs remain publisher-scoped and are never treated as app IDs.
+     */
+    publisherProperties?: Readonly<Record<string, readonly ProductPolicyResolvedProperty[] | undefined>>;
     /**
      * Require products to match the allowed domain/identifier set even when that
      * set is empty. Used when a request property_list resolves successfully to
@@ -56,7 +64,12 @@ export interface ProductPropertyPolicyIdentifier {
     type: string;
     value: string;
 }
-export type ProductPropertyPolicyDiagnosticCode = 'outside_property_list' | 'excluded_domain' | 'excluded_property_id' | 'missing_publisher_properties' | 'unresolved_tag_selector' | 'unknown_selector' | 'malformed_publisher_domain';
+export interface ProductPolicyResolvedProperty {
+    property_id?: string;
+    identifiers: readonly ProductPropertyPolicyIdentifier[];
+    tags?: readonly string[];
+}
+export type ProductPropertyPolicyDiagnosticCode = 'outside_property_list' | 'excluded_domain' | 'excluded_property_id' | 'missing_publisher_properties' | 'unresolved_tag_selector' | 'unknown_selector' | 'malformed_publisher_domain' | 'unresolved_property_identifiers' | 'excluded_resolved_property';
 export type ProductPropertyPolicyDiagnosticSeverity = 'rejected' | 'flagged';
 export interface ProductPropertyPolicyDiagnostic {
     code: ProductPropertyPolicyDiagnosticCode;
@@ -75,6 +88,7 @@ export interface ProductPropertyPolicyDiagnostic {
     matched_excluded_domain?: string;
     property_ids?: string[];
     matched_property_ids?: string[];
+    identifier_types?: string[];
 }
 export interface ProductPropertyPolicyValidationResult<TProduct extends ProductPolicyProductLike> {
     mode: ProductPropertyPolicyMode;

package/dist/lib/media-buy/property-policy.d.ts

@@ -1,3 +1,4 @@
+export declare function isSupportedPropertyIdentifierType(type: string): boolean;
 export type ProductPropertyPolicyMode = 'audit' | 'filter' | 'reject_response';
 export type ProductPropertyPolicySelectorBehavior = 'allow' | 'flag' | 'reject';
 export interface BuyerPropertyPolicy {
@@ -10,6 +11,13 @@ export interface BuyerPropertyPolicy {
      * `*.example.com` matches subdomains only).
      */
     allowedPropertyIdentifiers?: readonly ProductPropertyPolicyIdentifier[];
+    /**
+     * Complete publisher catalogs, keyed by canonical publisher domain. Enables
+     * app/CTV identifier matching for all/by_id/by_tag selectors. Omitted keys
+     * mean unresolved metadata; an empty array means a known empty catalog.
+     * Property IDs remain publisher-scoped and are never treated as app IDs.
+     */
+    publisherProperties?: Readonly<Record<string, readonly ProductPolicyResolvedProperty[] | undefined>>;
     /**
      * Require products to match the allowed domain/identifier set even when that
      * set is empty. Used when a request property_list resolves successfully to
@@ -56,7 +64,12 @@ export interface ProductPropertyPolicyIdentifier {
     type: string;
     value: string;
 }
-export type ProductPropertyPolicyDiagnosticCode = 'outside_property_list' | 'excluded_domain' | 'excluded_property_id' | 'missing_publisher_properties' | 'unresolved_tag_selector' | 'unknown_selector' | 'malformed_publisher_domain';
+export interface ProductPolicyResolvedProperty {
+    property_id?: string;
+    identifiers: readonly ProductPropertyPolicyIdentifier[];
+    tags?: readonly string[];
+}
+export type ProductPropertyPolicyDiagnosticCode = 'outside_property_list' | 'excluded_domain' | 'excluded_property_id' | 'missing_publisher_properties' | 'unresolved_tag_selector' | 'unknown_selector' | 'malformed_publisher_domain' | 'unresolved_property_identifiers' | 'excluded_resolved_property';
 export type ProductPropertyPolicyDiagnosticSeverity = 'rejected' | 'flagged';
 export interface ProductPropertyPolicyDiagnostic {
     code: ProductPropertyPolicyDiagnosticCode;
@@ -75,6 +88,7 @@ export interface ProductPropertyPolicyDiagnostic {
     matched_excluded_domain?: string;
     property_ids?: string[];
     matched_property_ids?: string[];
+    identifier_types?: string[];
 }
 export interface ProductPropertyPolicyValidationResult<TProduct extends ProductPolicyProductLike> {
     mode: ProductPropertyPolicyMode;