@adcp/sdk 16.0.0-beta.7 → 16.0.0-beta.8

package/README.md

@@ -808,6 +808,23 @@ Build a registry service that:
 
 Library provides discovery logic - you add persistence layer.
 
+### Property catalog registration and errors
+
+For bulk property catalog registration, use `RegistryClient.resolveIdentifiersAll()`
+in default `resolve` mode (requires an API key and provenance); use `mode: 'lookup'`
+for read-only resolution. It splits by count and request bytes, bounds concurrency,
+honors rate-limit retry delays, and returns per-input outcomes. `saveProperty()`
+updates hosted publisher configuration; `saveProperties()` fans out those updates
+and is intended for one configuration per publisher domain. Both validate
+`publisher_domain` before HTTP. See [the property-list guide](docs/guides/PROPERTY-LISTS.md)
+for identifier validators, mixed app/CTV matching, MCP list serving, signed change
+notifications, and certification.
+
+Registry HTTP errors use `RegistryRequestError` / `isRegistryRequestError` with
+`status`, `method`, `retryAfterMs`, and bounded untrusted `details`. Do not parse
+`error.message` for HTTP status or retry timing. Local identifier validation uses
+`IdentifierValidationError`; bulk resolve failures are available in each outcome.
+
 ### Brand relationship verification
 
 Use `RegistryClient.lookupBrand()` to resolve a domain and verify its relationship to a house. The public v3 registry does not expose an ordered-chain endpoint; v3 hierarchy is one level deep.

package/dist/lib/conformance/index.d.mts

@@ -19,6 +19,8 @@
  * ```
  */
 export { runConformance } from './runConformance.mjs';
+export { runPropertyListConformance } from './property-lists.mjs';
+export type { PropertyListConformanceReport } from './property-lists.mjs';
 export { runWebhookConformance } from './webhook.mjs';
 export { seedFixtures } from './seeder.mjs';
 export { TARGETING_GEOGRAPHY_CONFORMANCE_VECTORS, buildTargetingInputConformanceVectors, runTargetingInputConformance, } from './targeting.mjs';

package/dist/lib/conformance/index.d.ts

@@ -19,6 +19,8 @@
  * ```
  */
 export { runConformance } from './runConformance';
+export { runPropertyListConformance } from './property-lists';
+export type { PropertyListConformanceReport } from './property-lists';
 export { runWebhookConformance } from './webhook';
 export { seedFixtures } from './seeder';
 export { TARGETING_GEOGRAPHY_CONFORMANCE_VECTORS, buildTargetingInputConformanceVectors, runTargetingInputConformance, } from './targeting';

package/dist/lib/conformance/index.js

@@ -29,12 +29,14 @@ __export(conformance_exports, {
   UPDATE_TIER_TOOLS: () => import_types.UPDATE_TIER_TOOLS,
   buildTargetingInputConformanceVectors: () => import_targeting.buildTargetingInputConformanceVectors,
   runConformance: () => import_runConformance.runConformance,
+  runPropertyListConformance: () => import_property_lists.runPropertyListConformance,
   runTargetingInputConformance: () => import_targeting.runTargetingInputConformance,
   runWebhookConformance: () => import_webhook.runWebhookConformance,
   seedFixtures: () => import_seeder.seedFixtures
 });
 module.exports = __toCommonJS(conformance_exports);
 var import_runConformance = require('./runConformance.js');
+var import_property_lists = require('./property-lists.js');
 var import_webhook = require('./webhook.js');
 var import_seeder = require('./seeder.js');
 var import_targeting = require('./targeting.js');
@@ -52,6 +54,7 @@ var import_types = require('./types.js');
   UPDATE_TIER_TOOLS,
   buildTargetingInputConformanceVectors,
   runConformance,
+  runPropertyListConformance,
   runTargetingInputConformance,
   runWebhookConformance,
   seedFixtures

package/dist/lib/conformance/index.mjs

@@ -1,4 +1,5 @@
 import { runConformance } from "./runConformance.mjs";
+import { runPropertyListConformance } from "./property-lists.mjs";
 import { runWebhookConformance } from "./webhook.mjs";
 import { seedFixtures } from "./seeder.mjs";
 import {
@@ -28,6 +29,7 @@ export {
   UPDATE_TIER_TOOLS,
   buildTargetingInputConformanceVectors,
   runConformance,
+  runPropertyListConformance,
   runTargetingInputConformance,
   runWebhookConformance,
   seedFixtures

package/dist/lib/conformance/property-lists.d.mts

@@ -0,0 +1,14 @@
+import type { PropertyListReference } from '../types/tools.generated.mjs';
+import { type ResolveListOptions } from '../server/targeting-helpers.mjs';
+export interface PropertyListConformanceReport {
+    totalRuns: number;
+    totalFailures: number;
+    results: Array<{
+        index: number;
+        ok: boolean;
+        identifierCount?: number;
+        code?: string;
+    }>;
+}
+/** Certify buyer-issued references using the same MCP resolver sellers use, with caching disabled. */
+export declare function runPropertyListConformance(references: readonly PropertyListReference[], options?: ResolveListOptions): Promise<PropertyListConformanceReport>;

package/dist/lib/conformance/property-lists.d.ts

@@ -0,0 +1,14 @@
+import type { PropertyListReference } from '../types/tools.generated';
+import { type ResolveListOptions } from '../server/targeting-helpers';
+export interface PropertyListConformanceReport {
+    totalRuns: number;
+    totalFailures: number;
+    results: Array<{
+        index: number;
+        ok: boolean;
+        identifierCount?: number;
+        code?: string;
+    }>;
+}
+/** Certify buyer-issued references using the same MCP resolver sellers use, with caching disabled. */
+export declare function runPropertyListConformance(references: readonly PropertyListReference[], options?: ResolveListOptions): Promise<PropertyListConformanceReport>;

package/dist/lib/conformance/property-lists.js

@@ -0,0 +1,45 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var property_lists_exports = {};
+__export(property_lists_exports, {
+  runPropertyListConformance: () => runPropertyListConformance
+});
+module.exports = __toCommonJS(property_lists_exports);
+var import_targeting_helpers = require('../server/targeting-helpers.js');
+async function runPropertyListConformance(references, options = {}) {
+  const results = [];
+  for (const [index, reference] of references.entries()) {
+    try {
+      const resolved = await (0, import_targeting_helpers.resolvePropertyList)(reference, {
+        ...options,
+        cache: false,
+        strictResponseValidation: true
+      });
+      if (resolved.listId !== reference.list_id) throw new Error("property_list_identity_mismatch");
+      results.push({ index, ok: true, identifierCount: resolved.identifiers.length });
+    } catch {
+      results.push({ index, ok: false, code: "property_list_reference_unresolvable" });
+    }
+  }
+  return { totalRuns: results.length, totalFailures: results.filter((result) => !result.ok).length, results };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  runPropertyListConformance
+});

package/dist/lib/conformance/property-lists.mjs

@@ -0,0 +1,21 @@
+import { resolvePropertyList } from "../server/targeting-helpers.mjs";
+async function runPropertyListConformance(references, options = {}) {
+  const results = [];
+  for (const [index, reference] of references.entries()) {
+    try {
+      const resolved = await resolvePropertyList(reference, {
+        ...options,
+        cache: false,
+        strictResponseValidation: true
+      });
+      if (resolved.listId !== reference.list_id) throw new Error("property_list_identity_mismatch");
+      results.push({ index, ok: true, identifierCount: resolved.identifiers.length });
+    } catch {
+      results.push({ index, ok: false, code: "property_list_reference_unresolvable" });
+    }
+  }
+  return { totalRuns: results.length, totalFailures: results.filter((result) => !result.ok).length, results };
+}
+export {
+  runPropertyListConformance
+};

package/dist/lib/conformance/runConformance.js

@@ -23,6 +23,7 @@ __export(runConformance_exports, {
 });
 module.exports = __toCommonJS(runConformance_exports);
 var import_AgentClient = require('../core/AgentClient.js');
+var import_property_lists = require('./property-lists.js');
 var import_version = require('../version.js');
 var import_types = require('./types.js');
 var import_schemaLoader = require('./schemaLoader.js');
@@ -120,6 +121,23 @@ async function runConformance(agentUrl, options = {}) {
     });
     uniformError.push(report);
   }
+  const propertyLists = options.propertyListReferences ? await (0, import_property_lists.runPropertyListConformance)(options.propertyListReferences) : void 0;
+  for (const result of propertyLists?.results ?? []) {
+    if (result.ok) continue;
+    if (failures.length >= maxFailures) {
+      droppedFailures++;
+      continue;
+    }
+    failures.push({
+      tool: "get_property_list",
+      seed,
+      shrunk: false,
+      input: { propertyListReferenceIndex: result.index },
+      response: null,
+      verdict: "invalid",
+      invariantFailures: ["Buyer-issued property-list reference could not be resolved."]
+    });
+  }
   const completedAt = /* @__PURE__ */ new Date();
   return {
     agentUrl,
@@ -131,8 +149,9 @@ async function runConformance(agentUrl, options = {}) {
     fixturesUsed: mergedFixtures,
     autoSeeded: !!options.autoSeed,
     seedWarnings,
-    totalRuns,
+    totalRuns: totalRuns + (propertyLists?.totalRuns ?? 0),
     totalFailures: failures.length + droppedFailures,
+    ...propertyLists ? { propertyLists } : {},
     droppedFailures,
     perTool,
     failures,

package/dist/lib/conformance/runConformance.mjs

@@ -1,4 +1,5 @@
 import { AgentClient } from "../core/AgentClient.mjs";
+import { runPropertyListConformance } from "./property-lists.mjs";
 import { parseAdcpMajorVersion } from "../version.mjs";
 import {
   COMPACT_LIFECYCLE_TOOLS,
@@ -105,6 +106,23 @@ async function runConformance(agentUrl, options = {}) {
     });
     uniformError.push(report);
   }
+  const propertyLists = options.propertyListReferences ? await runPropertyListConformance(options.propertyListReferences) : void 0;
+  for (const result of propertyLists?.results ?? []) {
+    if (result.ok) continue;
+    if (failures.length >= maxFailures) {
+      droppedFailures++;
+      continue;
+    }
+    failures.push({
+      tool: "get_property_list",
+      seed,
+      shrunk: false,
+      input: { propertyListReferenceIndex: result.index },
+      response: null,
+      verdict: "invalid",
+      invariantFailures: ["Buyer-issued property-list reference could not be resolved."]
+    });
+  }
   const completedAt = /* @__PURE__ */ new Date();
   return {
     agentUrl,
@@ -116,8 +134,9 @@ async function runConformance(agentUrl, options = {}) {
     fixturesUsed: mergedFixtures,
     autoSeeded: !!options.autoSeed,
     seedWarnings,
-    totalRuns,
+    totalRuns: totalRuns + (propertyLists?.totalRuns ?? 0),
     totalFailures: failures.length + droppedFailures,
+    ...propertyLists ? { propertyLists } : {},
     droppedFailures,
     perTool,
     failures,

package/dist/lib/conformance/types.d.mts

@@ -32,6 +32,8 @@ export declare const DEFAULT_TOOLS: readonly ConformanceToolName[];
 /** Tier 1 + Tier 2 + Tier 3. Used when `autoSeed` is true or fixtures were supplied. */
 export declare const DEFAULT_TOOLS_WITH_UPDATES: readonly ConformanceToolName[];
 export interface RunConformanceOptions {
+    /** Buyer-issued references to certify through the seller MCP resolution path (without cached results). */
+    propertyListReferences?: readonly import('../types/tools.generated.mjs').PropertyListReference[];
     /** Seed for reproducible runs. Omit for a random seed. */
     seed?: number;
     /** Subset of tools to fuzz. Defaults to the full stateless tier. */
@@ -210,6 +212,7 @@ export interface ConformanceToolStats {
     skipReason?: SkipReason;
 }
 export interface ConformanceReport {
+    propertyLists?: import('./property-lists.mjs').PropertyListConformanceReport;
     agentUrl: string;
     seed: number;
     /** Schema version the fuzzer loaded. Pinned so a report is replayable. */

package/dist/lib/conformance/types.d.ts

@@ -32,6 +32,8 @@ export declare const DEFAULT_TOOLS: readonly ConformanceToolName[];
 /** Tier 1 + Tier 2 + Tier 3. Used when `autoSeed` is true or fixtures were supplied. */
 export declare const DEFAULT_TOOLS_WITH_UPDATES: readonly ConformanceToolName[];
 export interface RunConformanceOptions {
+    /** Buyer-issued references to certify through the seller MCP resolution path (without cached results). */
+    propertyListReferences?: readonly import('../types/tools.generated').PropertyListReference[];
     /** Seed for reproducible runs. Omit for a random seed. */
     seed?: number;
     /** Subset of tools to fuzz. Defaults to the full stateless tier. */
@@ -210,6 +212,7 @@ export interface ConformanceToolStats {
     skipReason?: SkipReason;
 }
 export interface ConformanceReport {
+    propertyLists?: import('./property-lists').PropertyListConformanceReport;
     agentUrl: string;
     seed: number;
     /** Schema version the fuzzer loaded. Pinned so a report is replayable. */

package/dist/lib/core/SingleAgentClient.d.mts

@@ -18,7 +18,7 @@ import { type AgentDiscoveryCacheConfig } from './agent-discovery-cache.mjs';
 import { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage } from './buyer-account-registry.mjs';
 import type { ProductCache } from './product-cache.mjs';
 import { type ResolveAccountOptions, type ResolveAccountResult } from './account-resolution.mjs';
-import { type BuyerPropertyPolicy, type ProductPropertyPolicyMode } from '../media-buy/property-policy.mjs';
+import { type BuyerPropertyPolicy, type ProductPolicyResolvedProperty, type ProductPropertyPolicyMode } from '../media-buy/property-policy.mjs';
 import { type ResolveListOptions } from '../server/targeting-helpers.mjs';
 import { type CanonicalCreateMediaBuyInput, type CanonicalCreativeResponse, type CanonicalGetProductsRequest, type CanonicalGetProductsResponse, type CanonicalListCreativesRequest, type CanonicalListCreativesResponse, type CanonicalPreviewCreativeRequest, type CanonicalPreviewCreativeResponse, type CanonicalSyncCreativesRequest, type CanonicalUpdateMediaBuyRequest, type CreativeFormatWireMode, type SyncCreativeFormatProjection } from '../v2/projection/creative-delivery.mjs';
 import type { LegacyFormatConverter } from '../v2/projection/v1-to-v2.mjs';
@@ -63,6 +63,16 @@ export declare class UnsupportedFeatureError extends Error {
     constructor(feature: string, serverVersion: 'v2' | 'v3', message?: string);
 }
 export interface ClientProductPropertyPolicy extends BuyerPropertyPolicy {
+    /** Resolve a complete publisher catalog for app/CTV selector matching. Failures follow unknownSelectorBehavior. */
+    resolvePublisherProperties?: (publisherDomain: string, options?: {
+        signal?: AbortSignal;
+    }) => Promise<readonly ProductPolicyResolvedProperty[] | undefined>;
+    /** Maximum distinct catalog lookups per response. Overflow follows unknownSelectorBehavior. Default: 100. */
+    maxPublisherLookups?: number;
+    /** Per-catalog timeout. The hook receives an abort signal. Default: 10 seconds. */
+    publisherLookupTimeoutMs?: number;
+    /** Total catalog-lookup budget per response. Unfinished lookups stay unknown. Default: 10 seconds. */
+    publisherLookupBudgetMs?: number;
     /**
      * Enforcement mode for completed `get_products` responses.
      *
@@ -72,8 +82,8 @@ export interface ClientProductPropertyPolicy extends BuyerPropertyPolicy {
      */
     mode?: ProductPropertyPolicyMode;
     /**
-     * When true, a `get_products` request carrying `property_list` is resolved
-     * and used as an allow-list for the returned products. Defaults to true.
+     * Resolve `filters.property_list` (AdCP 3.2) or deprecated `property_list`
+     * as an allow-list. Conflicting references fail closed. Defaults to true.
      */
     enforceRequestPropertyList?: boolean;
     /**

package/dist/lib/core/SingleAgentClient.d.ts

@@ -18,7 +18,7 @@ import { type AgentDiscoveryCacheConfig } from './agent-discovery-cache';
 import { BuyerAccountRegistry, type AccountPolicy, type BuyerAccountStorage } from './buyer-account-registry';
 import type { ProductCache } from './product-cache';
 import { type ResolveAccountOptions, type ResolveAccountResult } from './account-resolution';
-import { type BuyerPropertyPolicy, type ProductPropertyPolicyMode } from '../media-buy/property-policy';
+import { type BuyerPropertyPolicy, type ProductPolicyResolvedProperty, type ProductPropertyPolicyMode } from '../media-buy/property-policy';
 import { type ResolveListOptions } from '../server/targeting-helpers';
 import { type CanonicalCreateMediaBuyInput, type CanonicalCreativeResponse, type CanonicalGetProductsRequest, type CanonicalGetProductsResponse, type CanonicalListCreativesRequest, type CanonicalListCreativesResponse, type CanonicalPreviewCreativeRequest, type CanonicalPreviewCreativeResponse, type CanonicalSyncCreativesRequest, type CanonicalUpdateMediaBuyRequest, type CreativeFormatWireMode, type SyncCreativeFormatProjection } from '../v2/projection/creative-delivery';
 import type { LegacyFormatConverter } from '../v2/projection/v1-to-v2';
@@ -63,6 +63,16 @@ export declare class UnsupportedFeatureError extends Error {
     constructor(feature: string, serverVersion: 'v2' | 'v3', message?: string);
 }
 export interface ClientProductPropertyPolicy extends BuyerPropertyPolicy {
+    /** Resolve a complete publisher catalog for app/CTV selector matching. Failures follow unknownSelectorBehavior. */
+    resolvePublisherProperties?: (publisherDomain: string, options?: {
+        signal?: AbortSignal;
+    }) => Promise<readonly ProductPolicyResolvedProperty[] | undefined>;
+    /** Maximum distinct catalog lookups per response. Overflow follows unknownSelectorBehavior. Default: 100. */
+    maxPublisherLookups?: number;
+    /** Per-catalog timeout. The hook receives an abort signal. Default: 10 seconds. */
+    publisherLookupTimeoutMs?: number;
+    /** Total catalog-lookup budget per response. Unfinished lookups stay unknown. Default: 10 seconds. */
+    publisherLookupBudgetMs?: number;
     /**
      * Enforcement mode for completed `get_products` responses.
      *
@@ -72,8 +82,8 @@ export interface ClientProductPropertyPolicy extends BuyerPropertyPolicy {
      */
     mode?: ProductPropertyPolicyMode;
     /**
-     * When true, a `get_products` request carrying `property_list` is resolved
-     * and used as an allow-list for the returned products. Defaults to true.
+     * Resolve `filters.property_list` (AdCP 3.2) or deprecated `property_list`
+     * as an allow-list. Conflicting references fail closed. Defaults to true.
      */
     enforceRequestPropertyList?: boolean;
     /**

package/dist/lib/core/SingleAgentClient.js

@@ -696,7 +696,9 @@ function productIdForPricingDiagnostics(product) {
   return typeof id === "string" ? id : void 0;
 }
 function propertyListReferenceFromRequest(params) {
-  const value = params.property_list;
+  const filters = params.filters;
+  const nested = filters && typeof filters === "object" && !Array.isArray(filters) && Object.hasOwn(filters, "property_list") && filters.property_list !== void 0;
+  const value = nested ? filters.property_list : params.property_list;
   if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
   const ref = value;
   if (typeof ref.agent_url !== "string" || typeof ref.list_id !== "string") return void 0;
@@ -709,21 +711,37 @@ function propertyListReferenceFromRequest(params) {
 function productPolicyRequestSnapshot(requestParams) {
   const account = canonicalAccountRoutingSnapshot(requestParams.account);
   const propertyList = propertyListReferenceFromRequest(requestParams);
+  const referenceError = propertyListReferenceError(requestParams);
   return Object.freeze({
     ...account ? { account } : {},
-    ...propertyList ? { property_list: Object.freeze(propertyList) } : {}
+    ...propertyList ? { property_list: Object.freeze(propertyList) } : {},
+    ...referenceError ? { property_list_error: referenceError } : {}
   });
 }
+function propertyListReferenceError(params) {
+  if (typeof params.property_list_error === "string") return params.property_list_error;
+  const filters = params.filters;
+  if (params.property_list !== void 0 && !propertyListReferenceFromRequest({ property_list: params.property_list }))
+    return "property_list_invalid_reference";
+  if (!filters || typeof filters !== "object" || Array.isArray(filters) || !Object.hasOwn(filters, "property_list") || filters.property_list === void 0)
+    return void 0;
+  const nested = propertyListReferenceFromRequest(params);
+  if (!nested) return "property_list_invalid_reference";
+  if (params.property_list !== void 0) {
+    const legacy = propertyListReferenceFromRequest({ property_list: params.property_list });
+    if (!legacy || nested.agent_url !== legacy.agent_url || nested.list_id !== legacy.list_id || nested.auth_token !== legacy.auth_token) {
+      return "property_list_conflicting_references";
+    }
+  }
+  return void 0;
+}
 function hasProductPropertyPolicyRules(policy) {
   return Boolean(
     policy.allowedDomains?.length || policy.allowedPropertyIdentifiers?.length || policy.requireAllowedPropertyMatch || policy.excludedDomains?.length || policy.excludedPropertyIds?.length || policy.strict || policy.unknownSelectorBehavior || policy.missingPublisherPropertiesBehavior
   );
 }
-function comparablePropertyIdentifiers(identifiers) {
-  return identifiers.filter((identifier) => identifier.type === "domain" || identifier.type === "subdomain").map((identifier) => ({ type: identifier.type, value: identifier.value }));
-}
 function unsupportedPropertyIdentifiers(identifiers) {
-  return identifiers.filter((identifier) => identifier.type !== "domain" && identifier.type !== "subdomain").map((identifier) => ({ type: identifier.type }));
+  return identifiers.filter((identifier) => !(0, import_property_policy.isSupportedPropertyIdentifierType)(identifier.type)).map((identifier) => ({ type: identifier.type }));
 }
 function sanitizeDiagnosticUrl(value) {
   try {
@@ -1320,8 +1338,17 @@ class SingleAgentClient {
   }
   assertDurablePropertyListCredentialSupported(taskType, requestParams) {
     if (!this.config.deferredStorage || taskType !== "get_products") return;
-    const propertyList = propertyListReferenceFromRequest(requestParams);
-    if (!propertyList?.auth_token) return;
+    const filters = requestParams.filters;
+    const references = [
+      requestParams.property_list,
+      filters && typeof filters === "object" ? filters.property_list : void 0
+    ];
+    const hasCredential = references.some((reference) => {
+      if (!reference || typeof reference !== "object") return false;
+      const token = reference.auth_token;
+      return token !== void 0 && token !== null && token !== "";
+    });
+    if (!hasCredential) return;
     const policyConfig = this.config.validation?.productPropertyPolicy;
     if (policyConfig === false || policyConfig?.enforceRequestPropertyList === false) return;
     throw new import_errors.ConfigurationError(
@@ -4132,39 +4159,40 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       message = "Property list not adhered to",
       enforceRequestPropertyList = true,
       propertyListResolveOptions,
+      resolvePublisherProperties,
+      maxPublisherLookups = 100,
+      publisherLookupTimeoutMs = 1e4,
+      publisherLookupBudgetMs = 1e4,
       ...explicitPolicy
     } = policyConfig || {};
     const policy = {
       ...explicitPolicy
     };
     let resolvedRequestPropertyList;
-    if (requestPropertyList && enforceRequestPropertyList) {
+    const referenceError = propertyListReferenceError(requestParams);
+    if ((requestPropertyList || referenceError) && enforceRequestPropertyList) {
       try {
+        if (referenceError) throw new Error(referenceError);
         const resolved = await (0, import_targeting_helpers.resolvePropertyList)(requestPropertyList, propertyListResolveOptions);
-        const comparableIdentifiers = comparablePropertyIdentifiers(resolved.identifiers);
         const unsupportedIdentifiers = unsupportedPropertyIdentifiers(resolved.identifiers);
-        if (unsupportedIdentifiers.length > 0) {
-          throw new Error("property_list_unsupported_identifier_types");
-        }
-        if (comparableIdentifiers.length > 0 || resolved.identifiers.length === 0) {
-          policy.allowedPropertyIdentifiers = [...policy.allowedPropertyIdentifiers ?? [], ...comparableIdentifiers];
-          policy.requireAllowedPropertyMatch = true;
-        }
+        policy.allowedPropertyIdentifiers = [...policy.allowedPropertyIdentifiers ?? [], ...resolved.identifiers];
+        policy.requireAllowedPropertyMatch = true;
         policy.strict = policy.strict ?? true;
         resolvedRequestPropertyList = {
           listId: resolved.listId,
           agentUrl: resolved.agentUrl,
           identifierCount: resolved.identifiers.length,
+          unsupportedIdentifierTypes: [...new Set(unsupportedIdentifiers.map((identifier) => identifier.type))],
           ...resolved.cacheValidUntil ? { cacheValidUntil: resolved.cacheValidUntil } : {}
         };
       } catch (err) {
         const errorCode = propertyListResolutionErrorCode(err);
-        const diagnosticAgentUrl = sanitizeDiagnosticUrl(requestPropertyList.agent_url);
+        const diagnosticAgentUrl = requestPropertyList ? sanitizeDiagnosticUrl(requestPropertyList.agent_url) : "invalid_url";
         return (0, import_match.attachMatch)({
           success: false,
           status: "failed",
           data: response,
-          error: `${message}: could not resolve property_list ${requestPropertyList.list_id}`,
+          error: `${message}: could not resolve property_list`,
           metadata: {
             ...result.metadata,
             status: "failed",
@@ -4177,7 +4205,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
               message,
               diagnostics: [],
               request_property_list: {
-                list_id: requestPropertyList.list_id,
+                list_id: requestPropertyList?.list_id ?? "invalid_reference",
                 agent_url: diagnosticAgentUrl,
                 resolution_error: errorCode
               }
@@ -4192,7 +4220,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
               mode,
               ok: false,
               request_property_list: {
-                list_id: requestPropertyList.list_id,
+                list_id: requestPropertyList?.list_id,
                 agent_url: diagnosticAgentUrl,
                 resolution_error: errorCode
               }
@@ -4202,6 +4230,65 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       }
     }
     if (!hasProductPropertyPolicyRules(policy)) return result;
+    if (resolvePublisherProperties && policy.allowedPropertyIdentifiers?.some(
+      (identifier) => identifier.type !== "domain" && identifier.type !== "subdomain"
+    )) {
+      if (!Number.isSafeInteger(maxPublisherLookups) || maxPublisherLookups < 1 || !Number.isSafeInteger(publisherLookupTimeoutMs) || publisherLookupTimeoutMs < 1 || publisherLookupTimeoutMs > 2147483647 || !Number.isSafeInteger(publisherLookupBudgetMs) || publisherLookupBudgetMs < 1 || publisherLookupBudgetMs > 2147483647) {
+        throw new import_errors.ConfigurationError("Publisher lookup limits must be positive bounded integers");
+      }
+      const { validatePublisherDomain } = await import("../identifiers.js");
+      const catalogs = Object.assign(
+        /* @__PURE__ */ Object.create(null),
+        policy.publisherProperties
+      );
+      const domains = new Set(
+        response.products.flatMap(
+          (product) => Array.isArray(product.publisher_properties) ? product.publisher_properties.flatMap(
+            (selector) => selector && typeof selector === "object" && "publisher_domain" in selector ? [selector.publisher_domain] : []
+          ) : []
+        )
+      );
+      const hosts = [
+        ...new Set(
+          [...domains].flatMap(
+            (domain) => typeof domain === "string" ? [(0, import_property_policy.normalizeDomainForPropertyPolicy)(domain)?.host] : []
+          )
+        )
+      ].filter((host) => typeof host === "string" && !Object.hasOwn(catalogs, host));
+      for (const host of hosts) catalogs[host] = void 0;
+      const lookupStartedAt = performance.now();
+      for (const host of hosts.slice(0, maxPublisherLookups)) {
+        (0, import_abort2.throwIfAborted)(taskSignal);
+        const remainingBudgetMs = publisherLookupBudgetMs - (performance.now() - lookupStartedAt);
+        if (remainingBudgetMs <= 0) break;
+        if (!validatePublisherDomain(host).ok || (0, import_net.isLikelyPrivateUrl)(`https://${host}`)) continue;
+        const controller = new AbortController();
+        const signal = taskSignal ? AbortSignal.any([taskSignal, controller.signal]) : controller.signal;
+        let timeout;
+        let budgetExpired = false;
+        try {
+          catalogs[host] = await Promise.race([
+            resolvePublisherProperties(host, { signal }),
+            new Promise((_, reject) => {
+              timeout = setTimeout(
+                () => {
+                  if (remainingBudgetMs <= publisherLookupTimeoutMs) budgetExpired = true;
+                  controller.abort();
+                  reject(new Error("publisher_catalog_timeout"));
+                },
+                Math.min(publisherLookupTimeoutMs, remainingBudgetMs)
+              );
+            })
+          ]);
+        } catch {
+          catalogs[host] = void 0;
+        } finally {
+          if (timeout) clearTimeout(timeout);
+        }
+        if (budgetExpired) break;
+      }
+      policy.publisherProperties = catalogs;
+    }
     let validation;
     try {
       validation = (0, import_property_policy.validateProductsAgainstPropertyPolicy)({
@@ -4225,6 +4312,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
           list_id: resolvedRequestPropertyList.listId,
           agent_url: sanitizeDiagnosticUrl(resolvedRequestPropertyList.agentUrl),
           identifier_count: resolvedRequestPropertyList.identifierCount,
+          unsupported_identifier_types: resolvedRequestPropertyList.unsupportedIdentifierTypes,
           ...resolvedRequestPropertyList.cacheValidUntil ? { cache_valid_until: resolvedRequestPropertyList.cacheValidUntil } : {}
         }
       } : {},