@adcp/sdk 16.3.0 → 16.5.0

package/dist/lib/core/TaskExecutor.mjs

@@ -3,7 +3,12 @@ import { dirname as __adcpDirname } from "node:path";
 import { createRequire as __adcpCreateRequire } from "node:module";
 const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
 const require2 = __adcpCreateRequire(import.meta.url);
+import { withMCPConnectionPolicy } from "../protocols/mcp-connection-policy.mjs";
 import { VersionUnsupportedError } from "../errors/index.mjs";
+import {
+  NeedsAuthorizationError,
+  hasValidatedMcpAuthorizationRequirements
+} from "../auth/oauth/authorization-required.mjs";
 import { deliveryWebhookRegistrationId } from "./webhook-registration.mjs";
 import { isAdcpVersionAtLeast } from "../utils/adcp-version-config.mjs";
 function validateIdentity33Payload(...args) {
@@ -17,6 +22,16 @@ import {
   prepareProtocolToolCall
 } from "../protocols/index.mjs";
 import { listMCPTasks } from "../protocols/mcp-tasks.mjs";
+import { ensureClientCredentialsTokens, getAgentStorage } from "../auth/oauth/index.mjs";
+import { getNonInteractiveOAuthProvider, shareNonInteractiveOAuthProvider } from "../auth/oauth/provider-cache.mjs";
+import { isLikelyPrivateUrl } from "../net/address-guards.mjs";
+import { assertSigningPolicy } from "../signing/protocol-methods.mjs";
+import {
+  buildAgentSigningContext,
+  CAPABILITY_OP,
+  ensureCapabilityLoaded,
+  signingContextStorage
+} from "../signing/client.mjs";
 import { withPreparedProtocolToolCall } from "../protocols/prepared-call-context.mjs";
 import { getAuthToken } from "../auth/index.mjs";
 import { getSignedRequestRejection } from "../protocols/signedRequestRejection.mjs";
@@ -667,7 +682,11 @@ class TaskExecutor {
    * adaptation runs, so the validator sees the same object the caller wrote.
    * Throws in strict, logs to `debugLogs` in warn, no-ops in off.
    */
-  validateRequest(taskName, params, debugLogs) {
+  validateRequest(taskName, params, debugLogs, adcpVersion) {
+    if (adcpVersion !== void 0) {
+      validateOutgoingRequest(taskName, params, this.requestValidationMode, debugLogs, adcpVersion);
+      return;
+    }
     if (this.config.experimentalIdentity33?.() && this.requestValidationMode !== "off") {
       const outcome = validateIdentity33Payload(taskName, "request", params, this.config.adcpVersion);
       if (!outcome.valid) {
@@ -1251,16 +1270,28 @@ class TaskExecutor {
     if (task && serverTaskId) task.serverTaskId = serverTaskId;
     switch (status) {
       case ADCP_STATUS.COMPLETED:
-        const completedData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+        const completedData = this.extractResponseData(
+          response,
+          debugLogs,
+          taskName,
+          serverVersion,
+          options.negotiatedAdcpVersion
+        );
         if (!deferTerminalTaskStatus) this.updateTaskStatus(taskId, "completed", completedData);
-        const operationSuccess = this.isOperationSuccess(completedData, taskName, serverVersion);
+        const operationSuccess = this.isOperationSuccess(
+          completedData,
+          taskName,
+          serverVersion,
+          options.negotiatedAdcpVersion
+        );
         const validationResult = this.validateResponseSchema(
           completedData,
           taskName,
           debugLogs,
           serverVersion,
           params,
-          refinementServedVersion
+          refinementServedVersion,
+          options.negotiatedAdcpVersion
         );
         const finalSuccess = operationSuccess && validationResult.valid;
         const finalError = !finalSuccess ? validationResult.errors.length > 0 ? `Schema validation failed: ${validationResult.errors.join("; ")}` : this.extractOperationError(completedData) : void 0;
@@ -1352,7 +1383,13 @@ class TaskExecutor {
       case ADCP_STATUS.FAILED:
       case ADCP_STATUS.REJECTED:
       case ADCP_STATUS.CANCELED: {
-        const failedData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+        const failedData = this.extractResponseData(
+          response,
+          debugLogs,
+          taskName,
+          serverVersion,
+          options.negotiatedAdcpVersion
+        );
         const failedPayload = response?.structuredContent === void 0 && response?.content === void 0 && response?.result === void 0 && response?.data != null && typeof response.data === "object" ? response.data : failedData;
         const adcpErrorInfo = extractAdcpErrorInfo(failedPayload);
         const hasStructuredError = !!adcpErrorInfo;
@@ -1380,16 +1417,28 @@ class TaskExecutor {
         };
       }
       default:
-        const defaultData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+        const defaultData = this.extractResponseData(
+          response,
+          debugLogs,
+          taskName,
+          serverVersion,
+          options.negotiatedAdcpVersion
+        );
         if (defaultData && (defaultData !== response || response.structuredContent || response.result || response.data)) {
-          const defaultSuccess = this.isOperationSuccess(defaultData, taskName, serverVersion);
+          const defaultSuccess = this.isOperationSuccess(
+            defaultData,
+            taskName,
+            serverVersion,
+            options.negotiatedAdcpVersion
+          );
           const defaultValidation = this.validateResponseSchema(
             defaultData,
             taskName,
             debugLogs,
             serverVersion,
             params,
-            refinementServedVersion
+            refinementServedVersion,
+            options.negotiatedAdcpVersion
           );
           const defaultFinalSuccess = defaultSuccess && defaultValidation.valid;
           const defaultFinalError = !defaultFinalSuccess ? defaultValidation.errors.length > 0 ? `Schema validation failed: ${defaultValidation.errors.join("; ")}` : this.extractOperationError(defaultData) : void 0;
@@ -1440,7 +1489,7 @@ class TaskExecutor {
    *
    * @internal Exposed for testing purposes
    */
-  extractResponseData(response, debugLogs, toolName, serverVersion) {
+  extractResponseData(response, debugLogs, toolName, serverVersion, negotiatedAdcpVersion) {
     const a2aState = response?.result?.status?.state;
     if (a2aState === "input-required" || a2aState === "auth-required") {
       const statusParts = response?.result?.status?.message?.parts;
@@ -1481,7 +1530,7 @@ class TaskExecutor {
       }
       const unwrapped = unwrapProtocolResponse(response, toolName, void 0, {
         filterInvalidProducts: this.config.filterInvalidProducts,
-        responseAdcpVersion: this.effectiveResponseAdcpVersion(serverVersion)
+        responseAdcpVersion: this.effectiveResponseAdcpVersion(serverVersion, negotiatedAdcpVersion)
       });
       if (response?.structuredContent) {
         this.logDebug(debugLogs, "info", "Successfully extracted MCP data", {
@@ -1512,8 +1561,12 @@ class TaskExecutor {
    * Check if extracted response data represents a successful operation.
    * Handles singular `error`, plural `errors` (AdCP schema), and `success: false`.
    */
-  isOperationSuccess(data, taskName, serverVersion) {
-    return isAdcpOperationSuccess(data, taskName, this.effectiveResponseAdcpVersion(serverVersion));
+  isOperationSuccess(data, taskName, serverVersion, negotiatedAdcpVersion) {
+    return isAdcpOperationSuccess(
+      data,
+      taskName,
+      this.effectiveResponseAdcpVersion(serverVersion, negotiatedAdcpVersion)
+    );
   }
   /**
    * Extract a human-readable error message from response data.
@@ -1544,7 +1597,13 @@ class TaskExecutor {
    * Handle 'working' status - return as valid intermediate state
    */
   async waitForWorkingCompletion(agent, taskId, taskName, params, initialResponse, messages, inputHandler, options = {}, debugLogs = [], startTime = Date.now(), serverVersion = "v3") {
-    const partialData = this.extractResponseData(initialResponse, debugLogs, taskName, serverVersion);
+    const partialData = this.extractResponseData(
+      initialResponse,
+      debugLogs,
+      taskName,
+      serverVersion,
+      options.negotiatedAdcpVersion
+    );
     const metadata = this.buildMetadata({
       taskId,
       taskName,
@@ -1568,7 +1627,13 @@ class TaskExecutor {
    * Set up submitted task with webhook
    */
   async setupSubmittedTask(agent, taskId, taskName, response, messages, options = {}, debugLogs = [], startTime = Date.now(), deferTerminalTaskStatus = false, serverVersion = "v3") {
-    const partialData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+    const partialData = this.extractResponseData(
+      response,
+      debugLogs,
+      taskName,
+      serverVersion,
+      options.negotiatedAdcpVersion
+    );
     let webhookUrl = response.webhookUrl;
     if (!webhookUrl && this.config.webhookManager) {
       webhookUrl = this.config.webhookManager.generateUrl(taskId);
@@ -2012,7 +2077,13 @@ class TaskExecutor {
     const operationRoutedContinuation = deferTerminalTaskStatus || directContinuationRecovery;
     const settlementServerTaskId = operationRoutedContinuation ? this.responseParser.getTaskId(response) : void 0;
     if (agent.protocol === "mcp" || !a2aTaskId) {
-      const partialData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+      const partialData = this.extractResponseData(
+        response,
+        debugLogs,
+        taskName,
+        serverVersion,
+        options.negotiatedAdcpVersion
+      );
       const metadata = this.buildMetadata({
         taskId,
         taskName,
@@ -2033,7 +2104,13 @@ class TaskExecutor {
       };
     }
     if (!inputHandler) {
-      const partialData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+      const partialData = this.extractResponseData(
+        response,
+        debugLogs,
+        taskName,
+        serverVersion,
+        options.negotiatedAdcpVersion
+      );
       const metadata = this.buildMetadata({
         taskId,
         taskName,
@@ -2060,6 +2137,9 @@ class TaskExecutor {
           a2aTaskId,
           serverVersion,
           ...options.wireAdcpVersion !== void 0 && { wireAdcpVersion: options.wireAdcpVersion },
+          ...options.negotiatedAdcpVersion !== void 0 && {
+            negotiatedAdcpVersion: options.negotiatedAdcpVersion
+          },
           ...options.versionEnvelope !== void 0 && { versionEnvelope: options.versionEnvelope },
           serverVersionSynthetic: this.activeTasks.get(taskId)?.serverVersionSynthetic,
           ...refinementServedVersion !== void 0 && { refinementServedVersion },
@@ -2204,6 +2284,9 @@ class TaskExecutor {
           a2aTaskId,
           serverVersion,
           ...options.wireAdcpVersion !== void 0 && { wireAdcpVersion: options.wireAdcpVersion },
+          ...options.negotiatedAdcpVersion !== void 0 && {
+            negotiatedAdcpVersion: options.negotiatedAdcpVersion
+          },
           ...options.versionEnvelope !== void 0 && { versionEnvelope: options.versionEnvelope },
           serverVersionSynthetic: this.activeTasks.get(taskId)?.serverVersionSynthetic,
           ...refinementServedVersion !== void 0 && { refinementServedVersion },
@@ -2332,22 +2415,79 @@ class TaskExecutor {
    * List tasks for an agent, preferring MCP Tasks protocol when available.
    */
   async listTasksForAgent(agent, transport) {
+    const credentialOwner = agent;
     if (agent.protocol === "mcp") {
-      const authToken = getAuthToken(agent);
+      agent = { ...agent, ...agent.headers && { headers: { ...agent.headers } } };
+      const version = this.config.wireAdcpVersion ?? this.config.adcpVersion ?? ADCP_VERSION;
+      let signingContext = buildAgentSigningContext(agent, { adcpVersion: version });
+      if (signingContext) agent = { ...agent, request_signing: signingContext.signing };
+      const syncTokens = () => {
+        agent.oauth_tokens = credentialOwner.oauth_tokens;
+      };
       try {
-        return await listMCPTasks(agent.agent_uri, authToken, void 0, {
-          transport: transport ?? this.config.transport,
-          onTransportActivity: this.config.onTransportActivity,
-          transportActivityContext: {
-            agentId: agent.id
+        if (credentialOwner.oauth_client_credentials) {
+          await ensureClientCredentialsTokens(credentialOwner, {
+            storage: getAgentStorage(credentialOwner),
+            allowPrivateIp: transport?.allowPrivateIp ?? isLikelyPrivateUrl(agent.agent_uri),
+            fetch: transport?.trustedFetchFn
+          });
+          syncTokens();
+        } else if (credentialOwner.oauth_tokens) {
+          getNonInteractiveOAuthProvider(credentialOwner, {
+            agentHint: credentialOwner.id,
+            storage: getAgentStorage(credentialOwner),
+            allowHttp: isLikelyPrivateUrl(credentialOwner.agent_uri)
+          });
+          shareNonInteractiveOAuthProvider(credentialOwner, agent);
+        }
+        signingContext = buildAgentSigningContext(agent, { adcpVersion: version });
+        if (signingContext) {
+          for (let attempt = 0; attempt < 2; attempt++) {
+            await ensureCapabilityLoaded(agent, signingContext, async (args) => {
+              const previousOwnerTokens = credentialOwner.oauth_tokens;
+              const previousRequestTokens = agent.oauth_tokens;
+              try {
+                return await ProtocolClient.callTool(agent, CAPABILITY_OP, args, {
+                  serverVersion: this.lastKnownServerVersion,
+                  adcpVersion: this.config.adcpVersion,
+                  wireAdcpVersion: this.config.wireAdcpVersion,
+                  versionEnvelope: this.config.versionEnvelope,
+                  transport: transport ?? this.config.transport,
+                  onTransportActivity: this.config.onTransportActivity
+                });
+              } finally {
+                if (credentialOwner.oauth_tokens === previousOwnerTokens && agent.oauth_tokens !== previousRequestTokens) {
+                  credentialOwner.oauth_tokens = agent.oauth_tokens;
+                } else {
+                  syncTokens();
+                }
+              }
+            });
+            syncTokens();
+            const current = buildAgentSigningContext(agent, { adcpVersion: version });
+            if (current.capabilityCacheKey === signingContext.capabilityCacheKey) break;
+            signingContext.invalidate();
+            if (attempt === 1)
+              throw new ConfigurationError("Task-list authorization changed during discovery; retry the call");
+            signingContext = current;
           }
-        });
+        }
+        return await signingContextStorage.run(
+          signingContext,
+          () => listMCPTasks(agent.agent_uri, getAuthToken(agent), void 0, {
+            signingContext,
+            headers: agent.headers,
+            transport: transport ?? this.config.transport,
+            onTransportActivity: this.config.onTransportActivity,
+            transportActivityContext: { agentId: agent.id }
+          })
+        );
       } catch (err) {
-        if (is401Error(err)) throw err;
+        if (is401Error(err) || err instanceof ConfigurationError || err instanceof TypeError) throw err;
       }
     }
     const response = await ProtocolClient.callTool(
-      agent,
+      credentialOwner,
       "tasks/list",
       {},
       {
@@ -2365,13 +2505,16 @@ class TaskExecutor {
    * Task tracking methods (PR #78)
    */
   async listTasks(agent, transport) {
-    const transportSnapshot = snapshotTransportOptions(transport ?? this.config.transport);
-    try {
-      return await this.listTasksForAgent(agent, transportSnapshot);
-    } catch {
-      console.warn("Failed to list tasks (see DEBUG=adcp:* logs for detail)");
-      return [];
-    }
+    return withMCPConnectionPolicy(transport ?? this.config.transport, async () => {
+      if (agent.request_signing) assertSigningPolicy(agent.request_signing);
+      const transportSnapshot = snapshotTransportOptions(transport ?? this.config.transport);
+      try {
+        return await this.listTasksForAgent(agent, transportSnapshot);
+      } catch {
+        console.warn("Failed to list tasks (see DEBUG=adcp:* logs for detail)");
+        return [];
+      }
+    });
   }
   async getTaskStatusWithRawResponse(agent, taskId, transport, signal, expectedTaskType, serverVersion, wireAdcpVersion, versionEnvelope, operationId) {
     const toolName = agent.protocol === "mcp" ? "tasks_get" : "tasks/get";
@@ -2447,7 +2590,8 @@ class TaskExecutor {
               a2aCancellationTaskId,
               cancelTransport?.trustedFetchFn,
               cancelTransport?.allowPrivateIp,
-              cancelTransport?.legacyCompat
+              cancelTransport?.legacyCompat,
+              wireAdcpVersion ?? this.config.wireAdcpVersion ?? this.config.adcpVersion ?? ADCP_VERSION
             ).catch(() => {
             });
           } catch {
@@ -2541,7 +2685,12 @@ class TaskExecutor {
         });
       }
       if (status.status === ADCP_STATUS.COMPLETED) {
-        const pollSuccess = this.isOperationSuccess(status.result, status.taskType, serverVersion);
+        const pollSuccess = this.isOperationSuccess(
+          status.result,
+          status.taskType,
+          serverVersion,
+          metadataTaskId ? this.activeTasks.get(metadataTaskId)?.options.negotiatedAdcpVersion : void 0
+        );
         if (pollSuccess) {
           return markAuthoritativePolledTerminal(
             attachMatch({
@@ -3096,6 +3245,7 @@ class TaskExecutor {
         state.messages,
         {
           ...state.wireAdcpVersion !== void 0 && { wireAdcpVersion: state.wireAdcpVersion },
+          ...state.negotiatedAdcpVersion !== void 0 && { negotiatedAdcpVersion: state.negotiatedAdcpVersion },
           ...state.versionEnvelope !== void 0 && { versionEnvelope: state.versionEnvelope }
         },
         [],
@@ -3317,6 +3467,7 @@ class TaskExecutor {
         // No handler for deferred tasks - input was provided by human
         {
           ...state.wireAdcpVersion !== void 0 && { wireAdcpVersion: state.wireAdcpVersion },
+          ...state.negotiatedAdcpVersion !== void 0 && { negotiatedAdcpVersion: state.negotiatedAdcpVersion },
           ...state.versionEnvelope !== void 0 && { versionEnvelope: state.versionEnvelope }
         },
         [],
@@ -3356,6 +3507,7 @@ class TaskExecutor {
             refinementServedVersion: state.refinementServedVersion
           },
           ...state.wireAdcpVersion !== void 0 && { wireAdcpVersion: state.wireAdcpVersion },
+          ...state.negotiatedAdcpVersion !== void 0 && { negotiatedAdcpVersion: state.negotiatedAdcpVersion },
           ...state.versionEnvelope !== void 0 && { versionEnvelope: state.versionEnvelope },
           ...state.serverVersionSynthetic !== void 0 && {
             serverVersionSynthetic: state.serverVersionSynthetic
@@ -4368,7 +4520,7 @@ class TaskExecutor {
       status: "failed",
       error: error.message || String(error),
       adcpError: adcpErrorInfo,
-      errorInstance: getSignedRequestRejection(error) ?? this.buildErrorInstance(taskId, adcpErrorInfo),
+      errorInstance: getSignedRequestRejection(error) ?? (error instanceof NeedsAuthorizationError && hasValidatedMcpAuthorizationRequirements(error.requirements, agent.agent_uri) ? error : this.buildErrorInstance(taskId, adcpErrorInfo)),
       correlationId,
       metadata: this.buildMetadata({
         taskId,
@@ -4542,11 +4694,11 @@ class TaskExecutor {
    * valid so the caller can continue. Off mode short-circuits before
    * AJV runs.
    */
-  validateResponseSchema(response, taskName, debugLogs, serverVersion, requestParams, refinementServedVersion) {
+  validateResponseSchema(response, taskName, debugLogs, serverVersion, requestParams, refinementServedVersion, negotiatedAdcpVersion) {
     const mode = this.responseValidationMode;
     const logViolations = this.config.logSchemaViolations !== false;
     try {
-      const pinnedValidationVersion = this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? ADCP_VERSION;
+      const pinnedValidationVersion = this.responseAdcpVersionForValidation() ?? negotiatedAdcpVersion ?? this.config.adcpVersion ?? ADCP_VERSION;
       if (taskName === "get_adcp_capabilities") {
         return withServedValidationVersion(
           response,
@@ -4648,8 +4800,8 @@ class TaskExecutor {
     if (this.config.versionEnvelope === "major-only") return "3.0";
     return void 0;
   }
-  effectiveResponseAdcpVersion(serverVersion) {
-    return this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? ADCP_VERSION;
+  effectiveResponseAdcpVersion(serverVersion, negotiatedAdcpVersion) {
+    return this.responseAdcpVersionForValidation() ?? negotiatedAdcpVersion ?? this.config.adcpVersion ?? ADCP_VERSION;
   }
   /**
    * Update task status and emit events

package/dist/lib/core/account-reduction.d.mts

@@ -0,0 +1,36 @@
+/**
+ * Locating and rewriting account natural keys inside a request, for the
+ * client's `accountIdentityDowngrade: 'reduce'` bookkeeping.
+ *
+ * When a request reaches a seller on an older release, its account keys can
+ * lose fields the older release cannot express (AdCP 3.2's `operator_unit`,
+ * `currency`, `timezone` and `brand.countries`). The client records which
+ * reduced key each buyer key reached the seller with, refuses a second buyer
+ * key that would land on the same seller account, and keeps addressing the
+ * account by its reduced key after the seller upgrades, until the buyer moves
+ * it to the full key.
+ */
+import type { AccountReference } from '../types/index.mjs';
+type Path = ReadonlyArray<string | number>;
+/** The natural-key projection of an account reference or `sync_accounts` row. */
+export declare function naturalAccountKey(value: unknown): AccountReference | undefined;
+export interface AccountKeySite {
+    path: Path;
+    key: AccountReference;
+}
+/**
+ * Natural account keys in a request: every `account` object and every entry
+ * of an `accounts` array (sync_accounts rows, list filters), at any depth.
+ */
+export declare function accountKeySites(params: unknown): AccountKeySite[];
+export declare function valueAt(root: unknown, path: Path): unknown;
+/**
+ * Return `root` with the account key at `path` replaced by `reduced`: the
+ * reducible fields `reduced` lacks are removed and the rest of the object
+ * (billing, settings) is kept. Unchanged branches keep their identity.
+ */
+export declare function withReducedKeyAt<T>(root: T, path: Path, reduced: AccountReference): T;
+/** Fields present on `full` but absent from `reduced`, as account-relative paths. */
+export declare function reducedFields(full: AccountReference, reduced: AccountReference): string[];
+export declare function sameAccountKey(left: AccountReference, right: AccountReference): boolean;
+export {};

package/dist/lib/core/account-reduction.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Locating and rewriting account natural keys inside a request, for the
+ * client's `accountIdentityDowngrade: 'reduce'` bookkeeping.
+ *
+ * When a request reaches a seller on an older release, its account keys can
+ * lose fields the older release cannot express (AdCP 3.2's `operator_unit`,
+ * `currency`, `timezone` and `brand.countries`). The client records which
+ * reduced key each buyer key reached the seller with, refuses a second buyer
+ * key that would land on the same seller account, and keeps addressing the
+ * account by its reduced key after the seller upgrades, until the buyer moves
+ * it to the full key.
+ */
+import type { AccountReference } from '../types';
+type Path = ReadonlyArray<string | number>;
+/** The natural-key projection of an account reference or `sync_accounts` row. */
+export declare function naturalAccountKey(value: unknown): AccountReference | undefined;
+export interface AccountKeySite {
+    path: Path;
+    key: AccountReference;
+}
+/**
+ * Natural account keys in a request: every `account` object and every entry
+ * of an `accounts` array (sync_accounts rows, list filters), at any depth.
+ */
+export declare function accountKeySites(params: unknown): AccountKeySite[];
+export declare function valueAt(root: unknown, path: Path): unknown;
+/**
+ * Return `root` with the account key at `path` replaced by `reduced`: the
+ * reducible fields `reduced` lacks are removed and the rest of the object
+ * (billing, settings) is kept. Unchanged branches keep their identity.
+ */
+export declare function withReducedKeyAt<T>(root: T, path: Path, reduced: AccountReference): T;
+/** Fields present on `full` but absent from `reduced`, as account-relative paths. */
+export declare function reducedFields(full: AccountReference, reduced: AccountReference): string[];
+export declare function sameAccountKey(left: AccountReference, right: AccountReference): boolean;
+export {};

package/dist/lib/core/account-reduction.js

@@ -0,0 +1,127 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var account_reduction_exports = {};
+__export(account_reduction_exports, {
+  accountKeySites: () => accountKeySites,
+  naturalAccountKey: () => naturalAccountKey,
+  reducedFields: () => reducedFields,
+  sameAccountKey: () => sameAccountKey,
+  valueAt: () => valueAt,
+  withReducedKeyAt: () => withReducedKeyAt
+});
+module.exports = __toCommonJS(account_reduction_exports);
+var import_account_key = require('./account-key.js');
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+const REDUCIBLE_FIELDS = ["operator_unit", "currency", "timezone"];
+function naturalAccountKey(value) {
+  if (!isObject(value) || typeof value.account_id === "string") return void 0;
+  const brand = value.brand;
+  if (!isObject(brand) || typeof brand.domain !== "string" || typeof value.operator !== "string") return void 0;
+  return {
+    brand: {
+      domain: brand.domain,
+      ...typeof brand.brand_id === "string" && { brand_id: brand.brand_id },
+      ...Array.isArray(brand.countries) && { countries: brand.countries }
+    },
+    operator: value.operator,
+    ...isObject(value.operator_unit) && { operator_unit: value.operator_unit },
+    ...typeof value.currency === "string" && { currency: value.currency },
+    ...typeof value.timezone === "string" && { timezone: value.timezone },
+    ...typeof value.sandbox === "boolean" && { sandbox: value.sandbox }
+  };
+}
+function accountKeySites(params) {
+  const sites = [];
+  const visit = (value, path, depth) => {
+    if (depth > 8) return;
+    if (Array.isArray(value)) {
+      value.forEach((item, index) => visit(item, [...path, index], depth + 1));
+      return;
+    }
+    if (!isObject(value)) return;
+    for (const [field, child] of Object.entries(value)) {
+      if (field === "account") {
+        const key = naturalAccountKey(child);
+        if (key) sites.push({ path: [...path, field], key });
+      } else if (field === "accounts" && Array.isArray(child)) {
+        child.forEach((entry, index) => {
+          const key = naturalAccountKey(entry);
+          if (key) sites.push({ path: [...path, field, index], key });
+        });
+      }
+      visit(child, [...path, field], depth + 1);
+    }
+  };
+  visit(params, [], 0);
+  return sites;
+}
+function valueAt(root, path) {
+  let current = root;
+  for (const segment of path) {
+    if (current === null || typeof current !== "object") return void 0;
+    current = current[segment];
+  }
+  return current;
+}
+function withReducedKeyAt(root, path, reduced) {
+  if (path.length === 0) {
+    if (!isObject(root) || "account_id" in reduced) return root;
+    const next = { ...root };
+    for (const field of REDUCIBLE_FIELDS) {
+      if (reduced[field] === void 0) delete next[field];
+    }
+    if (isObject(next.brand) && reduced.brand.countries === void 0 && "countries" in next.brand) {
+      const { countries: _, ...brand } = next.brand;
+      next.brand = brand;
+    }
+    return next;
+  }
+  const [head, ...rest] = path;
+  if (Array.isArray(root) && typeof head === "number") {
+    const copy = [...root];
+    copy[head] = withReducedKeyAt(copy[head], rest, reduced);
+    return copy;
+  }
+  if (isObject(root) && typeof head === "string") {
+    return { ...root, [head]: withReducedKeyAt(root[head], rest, reduced) };
+  }
+  return root;
+}
+function reducedFields(full, reduced) {
+  if ("account_id" in full || "account_id" in reduced) return [];
+  const fields = REDUCIBLE_FIELDS.filter(
+    (field) => full[field] !== void 0 && reduced[field] === void 0
+  );
+  if (full.brand.countries !== void 0 && reduced.brand.countries === void 0) fields.push("brand.countries");
+  return fields;
+}
+function sameAccountKey(left, right) {
+  return (0, import_account_key.accountReferenceKey)(left) === (0, import_account_key.accountReferenceKey)(right);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  accountKeySites,
+  naturalAccountKey,
+  reducedFields,
+  sameAccountKey,
+  valueAt,
+  withReducedKeyAt
+});