@adcp/sdk 16.4.0 → 16.6.0

package/dist/lib/server/media-buy-store.js

@@ -25,6 +25,25 @@ module.exports = __toCommonJS(media_buy_store_exports);
 var import_targeting_input = require('../media-buy/targeting-input.js');
 var import_state_store = require('./state-store.js');
 const DEFAULT_MEDIA_BUY_STORE_COLLECTION = "media_buys_targeting";
+const PACKAGE_IDENTITY_FIELDS = ["package_id", "product_id", "buyer_ref"];
+function compatibleIdentity(left, right) {
+  if (!left || !right) return false;
+  return PACKAGE_IDENTITY_FIELDS.every((key) => !left[key] || !right[key] || left[key] === right[key]);
+}
+function sharesIdentity(left, right) {
+  if (!left || !right) return false;
+  return compatibleIdentity(left, right) && PACKAGE_IDENTITY_FIELDS.some((key) => left[key] && left[key] === right[key]);
+}
+function matchContextPackage(requests, responses, index) {
+  const matches = requests.filter((request) => sharesIdentity(request, responses[index]));
+  if (matches.length === 1 && responses.filter((response) => sharesIdentity(matches[0], response)).length === 1) {
+    return matches[0];
+  }
+  if (requests.length === responses.length && requests.every((request, i) => compatibleIdentity(request, responses[i]))) {
+    return requests[index];
+  }
+  return void 0;
+}
 function createMediaBuyStore(options) {
   const collection = options.collection ?? DEFAULT_MEDIA_BUY_STORE_COLLECTION;
   function viewFor(accountId) {
@@ -42,8 +61,9 @@ function createMediaBuyStore(options) {
     async persistFromCreate(accountId, request, result) {
       const requestPackages = request.packages ?? [];
       const responsePackages = result.packages ?? [];
-      if (requestPackages.length === 0 || !result.media_buy_id) return;
-      const persistedPackages = [];
+      if (!result.media_buy_id) return;
+      const prior = await loadRecord(accountId, result.media_buy_id);
+      const byId = new Map((prior?.packages ?? []).map((pkg) => [pkg.package_id, { ...pkg }]));
       for (let i = 0; i < requestPackages.length; i++) {
         const reqPkg = requestPackages[i];
         if (!reqPkg?.targeting_overlay) continue;
@@ -54,12 +74,26 @@ function createMediaBuyStore(options) {
         if (!packageId) continue;
         const persistedOverlay = respPkg?.targeting_overlay ?? (0, import_targeting_input.resolveTargetingInput)(reqPkg.targeting_overlay);
         if (!persistedOverlay) continue;
-        persistedPackages.push({ package_id: packageId, targeting_overlay: persistedOverlay });
+        byId.set(packageId, { ...byId.get(packageId), package_id: packageId, targeting_overlay: persistedOverlay });
       }
-      if (persistedPackages.length === 0) return;
+      for (const [index, response] of responsePackages.entries()) {
+        if (!response.package_id) continue;
+        const context2 = matchContextPackage(requestPackages, responsePackages, index)?.context ?? response.context;
+        const stored = byId.get(response.package_id);
+        if (context2 !== void 0 && stored?.context === void 0) {
+          byId.set(response.package_id, {
+            ...stored,
+            package_id: response.package_id,
+            context: structuredClone(context2)
+          });
+        }
+      }
+      const context = prior?.context ?? request.context ?? result.context;
+      if (byId.size === 0 && context === void 0) return;
       await writeRecord(accountId, {
         media_buy_id: result.media_buy_id,
-        packages: persistedPackages
+        ...context !== void 0 ? { context: structuredClone(context) } : {},
+        packages: Array.from(byId.values())
       });
     },
     async mergeFromUpdate(accountId, mediaBuyId, patch) {
@@ -67,42 +101,56 @@ function createMediaBuyStore(options) {
         media_buy_id: mediaBuyId,
         packages: []
       };
-      const byId = new Map(prior.packages.map((p) => [p.package_id, p.targeting_overlay]));
+      const byId = new Map(prior.packages.map((p) => [p.package_id, { ...p }]));
       for (const pkg of patch.packages ?? []) {
         const packageId = pkg?.package_id;
         if (!packageId) continue;
         if (!("targeting_overlay" in pkg)) continue;
         const incoming = pkg.targeting_overlay;
         if (incoming === void 0) continue;
-        const merged = (0, import_targeting_input.applyTargetingInput)(byId.get(packageId), incoming);
-        if (merged) byId.set(packageId, merged);
-        else byId.delete(packageId);
+        const stored = byId.get(packageId);
+        const merged = (0, import_targeting_input.applyTargetingInput)(stored?.targeting_overlay, incoming);
+        if (merged) byId.set(packageId, { ...stored, package_id: packageId, targeting_overlay: merged });
+        else if (stored?.context !== void 0) {
+          byId.set(packageId, { package_id: packageId, context: stored.context });
+        } else byId.delete(packageId);
       }
       for (const pkg of patch.new_packages ?? []) {
         if (!pkg?.targeting_overlay || !pkg.package_id) continue;
         const resolved = (0, import_targeting_input.resolveTargetingInput)(pkg.targeting_overlay);
-        if (resolved) byId.set(pkg.package_id, resolved);
+        if (resolved)
+          byId.set(pkg.package_id, {
+            ...byId.get(pkg.package_id),
+            package_id: pkg.package_id,
+            targeting_overlay: resolved
+          });
       }
       await writeRecord(accountId, {
-        media_buy_id: mediaBuyId,
-        packages: Array.from(byId.entries()).map(([package_id, targeting_overlay]) => ({
-          package_id,
-          targeting_overlay
-        }))
+        ...prior,
+        packages: Array.from(byId.values())
       });
     },
     async backfill(accountId, result) {
       const buys = result.media_buys;
       if (!buys || buys.length === 0) return result;
       for (const buy of buys) {
-        if (!buy?.media_buy_id || !buy.packages) continue;
+        if (!buy?.media_buy_id) continue;
         const record = await loadRecord(accountId, buy.media_buy_id);
         if (!record) continue;
-        const overlayById = new Map(record.packages.map((p) => [p.package_id, p.targeting_overlay]));
-        for (const pkg of buy.packages) {
-          if (!pkg?.package_id || pkg.targeting_overlay !== void 0) continue;
-          const persisted = overlayById.get(pkg.package_id);
-          if (persisted) pkg.targeting_overlay = persisted;
+        if (buy.context === void 0 && record.context !== void 0) {
+          buy.context = structuredClone(record.context);
+        }
+        const byId = new Map(record.packages.map((p) => [p.package_id, p]));
+        for (const pkg of buy.packages ?? []) {
+          if (!pkg?.package_id) continue;
+          const persisted = byId.get(pkg.package_id);
+          if (!persisted) continue;
+          if (pkg.targeting_overlay === void 0 && persisted.targeting_overlay !== void 0) {
+            pkg.targeting_overlay = persisted.targeting_overlay;
+          }
+          if (pkg.context === void 0 && persisted.context !== void 0) {
+            pkg.context = structuredClone(persisted.context);
+          }
         }
       }
       return result;

package/dist/lib/server/media-buy-store.mjs

@@ -1,6 +1,25 @@
 import { applyTargetingInput, resolveTargetingInput } from "../media-buy/targeting-input.mjs";
 import { scopedStore } from "./state-store.mjs";
 const DEFAULT_MEDIA_BUY_STORE_COLLECTION = "media_buys_targeting";
+const PACKAGE_IDENTITY_FIELDS = ["package_id", "product_id", "buyer_ref"];
+function compatibleIdentity(left, right) {
+  if (!left || !right) return false;
+  return PACKAGE_IDENTITY_FIELDS.every((key) => !left[key] || !right[key] || left[key] === right[key]);
+}
+function sharesIdentity(left, right) {
+  if (!left || !right) return false;
+  return compatibleIdentity(left, right) && PACKAGE_IDENTITY_FIELDS.some((key) => left[key] && left[key] === right[key]);
+}
+function matchContextPackage(requests, responses, index) {
+  const matches = requests.filter((request) => sharesIdentity(request, responses[index]));
+  if (matches.length === 1 && responses.filter((response) => sharesIdentity(matches[0], response)).length === 1) {
+    return matches[0];
+  }
+  if (requests.length === responses.length && requests.every((request, i) => compatibleIdentity(request, responses[i]))) {
+    return requests[index];
+  }
+  return void 0;
+}
 function createMediaBuyStore(options) {
   const collection = options.collection ?? DEFAULT_MEDIA_BUY_STORE_COLLECTION;
   function viewFor(accountId) {
@@ -18,8 +37,9 @@ function createMediaBuyStore(options) {
     async persistFromCreate(accountId, request, result) {
       const requestPackages = request.packages ?? [];
       const responsePackages = result.packages ?? [];
-      if (requestPackages.length === 0 || !result.media_buy_id) return;
-      const persistedPackages = [];
+      if (!result.media_buy_id) return;
+      const prior = await loadRecord(accountId, result.media_buy_id);
+      const byId = new Map((prior?.packages ?? []).map((pkg) => [pkg.package_id, { ...pkg }]));
       for (let i = 0; i < requestPackages.length; i++) {
         const reqPkg = requestPackages[i];
         if (!reqPkg?.targeting_overlay) continue;
@@ -30,12 +50,26 @@ function createMediaBuyStore(options) {
         if (!packageId) continue;
         const persistedOverlay = respPkg?.targeting_overlay ?? resolveTargetingInput(reqPkg.targeting_overlay);
         if (!persistedOverlay) continue;
-        persistedPackages.push({ package_id: packageId, targeting_overlay: persistedOverlay });
+        byId.set(packageId, { ...byId.get(packageId), package_id: packageId, targeting_overlay: persistedOverlay });
       }
-      if (persistedPackages.length === 0) return;
+      for (const [index, response] of responsePackages.entries()) {
+        if (!response.package_id) continue;
+        const context2 = matchContextPackage(requestPackages, responsePackages, index)?.context ?? response.context;
+        const stored = byId.get(response.package_id);
+        if (context2 !== void 0 && stored?.context === void 0) {
+          byId.set(response.package_id, {
+            ...stored,
+            package_id: response.package_id,
+            context: structuredClone(context2)
+          });
+        }
+      }
+      const context = prior?.context ?? request.context ?? result.context;
+      if (byId.size === 0 && context === void 0) return;
       await writeRecord(accountId, {
         media_buy_id: result.media_buy_id,
-        packages: persistedPackages
+        ...context !== void 0 ? { context: structuredClone(context) } : {},
+        packages: Array.from(byId.values())
       });
     },
     async mergeFromUpdate(accountId, mediaBuyId, patch) {
@@ -43,42 +77,56 @@ function createMediaBuyStore(options) {
         media_buy_id: mediaBuyId,
         packages: []
       };
-      const byId = new Map(prior.packages.map((p) => [p.package_id, p.targeting_overlay]));
+      const byId = new Map(prior.packages.map((p) => [p.package_id, { ...p }]));
       for (const pkg of patch.packages ?? []) {
         const packageId = pkg?.package_id;
         if (!packageId) continue;
         if (!("targeting_overlay" in pkg)) continue;
         const incoming = pkg.targeting_overlay;
         if (incoming === void 0) continue;
-        const merged = applyTargetingInput(byId.get(packageId), incoming);
-        if (merged) byId.set(packageId, merged);
-        else byId.delete(packageId);
+        const stored = byId.get(packageId);
+        const merged = applyTargetingInput(stored?.targeting_overlay, incoming);
+        if (merged) byId.set(packageId, { ...stored, package_id: packageId, targeting_overlay: merged });
+        else if (stored?.context !== void 0) {
+          byId.set(packageId, { package_id: packageId, context: stored.context });
+        } else byId.delete(packageId);
       }
       for (const pkg of patch.new_packages ?? []) {
         if (!pkg?.targeting_overlay || !pkg.package_id) continue;
         const resolved = resolveTargetingInput(pkg.targeting_overlay);
-        if (resolved) byId.set(pkg.package_id, resolved);
+        if (resolved)
+          byId.set(pkg.package_id, {
+            ...byId.get(pkg.package_id),
+            package_id: pkg.package_id,
+            targeting_overlay: resolved
+          });
       }
       await writeRecord(accountId, {
-        media_buy_id: mediaBuyId,
-        packages: Array.from(byId.entries()).map(([package_id, targeting_overlay]) => ({
-          package_id,
-          targeting_overlay
-        }))
+        ...prior,
+        packages: Array.from(byId.values())
       });
     },
     async backfill(accountId, result) {
       const buys = result.media_buys;
       if (!buys || buys.length === 0) return result;
       for (const buy of buys) {
-        if (!buy?.media_buy_id || !buy.packages) continue;
+        if (!buy?.media_buy_id) continue;
         const record = await loadRecord(accountId, buy.media_buy_id);
         if (!record) continue;
-        const overlayById = new Map(record.packages.map((p) => [p.package_id, p.targeting_overlay]));
-        for (const pkg of buy.packages) {
-          if (!pkg?.package_id || pkg.targeting_overlay !== void 0) continue;
-          const persisted = overlayById.get(pkg.package_id);
-          if (persisted) pkg.targeting_overlay = persisted;
+        if (buy.context === void 0 && record.context !== void 0) {
+          buy.context = structuredClone(record.context);
+        }
+        const byId = new Map(record.packages.map((p) => [p.package_id, p]));
+        for (const pkg of buy.packages ?? []) {
+          if (!pkg?.package_id) continue;
+          const persisted = byId.get(pkg.package_id);
+          if (!persisted) continue;
+          if (pkg.targeting_overlay === void 0 && persisted.targeting_overlay !== void 0) {
+            pkg.targeting_overlay = persisted.targeting_overlay;
+          }
+          if (pkg.context === void 0 && persisted.context !== void 0) {
+            pkg.context = structuredClone(persisted.context);
+          }
         }
       }
       return result;

package/dist/lib/server/responses.js

@@ -60,6 +60,7 @@ __export(responses_exports, {
 module.exports = __toCommonJS(responses_exports);
 var import_media_buy_helpers = require('./media-buy-helpers.js');
 var import_reporting_delivery_config = require('./reporting-delivery-config.js');
+var import_account_response_identity = require('./account-response-identity.js');
 const explicitResponseSummaries = /* @__PURE__ */ new WeakMap();
 function _getExplicitResponseSummary(response) {
   return explicitResponseSummaries.get(response);
@@ -124,7 +125,14 @@ function stripBusinessEntityBank(row, key) {
   return stripped;
 }
 function stripAccountWriteOnlyFields(account) {
-  const stripped = stripBusinessEntityBank(stripNotificationConfigSecrets(account), "billing_entity");
+  const {
+    destination_billing_entity: _destination,
+    authInfo: _authInfo,
+    ctx_metadata: _metadata,
+    ...responseFields
+  } = account;
+  const response = stripBusinessEntityBank(stripNotificationConfigSecrets(responseFields), "billing_entity");
+  const stripped = { ...response, ...(0, import_account_response_identity.projectAccountResponseIdentityFields)(response) };
   const reportingDeliveryConfigs = stripped.reporting_delivery_configs;
   if (reportingDeliveryConfigs === void 0) return stripped;
   return {

package/dist/lib/server/responses.mjs

@@ -1,5 +1,6 @@
 import { validActionsForStatus } from "./media-buy-helpers.mjs";
 import { projectReportingDeliveryConfigStates } from "./reporting-delivery-config.mjs";
+import { projectAccountResponseIdentityFields } from "./account-response-identity.mjs";
 const explicitResponseSummaries = /* @__PURE__ */ new WeakMap();
 function _getExplicitResponseSummary(response) {
   return explicitResponseSummaries.get(response);
@@ -64,7 +65,14 @@ function stripBusinessEntityBank(row, key) {
   return stripped;
 }
 function stripAccountWriteOnlyFields(account) {
-  const stripped = stripBusinessEntityBank(stripNotificationConfigSecrets(account), "billing_entity");
+  const {
+    destination_billing_entity: _destination,
+    authInfo: _authInfo,
+    ctx_metadata: _metadata,
+    ...responseFields
+  } = account;
+  const response = stripBusinessEntityBank(stripNotificationConfigSecrets(responseFields), "billing_entity");
+  const stripped = { ...response, ...projectAccountResponseIdentityFields(response) };
   const reportingDeliveryConfigs = stripped.reporting_delivery_configs;
   if (reportingDeliveryConfigs === void 0) return stripped;
   return {

package/dist/lib/server/state-machine.d.mts

@@ -20,21 +20,20 @@
  *     Production seller code that handles the wire protocol directly
  *     should use this — the framework projects `AdcpError` onto the
  *     wire `adcp_error` envelope automatically.
+ * Media-buy helpers accept the served AdCP version as a third argument;
+ * `getMediaBuyTransitions(version)` selects the same graph for custom consumers.
  *
  * @public
  */
 import type { CreativeStatus, MediaBuyStatus } from '../types/core.generated.mjs';
 /**
- * Legal `MediaBuyStatus` transitions per `media-buy-status.json`.
- *
- * `active ↔ paused` is reversible (buyer pauses, seller resumes).
- * `completed | rejected | canceled` are terminal — no outbound edges.
- *
- * `pending_start → rejected` is supported because the schema's prose
- * (`"declined by the seller after creation"`) does not exclude post-start
- * rejection. Storyboards do not exercise that edge today; sellers MAY
- * narrow it in their own enforcement if their upstream forbids it.
+ * Lifecycle graph for the served AdCP release. In 3.3, a seller review rejection
+ * can introduce buyer work before activation: `pending_start → pending_creatives`.
+ * Older releases keep their published graph. Active/paused buys cannot rewind.
+ * Accepts full-semver or release-precision versions, including 3.3 candidates.
  */
+export declare function getMediaBuyTransitions(adcpVersion?: string): ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>>;
+/** Lifecycle graph for the SDK's default AdCP release. */
 export declare const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>>;
 /**
  * Legal `CreativeStatus` transitions per `creative-status.json`.
@@ -47,7 +46,7 @@ export declare const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, Readonly
  */
 export declare const CREATIVE_ASSET_TRANSITIONS: ReadonlyMap<CreativeStatus, ReadonlySet<CreativeStatus>>;
 /** Boolean predicate for `MediaBuyStatus` transitions. Self-edges are illegal. */
-export declare function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): boolean;
+export declare function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus, adcpVersion?: string): boolean;
 /** Boolean predicate for `CreativeStatus` transitions. Self-edges are illegal. */
 export declare function isLegalCreativeTransition(from: CreativeStatus, to: CreativeStatus): boolean;
 /**
@@ -70,7 +69,7 @@ export declare function isLegalCreativeTransition(from: CreativeStatus, to: Crea
  * `STANDARD_ERROR_CODES` — the buyer can adjust their request (re-fetch
  * current state, choose a different action) rather than escalating.
  */
-export declare function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): void;
+export declare function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus, adcpVersion?: string): void;
 /**
  * Throws an `AdcpError('INVALID_STATE')` for an illegal `CreativeStatus`
  * transition. Creatives have no terminals — every state can recover via

package/dist/lib/server/state-machine.d.ts

@@ -20,21 +20,20 @@
  *     Production seller code that handles the wire protocol directly
  *     should use this — the framework projects `AdcpError` onto the
  *     wire `adcp_error` envelope automatically.
+ * Media-buy helpers accept the served AdCP version as a third argument;
+ * `getMediaBuyTransitions(version)` selects the same graph for custom consumers.
  *
  * @public
  */
 import type { CreativeStatus, MediaBuyStatus } from '../types/core.generated';
 /**
- * Legal `MediaBuyStatus` transitions per `media-buy-status.json`.
- *
- * `active ↔ paused` is reversible (buyer pauses, seller resumes).
- * `completed | rejected | canceled` are terminal — no outbound edges.
- *
- * `pending_start → rejected` is supported because the schema's prose
- * (`"declined by the seller after creation"`) does not exclude post-start
- * rejection. Storyboards do not exercise that edge today; sellers MAY
- * narrow it in their own enforcement if their upstream forbids it.
+ * Lifecycle graph for the served AdCP release. In 3.3, a seller review rejection
+ * can introduce buyer work before activation: `pending_start → pending_creatives`.
+ * Older releases keep their published graph. Active/paused buys cannot rewind.
+ * Accepts full-semver or release-precision versions, including 3.3 candidates.
  */
+export declare function getMediaBuyTransitions(adcpVersion?: string): ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>>;
+/** Lifecycle graph for the SDK's default AdCP release. */
 export declare const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>>;
 /**
  * Legal `CreativeStatus` transitions per `creative-status.json`.
@@ -47,7 +46,7 @@ export declare const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, Readonly
  */
 export declare const CREATIVE_ASSET_TRANSITIONS: ReadonlyMap<CreativeStatus, ReadonlySet<CreativeStatus>>;
 /** Boolean predicate for `MediaBuyStatus` transitions. Self-edges are illegal. */
-export declare function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): boolean;
+export declare function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus, adcpVersion?: string): boolean;
 /** Boolean predicate for `CreativeStatus` transitions. Self-edges are illegal. */
 export declare function isLegalCreativeTransition(from: CreativeStatus, to: CreativeStatus): boolean;
 /**
@@ -70,7 +69,7 @@ export declare function isLegalCreativeTransition(from: CreativeStatus, to: Crea
  * `STANDARD_ERROR_CODES` — the buyer can adjust their request (re-fetch
  * current state, choose a different action) rather than escalating.
  */
-export declare function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): void;
+export declare function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus, adcpVersion?: string): void;
 /**
  * Throws an `AdcpError('INVALID_STATE')` for an illegal `CreativeStatus`
  * transition. Creatives have no terminals — every state can recover via

package/dist/lib/server/state-machine.js

@@ -22,12 +22,15 @@ __export(state_machine_exports, {
   MEDIA_BUY_TRANSITIONS: () => MEDIA_BUY_TRANSITIONS,
   assertCreativeTransition: () => assertCreativeTransition,
   assertMediaBuyTransition: () => assertMediaBuyTransition,
+  getMediaBuyTransitions: () => getMediaBuyTransitions,
   isLegalCreativeTransition: () => isLegalCreativeTransition,
   isLegalMediaBuyTransition: () => isLegalMediaBuyTransition
 });
 module.exports = __toCommonJS(state_machine_exports);
+var import_version = require('../version.js');
+var import_adcp_version_config = require('../utils/adcp-version-config.js');
 var import_async_outcome = require('./decisioning/async-outcome.js');
-const MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
+const LEGACY_MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
   ["pending_creatives", /* @__PURE__ */ new Set(["pending_start", "active", "paused", "canceled", "rejected"])],
   ["pending_start", /* @__PURE__ */ new Set(["active", "paused", "canceled", "rejected"])],
   ["active", /* @__PURE__ */ new Set(["paused", "completed", "canceled"])],
@@ -36,6 +39,17 @@ const MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
   ["rejected", /* @__PURE__ */ new Set()],
   ["canceled", /* @__PURE__ */ new Set()]
 ]);
+const CREATIVE_REVIEW_MEDIA_BUY_TRANSITIONS = new Map([
+  ...LEGACY_MEDIA_BUY_TRANSITIONS,
+  [
+    "pending_start",
+    /* @__PURE__ */ new Set(["pending_creatives", ...LEGACY_MEDIA_BUY_TRANSITIONS.get("pending_start")])
+  ]
+]);
+function getMediaBuyTransitions(adcpVersion = import_version.ADCP_VERSION) {
+  return (0, import_adcp_version_config.isAdcpVersionAtLeast)(adcpVersion, "3.3-beta") ? CREATIVE_REVIEW_MEDIA_BUY_TRANSITIONS : LEGACY_MEDIA_BUY_TRANSITIONS;
+}
+const MEDIA_BUY_TRANSITIONS = getMediaBuyTransitions();
 const CREATIVE_ASSET_TRANSITIONS = /* @__PURE__ */ new Map([
   ["processing", /* @__PURE__ */ new Set(["pending_review", "rejected"])],
   ["pending_review", /* @__PURE__ */ new Set(["approved", "rejected"])],
@@ -43,14 +57,14 @@ const CREATIVE_ASSET_TRANSITIONS = /* @__PURE__ */ new Map([
   ["archived", /* @__PURE__ */ new Set(["approved"])],
   ["rejected", /* @__PURE__ */ new Set(["processing", "pending_review"])]
 ]);
-function isLegalMediaBuyTransition(from, to) {
-  return MEDIA_BUY_TRANSITIONS.get(from)?.has(to) ?? false;
+function isLegalMediaBuyTransition(from, to, adcpVersion = import_version.ADCP_VERSION) {
+  return getMediaBuyTransitions(adcpVersion).get(from)?.has(to) ?? false;
 }
 function isLegalCreativeTransition(from, to) {
   return CREATIVE_ASSET_TRANSITIONS.get(from)?.has(to) ?? false;
 }
-function assertMediaBuyTransition(from, to) {
-  if (isLegalMediaBuyTransition(from, to)) return;
+function assertMediaBuyTransition(from, to, adcpVersion = import_version.ADCP_VERSION) {
+  if (isLegalMediaBuyTransition(from, to, adcpVersion)) return;
   if (to === "canceled") {
     throw new import_async_outcome.AdcpError("NOT_CANCELLABLE", {
       message: `Media buy in ${from} state cannot be canceled.`,
@@ -75,6 +89,7 @@ function assertCreativeTransition(from, to) {
   MEDIA_BUY_TRANSITIONS,
   assertCreativeTransition,
   assertMediaBuyTransition,
+  getMediaBuyTransitions,
   isLegalCreativeTransition,
   isLegalMediaBuyTransition
 });

package/dist/lib/server/state-machine.mjs

@@ -1,5 +1,7 @@
+import { ADCP_VERSION } from "../version.mjs";
+import { isAdcpVersionAtLeast } from "../utils/adcp-version-config.mjs";
 import { AdcpError } from "./decisioning/async-outcome.mjs";
-const MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
+const LEGACY_MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
   ["pending_creatives", /* @__PURE__ */ new Set(["pending_start", "active", "paused", "canceled", "rejected"])],
   ["pending_start", /* @__PURE__ */ new Set(["active", "paused", "canceled", "rejected"])],
   ["active", /* @__PURE__ */ new Set(["paused", "completed", "canceled"])],
@@ -8,6 +10,17 @@ const MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
   ["rejected", /* @__PURE__ */ new Set()],
   ["canceled", /* @__PURE__ */ new Set()]
 ]);
+const CREATIVE_REVIEW_MEDIA_BUY_TRANSITIONS = new Map([
+  ...LEGACY_MEDIA_BUY_TRANSITIONS,
+  [
+    "pending_start",
+    /* @__PURE__ */ new Set(["pending_creatives", ...LEGACY_MEDIA_BUY_TRANSITIONS.get("pending_start")])
+  ]
+]);
+function getMediaBuyTransitions(adcpVersion = ADCP_VERSION) {
+  return isAdcpVersionAtLeast(adcpVersion, "3.3-beta") ? CREATIVE_REVIEW_MEDIA_BUY_TRANSITIONS : LEGACY_MEDIA_BUY_TRANSITIONS;
+}
+const MEDIA_BUY_TRANSITIONS = getMediaBuyTransitions();
 const CREATIVE_ASSET_TRANSITIONS = /* @__PURE__ */ new Map([
   ["processing", /* @__PURE__ */ new Set(["pending_review", "rejected"])],
   ["pending_review", /* @__PURE__ */ new Set(["approved", "rejected"])],
@@ -15,14 +28,14 @@ const CREATIVE_ASSET_TRANSITIONS = /* @__PURE__ */ new Map([
   ["archived", /* @__PURE__ */ new Set(["approved"])],
   ["rejected", /* @__PURE__ */ new Set(["processing", "pending_review"])]
 ]);
-function isLegalMediaBuyTransition(from, to) {
-  return MEDIA_BUY_TRANSITIONS.get(from)?.has(to) ?? false;
+function isLegalMediaBuyTransition(from, to, adcpVersion = ADCP_VERSION) {
+  return getMediaBuyTransitions(adcpVersion).get(from)?.has(to) ?? false;
 }
 function isLegalCreativeTransition(from, to) {
   return CREATIVE_ASSET_TRANSITIONS.get(from)?.has(to) ?? false;
 }
-function assertMediaBuyTransition(from, to) {
-  if (isLegalMediaBuyTransition(from, to)) return;
+function assertMediaBuyTransition(from, to, adcpVersion = ADCP_VERSION) {
+  if (isLegalMediaBuyTransition(from, to, adcpVersion)) return;
   if (to === "canceled") {
     throw new AdcpError("NOT_CANCELLABLE", {
       message: `Media buy in ${from} state cannot be canceled.`,
@@ -46,6 +59,7 @@ export {
   MEDIA_BUY_TRANSITIONS,
   assertCreativeTransition,
   assertMediaBuyTransition,
+  getMediaBuyTransitions,
   isLegalCreativeTransition,
   isLegalMediaBuyTransition
 };

package/dist/lib/server/targeting-helpers.d.mts

@@ -56,7 +56,7 @@ export declare const defaultResolvedListCache: ResolvedListCache;
 export declare function clearDefaultResolvedListCache(): void;
 export type ResolveListCallTool = (agentUrl: string, toolName: 'get_property_list' | 'get_collection_list', args: Record<string, unknown>, authToken?: string) => Promise<unknown>;
 export interface ResolveListOptions {
-    /** Require schema-valid property-list pages with identifiers when resolving. Used for certification. */
+    /** Require schema-valid list pages with resolved items. Used for certification. */
     strictResponseValidation?: boolean;
     /** Maximum page size when calling get_property_list / get_collection_list. Defaults to 1000. */
     pageSize?: number;

package/dist/lib/server/targeting-helpers.d.ts

@@ -56,7 +56,7 @@ export declare const defaultResolvedListCache: ResolvedListCache;
 export declare function clearDefaultResolvedListCache(): void;
 export type ResolveListCallTool = (agentUrl: string, toolName: 'get_property_list' | 'get_collection_list', args: Record<string, unknown>, authToken?: string) => Promise<unknown>;
 export interface ResolveListOptions {
-    /** Require schema-valid property-list pages with identifiers when resolving. Used for certification. */
+    /** Require schema-valid list pages with resolved items. Used for certification. */
     strictResponseValidation?: boolean;
     /** Maximum page size when calling get_property_list / get_collection_list. Defaults to 1000. */
     pageSize?: number;

package/dist/lib/server/targeting-helpers.js

@@ -45,6 +45,7 @@ var import_mcp = require('../protocols/mcp.js');
 var import_net = require('../net/index.js');
 var import_probe_policy = require('../utils/probe-policy.js');
 var import_pin_and_bind_fetch = require('./pin-and-bind-fetch.js');
+var import_response_unwrapper = require('../utils/response-unwrapper.js');
 const DEFAULT_RESOLVE_LIST_PAGE_SIZE = 1e3;
 class MemoryResolvedListCache {
   entries = /* @__PURE__ */ new Map();
@@ -80,6 +81,24 @@ function clearDefaultResolvedListCache() {
 const defaultResolveListFetchBase = (0, import_pin_and_bind_fetch.createPinAndBindFetch)();
 const defaultResolveListFetch = (input, init) => defaultResolveListFetchBase(input, { ...init, redirect: "manual" });
 const defaultResolveListCallTool = (agentUrl, toolName, args, authToken) => (0, import_mcp.callMCPTool)(agentUrl, toolName, args, authToken, [], void 0, void 0, defaultResolveListFetch);
+function resolvedListPayload(result, kind) {
+  if (!result || typeof result !== "object" || Array.isArray(result)) return result;
+  const envelope = result;
+  const isMcp = "structuredContent" in envelope || "content" in envelope || "isError" in envelope;
+  let payload;
+  try {
+    payload = isMcp ? (0, import_response_unwrapper.unwrapProtocolResponse)(envelope, void 0, "mcp") : envelope;
+  } catch (cause) {
+    throw new Error(`${kind}_list_invalid_response`, { cause });
+  }
+  const data = payload && typeof payload === "object" ? payload : void 0;
+  if (envelope.isError === true || data?.adcp_error !== void 0) {
+    throw Object.assign(new Error(`${kind}_list_invalid_response`, { cause: data?.adcp_error }), {
+      adcp_error: data?.adcp_error
+    });
+  }
+  return payload;
+}
 async function resolvePropertyList(ref, options = {}) {
   const structurallyNormalizedRef = await normalizePropertyListReference(ref, { resolveDns: false });
   const cache = cacheForOptions(options);
@@ -102,7 +121,10 @@ async function fetchResolvedPropertyList(ref, options) {
   const seenCursors = /* @__PURE__ */ new Set();
   for (let pageIndex = 0; pageIndex < maxPagesForOptions(options); pageIndex += 1) {
     const args = buildResolveListArgs(ref.list_id, pageSizeForOptions(options), cursor);
-    const raw = await callTool(ref.agent_url, "get_property_list", args, ref.auth_token);
+    const raw = resolvedListPayload(
+      await callTool(ref.agent_url, "get_property_list", args, ref.auth_token),
+      "property"
+    );
     if (!raw || typeof raw !== "object" || !("list" in raw)) {
       throw new Error("property_list_invalid_response");
     }
@@ -154,7 +176,7 @@ async function resolveCollectionList(ref, options = {}) {
   const cache = cacheForOptions(options);
   const nowMs = nowMsForOptions(options);
   const cacheKey = resolvedListCacheKey("collection", structurallyNormalizedRef, options);
-  const cached = cacheKey ? cache?.get(cacheKey, nowMs) : void 0;
+  const cached = cacheKey && !options.strictResponseValidation ? cache?.get(cacheKey, nowMs) : void 0;
   if (cached) return cached;
   const normalizedRef = options.callTool ? structurallyNormalizedRef : await normalizeCollectionListReference(structurallyNormalizedRef, { resolveDns: false });
   const result = await fetchResolvedCollectionList(normalizedRef, options);
@@ -170,11 +192,29 @@ async function fetchResolvedCollectionList(ref, options) {
   let cursor;
   for (let pageIndex = 0; pageIndex < maxPagesForOptions(options); pageIndex += 1) {
     const args = buildResolveListArgs(ref.list_id, pageSizeForOptions(options), cursor);
-    const raw = await callTool(ref.agent_url, "get_collection_list", args, ref.auth_token);
+    const raw = resolvedListPayload(
+      await callTool(ref.agent_url, "get_collection_list", args, ref.auth_token),
+      "collection"
+    );
     if (!raw || typeof raw !== "object" || !("list" in raw)) {
       throw new Error("collection_list_invalid_response");
     }
     const response = raw;
+    if (response.status !== void 0 && response.status !== "completed" || raw.errors !== void 0 && (!Array.isArray(raw.errors) || raw.errors.some((error) => !error || typeof error !== "object" || error.severity !== "warning")) || !response.list || response.list.list_id !== ref.list_id || !Array.isArray(response.collections) || response.collections.some(
+      (collection) => !collection || typeof collection !== "object" || Array.isArray(collection) || ["publisher_domain", "collection_id", "collection_rid", "name"].some(
+        (field) => field in collection && typeof collection[field] !== "string"
+      ) || collection.distribution_ids !== void 0 && (!Array.isArray(collection.distribution_ids) || collection.distribution_ids.some(
+        (identifier) => !identifier || typeof identifier !== "object" || typeof identifier.type !== "string" || typeof identifier.value !== "string"
+      ))
+    )) {
+      throw new Error("collection_list_invalid_response");
+    }
+    if (options.strictResponseValidation) {
+      const { GetCollectionListResponseSchema } = await import("../types/schemas.generated.js");
+      if (!GetCollectionListResponseSchema.safeParse(raw).success || response.status !== "completed" || response.collections.length > pageSizeForOptions(options)) {
+        throw new Error("collection_list_invalid_response");
+      }
+    }
     listId = response.list.list_id;
     collections.push(...response.collections ?? []);
     if (typeof response.cache_valid_until === "string") {