@adcp/sdk 5.25.0 → 6.0.0

package/dist/lib/server/index.js

@@ -1,10 +1,29 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toMcpResponse = exports.TestControllerError = exports.handleTestControllerRequest = exports.registerTestController = exports.MCP_TASKS_MIGRATION = exports.getMcpTasksMigration = exports.cleanupExpiredTasks = exports.PostgresTaskStore = exports.isTerminal = exports.InMemoryTaskStore = exports.createTaskCapableServer = exports.registerAdcpTaskTool = exports.taskToolResponse = exports.validActionsForStatus = exports.toStructuredContent = exports.reportUsageResponse = exports.syncGovernanceResponse = exports.syncAccountsResponse = exports.acquireRightsRejected = exports.acquireRightsPendingApproval = exports.acquireRightsAcquired = exports.acquireRightsResponse = exports.cancelMediaBuyResponse = exports.activateSignalResponse = exports.getSignalsResponse = exports.syncCreativesResponse = exports.getPlanAuditLogsResponse = exports.listContentStandardsResponse = exports.listCollectionListsResponse = exports.listPropertyListsResponse = exports.listCreativesResponse = exports.creativeDeliveryResponse = exports.previewCreativeResponse = exports.buildCreativeMultiResponse = exports.buildCreativeResponse = exports.performanceFeedbackResponse = exports.getMediaBuysResponse = exports.updateMediaBuyResponse = exports.listCreativeFormatsResponse = exports.listAccountsResponse = exports.deliveryResponse = exports.mediaBuyResponse = exports.productsResponse = exports.capabilitiesResponse = exports.CONFLICT_ADCP_ERROR_ALLOWLIST = exports.ADCP_ERROR_FIELD_ALLOWLIST = exports.DEFAULT_ERROR_ENVELOPE_FIELDS = exports.ERROR_ENVELOPE_FIELD_ALLOWLIST = exports.wrapEnvelope = exports.adcpError = void 0;
-exports.ADCP_STATE_MIGRATION = exports.getAdcpStateMigration = exports.PostgresStateStore = exports.validateWrite = exports.validatePayloadSize = exports.validateId = exports.validateCollection = exports.isPutIfMatchConflict = exports.patchWithRetry = exports.scopedStore = exports.createSessionedStore = exports.SESSION_KEY_FIELD = exports.DEFAULT_MAX_DOCUMENT_BYTES = exports.PatchConflictError = exports.StateError = exports.InMemoryStateStore = exports.mcpToolNameResolver = exports.requireAuthenticatedOrSigned = exports.requireSignatureWhenPresent = exports.verifySignatureAsAuthenticator = exports.verifyIntrospection = exports.DEFAULT_JWT_CLOCK_TOLERANCE_SECONDS = exports.DEFAULT_JWT_ALGORITHMS = exports.getServeRequestContext = exports.ADCP_SERVE_REQUEST_CONTEXT = exports.isAuthenticatorPresenceGated = exports.tagAuthenticatorPresenceGated = exports.AUTH_PRESENCE_GATED = exports.authenticatorNeedsRawBody = exports.tagAuthenticatorNeedsRawBody = exports.AUTH_NEEDS_RAW_BODY = exports.AuthError = exports.signatureErrorCodeFromCause = exports.respondUnauthorized = exports.extractBearerToken = exports.anyOf = exports.verifyBearer = exports.verifyApiKey = exports.createExpressAdapter = exports.resolveHost = exports.hostname = exports.UnknownHostError = exports.serve = exports.createSeedFixtureCache = exports.enforceMapCap = exports.SESSION_ENTRY_CAP = exports.SEED_MESSAGES = exports.SEED_SCENARIOS = exports.CONTROLLER_SCENARIOS = exports.TOOL_INPUT_SHAPE = void 0;
-exports.matchesCollectionList = exports.matchesPropertyList = exports.resolveCollectionList = exports.resolvePropertyList = exports.governanceDeniedError = exports.checkGovernance = exports.LOOPBACK_OK_WEBHOOK_SSRF_POLICY = exports.WEBHOOK_SSRF_POLICY = exports.createPinAndBindFetch = exports.memoryWebhookKeyStore = exports.createWebhookEmitter = exports.A2AInvocationError = exports.createA2AAdapter = exports.hashPayload = exports.cleanupExpiredIdempotency = exports.IDEMPOTENCY_MIGRATION = exports.getIdempotencyMigration = exports.pgBackend = exports.memoryBackend = exports.probeIdempotencyStore = exports.createIdempotencyStore = exports.bridgeFromSessionStore = exports.bridgeFromTestControllerStore = exports.filterValidSeededProducts = exports.mergeSeededProductsIntoResponse = exports.isSandboxRequest = exports.DEFAULT_REPORTING_CAPABILITIES = exports.ADCP_SIGNED_REQUESTS_STATE = exports.ADCP_PRE_TRANSPORT = exports.requireSessionKey = exports.createAdcpServer = exports.structuredDeserialize = exports.structuredSerialize = void 0;
+exports.registerTestController = exports.MCP_TASKS_MIGRATION = exports.getMcpTasksMigration = exports.cleanupExpiredTasks = exports.PostgresTaskStore = exports.isTerminal = exports.InMemoryTaskStore = exports.createTaskCapableServer = exports.registerAdcpTaskTool = exports.taskToolResponse = exports.validActionsForStatus = exports.toStructuredContent = exports.reportUsageResponse = exports.syncGovernanceResponse = exports.syncAccountsResponse = exports.acquireRightsRejected = exports.acquireRightsPendingApproval = exports.acquireRightsAcquired = exports.acquireRightsResponse = exports.cancelMediaBuyResponse = exports.activateSignalResponse = exports.getSignalsResponse = exports.syncCreativesResponse = exports.getPlanAuditLogsResponse = exports.listContentStandardsResponse = exports.listCollectionListsResponse = exports.listPropertyListsResponse = exports.listCreativesResponse = exports.creativeDeliveryResponse = exports.previewCreativeResponse = exports.buildCreativeMultiResponse = exports.buildCreativeResponse = exports.performanceFeedbackResponse = exports.getMediaBuysResponse = exports.updateMediaBuyResponse = exports.listCreativeFormatsResponse = exports.listAccountsResponse = exports.deliveryResponse = exports.mediaBuyResponse = exports.productsResponse = exports.capabilitiesResponse = exports.CONFLICT_ADCP_ERROR_ALLOWLIST = exports.ADCP_ERROR_FIELD_ALLOWLIST = exports.DEFAULT_ERROR_ENVELOPE_FIELDS = exports.ERROR_ENVELOPE_FIELD_ALLOWLIST = exports.wrapEnvelope = exports.pickSafeDetails = exports.normalizeErrors = exports.normalizeError = exports.adcpError = void 0;
+exports.validateWrite = exports.validatePayloadSize = exports.validateId = exports.validateCollection = exports.isPutIfMatchConflict = exports.patchWithRetry = exports.scopedStore = exports.createSessionedStore = exports.SESSION_KEY_FIELD = exports.DEFAULT_MAX_DOCUMENT_BYTES = exports.PatchConflictError = exports.StateError = exports.InMemoryStateStore = exports.mcpToolNameResolver = exports.requireAuthenticatedOrSigned = exports.requireSignatureWhenPresent = exports.verifySignatureAsAuthenticator = exports.verifyIntrospection = exports.DEFAULT_JWT_CLOCK_TOLERANCE_SECONDS = exports.DEFAULT_JWT_ALGORITHMS = exports.getServeRequestContext = exports.ADCP_SERVE_REQUEST_CONTEXT = exports.isAuthenticatorPresenceGated = exports.tagAuthenticatorPresenceGated = exports.AUTH_PRESENCE_GATED = exports.authenticatorNeedsRawBody = exports.tagAuthenticatorNeedsRawBody = exports.AUTH_NEEDS_RAW_BODY = exports.AuthError = exports.signatureErrorCodeFromCause = exports.respondUnauthorized = exports.extractBearerToken = exports.anyOf = exports.verifyBearer = exports.verifyApiKey = exports.createExpressAdapter = exports.resolveHost = exports.hostname = exports.UnknownHostError = exports.serve = exports.createSeedFixtureCache = exports.enforceMapCap = exports.SESSION_ENTRY_CAP = exports.SEED_MESSAGES = exports.SEED_SCENARIOS = exports.CONTROLLER_SCENARIOS = exports.TOOL_INPUT_SHAPE = exports.toMcpResponse = exports.TestControllerError = exports.handleTestControllerRequest = void 0;
+exports.scopeCtxMetadataKey = exports.ctxMetadataResultKey = exports.hasCtxMetadata = exports.stripCtxMetadata = exports.MAX_TTL_SECONDS = exports.DEFAULT_MAX_VALUE_BYTES = exports.ADCP_INTERNAL_TAG = exports.CtxMetadataValidationError = exports.CTX_METADATA_MIGRATION = exports.cleanupExpiredCtxMetadata = exports.getCtxMetadataMigration = exports.pgCtxMetadataStore = exports.memoryCtxMetadataStore = exports.createCtxMetadataStore = exports.matchesCollectionList = exports.matchesPropertyList = exports.resolveCollectionList = exports.resolvePropertyList = exports.governanceDeniedError = exports.checkGovernance = exports.LOOPBACK_OK_WEBHOOK_SSRF_POLICY = exports.WEBHOOK_SSRF_POLICY = exports.createPinAndBindFetch = exports.memoryWebhookKeyStore = exports.createWebhookEmitter = exports.A2AInvocationError = exports.createA2AAdapter = exports.hashPayload = exports.cleanupExpiredIdempotency = exports.IDEMPOTENCY_MIGRATION = exports.getIdempotencyMigration = exports.pgBackend = exports.memoryBackend = exports.probeIdempotencyStore = exports.createIdempotencyStore = exports.bridgeFromSessionStore = exports.bridgeFromTestControllerStore = exports.filterValidSeededProducts = exports.mergeSeededProductsIntoResponse = exports.isSandboxRequest = exports.DEFAULT_REPORTING_CAPABILITIES = exports.ADCP_SIGNED_REQUESTS_STATE = exports.ADCP_PRE_TRANSPORT = exports.requireSessionKey = exports.structuredDeserialize = exports.structuredSerialize = exports.ADCP_STATE_MIGRATION = exports.getAdcpStateMigration = exports.PostgresStateStore = void 0;
 var errors_1 = require("./errors");
 Object.defineProperty(exports, "adcpError", { enumerable: true, get: function () { return errors_1.adcpError; } });
+var normalize_errors_1 = require("./normalize-errors");
+Object.defineProperty(exports, "normalizeError", { enumerable: true, get: function () { return normalize_errors_1.normalizeError; } });
+Object.defineProperty(exports, "normalizeErrors", { enumerable: true, get: function () { return normalize_errors_1.normalizeErrors; } });
+var pick_safe_details_1 = require("./pick-safe-details");
+Object.defineProperty(exports, "pickSafeDetails", { enumerable: true, get: function () { return pick_safe_details_1.pickSafeDetails; } });
 var wrap_envelope_1 = require("./wrap-envelope");
 Object.defineProperty(exports, "wrapEnvelope", { enumerable: true, get: function () { return wrap_envelope_1.wrapEnvelope; } });
 var envelope_allowlist_1 = require("./envelope-allowlist");
@@ -121,8 +140,15 @@ Object.defineProperty(exports, "ADCP_STATE_MIGRATION", { enumerable: true, get:
 var structured_serialize_1 = require("./structured-serialize");
 Object.defineProperty(exports, "structuredSerialize", { enumerable: true, get: function () { return structured_serialize_1.structuredSerialize; } });
 Object.defineProperty(exports, "structuredDeserialize", { enumerable: true, get: function () { return structured_serialize_1.structuredDeserialize; } });
+// `createAdcpServer` is NOT re-exported from `@adcp/sdk/server` anymore —
+// LLMs scaffolding from skills consistently latched onto it as the canonical
+// entry point despite the @deprecated JSDoc. Removing the top-level export
+// forces new code to either reach for `createAdcpServerFromPlatform` (the v6
+// canonical) or import from `@adcp/sdk/server/legacy/v5` (mid-migration /
+// escape-hatch only). Breaking change: v5 adopters see a hard import error
+// and update their import path. The migration is one line; the LLM-output
+// quality win is significant. See `docs/migration-5.x-to-6.x.md`.
 var create_adcp_server_1 = require("./create-adcp-server");
-Object.defineProperty(exports, "createAdcpServer", { enumerable: true, get: function () { return create_adcp_server_1.createAdcpServer; } });
 Object.defineProperty(exports, "requireSessionKey", { enumerable: true, get: function () { return create_adcp_server_1.requireSessionKey; } });
 Object.defineProperty(exports, "ADCP_PRE_TRANSPORT", { enumerable: true, get: function () { return create_adcp_server_1.ADCP_PRE_TRANSPORT; } });
 Object.defineProperty(exports, "ADCP_SIGNED_REQUESTS_STATE", { enumerable: true, get: function () { return create_adcp_server_1.ADCP_SIGNED_REQUESTS_STATE; } });
@@ -161,4 +187,53 @@ Object.defineProperty(exports, "resolvePropertyList", { enumerable: true, get: f
 Object.defineProperty(exports, "resolveCollectionList", { enumerable: true, get: function () { return targeting_helpers_1.resolveCollectionList; } });
 Object.defineProperty(exports, "matchesPropertyList", { enumerable: true, get: function () { return targeting_helpers_1.matchesPropertyList; } });
 Object.defineProperty(exports, "matchesCollectionList", { enumerable: true, get: function () { return targeting_helpers_1.matchesCollectionList; } });
+// ---------------------------------------------------------------------------
+// Platform-shaped server entry point (recommended for new agents)
+// ---------------------------------------------------------------------------
+//
+// `createAdcpServerFromPlatform` wraps `createAdcpServer` (the lower-level
+// handler-bag entry above) with compile-time specialism enforcement
+// (`RequiredPlatformsFor<S>`), capability projection, idempotency wiring,
+// async tasks, status normalization, multi-tenant routing, and webhook
+// auto-emit. Adopters declare a typed `DecisioningPlatform` per-specialism
+// and the framework wires the rest. See `docs/migration-5.x-to-6.x.md`
+// and `skills/build-decisioning-platform/` for the full walkthrough.
+//
+// Both `createAdcpServer` and `createAdcpServerFromPlatform` live on the
+// same import path so adopters discover them as siblings; pick the
+// function shape that matches your agent. The platform path internally
+// builds an `AdcpServerConfig` and calls `createAdcpServer` — they're
+// not adjacent surfaces, they're parent-child layers of the same SDK.
+//
+// **Pin to v5 long-term?** Import from `@adcp/sdk/server/legacy/v5`
+// instead. The subpath is the stable home for the v5 handler-bag
+// constructor; the top-level re-export here may be removed in a
+// future major. New code should not pin against `legacy/v5` either —
+// reach for `createAdcpServerFromPlatform` first.
+__exportStar(require("./decisioning"), exports);
+// ---------------------------------------------------------------------------
+// Ctx-metadata store — opaque-blob round-trip for adapter-internal state
+// ---------------------------------------------------------------------------
+//
+// Publishers attach platform-specific opaque blobs to any returned resource
+// (product, media_buy, package, creative, audience, signal, rights_grant);
+// the framework persists by `(account_id, kind, id)`, strips from buyer-
+// facing wire payloads, threads back into the publisher's request context
+// on subsequent calls referencing the same resource ID. See
+// `docs/proposals/decisioning-platform-v6-1-ctx-metadata.md`.
+var ctx_metadata_1 = require("./ctx-metadata");
+Object.defineProperty(exports, "createCtxMetadataStore", { enumerable: true, get: function () { return ctx_metadata_1.createCtxMetadataStore; } });
+Object.defineProperty(exports, "memoryCtxMetadataStore", { enumerable: true, get: function () { return ctx_metadata_1.memoryCtxMetadataStore; } });
+Object.defineProperty(exports, "pgCtxMetadataStore", { enumerable: true, get: function () { return ctx_metadata_1.pgCtxMetadataStore; } });
+Object.defineProperty(exports, "getCtxMetadataMigration", { enumerable: true, get: function () { return ctx_metadata_1.getCtxMetadataMigration; } });
+Object.defineProperty(exports, "cleanupExpiredCtxMetadata", { enumerable: true, get: function () { return ctx_metadata_1.cleanupExpiredCtxMetadata; } });
+Object.defineProperty(exports, "CTX_METADATA_MIGRATION", { enumerable: true, get: function () { return ctx_metadata_1.CTX_METADATA_MIGRATION; } });
+Object.defineProperty(exports, "CtxMetadataValidationError", { enumerable: true, get: function () { return ctx_metadata_1.CtxMetadataValidationError; } });
+Object.defineProperty(exports, "ADCP_INTERNAL_TAG", { enumerable: true, get: function () { return ctx_metadata_1.ADCP_INTERNAL_TAG; } });
+Object.defineProperty(exports, "DEFAULT_MAX_VALUE_BYTES", { enumerable: true, get: function () { return ctx_metadata_1.DEFAULT_MAX_VALUE_BYTES; } });
+Object.defineProperty(exports, "MAX_TTL_SECONDS", { enumerable: true, get: function () { return ctx_metadata_1.MAX_TTL_SECONDS; } });
+Object.defineProperty(exports, "stripCtxMetadata", { enumerable: true, get: function () { return ctx_metadata_1.stripCtxMetadata; } });
+Object.defineProperty(exports, "hasCtxMetadata", { enumerable: true, get: function () { return ctx_metadata_1.hasCtxMetadata; } });
+Object.defineProperty(exports, "ctxMetadataResultKey", { enumerable: true, get: function () { return ctx_metadata_1.ctxMetadataResultKey; } });
+Object.defineProperty(exports, "scopeCtxMetadataKey", { enumerable: true, get: function () { return ctx_metadata_1.scopeCtxMetadataKey; } });
 //# sourceMappingURL=index.js.map

package/dist/lib/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":";;;;;AAAA,mCAAqC;AAA5B,mGAAA,SAAS,OAAA;AAGlB,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAGrB,2DAK8B;AAJ5B,oIAAA,8BAA8B,OAAA;AAC9B,mIAAA,6BAA6B,OAAA;AAC7B,gIAAA,0BAA0B,OAAA;AAC1B,mIAAA,6BAA6B,OAAA;AAG/B,yCA+BqB;AA9BnB,iHAAA,oBAAoB,OAAA;AACpB,6GAAA,gBAAgB,OAAA;AAChB,6GAAA,gBAAgB,OAAA;AAChB,6GAAA,gBAAgB,OAAA;AAChB,iHAAA,oBAAoB,OAAA;AACpB,wHAAA,2BAA2B,OAAA;AAC3B,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,wHAAA,2BAA2B,OAAA;AAC3B,kHAAA,qBAAqB,OAAA;AACrB,uHAAA,0BAA0B,OAAA;AAC1B,oHAAA,uBAAuB,OAAA;AACvB,qHAAA,wBAAwB,OAAA;AACxB,kHAAA,qBAAqB,OAAA;AACrB,sHAAA,yBAAyB,OAAA;AACzB,wHAAA,2BAA2B,OAAA;AAC3B,yHAAA,4BAA4B,OAAA;AAC5B,qHAAA,wBAAwB,OAAA;AACxB,kHAAA,qBAAqB,OAAA;AACrB,+GAAA,kBAAkB,OAAA;AAClB,mHAAA,sBAAsB,OAAA;AACtB,mHAAA,sBAAsB,OAAA;AACtB,kHAAA,qBAAqB,OAAA;AACrB,kHAAA,qBAAqB,OAAA;AACrB,yHAAA,4BAA4B,OAAA;AAC5B,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AACpB,mHAAA,sBAAsB,OAAA;AACtB,gHAAA,mBAAmB,OAAA;AACnB,gHAAA,mBAAmB,OAAA;AAIrB,yDAA4D;AAAnD,0HAAA,qBAAqB,OAAA;AAG9B,iCAMiB;AALf,yGAAA,gBAAgB,OAAA;AAChB,6GAAA,oBAAoB,OAAA;AACpB,gHAAA,uBAAuB,OAAA;AACvB,0GAAA,iBAAiB,OAAA;AACjB,mGAAA,UAAU,OAAA;AAeZ,6DAK+B;AAJ7B,wHAAA,iBAAiB,OAAA;AACjB,0HAAA,mBAAmB,OAAA;AACnB,2HAAA,oBAAoB,OAAA;AACpB,0HAAA,mBAAmB,OAAA;AAIrB,qDAY2B;AAXzB,yHAAA,sBAAsB,OAAA;AACtB,8HAAA,2BAA2B,OAAA;AAC3B,sHAAA,mBAAmB,OAAA;AACnB,gHAAA,aAAa,OAAA;AACb,mHAAA,gBAAgB,OAAA;AAChB,uHAAA,oBAAoB,OAAA;AACpB,iHAAA,cAAc,OAAA;AACd,gHAAA,aAAa,OAAA;AACb,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,yHAAA,sBAAsB,OAAA;AAWxB,iCAAyE;AAAhE,8FAAA,KAAK,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAAE,iGAAA,QAAQ,OAAA;AAAE,oGAAA,WAAW,OAAA;AAGvD,qDAAyD;AAAhD,uHAAA,oBAAoB,OAAA;AAG7B,+BAkBgB;AAjBd,oGAAA,YAAY,OAAA;AACZ,oGAAA,YAAY,OAAA;AACZ,6FAAA,KAAK,OAAA;AACL,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,mHAAA,2BAA2B,OAAA;AAC3B,iGAAA,SAAS,OAAA;AACT,2GAAA,mBAAmB,OAAA;AACnB,oHAAA,4BAA4B,OAAA;AAC5B,iHAAA,yBAAyB,OAAA;AACzB,2GAAA,mBAAmB,OAAA;AACnB,qHAAA,6BAA6B,OAAA;AAC7B,oHAAA,4BAA4B,OAAA;AAC5B,kHAAA,0BAA0B,OAAA;AAC1B,8GAAA,sBAAsB,OAAA;AACtB,8GAAA,sBAAsB,OAAA;AACtB,2HAAA,mCAAmC,OAAA;AAYrC,2DAA2D;AAAlD,yHAAA,mBAAmB,OAAA;AAO5B,mDAK0B;AAJxB,gIAAA,8BAA8B,OAAA;AAC9B,6HAAA,2BAA2B,OAAA;AAC3B,8HAAA,4BAA4B,OAAA;AAC5B,qHAAA,mBAAmB,OAAA;AAQrB,6CAcuB;AAbrB,iHAAA,kBAAkB,OAAA;AAClB,yGAAA,UAAU,OAAA;AACV,iHAAA,kBAAkB,OAAA;AAClB,yHAAA,0BAA0B,OAAA;AAC1B,gHAAA,iBAAiB,OAAA;AACjB,mHAAA,oBAAoB,OAAA;AACpB,0GAAA,WAAW,OAAA;AACX,6GAAA,cAAc,OAAA;AACd,mHAAA,oBAAoB,OAAA;AACpB,iHAAA,kBAAkB,OAAA;AAClB,yGAAA,UAAU,OAAA;AACV,kHAAA,mBAAmB,OAAA;AACnB,4GAAA,aAAa,OAAA;AAaf,+DAAyG;AAAhG,0HAAA,kBAAkB,OAAA;AAAE,6HAAA,qBAAqB,OAAA;AAAE,4HAAA,oBAAoB,OAAA;AAGxE,+DAAoF;AAA3E,2HAAA,mBAAmB,OAAA;AAAE,6HAAA,qBAAqB,OAAA;AAEnD,2DAK8B;AAJ5B,sHAAA,gBAAgB,OAAA;AAChB,uHAAA,iBAAiB,OAAA;AACjB,wHAAA,kBAAkB,OAAA;AAClB,gIAAA,0BAA0B,OAAA;AAiC5B,uDAAoE;AAA3D,kIAAA,8BAA8B,OAAA;AAEvC,mEAMkC;AALhC,0HAAA,gBAAgB,OAAA;AAChB,yIAAA,+BAA+B,OAAA;AAC/B,mIAAA,yBAAyB,OAAA;AACzB,uIAAA,6BAA6B,OAAA;AAC7B,gIAAA,sBAAsB,OAAA;AAQxB,6CASuB;AARrB,qHAAA,sBAAsB,OAAA;AACtB,oHAAA,qBAAqB,OAAA;AACrB,4GAAA,aAAa,OAAA;AACb,wGAAA,SAAS,OAAA;AACT,sHAAA,uBAAuB,OAAA;AACvB,oHAAA,qBAAqB,OAAA;AACrB,wHAAA,yBAAyB,OAAA;AACzB,0GAAA,WAAW,OAAA;AAYb,6CAAqE;AAA5D,+GAAA,gBAAgB,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAS7C,qDAAgF;AAAvE,uHAAA,oBAAoB,OAAA;AAAE,wHAAA,qBAAqB,OAAA;AAcpD,2DAAmH;AAA1G,2HAAA,qBAAqB,OAAA;AAAE,yHAAA,mBAAmB,OAAA;AAAE,qIAAA,+BAA+B,OAAA;AAGpF,2CAAsE;AAA7D,6GAAA,eAAe,OAAA;AAAE,mHAAA,qBAAqB,OAAA;AAS/C,yDAK6B;AAJ3B,wHAAA,mBAAmB,OAAA;AACnB,0HAAA,qBAAqB,OAAA;AACrB,wHAAA,mBAAmB,OAAA;AACnB,0HAAA,qBAAqB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/server/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,mCAAqC;AAA5B,mGAAA,SAAS,OAAA;AAGlB,uDAAqE;AAA5D,kHAAA,cAAc,OAAA;AAAE,mHAAA,eAAe,OAAA;AAGxC,yDAAsD;AAA7C,oHAAA,eAAe,OAAA;AAGxB,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AAGrB,2DAK8B;AAJ5B,oIAAA,8BAA8B,OAAA;AAC9B,mIAAA,6BAA6B,OAAA;AAC7B,gIAAA,0BAA0B,OAAA;AAC1B,mIAAA,6BAA6B,OAAA;AAG/B,yCA+BqB;AA9BnB,iHAAA,oBAAoB,OAAA;AACpB,6GAAA,gBAAgB,OAAA;AAChB,6GAAA,gBAAgB,OAAA;AAChB,6GAAA,gBAAgB,OAAA;AAChB,iHAAA,oBAAoB,OAAA;AACpB,wHAAA,2BAA2B,OAAA;AAC3B,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,wHAAA,2BAA2B,OAAA;AAC3B,kHAAA,qBAAqB,OAAA;AACrB,uHAAA,0BAA0B,OAAA;AAC1B,oHAAA,uBAAuB,OAAA;AACvB,qHAAA,wBAAwB,OAAA;AACxB,kHAAA,qBAAqB,OAAA;AACrB,sHAAA,yBAAyB,OAAA;AACzB,wHAAA,2BAA2B,OAAA;AAC3B,yHAAA,4BAA4B,OAAA;AAC5B,qHAAA,wBAAwB,OAAA;AACxB,kHAAA,qBAAqB,OAAA;AACrB,+GAAA,kBAAkB,OAAA;AAClB,mHAAA,sBAAsB,OAAA;AACtB,mHAAA,sBAAsB,OAAA;AACtB,kHAAA,qBAAqB,OAAA;AACrB,kHAAA,qBAAqB,OAAA;AACrB,yHAAA,4BAA4B,OAAA;AAC5B,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AACpB,mHAAA,sBAAsB,OAAA;AACtB,gHAAA,mBAAmB,OAAA;AACnB,gHAAA,mBAAmB,OAAA;AAIrB,yDAA4D;AAAnD,0HAAA,qBAAqB,OAAA;AAG9B,iCAMiB;AALf,yGAAA,gBAAgB,OAAA;AAChB,6GAAA,oBAAoB,OAAA;AACpB,gHAAA,uBAAuB,OAAA;AACvB,0GAAA,iBAAiB,OAAA;AACjB,mGAAA,UAAU,OAAA;AAeZ,6DAK+B;AAJ7B,wHAAA,iBAAiB,OAAA;AACjB,0HAAA,mBAAmB,OAAA;AACnB,2HAAA,oBAAoB,OAAA;AACpB,0HAAA,mBAAmB,OAAA;AAIrB,qDAY2B;AAXzB,yHAAA,sBAAsB,OAAA;AACtB,8HAAA,2BAA2B,OAAA;AAC3B,sHAAA,mBAAmB,OAAA;AACnB,gHAAA,aAAa,OAAA;AACb,mHAAA,gBAAgB,OAAA;AAChB,uHAAA,oBAAoB,OAAA;AACpB,iHAAA,cAAc,OAAA;AACd,gHAAA,aAAa,OAAA;AACb,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,yHAAA,sBAAsB,OAAA;AAWxB,iCAAyE;AAAhE,8FAAA,KAAK,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAAE,iGAAA,QAAQ,OAAA;AAAE,oGAAA,WAAW,OAAA;AAGvD,qDAAyD;AAAhD,uHAAA,oBAAoB,OAAA;AAG7B,+BAkBgB;AAjBd,oGAAA,YAAY,OAAA;AACZ,oGAAA,YAAY,OAAA;AACZ,6FAAA,KAAK,OAAA;AACL,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,mHAAA,2BAA2B,OAAA;AAC3B,iGAAA,SAAS,OAAA;AACT,2GAAA,mBAAmB,OAAA;AACnB,oHAAA,4BAA4B,OAAA;AAC5B,iHAAA,yBAAyB,OAAA;AACzB,2GAAA,mBAAmB,OAAA;AACnB,qHAAA,6BAA6B,OAAA;AAC7B,oHAAA,4BAA4B,OAAA;AAC5B,kHAAA,0BAA0B,OAAA;AAC1B,8GAAA,sBAAsB,OAAA;AACtB,8GAAA,sBAAsB,OAAA;AACtB,2HAAA,mCAAmC,OAAA;AAYrC,2DAA2D;AAAlD,yHAAA,mBAAmB,OAAA;AAO5B,mDAK0B;AAJxB,gIAAA,8BAA8B,OAAA;AAC9B,6HAAA,2BAA2B,OAAA;AAC3B,8HAAA,4BAA4B,OAAA;AAC5B,qHAAA,mBAAmB,OAAA;AAQrB,6CAcuB;AAbrB,iHAAA,kBAAkB,OAAA;AAClB,yGAAA,UAAU,OAAA;AACV,iHAAA,kBAAkB,OAAA;AAClB,yHAAA,0BAA0B,OAAA;AAC1B,gHAAA,iBAAiB,OAAA;AACjB,mHAAA,oBAAoB,OAAA;AACpB,0GAAA,WAAW,OAAA;AACX,6GAAA,cAAc,OAAA;AACd,mHAAA,oBAAoB,OAAA;AACpB,iHAAA,kBAAkB,OAAA;AAClB,yGAAA,UAAU,OAAA;AACV,kHAAA,mBAAmB,OAAA;AACnB,4GAAA,aAAa,OAAA;AAaf,+DAAyG;AAAhG,0HAAA,kBAAkB,OAAA;AAAE,6HAAA,qBAAqB,OAAA;AAAE,4HAAA,oBAAoB,OAAA;AAGxE,+DAAoF;AAA3E,2HAAA,mBAAmB,OAAA;AAAE,6HAAA,qBAAqB,OAAA;AAEnD,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,kEAAkE;AAClE,2DAAyG;AAAhG,uHAAA,iBAAiB,OAAA;AAAE,wHAAA,kBAAkB,OAAA;AAAE,gIAAA,0BAA0B,OAAA;AAiC1E,uDAAoE;AAA3D,kIAAA,8BAA8B,OAAA;AAEvC,mEAMkC;AALhC,0HAAA,gBAAgB,OAAA;AAChB,yIAAA,+BAA+B,OAAA;AAC/B,mIAAA,yBAAyB,OAAA;AACzB,uIAAA,6BAA6B,OAAA;AAC7B,gIAAA,sBAAsB,OAAA;AAQxB,6CASuB;AARrB,qHAAA,sBAAsB,OAAA;AACtB,oHAAA,qBAAqB,OAAA;AACrB,4GAAA,aAAa,OAAA;AACb,wGAAA,SAAS,OAAA;AACT,sHAAA,uBAAuB,OAAA;AACvB,oHAAA,qBAAqB,OAAA;AACrB,wHAAA,yBAAyB,OAAA;AACzB,0GAAA,WAAW,OAAA;AAYb,6CAAqE;AAA5D,+GAAA,gBAAgB,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAS7C,qDAAgF;AAAvE,uHAAA,oBAAoB,OAAA;AAAE,wHAAA,qBAAqB,OAAA;AAcpD,2DAAmH;AAA1G,2HAAA,qBAAqB,OAAA;AAAE,yHAAA,mBAAmB,OAAA;AAAE,qIAAA,+BAA+B,OAAA;AAGpF,2CAAsE;AAA7D,6GAAA,eAAe,OAAA;AAAE,mHAAA,qBAAqB,OAAA;AAS/C,yDAK6B;AAJ3B,wHAAA,mBAAmB,OAAA;AACnB,0HAAA,qBAAqB,OAAA;AACrB,wHAAA,mBAAmB,OAAA;AACnB,0HAAA,qBAAqB,OAAA;AASvB,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,uEAAuE;AACvE,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,iEAAiE;AACjE,gEAAgE;AAChE,qEAAqE;AACrE,kDAAkD;AAClD,gDAA8B;AAE9B,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,0EAA0E;AAC1E,4DAA4D;AAC5D,8DAA8D;AAC9D,+CAewB;AAdtB,sHAAA,sBAAsB,OAAA;AACtB,sHAAA,sBAAsB,OAAA;AACtB,kHAAA,kBAAkB,OAAA;AAClB,uHAAA,uBAAuB,OAAA;AACvB,yHAAA,yBAAyB,OAAA;AACzB,sHAAA,sBAAsB,OAAA;AACtB,0HAAA,0BAA0B,OAAA;AAC1B,iHAAA,iBAAiB,OAAA;AACjB,uHAAA,uBAAuB,OAAA;AACvB,+GAAA,eAAe,OAAA;AACf,gHAAA,gBAAgB,OAAA;AAChB,8GAAA,cAAc,OAAA;AACd,oHAAA,oBAAoB,OAAA;AACpB,mHAAA,mBAAmB,OAAA"}

package/dist/lib/server/legacy/v5/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `@adcp/sdk/server/legacy/v5` — stable home for the v5 handler-bag
+ * server constructor.
+ *
+ * **New code should not import from this subpath.** The canonical v6
+ * entry point is `createAdcpServerFromPlatform` from `@adcp/sdk/server`,
+ * which wraps this constructor with the typed specialism interfaces,
+ * compile-time capability enforcement, ctx_metadata auto-hydration,
+ * idempotency-principal synthesis, status mappers, multi-tenant routing,
+ * and webhook auto-emit. See `docs/migration-5.x-to-6.x.md`.
+ *
+ * Reasons to import from `legacy/v5` rather than `@adcp/sdk/server`:
+ *
+ *   1. **Mid-migration codebases.** v5 adopters who haven't finished
+ *      migrating to v6 keep working by switching the import path —
+ *      same constructor, same config shape, no behavior change.
+ *
+ *   2. **Escape-hatch handlers** that v6 doesn't model directly: custom
+ *      `tools[]` outside the AdCP wire surface, the `mergeSeam` hook,
+ *      `preTransport` / `signedRequests` middleware. These stay on v5
+ *      until the v6 platform interface picks them up explicitly.
+ *
+ *   3. **Pinning against future v6 evolution.** The top-level export
+ *      is `@deprecated` and may be removed in a major; `legacy/v5`
+ *      is the stable subpath for adopters who genuinely need the v5
+ *      shape long-term.
+ *
+ * The top-level `@adcp/sdk/server` keeps a tag-deprecated re-export of
+ * `createAdcpServer` for one cycle so existing imports don't break on
+ * upgrade. New imports SHOULD reach for the subpath.
+ *
+ * @public
+ */
+export { createAdcpServer } from '../../create-adcp-server';
+export * from '../..';
+export type { AdcpServerConfig, WebhooksConfig, AdcpToolMap, AdcpServerToolName, AdcpCapabilitiesConfig, AdcpCapabilitiesOverrides, AdcpCustomToolConfig, AdcpLogger, SignedRequestsConfig, AdcpPreTransport, AdcpSignedRequestsState, HandlerContext, SessionKeyContext, MediaBuyHandlers, SignalsHandlers, CreativeHandlers, GovernanceHandlers, AccountHandlers, EventTrackingHandlers, SponsoredIntelligenceHandlers, ResolveAccountContext, } from '../../create-adcp-server';
+export type { AdcpServer, AdcpServerComplianceApi, AdcpServerTransport, AdcpTestRequest, AdcpTestToolsCallRequest, AdcpTestResponse, } from '../../adcp-server';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/server/legacy/v5/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/lib/server/legacy/v5/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAM5D,cAAc,OAAO,CAAC;AAEtB,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACV,UAAU,EACV,uBAAuB,EACvB,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC"}

package/dist/lib/server/legacy/v5/index.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * `@adcp/sdk/server/legacy/v5` — stable home for the v5 handler-bag
+ * server constructor.
+ *
+ * **New code should not import from this subpath.** The canonical v6
+ * entry point is `createAdcpServerFromPlatform` from `@adcp/sdk/server`,
+ * which wraps this constructor with the typed specialism interfaces,
+ * compile-time capability enforcement, ctx_metadata auto-hydration,
+ * idempotency-principal synthesis, status mappers, multi-tenant routing,
+ * and webhook auto-emit. See `docs/migration-5.x-to-6.x.md`.
+ *
+ * Reasons to import from `legacy/v5` rather than `@adcp/sdk/server`:
+ *
+ *   1. **Mid-migration codebases.** v5 adopters who haven't finished
+ *      migrating to v6 keep working by switching the import path —
+ *      same constructor, same config shape, no behavior change.
+ *
+ *   2. **Escape-hatch handlers** that v6 doesn't model directly: custom
+ *      `tools[]` outside the AdCP wire surface, the `mergeSeam` hook,
+ *      `preTransport` / `signedRequests` middleware. These stay on v5
+ *      until the v6 platform interface picks them up explicitly.
+ *
+ *   3. **Pinning against future v6 evolution.** The top-level export
+ *      is `@deprecated` and may be removed in a major; `legacy/v5`
+ *      is the stable subpath for adopters who genuinely need the v5
+ *      shape long-term.
+ *
+ * The top-level `@adcp/sdk/server` keeps a tag-deprecated re-export of
+ * `createAdcpServer` for one cycle so existing imports don't break on
+ * upgrade. New imports SHOULD reach for the subpath.
+ *
+ * @public
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAdcpServer = void 0;
+// `createAdcpServer` is the v5 entry point that was previously at the
+// top-level `@adcp/sdk/server` export. It now lives only here.
+var create_adcp_server_1 = require("../../create-adcp-server");
+Object.defineProperty(exports, "createAdcpServer", { enumerable: true, get: function () { return create_adcp_server_1.createAdcpServer; } });
+// Re-export everything else from `@adcp/sdk/server` so a v5 adopter's
+// migration path is a single-line import swap:
+//   from '@adcp/sdk/server'  →  from '@adcp/sdk/server/legacy/v5'
+// without splitting destructured imports across two paths.
+__exportStar(require("../.."), exports);
+//# sourceMappingURL=index.js.map

package/dist/lib/server/legacy/v5/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/lib/server/legacy/v5/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;;;;;;;;;;;;;;;;;AAEH,sEAAsE;AACtE,+DAA+D;AAC/D,+DAA4D;AAAnD,sHAAA,gBAAgB,OAAA;AAEzB,sEAAsE;AACtE,+CAA+C;AAC/C,kEAAkE;AAClE,2DAA2D;AAC3D,wCAAsB"}

package/dist/lib/server/normalize-errors.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Wire-shape normalizer for the AdCP `Error` row used in tool responses
+ * carrying per-row failures (`sync_creatives`, `sync_audiences`,
+ * `sync_accounts`, `report_usage`, `acquire_rights` error arm).
+ *
+ * Adopters return errors in whichever shape their codebase already
+ * speaks: bare strings, native `Error` instances, plain
+ * `{ code, message }` objects, `AdcpError` instances thrown internally,
+ * upstream-platform error objects with vendor-specific fields. This
+ * helper coerces all of those into the canonical wire `Error` shape
+ * (`code`, `message`, optional `field` / `suggestion` / `retry_after`
+ * / `details` / `recovery`) so the framework's response validator
+ * accepts the projected response without forcing every adopter to
+ * hand-shape the wire envelope.
+ *
+ * @see AdCP wire spec: `core/error.json`
+ *
+ * @public
+ */
+/**
+ * Canonical wire `Error` row. Mirrors `core/error.json` —
+ * `code` + `message` are required; everything else optional.
+ *
+ * Differs from the SDK's `AdcpStructuredError` in only one detail —
+ * `recovery` is optional here (per the wire spec) but required on
+ * `AdcpStructuredError` (the SDK's stricter shape for thrown errors).
+ *
+ * @public
+ */
+export interface NormalizedError {
+    code: string;
+    message: string;
+    field?: string;
+    suggestion?: string;
+    retry_after?: number;
+    details?: Record<string, unknown>;
+    recovery?: 'transient' | 'correctable' | 'terminal';
+}
+/**
+ * Coerce a single adopter-returned error value into the canonical
+ * wire `Error` shape. Handles:
+ *
+ *   - `string` → `{ code: 'GENERIC_ERROR', message: <input>, recovery: 'terminal' }`
+ *   - `Error` instance → `{ code: 'GENERIC_ERROR', message: err.message, recovery: 'terminal' }`
+ *   - `AdcpError` instance → projected to wire shape using its `code` /
+ *     `recovery` / `field` / `suggestion` / `retry_after` / `details`
+ *   - Plain object with `code` + `message` → fields whitelisted to the
+ *     wire shape; vendor-specific fields dropped (use `details` for
+ *     vendor extensions)
+ *   - Any other object → `{ code: 'GENERIC_ERROR', message: <safeStringify>, recovery: 'terminal' }`
+ *   - `null` / `undefined` → `{ code: 'GENERIC_ERROR', message: 'Unknown error', recovery: 'terminal' }`
+ *
+ * The `details` field, when present on the input, is shallow-copied
+ * and SHOULD be passed through {@link pickSafeDetails} on the
+ * adopter side before reaching this helper. `normalizeError` does NOT
+ * sanitize `details` — it's the adopter's job to ensure no
+ * credentials / PII / stack traces land there.
+ *
+ * @public
+ */
+export declare function normalizeError(input: unknown): NormalizedError;
+/**
+ * Coerce an adopter-returned errors collection into a wire-shaped
+ * `Error[]`. Accepts `undefined` / `null` (returns `undefined`),
+ * a single error value (wraps in array), or an array of error values
+ * (each normalized via {@link normalizeError}).
+ *
+ * Empty arrays and arrays where every entry normalizes to the same
+ * sentinel "Unknown error" are still emitted — the framework lets the
+ * wire validator decide whether `errors: []` is acceptable for the
+ * specific tool response (sync_creatives accepts empty;
+ * sync_creatives_error requires non-empty).
+ *
+ * Use at the v6 wire-projection seam:
+ *
+ * ```ts
+ * import { normalizeErrors } from '@adcp/client/server';
+ *
+ * const projected = adopterRows.map(row => ({
+ *   ...row,
+ *   errors: normalizeErrors(row.errors),
+ * }));
+ * ```
+ *
+ * @public
+ */
+export declare function normalizeErrors(input: unknown): NormalizedError[] | undefined;
+//# sourceMappingURL=normalize-errors.d.ts.map

package/dist/lib/server/normalize-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-errors.d.ts","sourceRoot":"","sources":["../../../src/lib/server/normalize-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,EAAE,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CA0C9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,EAAE,GAAG,SAAS,CAM7E"}

package/dist/lib/server/normalize-errors.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * Wire-shape normalizer for the AdCP `Error` row used in tool responses
+ * carrying per-row failures (`sync_creatives`, `sync_audiences`,
+ * `sync_accounts`, `report_usage`, `acquire_rights` error arm).
+ *
+ * Adopters return errors in whichever shape their codebase already
+ * speaks: bare strings, native `Error` instances, plain
+ * `{ code, message }` objects, `AdcpError` instances thrown internally,
+ * upstream-platform error objects with vendor-specific fields. This
+ * helper coerces all of those into the canonical wire `Error` shape
+ * (`code`, `message`, optional `field` / `suggestion` / `retry_after`
+ * / `details` / `recovery`) so the framework's response validator
+ * accepts the projected response without forcing every adopter to
+ * hand-shape the wire envelope.
+ *
+ * @see AdCP wire spec: `core/error.json`
+ *
+ * @public
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeError = normalizeError;
+exports.normalizeErrors = normalizeErrors;
+exports._coerceErrorCode = _coerceErrorCode;
+/**
+ * Coerce a single adopter-returned error value into the canonical
+ * wire `Error` shape. Handles:
+ *
+ *   - `string` → `{ code: 'GENERIC_ERROR', message: <input>, recovery: 'terminal' }`
+ *   - `Error` instance → `{ code: 'GENERIC_ERROR', message: err.message, recovery: 'terminal' }`
+ *   - `AdcpError` instance → projected to wire shape using its `code` /
+ *     `recovery` / `field` / `suggestion` / `retry_after` / `details`
+ *   - Plain object with `code` + `message` → fields whitelisted to the
+ *     wire shape; vendor-specific fields dropped (use `details` for
+ *     vendor extensions)
+ *   - Any other object → `{ code: 'GENERIC_ERROR', message: <safeStringify>, recovery: 'terminal' }`
+ *   - `null` / `undefined` → `{ code: 'GENERIC_ERROR', message: 'Unknown error', recovery: 'terminal' }`
+ *
+ * The `details` field, when present on the input, is shallow-copied
+ * and SHOULD be passed through {@link pickSafeDetails} on the
+ * adopter side before reaching this helper. `normalizeError` does NOT
+ * sanitize `details` — it's the adopter's job to ensure no
+ * credentials / PII / stack traces land there.
+ *
+ * @public
+ */
+function normalizeError(input) {
+    if (input == null) {
+        return { code: 'GENERIC_ERROR', message: 'Unknown error', recovery: 'terminal' };
+    }
+    if (typeof input === 'string') {
+        return { code: 'GENERIC_ERROR', message: input, recovery: 'terminal' };
+    }
+    // AdcpError-shaped (has `code`, optional structured fields). Detected
+    // structurally rather than via instanceof so framework code in different
+    // module realms (test fixtures, server-side renderers) still gets the
+    // typed projection.
+    if (typeof input === 'object' && 'code' in input) {
+        const obj = input;
+        const code = typeof obj.code === 'string' && obj.code.length > 0 ? obj.code : 'GENERIC_ERROR';
+        const message = typeof obj.message === 'string' && obj.message.length > 0 ? obj.message : code; // fall back to code when message missing — never empty-string
+        const out = { code, message };
+        if (typeof obj.field === 'string')
+            out.field = obj.field;
+        if (typeof obj.suggestion === 'string')
+            out.suggestion = obj.suggestion;
+        if (typeof obj.retry_after === 'number' && Number.isFinite(obj.retry_after)) {
+            // Wire spec clamps retry_after to [1, 3600]
+            out.retry_after = Math.max(1, Math.min(3600, Math.floor(obj.retry_after)));
+        }
+        if (obj.recovery === 'transient' || obj.recovery === 'correctable' || obj.recovery === 'terminal') {
+            out.recovery = obj.recovery;
+        }
+        if (typeof obj.details === 'object' && obj.details !== null) {
+            // Shallow copy to break aliasing; adopter is responsible for sanitizing
+            // via pickSafeDetails before reaching here.
+            out.details = { ...obj.details };
+        }
+        return out;
+    }
+    // Native Error (no `code` field, has `message`).
+    if (input instanceof Error) {
+        return { code: 'GENERIC_ERROR', message: input.message || 'Unknown error', recovery: 'terminal' };
+    }
+    // Last-resort: stringify whatever was passed.
+    return {
+        code: 'GENERIC_ERROR',
+        message: safeStringify(input),
+        recovery: 'terminal',
+    };
+}
+/**
+ * Coerce an adopter-returned errors collection into a wire-shaped
+ * `Error[]`. Accepts `undefined` / `null` (returns `undefined`),
+ * a single error value (wraps in array), or an array of error values
+ * (each normalized via {@link normalizeError}).
+ *
+ * Empty arrays and arrays where every entry normalizes to the same
+ * sentinel "Unknown error" are still emitted — the framework lets the
+ * wire validator decide whether `errors: []` is acceptable for the
+ * specific tool response (sync_creatives accepts empty;
+ * sync_creatives_error requires non-empty).
+ *
+ * Use at the v6 wire-projection seam:
+ *
+ * ```ts
+ * import { normalizeErrors } from '@adcp/client/server';
+ *
+ * const projected = adopterRows.map(row => ({
+ *   ...row,
+ *   errors: normalizeErrors(row.errors),
+ * }));
+ * ```
+ *
+ * @public
+ */
+function normalizeErrors(input) {
+    if (input == null)
+        return undefined;
+    if (Array.isArray(input)) {
+        return input.map(normalizeError);
+    }
+    return [normalizeError(input)];
+}
+/**
+ * Coerce an `ErrorCode`-typed input back to the underlying string —
+ * useful when adopters pass an enum-narrowed code into a place that
+ * expects the wire string. Pure-function alias for clarity at call
+ * sites; the runtime is identity.
+ *
+ * @internal
+ */
+function _coerceErrorCode(code) {
+    return code;
+}
+/** Best-effort `JSON.stringify` that swallows circular-reference errors. */
+function safeStringify(input) {
+    try {
+        const s = JSON.stringify(input);
+        return typeof s === 'string' ? s : String(input);
+    }
+    catch {
+        return '[unserializable error]';
+    }
+}
+//# sourceMappingURL=normalize-errors.js.map

package/dist/lib/server/normalize-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize-errors.js","sourceRoot":"","sources":["../../../src/lib/server/normalize-errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AA8CH,wCA0CC;AA2BD,0CAMC;AAUD,4CAEC;AA7GD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACzE,CAAC;IACD,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;QAC9F,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,8DAA8D;QAC9J,MAAM,GAAG,GAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/C,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACzD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;YAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;QACxE,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,4CAA4C;YAC5C,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAClG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC9B,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5D,wEAAwE;YACxE,4CAA4C;YAC5C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAI,GAAG,CAAC,OAAmC,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,iDAAiD;IACjD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACpG,CAAC;IACD,8CAA8C;IAC9C,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;QAC7B,QAAQ,EAAE,UAAU;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,IAAwB;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/lib/server/pick-safe-details.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Security primitive for the `details` field on `AdcpError` and the
+ * `Error` wire row. Adopters fronting upstream platforms (GAM, Snap,
+ * retail-media APIs, internal billing systems) often want to surface
+ * upstream error context to buyers — but raw upstream errors carry
+ * credentials, PII, internal stack traces, request IDs that leak
+ * tenant identity, and other liability surfaces that MUST NOT cross
+ * the wire boundary.
+ *
+ * `pickSafeDetails(input, allowlist, opts?)` is an explicit-allowlist
+ * sanitizer: only keys in the allowlist survive, with optional caps
+ * on depth and serialized size. Returns `undefined` when the input is
+ * not a plain object or the allowlist filter produces an empty
+ * result, so callers can spread the return into an optional `details`
+ * field without polluting it with `{}`.
+ *
+ * Adopters should call this BEFORE constructing the `AdcpError` /
+ * wire `Error` row. The framework's `normalizeError` does NOT
+ * sanitize details — it shallow-copies whatever was passed.
+ *
+ * @example
+ * ```ts
+ * import { pickSafeDetails } from '@adcp/client/server';
+ *
+ * try {
+ *   await gamClient.createOrder(req);
+ * } catch (upstreamErr) {
+ *   throw new AdcpError('UPSTREAM_REJECTED', {
+ *     recovery: 'transient',
+ *     message: 'Ad server rejected the order',
+ *     // Allowlist: only safe upstream fields cross the wire
+ *     details: pickSafeDetails(upstreamErr, [
+ *       'http_status',
+ *       'request_id',
+ *       'gam_error_code',
+ *     ]),
+ *   });
+ * }
+ * ```
+ *
+ * @public
+ */
+export interface PickSafeDetailsOptions {
+    /**
+     * Maximum nesting depth retained in the result. `undefined` keeps
+     * the input unchanged at any depth; values like `2` keep top-level
+     * + one nested level. Strings, numbers, booleans, and null are
+     * leaves; arrays and plain objects count as a level.
+     *
+     * Default: `2` — top-level + one nested level. Caps cardinality
+     * blast radius from accidentally-recursive upstream error objects.
+     */
+    maxDepth?: number;
+    /**
+     * Maximum serialized JSON byte size of the result (best-effort
+     * UTF-8 estimate via `JSON.stringify().length`). When the projected
+     * result exceeds this, returns `undefined` rather than truncating —
+     * adopters should choose a tighter allowlist if they hit the cap.
+     *
+     * Default: `2048` bytes. Wire envelopes shouldn't carry kilobytes
+     * of details; if you need that, ship via `publishStatusChange` or
+     * `task_registry.progress`.
+     */
+    maxSizeBytes?: number;
+}
+/**
+ * Filter `input` to keys named in `allowlist`, depth-capped and
+ * size-capped. Returns `undefined` when the result is empty or
+ * exceeds the size cap so callers can spread the value into an
+ * optional `details` field without polluting it.
+ *
+ * Properties NOT in the allowlist are dropped silently (no warning;
+ * the design assumes the allowlist is the contract). Nested objects
+ * are recursively filtered with the SAME allowlist — there is no
+ * per-key allowlist for nested fields. Adopters who need per-level
+ * filtering should call `pickSafeDetails` recursively on each
+ * nested value.
+ *
+ * Common-sense behaviors:
+ *   - `null` / `undefined` / non-object input → `undefined`
+ *   - Empty result after filtering → `undefined`
+ *   - Arrays at the top level → `undefined` (use a wrapping object)
+ *   - Functions and Symbols are dropped
+ *   - Date / RegExp / Error / Map / Set are dropped (use a string
+ *     allowlist of primitive fields, or pre-shape the input)
+ *
+ * @public
+ */
+export declare function pickSafeDetails(input: unknown, allowlist: readonly string[], opts?: PickSafeDetailsOptions): Record<string, unknown> | undefined;
+//# sourceMappingURL=pick-safe-details.d.ts.map

package/dist/lib/server/pick-safe-details.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pick-safe-details.d.ts","sourceRoot":"","sources":["../../../src/lib/server/pick-safe-details.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAyBrC"}