@adcp/sdk 6.6.0 → 6.7.0

package/compliance/cache/{3.0.1 → 3.0.5}/universal/storyboard-schema.yaml

@@ -53,6 +53,60 @@
 #     MUST exist in the source tree at build time. Duplicate IDs
 #     across files are a build-time error.)
 #
+# default_agent: string (optional — logical agent key used by multi-agent
+#   storyboard runners to route steps that do not have a unique specialism
+#   claimant in the runtime agents map. Resolved by the runner against the
+#   `agents` option passed to `runStoryboard({ agents: { sales: …, governance: …, … } })`.
+#
+#   Key shape: free-form non-empty string, matched verbatim against the
+#   runtime `agents` map's keys. The spec does NOT constrain the key to the
+#   specialism enum (`sales`, `signals`, `governance`, `creative`, `brand`)
+#   because production multi-agent topologies legitimately fan out per-property
+#   (`nyt_sales`, `wsj_sales`), per-region (`sales_eu`, `sales_us`), or
+#   per-brand-rights-holder. Authors choose the convention that matches their
+#   operator's CI invocation; portability across operators is the author's
+#   concern, not the spec's.
+#
+#   When to set it. Storyboards that exercise cross-domain tools — e.g.,
+#   `sync_creatives`, `list_creative_formats` — do not name a single specialism
+#   the runner can match. The author has the most context for which logical
+#   tenant should receive these calls (usually "wherever the seller is":
+#   `sales`). Encoding `default_agent: sales` once in the YAML beats
+#   re-asserting it on every CI invocation. (Note: `comply_test_controller`
+#   is routed via `prerequisites.controller_seeding`, not this field — the
+#   controller is a back-channel, not a specialism claimant.)
+#
+#   Resolution order (runner contract — see adcp-client#1066, adcp-client#1355):
+#     1. Step-level `agent:` override (if declared on the step).
+#     2. Specialism-claimant match against the runtime agents map (matched
+#        via each agent's `get_adcp_capabilities.supported_protocols`):
+#          - Exactly one agent claims the step's task's specialism → route there.
+#          - Zero claimants → fall through to slot 3.
+#          - Two or more claimants → runner MUST grade the step `unrouted_step`
+#            rather than picking arbitrarily. Multi-claim is an operator-config
+#            error; the storyboard cannot disambiguate it. Slot 3/4 do NOT
+#            rescue this case — silently picking one would mask the misconfig.
+#     3. Storyboard-level `default_agent` (THIS field) resolved against the
+#        runtime agents map. When the field is set but the key is absent from
+#        the map, the runner MUST grade the step `default_agent_unresolved`
+#        and MUST NOT fall through to slot 4 — silent fallback would invisibly
+#        override the storyboard author's encoded intent. Slot 4 fires only
+#        when the storyboard does NOT declare this field.
+#     4. Run-options `default_agent` passed to `runStoryboard({ default_agent })`.
+#        Same key-resolution rule as slot 3: set-but-unmatched grades
+#        `default_agent_unresolved`; unset falls through to slot 5.
+#     5. Fail-fast — runner raises `unrouted_step` and grades the step failed.
+#
+#   Single-agent runs ignore this field entirely — there is no map to resolve
+#   against, every step routes to the only configured agent. Authors SHOULD
+#   still declare it for clarity; multi-agent runners treat it as advisory and
+#   single-agent runners as a no-op.
+#
+#   Validation. The `<key>` MUST be a non-empty string. Validation that the
+#   key resolves to a configured tenant is a runtime concern (per the slot 3
+#   rule above), not a schema concern — the same storyboard runs against
+#   different topologies.)
+#
 # agent:
 #   interaction_model: enum (stateless_transform | stateful_preloaded | stateful_push | stateless_generate | media_buy_seller | marketplace_catalog | owned_signals | si_platform | brand_rights_holder | governance_agent)
 #   capabilities: string[] (AdCP capability flags: supports_transformation, has_creative_library, supports_generation, sells_media, accepts_briefs, supports_guaranteed, supports_non_guaranteed, catalog_signals)
@@ -272,6 +326,54 @@
 #     "prior_step.<step_id>.passed"   → true if the named prior step in the same storyboard passed
 #   Storyboard authors should prefer expressing gating through step ordering when possible.
 #
+# provides_state_for: string | string[] (optional — declares that this step's pass
+#   establishes equivalent state for the named peer step(s) in the same phase. Used
+#   to rescue the cascade-skip default when one of two interchangeable stateful
+#   steps is missing on the agent: e.g., explicit-mode sellers that pre-provision
+#   accounts out-of-band declare `sync_accounts` as missing_tool but expose
+#   `list_accounts` as the canonical alternative — declaring
+#   `provides_state_for: sync_accounts` on `list_accounts` tells the runner that
+#   the substitute's pass satisfies the same downstream state contract.
+#
+#   Grammar parallels `contributes_to`: declared on the substitute step, names
+#   the target peer(s) whose state it provides. The two fields are independent —
+#   `contributes_to` flows branch-set flags into a later `assert_contribution`;
+#   `provides_state_for` waives a peer's missing-tool / missing-test-controller
+#   cascade so downstream stateful steps still run.
+#
+#   Array semantics: `provides_state_for: [A, B]` is ALL-OF — one substitute pass
+#   establishes state for both A and B simultaneously. ANY-OF semantics are not
+#   supported; if a substitute only conditionally satisfies a peer, model it as
+#   two separate substitute steps.
+#
+#   Validation rules (enforced by lint:storyboard-provides-state-for, fail at
+#   parse time):
+#     - Same-phase only. The target step MUST live in the same phase as the
+#       substitute step. Cross-phase substitution is rejected; a cross-phase
+#       state contract belongs in `context_outputs` / `context_inputs`, not
+#       this field.
+#     - Target step must exist in the same phase by `id`.
+#     - Target step MUST declare `stateful: true`. Stateless peers don't
+#       carry a state contract to substitute for.
+#     - Substitute step MUST declare `stateful: true`. A stateless step
+#       cannot establish equivalent state on the agent side.
+#     - Self-references (`provides_state_for: <own_id>`) are rejected.
+#     - Cycles (A→B and B→A in the same phase) are rejected. The peer-graph
+#       per phase MUST be acyclic.
+#
+#   Runner behavior (see runner-output-contract.yaml > skip_result.reasons.peer_substituted):
+#     - When the substitute step passes AND the target peer would otherwise
+#       grade `missing_tool` / `missing_test_controller`, the runner MUST
+#       grade the target peer with skip reason `peer_substituted` (not
+#       `missing_tool`) and MUST NOT cascade `prerequisite_failed` to
+#       downstream stateful steps in subsequent phases.
+#     - When the substitute step itself fails or is skipped, the cascade
+#       proceeds as if `provides_state_for` were absent — the substitute
+#       did not establish the state it claimed.
+#
+#   See adcontextprotocol/adcp#3734 (mechanism rationale) and
+#   adcp-client#1130 (the cascade-skip default this field rescues).
+#
 # context_outputs: array of ContextOutput objects (optional — capture values from
 #   this step's response into the runner's context accumulator so later steps can
 #   reference them via $context.<name>). Each entry:
@@ -575,7 +677,10 @@
 #
 # --- Validation ---
 #
-# check: string (what to validate: "response_schema", "field_present", "field_value",
+# check: string (what to validate: "response_schema", "field_present",
+#                "envelope_field_present" (walks protocol-envelope.json instead of
+#                response_schema_ref — use for top-level envelope fields like `status`),
+#                "field_value",
 #                "field_value_or_absent", "status_code", "http_status", "http_status_in",
 #                "error_code", "on_401_require_header", "resource_equals_agent_url",
 #                "any_of", "refs_resolve", "a2a_submitted_artifact")

package/compliance/cache/{3.0.1 → 3.0.5}/universal/v3-envelope-integrity.yaml

@@ -15,7 +15,9 @@ narrative: |
   docs/building/implementation/task-lifecycle.mdx.
 
   This storyboard documents the machine-check assertion and asserts the canonical v3
-  `status` field is present. The explicit envelope-root field-absence checks
+  `status` field is present using the `envelope_field_present` check type (added in
+  adcp-client#1045), which walks the protocol envelope rather than the inner response
+  schema. The explicit envelope-root field-absence checks
   (asserting task_status and response_status are absent) require `field_absent`
   runner support in @adcp/client — those checks are marked TODO below and are not
   executed until the runner ships that check type. The schema-level constraint
@@ -82,7 +84,7 @@ phases:
         validations:
           - check: response_schema
             description: "Response matches get-adcp-capabilities-response.json schema"
-          - check: field_present
+          - check: envelope_field_present
             path: "status"
             description: "Envelope carries the canonical v3 status field"
           # TODO: restore these as field_absent checks once @adcp/client runner ships

package/dist/lib/adapters/implicit-account-store.d.ts

@@ -0,0 +1,170 @@
+/**
+ * InMemoryImplicitAccountStore
+ *
+ * Reference implementation of `AccountStore` for `resolution: 'implicit'`
+ * platforms. Platforms using this resolution mode require buyers to call
+ * `sync_accounts` before any tool that needs tenant context; subsequent
+ * requests resolve the account from the caller's auth principal rather
+ * than from an inline `ext.account_ref`.
+ *
+ * Use this in tests and as a copy-and-adapt starting point for durable
+ * implementations. See `docs/guides/account-resolution.md` for key
+ * derivation guidance, error contracts, and TTL recommendations.
+ *
+ * **Picking an AccountStore?** Three reference shapes by *who creates the
+ * account*:
+ * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`
+ *   (this file, Shape A).
+ * - **Upstream OAuth API owns the roster** → `createOAuthPassthroughResolver`
+ *   (Shape B, returns just `resolve`).
+ * - **Publisher ops curates the roster** → `createRosterAccountStore`
+ *   (Shape C, complete AccountStore).
+ *
+ * @see docs/guides/account-resolution.md
+ * @public
+ */
+import type { AccountReference } from '../types/tools.generated';
+import type { Account, AccountStore, ResolvedAuthInfo, ResolveContext, SyncAccountsResultRow } from '../server/decisioning';
+/**
+ * Default key-extraction function for the auth-principal→account mapping.
+ *
+ * Canonical choices by credential kind:
+ * - `'oauth'`   → `oauth:<client_id>`   (OAuth 2.0 client identity; stable across token rotations)
+ * - `'api_key'` → `api_key:<key_id>`   (API-key identity; stable until key is revoked)
+ * - `'http_sig'`→ `http_sig:<agent_url>` (verified caller URL; the most durable identity)
+ *
+ * Adopters who key on `authInfo.sub` or `authInfo.extra` instead MUST
+ * document that choice — those fields are grant-specific and may not be
+ * stable across credential rotations.
+ */
+export declare function defaultImplicitKeyFn(authInfo: ResolvedAuthInfo): string | undefined;
+/**
+ * Constructor options for `InMemoryImplicitAccountStore`.
+ * @public
+ */
+export interface ImplicitAccountStoreOptions<TCtxMeta = Record<string, unknown>> {
+    /**
+     * Convert a buyer-supplied `AccountReference` (from `sync_accounts`) to the
+     * seller's `Account<TCtxMeta>`. Called once per ref in `upsert()`.
+     *
+     * **Default:** builds a synthetic account from the ref fields. Suitable
+     * for tests; replace for production (call your platform's account-lookup
+     * or account-creation API here).
+     */
+    buildAccount?: (ref: AccountReference, ctx?: ResolveContext) => Account<TCtxMeta> | Promise<Account<TCtxMeta>>;
+    /**
+     * Extract the principal key from `ResolvedAuthInfo`. The returned string
+     * is the lookup key for the `authInfo → accounts` mapping.
+     *
+     * **Default:** `defaultImplicitKeyFn` — uses `credential.client_id`
+     * (oauth), `credential.key_id` (api_key), or `credential.agent_url`
+     * (http_sig). Stable across token rotations within the same credential
+     * kind.
+     *
+     * Override when your platform keys on a custom claim (e.g., a
+     * `sub`-derived tenant ID in `authInfo.extra`).
+     */
+    keyFn?: (authInfo: ResolvedAuthInfo) => string | undefined;
+    /**
+     * Sync-linkage TTL in milliseconds. Entries stored by `upsert()` expire
+     * after this duration; `resolve()` returns `null` (→ `ACCOUNT_NOT_FOUND`)
+     * for expired entries, prompting the buyer to call `sync_accounts` again.
+     *
+     * **Default:** `86_400_000` (24 hours). Align with your platform's session
+     * or token lifetime; longer TTLs risk serving stale account state.
+     *
+     * Distinct from `AccountStore.refreshToken` — that refreshes the upstream
+     * OAuth token mid-request. This TTL governs how long the sync-linkage
+     * itself is valid before a fresh `sync_accounts` is required.
+     */
+    ttlMs?: number;
+}
+/**
+ * In-memory `AccountStore` for `resolution: 'implicit'` platforms.
+ *
+ * Wire contract:
+ * 1. Buyer calls `sync_accounts` → framework calls `upsert()` → store records
+ *    `authKey → accounts[]`.
+ * 2. Buyer calls any tool (e.g. `create_media_buy`) without `ext.account_ref`
+ *    → framework calls `resolve(undefined, ctx)` → store looks up by `authKey`.
+ * 3. If no prior sync: `resolve()` returns `null` → framework emits
+ *    `ACCOUNT_NOT_FOUND`. Do NOT return `AUTH_REQUIRED` — that signals
+ *    missing credentials, not a missing pre-sync.
+ *
+ * This class is intentionally minimal. Copy-and-adapt for durable stores
+ * (Postgres, Redis); see `docs/guides/account-resolution.md` for the DDL
+ * reference and the key-derivation rationale.
+ *
+ * @example
+ * ```ts
+ * import { InMemoryImplicitAccountStore } from '@adcp/sdk/server';
+ *
+ * const accountStore = new InMemoryImplicitAccountStore({
+ *   buildAccount: async (ref, ctx) => {
+ *     const upstream = await myPlatform.findOrCreate(ref, ctx?.authInfo);
+ *     return {
+ *       id: upstream.id,
+ *       name: upstream.name,
+ *       status: 'active',
+ *       ctx_metadata: { upstreamId: upstream.id },
+ *     };
+ *   },
+ * });
+ *
+ * // Wire into createAdcpServer:
+ * createAdcpServer({ accounts: accountStore, ... });
+ * ```
+ *
+ * @public
+ */
+export declare class InMemoryImplicitAccountStore<TCtxMeta = Record<string, unknown>> implements AccountStore<TCtxMeta> {
+    readonly resolution: "implicit";
+    private _store;
+    private _keyFn;
+    private _ttlMs;
+    private _buildAccount;
+    constructor(options?: ImplicitAccountStoreOptions<TCtxMeta>);
+    /**
+     * Resolve the caller's account from the auth-principal→account mapping
+     * populated by a prior `sync_accounts` call.
+     *
+     * Returns `null` (→ `ACCOUNT_NOT_FOUND`) when:
+     * - No prior `sync_accounts` was called for this principal
+     * - The stored entry has exceeded `ttlMs`
+     * - `ctx.authInfo` is absent or carries no extractable key
+     *
+     * **Multi-account note.** When a buyer synced multiple refs in one
+     * `sync_accounts` call, this implementation returns the _first_ stored
+     * account. If your platform requires per-request account disambiguation
+     * (e.g., different brands on the same buyer), switch to `'explicit'` mode
+     * so buyers pass `ext.account_ref` on each request, or override `keyFn`
+     * to encode the brand into the key.
+     */
+    resolve(_ref: AccountReference | undefined, ctx?: ResolveContext): Promise<Account<TCtxMeta> | null>;
+    /**
+     * Process a `sync_accounts` payload: build accounts from refs and store
+     * them under the caller's auth key.
+     *
+     * The auth key is extracted from `ctx.authInfo` via `keyFn`. When the
+     * key cannot be derived (no credential or unrecognized credential kind),
+     * all refs are returned as `SYNC_FAILED` rows — a silent-success-then-
+     * mystery-failure sequence is worse than an explicit error. Check your
+     * `authenticate` callback and `keyFn` if you see this error.
+     *
+     * When `ctx.authInfo` is absent (unauthenticated call), all refs fail
+     * with `UNAUTHENTICATED`. Your `authenticate` callback in
+     * `serve({ authenticate })` should reject unauthenticated requests before
+     * reaching this method.
+     */
+    upsert(refs: AccountReference[], ctx?: ResolveContext): Promise<SyncAccountsResultRow[]>;
+    /** Remove all stored sync linkages. */
+    clear(): void;
+    /**
+     * Return the auth key that would be derived from `authInfo`.
+     * Useful in tests to assert that a specific principal's linkage was stored.
+     */
+    authKey(authInfo: ResolvedAuthInfo): string | undefined;
+    /** Return the number of principal → accounts linkages currently stored. */
+    get size(): number;
+}
+//# sourceMappingURL=implicit-account-store.d.ts.map

package/dist/lib/adapters/implicit-account-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"implicit-account-store.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/implicit-account-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,0BAA0B,CAAC;AACjF,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EAEZ,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAM/B;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAWnF;AAiBD;;;GAGG;AACH,MAAM,WAAW,2BAA2B,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC7E;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/G;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,MAAM,GAAG,SAAS,CAAC;IAE3D;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,qBAAa,4BAA4B,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,YAAW,YAAY,CAAC,QAAQ,CAAC;IAC7G,QAAQ,CAAC,UAAU,EAAG,UAAU,CAAU;IAE1C,OAAO,CAAC,MAAM,CAA4C;IAC1D,OAAO,CAAC,MAAM,CAAqD;IACnE,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAG+B;gBAExC,OAAO,CAAC,EAAE,2BAA2B,CAAC,QAAQ,CAAC;IAQ3D;;;;;;;;;;;;;;;OAeG;IACG,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAc1G;;;;;;;;;;;;;;OAcG;IACG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAqH9F,uCAAuC;IACvC,KAAK,IAAI,IAAI;IAIb;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS;IAIvD,2EAA2E;IAC3E,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/lib/adapters/implicit-account-store.js

@@ -0,0 +1,313 @@
+"use strict";
+/**
+ * InMemoryImplicitAccountStore
+ *
+ * Reference implementation of `AccountStore` for `resolution: 'implicit'`
+ * platforms. Platforms using this resolution mode require buyers to call
+ * `sync_accounts` before any tool that needs tenant context; subsequent
+ * requests resolve the account from the caller's auth principal rather
+ * than from an inline `ext.account_ref`.
+ *
+ * Use this in tests and as a copy-and-adapt starting point for durable
+ * implementations. See `docs/guides/account-resolution.md` for key
+ * derivation guidance, error contracts, and TTL recommendations.
+ *
+ * **Picking an AccountStore?** Three reference shapes by *who creates the
+ * account*:
+ * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`
+ *   (this file, Shape A).
+ * - **Upstream OAuth API owns the roster** → `createOAuthPassthroughResolver`
+ *   (Shape B, returns just `resolve`).
+ * - **Publisher ops curates the roster** → `createRosterAccountStore`
+ *   (Shape C, complete AccountStore).
+ *
+ * @see docs/guides/account-resolution.md
+ * @public
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryImplicitAccountStore = void 0;
+exports.defaultImplicitKeyFn = defaultImplicitKeyFn;
+// ---------------------------------------------------------------------------
+// Key extraction
+// ---------------------------------------------------------------------------
+/**
+ * Default key-extraction function for the auth-principal→account mapping.
+ *
+ * Canonical choices by credential kind:
+ * - `'oauth'`   → `oauth:<client_id>`   (OAuth 2.0 client identity; stable across token rotations)
+ * - `'api_key'` → `api_key:<key_id>`   (API-key identity; stable until key is revoked)
+ * - `'http_sig'`→ `http_sig:<agent_url>` (verified caller URL; the most durable identity)
+ *
+ * Adopters who key on `authInfo.sub` or `authInfo.extra` instead MUST
+ * document that choice — those fields are grant-specific and may not be
+ * stable across credential rotations.
+ */
+function defaultImplicitKeyFn(authInfo) {
+    const cred = authInfo.credential;
+    if (!cred)
+        return undefined;
+    switch (cred.kind) {
+        case 'oauth':
+            return `oauth:${cred.client_id}`;
+        case 'api_key':
+            return `api_key:${cred.key_id}`;
+        case 'http_sig':
+            return `http_sig:${cred.agent_url}`;
+    }
+}
+// Natural key for a ref — used to detect re-syncs of the same
+// (brand, operator, sandbox) tuple so upsert() can return 'unchanged'
+// without calling buildAccount again (which may be non-deterministic).
+function refNaturalKey(ref) {
+    const r = ref;
+    const domain = r['brand']?.['domain'];
+    const operator = r['operator'];
+    const sandbox = Boolean(r['sandbox']);
+    return `${domain ?? ''}|${operator ?? ''}|${sandbox ? '1' : '0'}`;
+}
+// ---------------------------------------------------------------------------
+// Default buildAccount
+// ---------------------------------------------------------------------------
+function defaultBuildAccount(ref, _ctx) {
+    const r = ref;
+    const brand = r['brand'];
+    const operator = r['operator'] ?? '';
+    const sandbox = r['sandbox'] === true;
+    const sandboxSuffix = sandbox ? ':sandbox' : '';
+    const account_id = r['account_id'] ??
+        (brand && 'domain' in brand
+            ? `${brand.domain}:${operator}${sandboxSuffix}`
+            : `ref:${operator}${sandboxSuffix}`);
+    return {
+        id: account_id,
+        name: account_id,
+        status: 'active',
+        ...(brand !== undefined && { brand }),
+        ...(operator !== '' && { operator }),
+        ...(sandbox && { sandbox: true }),
+        ctx_metadata: {},
+    };
+}
+/**
+ * In-memory `AccountStore` for `resolution: 'implicit'` platforms.
+ *
+ * Wire contract:
+ * 1. Buyer calls `sync_accounts` → framework calls `upsert()` → store records
+ *    `authKey → accounts[]`.
+ * 2. Buyer calls any tool (e.g. `create_media_buy`) without `ext.account_ref`
+ *    → framework calls `resolve(undefined, ctx)` → store looks up by `authKey`.
+ * 3. If no prior sync: `resolve()` returns `null` → framework emits
+ *    `ACCOUNT_NOT_FOUND`. Do NOT return `AUTH_REQUIRED` — that signals
+ *    missing credentials, not a missing pre-sync.
+ *
+ * This class is intentionally minimal. Copy-and-adapt for durable stores
+ * (Postgres, Redis); see `docs/guides/account-resolution.md` for the DDL
+ * reference and the key-derivation rationale.
+ *
+ * @example
+ * ```ts
+ * import { InMemoryImplicitAccountStore } from '@adcp/sdk/server';
+ *
+ * const accountStore = new InMemoryImplicitAccountStore({
+ *   buildAccount: async (ref, ctx) => {
+ *     const upstream = await myPlatform.findOrCreate(ref, ctx?.authInfo);
+ *     return {
+ *       id: upstream.id,
+ *       name: upstream.name,
+ *       status: 'active',
+ *       ctx_metadata: { upstreamId: upstream.id },
+ *     };
+ *   },
+ * });
+ *
+ * // Wire into createAdcpServer:
+ * createAdcpServer({ accounts: accountStore, ... });
+ * ```
+ *
+ * @public
+ */
+class InMemoryImplicitAccountStore {
+    resolution = 'implicit';
+    _store = new Map();
+    _keyFn;
+    _ttlMs;
+    _buildAccount;
+    constructor(options) {
+        this._buildAccount =
+            options?.buildAccount ??
+                defaultBuildAccount;
+        this._keyFn = options?.keyFn ?? defaultImplicitKeyFn;
+        this._ttlMs = options?.ttlMs ?? 86_400_000;
+    }
+    /**
+     * Resolve the caller's account from the auth-principal→account mapping
+     * populated by a prior `sync_accounts` call.
+     *
+     * Returns `null` (→ `ACCOUNT_NOT_FOUND`) when:
+     * - No prior `sync_accounts` was called for this principal
+     * - The stored entry has exceeded `ttlMs`
+     * - `ctx.authInfo` is absent or carries no extractable key
+     *
+     * **Multi-account note.** When a buyer synced multiple refs in one
+     * `sync_accounts` call, this implementation returns the _first_ stored
+     * account. If your platform requires per-request account disambiguation
+     * (e.g., different brands on the same buyer), switch to `'explicit'` mode
+     * so buyers pass `ext.account_ref` on each request, or override `keyFn`
+     * to encode the brand into the key.
+     */
+    async resolve(_ref, ctx) {
+        const authInfo = ctx?.authInfo;
+        if (!authInfo)
+            return null;
+        const key = this._keyFn(authInfo);
+        if (key === undefined)
+            return null;
+        const entry = this._store.get(key);
+        if (!entry)
+            return null;
+        if (Date.now() - entry.storedAt > this._ttlMs) {
+            this._store.delete(key);
+            return null;
+        }
+        return entry.accounts[0] ?? null;
+    }
+    /**
+     * Process a `sync_accounts` payload: build accounts from refs and store
+     * them under the caller's auth key.
+     *
+     * The auth key is extracted from `ctx.authInfo` via `keyFn`. When the
+     * key cannot be derived (no credential or unrecognized credential kind),
+     * all refs are returned as `SYNC_FAILED` rows — a silent-success-then-
+     * mystery-failure sequence is worse than an explicit error. Check your
+     * `authenticate` callback and `keyFn` if you see this error.
+     *
+     * When `ctx.authInfo` is absent (unauthenticated call), all refs fail
+     * with `UNAUTHENTICATED`. Your `authenticate` callback in
+     * `serve({ authenticate })` should reject unauthenticated requests before
+     * reaching this method.
+     */
+    async upsert(refs, ctx) {
+        const authInfo = ctx?.authInfo;
+        // Derive the key before building any accounts. If the key cannot be
+        // extracted, fail all rows explicitly — returning success rows here
+        // would cause a mysterious ACCOUNT_NOT_FOUND on the next tool call.
+        const key = authInfo !== undefined ? this._keyFn(authInfo) : undefined;
+        if (key === undefined) {
+            return refs.map(ref => {
+                const r = ref;
+                return {
+                    brand: r['brand'] ?? { domain: 'unknown' },
+                    operator: r['operator'] ?? '',
+                    action: 'failed',
+                    status: 'rejected',
+                    errors: [
+                        {
+                            code: 'SYNC_FAILED',
+                            message: authInfo === undefined
+                                ? 'Unauthenticated: no authInfo on ctx — check authenticate configuration'
+                                : 'Could not derive principal key from auth credential — check keyFn or credential kind',
+                        },
+                    ],
+                };
+            });
+        }
+        // Build a natural-key index from any existing stored entry so we can
+        // detect re-syncs of the same (brand, operator, sandbox) tuple.
+        const existing = this._store.get(key);
+        const existingByNk = new Map();
+        if (existing) {
+            for (let i = 0; i < existing.refs.length; i++) {
+                existingByNk.set(refNaturalKey(existing.refs[i]), {
+                    account: existing.accounts[i],
+                    ref: existing.refs[i],
+                });
+            }
+        }
+        const newAccounts = [];
+        const newRefs = [];
+        const rows = [];
+        for (const ref of refs) {
+            const nk = refNaturalKey(ref);
+            const hit = existingByNk.get(nk);
+            if (hit) {
+                // Re-sync of the same (brand, operator, sandbox) — preserve the
+                // original account_id without calling buildAccount again so adopters
+                // with non-deterministic resolvers (upstream API calls, DB writes)
+                // don't accumulate duplicate ids on replay.
+                newAccounts.push(hit.account);
+                newRefs.push(hit.ref);
+                const r = ref;
+                const brand = hit.account.brand ??
+                    r['brand'] ??
+                    { domain: hit.account.id };
+                const operator = hit.account.operator ?? r['operator'] ?? '';
+                rows.push({
+                    account_id: hit.account.id,
+                    brand,
+                    operator,
+                    name: hit.account.name,
+                    action: 'unchanged',
+                    status: hit.account.status,
+                });
+                continue;
+            }
+            try {
+                const account = await this._buildAccount(ref, ctx);
+                newAccounts.push(account);
+                newRefs.push(ref);
+                const r = ref;
+                const brand = account.brand ?? r['brand'] ?? { domain: account.id };
+                const operator = account.operator ?? r['operator'] ?? '';
+                rows.push({
+                    account_id: account.id,
+                    brand,
+                    operator,
+                    name: account.name,
+                    action: 'created',
+                    status: account.status,
+                });
+            }
+            catch (err) {
+                // Suppress adopter-originated error details from the wire response —
+                // buildAccount exceptions may include upstream credentials, SQL text,
+                // or internal identifiers. Log server-side; emit a fixed string.
+                console.error('[InMemoryImplicitAccountStore] buildAccount threw:', err);
+                const r = ref;
+                rows.push({
+                    brand: r['brand'] ?? { domain: 'unknown' },
+                    operator: r['operator'] ?? '',
+                    action: 'failed',
+                    status: 'rejected',
+                    errors: [{ code: 'SYNC_FAILED', message: 'Account sync failed — check server logs' }],
+                });
+            }
+        }
+        // Only update the stored entry when at least one ref resolved successfully
+        // (either 'unchanged' or 'created'). An all-fail batch leaves the prior
+        // sync linkage intact so the buyer can retry without losing their mapping.
+        if (newAccounts.length > 0) {
+            this._store.set(key, { accounts: newAccounts, refs: newRefs, storedAt: Date.now() });
+        }
+        return rows;
+    }
+    // ---------------------------------------------------------------------------
+    // Test helpers
+    // ---------------------------------------------------------------------------
+    /** Remove all stored sync linkages. */
+    clear() {
+        this._store.clear();
+    }
+    /**
+     * Return the auth key that would be derived from `authInfo`.
+     * Useful in tests to assert that a specific principal's linkage was stored.
+     */
+    authKey(authInfo) {
+        return this._keyFn(authInfo);
+    }
+    /** Return the number of principal → accounts linkages currently stored. */
+    get size() {
+        return this._store.size;
+    }
+}
+exports.InMemoryImplicitAccountStore = InMemoryImplicitAccountStore;
+//# sourceMappingURL=implicit-account-store.js.map

package/dist/lib/adapters/implicit-account-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"implicit-account-store.js","sourceRoot":"","sources":["../../../src/lib/adapters/implicit-account-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AA4BH,oDAWC;AA3BD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAgB,oBAAoB,CAAC,QAA0B;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,SAAS,aAAa,CAAC,GAAqB;IAC1C,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,MAAM,GAAI,CAAC,CAAC,OAAO,CAAyC,EAAE,CAAC,QAAQ,CAAuB,CAAC;IACrG,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAuB,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAwB,CAAC,CAAC;IAC7D,OAAO,GAAG,MAAM,IAAI,EAAE,IAAI,QAAQ,IAAI,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACpE,CAAC;AAkDD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,mBAAmB,CAC1B,GAAqB,EACrB,IAAqB;IAErB,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAA+B,CAAC;IACvD,MAAM,QAAQ,GAAI,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,MAAM,UAAU,GACb,CAAC,CAAC,YAAY,CAAwB;QACvC,CAAC,KAAK,IAAI,QAAQ,IAAI,KAAK;YACzB,CAAC,CAAC,GAAI,KAA4B,CAAC,MAAM,IAAI,QAAQ,GAAG,aAAa,EAAE;YACvE,CAAC,CAAC,OAAO,QAAQ,GAAG,aAAa,EAAE,CAAC,CAAC;IACzC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,QAA6B;QACrC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjC,YAAY,EAAE,EAAwC;KACvD,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAa,4BAA4B;IAC9B,UAAU,GAAG,UAAmB,CAAC;IAElC,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAClD,MAAM,CAAqD;IAC3D,MAAM,CAAS;IACf,aAAa,CAG+B;IAEpD,YAAY,OAA+C;QACzD,IAAI,CAAC,aAAa;YAChB,OAAO,EAAE,YAAY;gBACpB,mBAAqG,CAAC;QACzG,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,oBAAoB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,OAAO,CAAC,IAAkC,EAAE,GAAoB;QACpE,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CAAC,IAAwB,EAAE,GAAoB;QACzD,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;QAE/B,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBACpB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,OAAO;oBACL,KAAK,EAAG,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,SAAS,EAAqB;oBAC9F,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE;oBACrD,MAAM,EAAE,QAAiB;oBACzB,MAAM,EAAE,UAA+B;oBACvC,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,aAAa;4BACnB,OAAO,EACL,QAAQ,KAAK,SAAS;gCACpB,CAAC,CAAC,wEAAwE;gCAC1E,CAAC,CAAC,sFAAsF;yBAC7F;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiE,CAAC;QAC9F,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE;oBACjD,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE;oBAC9B,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAwB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,IAAI,GAA4B,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,GAAG,EAAE,CAAC;gBACR,gEAAgE;gBAChE,qEAAqE;gBACrE,mEAAmE;gBACnE,4CAA4C;gBAC5C,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,MAAM,KAAK,GACT,GAAG,CAAC,OAAO,CAAC,KAAK;oBAChB,CAAC,CAAC,OAAO,CAAgC;oBACzC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAqB,CAAC;gBACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAK,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC;oBACR,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;oBAC1B,KAAK;oBACL,QAAQ;oBACR,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACtB,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;iBAC3B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,MAAM,KAAK,GACT,OAAO,CAAC,KAAK,IAAK,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAqB,CAAC;gBAC5G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAK,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;gBACjF,IAAI,CAAC,IAAI,CAAC;oBACR,UAAU,EAAE,OAAO,CAAC,EAAE;oBACtB,KAAK;oBACL,QAAQ;oBACR,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,sEAAsE;gBACtE,iEAAiE;gBACjE,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;gBACzE,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC;oBACR,KAAK,EAAG,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,SAAS,EAAqB;oBAC9F,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE;oBACrD,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,UAA+B;oBACvC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,eAAe;IACf,8EAA8E;IAE9E,uCAAuC;IACvC,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAA0B;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAtMD,oEAsMC"}

package/dist/lib/adapters/index.d.ts

@@ -10,10 +10,14 @@
  * - PropertyListAdapter: Manage buyer-defined property lists
  * - ProposalManager: Generate and refine media plan proposals
  * - SISessionManager: Handle Sponsored Intelligence conversational sessions
+ * - InMemoryImplicitAccountStore: AccountStore for resolution: 'implicit' platforms
  */
 export { ContentStandardsAdapter, type IContentStandardsAdapter, type ContentEvaluationResult, ContentStandardsErrorCodes, isContentStandardsError, defaultContentStandardsAdapter, } from './content-standards-adapter';
 export { PropertyListAdapter, type IPropertyListAdapter, type ResolvedProperty, PropertyListErrorCodes, isPropertyListError, defaultPropertyListAdapter, } from './property-list-adapter';
 export { ProposalManager, AIProposalManager, type IProposalManager, type ProposalContext, ProposalErrorCodes, defaultProposalManager, } from './proposal-manager';
 export { GovernanceAdapter, defaultGovernanceAdapter, type IGovernanceAdapter, type GovernanceAdapterConfig, type GovernanceAdapterErrorCode, type CommittedCheckRequest, GovernanceAdapterErrorCodes, isGovernanceAdapterError, } from './governance-adapter';
 export { SISessionManager, AISISessionManager, type ISISessionManager, type SISession, SIErrorCodes, defaultSISessionManager, } from './si-session-manager';
+export { InMemoryImplicitAccountStore, defaultImplicitKeyFn, type ImplicitAccountStoreOptions, } from './implicit-account-store';
+export { createOAuthPassthroughResolver, type OAuthPassthroughResolverOptions } from './oauth-passthrough-resolver';
+export { createRosterAccountStore, type RosterAccountStoreOptions } from './roster-account-store';
 //# sourceMappingURL=index.d.ts.map