@adcp/sdk 6.6.0 → 6.8.0

package/dist/lib/adapters/implicit-account-store.js

@@ -0,0 +1,315 @@
+"use strict";
+/**
+ * InMemoryImplicitAccountStore
+ *
+ * Reference implementation of `AccountStore` for `resolution: 'implicit'`
+ * platforms. Platforms using this resolution mode require buyers to call
+ * `sync_accounts` before any tool that needs tenant context; subsequent
+ * requests resolve the account from the caller's auth principal rather
+ * than from an inline `ext.account_ref`.
+ *
+ * Use this in tests and as a copy-and-adapt starting point for durable
+ * implementations. See `docs/guides/account-resolution.md` for key
+ * derivation guidance, error contracts, and TTL recommendations.
+ *
+ * **Picking an AccountStore?** Four reference shapes by *who creates the
+ * account*:
+ * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`
+ *   (this file, Shape A).
+ * - **Upstream OAuth API owns the roster** → `createOAuthPassthroughResolver`
+ *   (Shape B, returns just `resolve`).
+ * - **Publisher ops curates the roster** → `createRosterAccountStore`
+ *   (Shape C, complete AccountStore).
+ * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`
+ *   (Shape D, `resolution: 'derived'`).
+ *
+ * @see docs/guides/account-resolution.md
+ * @public
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryImplicitAccountStore = void 0;
+exports.defaultImplicitKeyFn = defaultImplicitKeyFn;
+// ---------------------------------------------------------------------------
+// Key extraction
+// ---------------------------------------------------------------------------
+/**
+ * Default key-extraction function for the auth-principal→account mapping.
+ *
+ * Canonical choices by credential kind:
+ * - `'oauth'`   → `oauth:<client_id>`   (OAuth 2.0 client identity; stable across token rotations)
+ * - `'api_key'` → `api_key:<key_id>`   (API-key identity; stable until key is revoked)
+ * - `'http_sig'`→ `http_sig:<agent_url>` (verified caller URL; the most durable identity)
+ *
+ * Adopters who key on `authInfo.sub` or `authInfo.extra` instead MUST
+ * document that choice — those fields are grant-specific and may not be
+ * stable across credential rotations.
+ */
+function defaultImplicitKeyFn(authInfo) {
+    const cred = authInfo.credential;
+    if (!cred)
+        return undefined;
+    switch (cred.kind) {
+        case 'oauth':
+            return `oauth:${cred.client_id}`;
+        case 'api_key':
+            return `api_key:${cred.key_id}`;
+        case 'http_sig':
+            return `http_sig:${cred.agent_url}`;
+    }
+}
+// Natural key for a ref — used to detect re-syncs of the same
+// (brand, operator, sandbox) tuple so upsert() can return 'unchanged'
+// without calling buildAccount again (which may be non-deterministic).
+function refNaturalKey(ref) {
+    const r = ref;
+    const domain = r['brand']?.['domain'];
+    const operator = r['operator'];
+    const sandbox = Boolean(r['sandbox']);
+    return `${domain ?? ''}|${operator ?? ''}|${sandbox ? '1' : '0'}`;
+}
+// ---------------------------------------------------------------------------
+// Default buildAccount
+// ---------------------------------------------------------------------------
+function defaultBuildAccount(ref, _ctx) {
+    const r = ref;
+    const brand = r['brand'];
+    const operator = r['operator'] ?? '';
+    const sandbox = r['sandbox'] === true;
+    const sandboxSuffix = sandbox ? ':sandbox' : '';
+    const account_id = r['account_id'] ??
+        (brand && 'domain' in brand
+            ? `${brand.domain}:${operator}${sandboxSuffix}`
+            : `ref:${operator}${sandboxSuffix}`);
+    return {
+        id: account_id,
+        name: account_id,
+        status: 'active',
+        ...(brand !== undefined && { brand }),
+        ...(operator !== '' && { operator }),
+        ...(sandbox && { sandbox: true }),
+        ctx_metadata: {},
+    };
+}
+/**
+ * In-memory `AccountStore` for `resolution: 'implicit'` platforms.
+ *
+ * Wire contract:
+ * 1. Buyer calls `sync_accounts` → framework calls `upsert()` → store records
+ *    `authKey → accounts[]`.
+ * 2. Buyer calls any tool (e.g. `create_media_buy`) without `ext.account_ref`
+ *    → framework calls `resolve(undefined, ctx)` → store looks up by `authKey`.
+ * 3. If no prior sync: `resolve()` returns `null` → framework emits
+ *    `ACCOUNT_NOT_FOUND`. Do NOT return `AUTH_REQUIRED` — that signals
+ *    missing credentials, not a missing pre-sync.
+ *
+ * This class is intentionally minimal. Copy-and-adapt for durable stores
+ * (Postgres, Redis); see `docs/guides/account-resolution.md` for the DDL
+ * reference and the key-derivation rationale.
+ *
+ * @example
+ * ```ts
+ * import { InMemoryImplicitAccountStore } from '@adcp/sdk/server';
+ *
+ * const accountStore = new InMemoryImplicitAccountStore({
+ *   buildAccount: async (ref, ctx) => {
+ *     const upstream = await myPlatform.findOrCreate(ref, ctx?.authInfo);
+ *     return {
+ *       id: upstream.id,
+ *       name: upstream.name,
+ *       status: 'active',
+ *       ctx_metadata: { upstreamId: upstream.id },
+ *     };
+ *   },
+ * });
+ *
+ * // Wire into createAdcpServer:
+ * createAdcpServer({ accounts: accountStore, ... });
+ * ```
+ *
+ * @public
+ */
+class InMemoryImplicitAccountStore {
+    resolution = 'implicit';
+    _store = new Map();
+    _keyFn;
+    _ttlMs;
+    _buildAccount;
+    constructor(options) {
+        this._buildAccount =
+            options?.buildAccount ??
+                defaultBuildAccount;
+        this._keyFn = options?.keyFn ?? defaultImplicitKeyFn;
+        this._ttlMs = options?.ttlMs ?? 86_400_000;
+    }
+    /**
+     * Resolve the caller's account from the auth-principal→account mapping
+     * populated by a prior `sync_accounts` call.
+     *
+     * Returns `null` (→ `ACCOUNT_NOT_FOUND`) when:
+     * - No prior `sync_accounts` was called for this principal
+     * - The stored entry has exceeded `ttlMs`
+     * - `ctx.authInfo` is absent or carries no extractable key
+     *
+     * **Multi-account note.** When a buyer synced multiple refs in one
+     * `sync_accounts` call, this implementation returns the _first_ stored
+     * account. If your platform requires per-request account disambiguation
+     * (e.g., different brands on the same buyer), switch to `'explicit'` mode
+     * so buyers pass `ext.account_ref` on each request, or override `keyFn`
+     * to encode the brand into the key.
+     */
+    async resolve(_ref, ctx) {
+        const authInfo = ctx?.authInfo;
+        if (!authInfo)
+            return null;
+        const key = this._keyFn(authInfo);
+        if (key === undefined)
+            return null;
+        const entry = this._store.get(key);
+        if (!entry)
+            return null;
+        if (Date.now() - entry.storedAt > this._ttlMs) {
+            this._store.delete(key);
+            return null;
+        }
+        return entry.accounts[0] ?? null;
+    }
+    /**
+     * Process a `sync_accounts` payload: build accounts from refs and store
+     * them under the caller's auth key.
+     *
+     * The auth key is extracted from `ctx.authInfo` via `keyFn`. When the
+     * key cannot be derived (no credential or unrecognized credential kind),
+     * all refs are returned as `SYNC_FAILED` rows — a silent-success-then-
+     * mystery-failure sequence is worse than an explicit error. Check your
+     * `authenticate` callback and `keyFn` if you see this error.
+     *
+     * When `ctx.authInfo` is absent (unauthenticated call), all refs fail
+     * with `UNAUTHENTICATED`. Your `authenticate` callback in
+     * `serve({ authenticate })` should reject unauthenticated requests before
+     * reaching this method.
+     */
+    async upsert(refs, ctx) {
+        const authInfo = ctx?.authInfo;
+        // Derive the key before building any accounts. If the key cannot be
+        // extracted, fail all rows explicitly — returning success rows here
+        // would cause a mysterious ACCOUNT_NOT_FOUND on the next tool call.
+        const key = authInfo !== undefined ? this._keyFn(authInfo) : undefined;
+        if (key === undefined) {
+            return refs.map(ref => {
+                const r = ref;
+                return {
+                    brand: r['brand'] ?? { domain: 'unknown' },
+                    operator: r['operator'] ?? '',
+                    action: 'failed',
+                    status: 'rejected',
+                    errors: [
+                        {
+                            code: 'SYNC_FAILED',
+                            message: authInfo === undefined
+                                ? 'Unauthenticated: no authInfo on ctx — check authenticate configuration'
+                                : 'Could not derive principal key from auth credential — check keyFn or credential kind',
+                        },
+                    ],
+                };
+            });
+        }
+        // Build a natural-key index from any existing stored entry so we can
+        // detect re-syncs of the same (brand, operator, sandbox) tuple.
+        const existing = this._store.get(key);
+        const existingByNk = new Map();
+        if (existing) {
+            for (let i = 0; i < existing.refs.length; i++) {
+                existingByNk.set(refNaturalKey(existing.refs[i]), {
+                    account: existing.accounts[i],
+                    ref: existing.refs[i],
+                });
+            }
+        }
+        const newAccounts = [];
+        const newRefs = [];
+        const rows = [];
+        for (const ref of refs) {
+            const nk = refNaturalKey(ref);
+            const hit = existingByNk.get(nk);
+            if (hit) {
+                // Re-sync of the same (brand, operator, sandbox) — preserve the
+                // original account_id without calling buildAccount again so adopters
+                // with non-deterministic resolvers (upstream API calls, DB writes)
+                // don't accumulate duplicate ids on replay.
+                newAccounts.push(hit.account);
+                newRefs.push(hit.ref);
+                const r = ref;
+                const brand = hit.account.brand ??
+                    r['brand'] ??
+                    { domain: hit.account.id };
+                const operator = hit.account.operator ?? r['operator'] ?? '';
+                rows.push({
+                    account_id: hit.account.id,
+                    brand,
+                    operator,
+                    name: hit.account.name,
+                    action: 'unchanged',
+                    status: hit.account.status,
+                });
+                continue;
+            }
+            try {
+                const account = await this._buildAccount(ref, ctx);
+                newAccounts.push(account);
+                newRefs.push(ref);
+                const r = ref;
+                const brand = account.brand ?? r['brand'] ?? { domain: account.id };
+                const operator = account.operator ?? r['operator'] ?? '';
+                rows.push({
+                    account_id: account.id,
+                    brand,
+                    operator,
+                    name: account.name,
+                    action: 'created',
+                    status: account.status,
+                });
+            }
+            catch (err) {
+                // Suppress adopter-originated error details from the wire response —
+                // buildAccount exceptions may include upstream credentials, SQL text,
+                // or internal identifiers. Log server-side; emit a fixed string.
+                console.error('[InMemoryImplicitAccountStore] buildAccount threw:', err);
+                const r = ref;
+                rows.push({
+                    brand: r['brand'] ?? { domain: 'unknown' },
+                    operator: r['operator'] ?? '',
+                    action: 'failed',
+                    status: 'rejected',
+                    errors: [{ code: 'SYNC_FAILED', message: 'Account sync failed — check server logs' }],
+                });
+            }
+        }
+        // Only update the stored entry when at least one ref resolved successfully
+        // (either 'unchanged' or 'created'). An all-fail batch leaves the prior
+        // sync linkage intact so the buyer can retry without losing their mapping.
+        if (newAccounts.length > 0) {
+            this._store.set(key, { accounts: newAccounts, refs: newRefs, storedAt: Date.now() });
+        }
+        return rows;
+    }
+    // ---------------------------------------------------------------------------
+    // Test helpers
+    // ---------------------------------------------------------------------------
+    /** Remove all stored sync linkages. */
+    clear() {
+        this._store.clear();
+    }
+    /**
+     * Return the auth key that would be derived from `authInfo`.
+     * Useful in tests to assert that a specific principal's linkage was stored.
+     */
+    authKey(authInfo) {
+        return this._keyFn(authInfo);
+    }
+    /** Return the number of principal → accounts linkages currently stored. */
+    get size() {
+        return this._store.size;
+    }
+}
+exports.InMemoryImplicitAccountStore = InMemoryImplicitAccountStore;
+//# sourceMappingURL=implicit-account-store.js.map

package/dist/lib/adapters/implicit-account-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"implicit-account-store.js","sourceRoot":"","sources":["../../../src/lib/adapters/implicit-account-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AA4BH,oDAWC;AA3BD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAgB,oBAAoB,CAAC,QAA0B;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,SAAS,aAAa,CAAC,GAAqB;IAC1C,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,MAAM,GAAI,CAAC,CAAC,OAAO,CAAyC,EAAE,CAAC,QAAQ,CAAuB,CAAC;IACrG,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAuB,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAwB,CAAC,CAAC;IAC7D,OAAO,GAAG,MAAM,IAAI,EAAE,IAAI,QAAQ,IAAI,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACpE,CAAC;AAkDD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,mBAAmB,CAC1B,GAAqB,EACrB,IAAqB;IAErB,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAA+B,CAAC;IACvD,MAAM,QAAQ,GAAI,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,MAAM,UAAU,GACb,CAAC,CAAC,YAAY,CAAwB;QACvC,CAAC,KAAK,IAAI,QAAQ,IAAI,KAAK;YACzB,CAAC,CAAC,GAAI,KAA4B,CAAC,MAAM,IAAI,QAAQ,GAAG,aAAa,EAAE;YACvE,CAAC,CAAC,OAAO,QAAQ,GAAG,aAAa,EAAE,CAAC,CAAC;IACzC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,QAA6B;QACrC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjC,YAAY,EAAE,EAAwC;KACvD,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAa,4BAA4B;IAC9B,UAAU,GAAG,UAAmB,CAAC;IAElC,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAClD,MAAM,CAAqD;IAC3D,MAAM,CAAS;IACf,aAAa,CAG+B;IAEpD,YAAY,OAA+C;QACzD,IAAI,CAAC,aAAa;YAChB,OAAO,EAAE,YAAY;gBACpB,mBAAqG,CAAC;QACzG,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,oBAAoB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,OAAO,CAAC,IAAkC,EAAE,GAAoB;QACpE,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CAAC,IAAwB,EAAE,GAAoB;QACzD,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;QAE/B,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBACpB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,OAAO;oBACL,KAAK,EAAG,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,SAAS,EAAqB;oBAC9F,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE;oBACrD,MAAM,EAAE,QAAiB;oBACzB,MAAM,EAAE,UAA+B;oBACvC,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,aAAa;4BACnB,OAAO,EACL,QAAQ,KAAK,SAAS;gCACpB,CAAC,CAAC,wEAAwE;gCAC1E,CAAC,CAAC,sFAAsF;yBAC7F;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiE,CAAC;QAC9F,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE;oBACjD,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE;oBAC9B,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAwB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,IAAI,GAA4B,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,GAAG,EAAE,CAAC;gBACR,gEAAgE;gBAChE,qEAAqE;gBACrE,mEAAmE;gBACnE,4CAA4C;gBAC5C,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,MAAM,KAAK,GACT,GAAG,CAAC,OAAO,CAAC,KAAK;oBAChB,CAAC,CAAC,OAAO,CAAgC;oBACzC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAqB,CAAC;gBACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAK,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC;oBACR,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;oBAC1B,KAAK;oBACL,QAAQ;oBACR,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACtB,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;iBAC3B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,MAAM,KAAK,GACT,OAAO,CAAC,KAAK,IAAK,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAqB,CAAC;gBAC5G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAK,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;gBACjF,IAAI,CAAC,IAAI,CAAC;oBACR,UAAU,EAAE,OAAO,CAAC,EAAE;oBACtB,KAAK;oBACL,QAAQ;oBACR,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,sEAAsE;gBACtE,iEAAiE;gBACjE,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;gBACzE,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC;oBACR,KAAK,EAAG,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,SAAS,EAAqB;oBAC9F,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE;oBACrD,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,UAA+B;oBACvC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,eAAe;IACf,8EAA8E;IAE9E,uCAAuC;IACvC,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAA0B;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAtMD,oEAsMC"}

package/dist/lib/adapters/index.d.ts

@@ -10,10 +10,15 @@
  * - PropertyListAdapter: Manage buyer-defined property lists
  * - ProposalManager: Generate and refine media plan proposals
  * - SISessionManager: Handle Sponsored Intelligence conversational sessions
+ * - InMemoryImplicitAccountStore: AccountStore for resolution: 'implicit' platforms
  */
 export { ContentStandardsAdapter, type IContentStandardsAdapter, type ContentEvaluationResult, ContentStandardsErrorCodes, isContentStandardsError, defaultContentStandardsAdapter, } from './content-standards-adapter';
 export { PropertyListAdapter, type IPropertyListAdapter, type ResolvedProperty, PropertyListErrorCodes, isPropertyListError, defaultPropertyListAdapter, } from './property-list-adapter';
 export { ProposalManager, AIProposalManager, type IProposalManager, type ProposalContext, ProposalErrorCodes, defaultProposalManager, } from './proposal-manager';
 export { GovernanceAdapter, defaultGovernanceAdapter, type IGovernanceAdapter, type GovernanceAdapterConfig, type GovernanceAdapterErrorCode, type CommittedCheckRequest, GovernanceAdapterErrorCodes, isGovernanceAdapterError, } from './governance-adapter';
 export { SISessionManager, AISISessionManager, type ISISessionManager, type SISession, SIErrorCodes, defaultSISessionManager, } from './si-session-manager';
+export { InMemoryImplicitAccountStore, defaultImplicitKeyFn, type ImplicitAccountStoreOptions, } from './implicit-account-store';
+export { createOAuthPassthroughResolver, type OAuthPassthroughResolverOptions } from './oauth-passthrough-resolver';
+export { createRosterAccountStore, type RosterAccountStoreOptions } from './roster-account-store';
+export { createDerivedAccountStore, type DerivedAccountStoreOptions } from './derived-account-store';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,YAAY,EACZ,uBAAuB,GACxB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,YAAY,EACZ,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,0BAA0B,CAAC;AAMlC,OAAO,EAAE,8BAA8B,EAAE,KAAK,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAOpH,OAAO,EAAE,wBAAwB,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAMlG,OAAO,EAAE,yBAAyB,EAAE,KAAK,0BAA0B,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/lib/adapters/index.js

@@ -11,9 +11,10 @@
  * - PropertyListAdapter: Manage buyer-defined property lists
  * - ProposalManager: Generate and refine media plan proposals
  * - SISessionManager: Handle Sponsored Intelligence conversational sessions
+ * - InMemoryImplicitAccountStore: AccountStore for resolution: 'implicit' platforms
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.defaultSISessionManager = exports.SIErrorCodes = exports.AISISessionManager = exports.SISessionManager = exports.isGovernanceAdapterError = exports.GovernanceAdapterErrorCodes = exports.defaultGovernanceAdapter = exports.GovernanceAdapter = exports.defaultProposalManager = exports.ProposalErrorCodes = exports.AIProposalManager = exports.ProposalManager = exports.defaultPropertyListAdapter = exports.isPropertyListError = exports.PropertyListErrorCodes = exports.PropertyListAdapter = exports.defaultContentStandardsAdapter = exports.isContentStandardsError = exports.ContentStandardsErrorCodes = exports.ContentStandardsAdapter = void 0;
+exports.createDerivedAccountStore = exports.createRosterAccountStore = exports.createOAuthPassthroughResolver = exports.defaultImplicitKeyFn = exports.InMemoryImplicitAccountStore = exports.defaultSISessionManager = exports.SIErrorCodes = exports.AISISessionManager = exports.SISessionManager = exports.isGovernanceAdapterError = exports.GovernanceAdapterErrorCodes = exports.defaultGovernanceAdapter = exports.GovernanceAdapter = exports.defaultProposalManager = exports.ProposalErrorCodes = exports.AIProposalManager = exports.ProposalManager = exports.defaultPropertyListAdapter = exports.isPropertyListError = exports.PropertyListErrorCodes = exports.PropertyListAdapter = exports.defaultContentStandardsAdapter = exports.isContentStandardsError = exports.ContentStandardsErrorCodes = exports.ContentStandardsAdapter = void 0;
 // Content Standards
 var content_standards_adapter_1 = require("./content-standards-adapter");
 Object.defineProperty(exports, "ContentStandardsAdapter", { enumerable: true, get: function () { return content_standards_adapter_1.ContentStandardsAdapter; } });
@@ -44,4 +45,27 @@ Object.defineProperty(exports, "SISessionManager", { enumerable: true, get: func
 Object.defineProperty(exports, "AISISessionManager", { enumerable: true, get: function () { return si_session_manager_1.AISISessionManager; } });
 Object.defineProperty(exports, "SIErrorCodes", { enumerable: true, get: function () { return si_session_manager_1.SIErrorCodes; } });
 Object.defineProperty(exports, "defaultSISessionManager", { enumerable: true, get: function () { return si_session_manager_1.defaultSISessionManager; } });
+// Implicit Account Store (resolution: 'implicit') — Shape A reference adapter.
+var implicit_account_store_1 = require("./implicit-account-store");
+Object.defineProperty(exports, "InMemoryImplicitAccountStore", { enumerable: true, get: function () { return implicit_account_store_1.InMemoryImplicitAccountStore; } });
+Object.defineProperty(exports, "defaultImplicitKeyFn", { enumerable: true, get: function () { return implicit_account_store_1.defaultImplicitKeyFn; } });
+// OAuth pass-through resolver — closes adcp-client#1363. Shape B factory
+// for adapters wrapping a vendor OAuth + ad-account API; replaces the ~30
+// LOC of bearer-extract + listing-fetch + match-by-id boilerplate every
+// such adapter re-derives by hand.
+var oauth_passthrough_resolver_1 = require("./oauth-passthrough-resolver");
+Object.defineProperty(exports, "createOAuthPassthroughResolver", { enumerable: true, get: function () { return oauth_passthrough_resolver_1.createOAuthPassthroughResolver; } });
+// Roster-backed AccountStore — Shape C factory for `resolution: 'explicit'`
+// publisher-curated platforms. Adopters bring their own roster source (admin-UI
+// managed DB row, in-memory map, file); the helper provides AccountStore
+// plumbing (resolve dispatch, optional list, ctx threading) with no opinion on
+// where the roster lives.
+var roster_account_store_1 = require("./roster-account-store");
+Object.defineProperty(exports, "createRosterAccountStore", { enumerable: true, get: function () { return roster_account_store_1.createRosterAccountStore; } });
+// Derived AccountStore — Shape D factory for `resolution: 'derived'` single-
+// tenant agents (no account_id on the wire; auth principal alone identifies
+// the tenant). Closes adcp-client#1462. Replaces ~25–30 LOC of bearer-extract +
+// throw-AUTH_REQUIRED + return-singleton boilerplate Shape D adopters write today.
+var derived_account_store_1 = require("./derived-account-store");
+Object.defineProperty(exports, "createDerivedAccountStore", { enumerable: true, get: function () { return derived_account_store_1.createDerivedAccountStore; } });
 //# sourceMappingURL=index.js.map

package/dist/lib/adapters/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/adapters/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,oBAAoB;AACpB,yEAOqC;AANnC,oIAAA,uBAAuB,OAAA;AAGvB,uIAAA,0BAA0B,OAAA;AAC1B,oIAAA,uBAAuB,OAAA;AACvB,2IAAA,8BAA8B,OAAA;AAGhC,iBAAiB;AACjB,iEAOiC;AAN/B,4HAAA,mBAAmB,OAAA;AAGnB,+HAAA,sBAAsB,OAAA;AACtB,4HAAA,mBAAmB,OAAA;AACnB,mIAAA,0BAA0B,OAAA;AAG5B,sBAAsB;AACtB,uDAO4B;AAN1B,mHAAA,eAAe,OAAA;AACf,qHAAA,iBAAiB,OAAA;AAGjB,sHAAA,kBAAkB,OAAA;AAClB,0HAAA,sBAAsB,OAAA;AAGxB,4CAA4C;AAC5C,2DAS8B;AAR5B,uHAAA,iBAAiB,OAAA;AACjB,8HAAA,wBAAwB,OAAA;AAKxB,iIAAA,2BAA2B,OAAA;AAC3B,8HAAA,wBAAwB,OAAA;AAG1B,kCAAkC;AAClC,2DAO8B;AAN5B,sHAAA,gBAAgB,OAAA;AAChB,wHAAA,kBAAkB,OAAA;AAGlB,kHAAA,YAAY,OAAA;AACZ,6HAAA,uBAAuB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/adapters/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAEH,oBAAoB;AACpB,yEAOqC;AANnC,oIAAA,uBAAuB,OAAA;AAGvB,uIAAA,0BAA0B,OAAA;AAC1B,oIAAA,uBAAuB,OAAA;AACvB,2IAAA,8BAA8B,OAAA;AAGhC,iBAAiB;AACjB,iEAOiC;AAN/B,4HAAA,mBAAmB,OAAA;AAGnB,+HAAA,sBAAsB,OAAA;AACtB,4HAAA,mBAAmB,OAAA;AACnB,mIAAA,0BAA0B,OAAA;AAG5B,sBAAsB;AACtB,uDAO4B;AAN1B,mHAAA,eAAe,OAAA;AACf,qHAAA,iBAAiB,OAAA;AAGjB,sHAAA,kBAAkB,OAAA;AAClB,0HAAA,sBAAsB,OAAA;AAGxB,4CAA4C;AAC5C,2DAS8B;AAR5B,uHAAA,iBAAiB,OAAA;AACjB,8HAAA,wBAAwB,OAAA;AAKxB,iIAAA,2BAA2B,OAAA;AAC3B,8HAAA,wBAAwB,OAAA;AAG1B,kCAAkC;AAClC,2DAO8B;AAN5B,sHAAA,gBAAgB,OAAA;AAChB,wHAAA,kBAAkB,OAAA;AAGlB,kHAAA,YAAY,OAAA;AACZ,6HAAA,uBAAuB,OAAA;AAGzB,+EAA+E;AAC/E,mEAIkC;AAHhC,sIAAA,4BAA4B,OAAA;AAC5B,8HAAA,oBAAoB,OAAA;AAItB,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,mCAAmC;AACnC,2EAAoH;AAA3G,4IAAA,8BAA8B,OAAA;AAEvC,4EAA4E;AAC5E,gFAAgF;AAChF,yEAAyE;AACzE,+EAA+E;AAC/E,0BAA0B;AAC1B,+DAAkG;AAAzF,gIAAA,wBAAwB,OAAA;AAEjC,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,mFAAmF;AACnF,iEAAqG;AAA5F,kIAAA,yBAAyB,OAAA"}

package/dist/lib/adapters/oauth-passthrough-resolver.d.ts

@@ -0,0 +1,193 @@
+/**
+ * OAuth pass-through `accounts.resolve` factory. Standardizes the canonical
+ * "Shape B" account-resolution pattern: an adapter wraps a vendor OAuth +
+ * ad-account API (Snap, Meta, TikTok, LinkedIn, Reddit, Pinterest, etc.) and
+ * resolves the buyer's `AccountReference` by hitting the upstream's
+ * "list-my-accounts" endpoint with the buyer's bearer.
+ *
+ * Without this factory, every Shape B adapter rolls the same ~30 LOC:
+ * extract bearer from `ctx.authInfo`, GET `/me/adaccounts`, match by id,
+ * return tenant with `ctx_metadata` populated. This factory handles the
+ * boilerplate; the adapter supplies the upstream specifics
+ * (`listEndpoint`, `toAccount` mapper) and the auth shape via
+ * {@link createUpstreamHttpClient}'s `dynamic_bearer.getToken`.
+ *
+ * Closes adcp-client#1363.
+ *
+ * **Picking an AccountStore?** Four reference shapes by *who creates the
+ * account*:
+ * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`
+ *   (Shape A).
+ * - **Upstream OAuth API owns the roster** → `createOAuthPassthroughResolver`
+ *   (this file, Shape B, returns just `resolve`).
+ * - **Publisher ops curates the roster** → `createRosterAccountStore`
+ *   (Shape C, complete AccountStore).
+ * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`
+ *   (Shape D, `resolution: 'derived'`).
+ *
+ * @public
+ */
+import type { Account, ResolveContext } from '../server/decisioning/account';
+import type { AccountReference } from '../types/tools.generated';
+import type { AuthContext, UpstreamHttpClient } from '../server/upstream-helpers';
+/**
+ * Options for {@link createOAuthPassthroughResolver}.
+ *
+ * @public
+ */
+export interface OAuthPassthroughResolverOptions<TUpstreamRow, TCtxMeta = Record<string, unknown>> {
+    /**
+     * Pre-configured upstream HTTP client (typically from
+     * {@link createUpstreamHttpClient}). Should be configured with
+     * `auth: { kind: 'dynamic_bearer', getToken: (ctx) => ... }` so the
+     * factory's `getAuthContext` output flows through to bearer selection.
+     */
+    httpClient: UpstreamHttpClient;
+    /**
+     * Path on the upstream API that returns the buyer's accounts. Common
+     * shapes: `/v1/adaccounts`, `/me/adaccounts`, `/customers`.
+     */
+    listEndpoint: string;
+    /**
+     * Property on each upstream row matching the wire `AccountReference.account_id`.
+     * Defaults to `'id'`.
+     *
+     * **Footgun:** when the generic `TUpstreamRow` is inferred (no explicit
+     * type argument), `keyof TUpstreamRow & string` collapses to `string` and
+     * a typo in `idField` compiles fine but silently always returns `null`.
+     * Pass an explicit `TUpstreamRow` (or a dummy interface with the upstream's
+     * field names) to get compile-time field validation.
+     */
+    idField?: keyof TUpstreamRow & string;
+    /**
+     * Property on the upstream response body that contains the array of rows.
+     * Defaults to `'data'` (Snap, Meta envelope shape). Set to `null` when the
+     * response body itself is the array (some flat-list APIs).
+     *
+     * Single-segment only. APIs with deeper nesting (TikTok's `data.list`,
+     * for example) need a custom response transform — wrap the upstream client
+     * with a fetch override that flattens, or use this factory only for the
+     * 70%-fit upstream shape and write a hand-rolled resolver for the rest.
+     * Google Ads' `customers:listAccessibleCustomers` returns string resource
+     * names (not row objects) and is not a fit for this factory.
+     */
+    rowsPath?: string | null;
+    /**
+     * Extract the auth context to forward to the upstream's
+     * `dynamic_bearer.getToken(ctx)` resolver. The return value flows through
+     * as the `authContext` per-call option on `httpClient.get`.
+     *
+     * Defaults to forwarding `ctx?.authInfo` verbatim — works when the http
+     * client's `getToken` resolver reads `ctx.authInfo.token` /
+     * `ctx.authInfo.credential.token`.
+     */
+    getAuthContext?: (ctx: ResolveContext | undefined) => AuthContext | undefined;
+    /**
+     * Map an upstream row to a framework `Account<TCtxMeta>`. Adapters
+     * typically embed the raw row (or distilled fields) in `ctx_metadata` so
+     * downstream specialism methods can read upstream IDs, tokens, etc.
+     * without re-resolving.
+     *
+     * **Treat `ctx_metadata.accessToken` (or any embedded credential) as a
+     * secret.** The framework strips `ctx_metadata` from the wire response,
+     * but adopter code that throws an error containing `JSON.stringify(account)`
+     * or logs `ctx.account` at info level WILL leak the token. Either don't
+     * embed the bearer (re-derive from `ctx.authInfo` on each downstream
+     * method), or audit your error projections.
+     */
+    toAccount: (row: TUpstreamRow, ctx: ResolveContext | undefined) => Account<TCtxMeta>;
+    /**
+     * Optional in-memory listing cache. Caches the full row array per buyer
+     * (keyed on the auth context); resolves `account_id` matches in-memory
+     * within the TTL window. One upstream hit per buyer per TTL period
+     * regardless of how many account_ids that buyer queries.
+     *
+     * Set `ttlMs` to enable (default: no cache, every resolve hits upstream).
+     *
+     * **TTL guidance:**
+     * - **Read tools** (`get_products`, `list_creative_formats`): 60–300s.
+     *   Buyer-side latency dominates; longer TTL absorbs bursts.
+     * - **Mutating tools** (`create_media_buy`, `update_media_buy`,
+     *   `sync_creatives`): 0–30s, or compose `composeMethod` to skip cache
+     *   on these paths. A revoked-but-not-yet-expired bearer would otherwise
+     *   continue authorizing mutations for the full TTL window.
+     *
+     * `getCacheKey` defaults to a SHA-256 hash of the JSON-serialized auth
+     * context. Hashing (vs raw stringification) keeps the bearer token out
+     * of Map keys — heap dumps and `util.inspect(cache)` no longer surface
+     * plaintext credentials. Provide a custom key when the auth context
+     * contains noise (timestamps, request ids) that would defeat caching.
+     *
+     * Cache size is naturally bounded by the number of distinct buyers
+     * times one entry each. Adopters with token-rotation churn can cap with
+     * `maxEntries` (LRU eviction).
+     */
+    cache?: {
+        ttlMs: number;
+        getCacheKey?: (authContext: AuthContext | undefined) => string;
+        /** LRU eviction cap. Defaults to 1024 — enough for most multi-tenant deployments. */
+        maxEntries?: number;
+    };
+}
+/**
+ * Create an `accounts.resolve` implementation that resolves buyer-supplied
+ * `AccountReference` against an upstream OAuth-protected listing endpoint.
+ * Returns just the resolve function — adapters compose it into their own
+ * `AccountStore` (typically alongside a no-op `upsert` since Shape B
+ * adapters don't manage account lifecycle).
+ *
+ * @example
+ * ```ts
+ * import {
+ *   createUpstreamHttpClient,
+ *   createOAuthPassthroughResolver,
+ *   defineSalesPlatform,
+ * } from '@adcp/sdk/server';
+ *
+ * const snap = createUpstreamHttpClient({
+ *   baseUrl: 'https://adsapi.snapchat.com',
+ *   auth: {
+ *     kind: 'dynamic_bearer',
+ *     getToken: async (ctx) => (ctx as any)?.authInfo?.credential?.token,
+ *   },
+ * });
+ *
+ * const resolve = createOAuthPassthroughResolver({
+ *   httpClient: snap,
+ *   listEndpoint: '/v1/me/adaccounts',
+ *   idField: 'id',
+ *   rowsPath: 'adaccounts',
+ *   toAccount: (row, ctx) => ({
+ *     id: row.id,
+ *     name: row.name,
+ *     status: 'active',
+ *     advertiser: row.advertiser_url,
+ *     ctx_metadata: {
+ *       upstreamId: row.id,
+ *       // Treat as secret — see `toAccount` JSDoc above.
+ *       accessToken: (ctx as any)?.authInfo?.credential?.token,
+ *     },
+ *   }),
+ *   cache: { ttlMs: 60_000 },
+ * });
+ *
+ * defineSalesPlatform({
+ *   accounts: { resolve },
+ *   ...
+ * });
+ * ```
+ *
+ * Behavior:
+ * - The factory only handles the `{ account_id }` discriminated-union arm.
+ *   Other arms (`{ brand, operator }`) and `undefined` ref return `null`
+ *   without calling upstream.
+ * - Upstream throws (4xx/5xx other than 404) propagate verbatim — adopters
+ *   compose `composeMethod` over the result if they want to catch and map
+ *   to a typed envelope (e.g. throw `AdcpError('AUTH_REQUIRED')` on 401).
+ * - Cache is opt-in and listing-keyed: one upstream hit per buyer per TTL
+ *   window regardless of how many `account_id`s that buyer queries.
+ *
+ * @public
+ */
+export declare function createOAuthPassthroughResolver<TUpstreamRow extends Record<string, unknown>, TCtxMeta = Record<string, unknown>>(options: OAuthPassthroughResolverOptions<TUpstreamRow, TCtxMeta>): (ref: AccountReference | undefined, ctx?: ResolveContext) => Promise<Account<TCtxMeta> | null>;
+//# sourceMappingURL=oauth-passthrough-resolver.d.ts.map

package/dist/lib/adapters/oauth-passthrough-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-passthrough-resolver.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/oauth-passthrough-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAElF;;;;GAIG;AACH,MAAM,WAAW,+BAA+B,CAAC,YAAY,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/F;;;;;OAKG;IACH,UAAU,EAAE,kBAAkB,CAAC;IAE/B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,YAAY,GAAG,MAAM,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,KAAK,WAAW,GAAG,SAAS,CAAC;IAE9E;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,KAAK,MAAM,CAAC;QAC/D,qFAAqF;QACrF,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5C,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAElC,OAAO,EAAE,+BAA+B,CAAC,YAAY,EAAE,QAAQ,CAAC,GAC/D,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CA2DhG"}