@adcp/sdk 6.6.0 → 6.8.0

package/dist/lib/server/auth.d.ts

@@ -29,6 +29,7 @@
 import type { IncomingMessage, ServerResponse } from 'http';
 import { type JWTPayload, type JWTVerifyOptions } from 'jose';
 import type { RequestSignatureErrorCode } from '../signing/errors';
+import type { AdcpCredential } from './decisioning/buyer-agent';
 /**
  * Default JWT algorithm allowlist. Asymmetric only — HS-family is intentionally
  * excluded to prevent algorithm-confusion attacks where a JWKS public key is
@@ -62,6 +63,64 @@ export interface AuthPrincipal {
     claims?: JWTPayload;
     /** Token expiry (seconds since epoch) when known — propagated to MCP `AuthInfo.expiresAt`. */
     expiresAt?: number;
+    /**
+     * Kind-discriminated credential variant — Phase 1 Stage 3 of #1269.
+     *
+     * Built-in authenticators stamp this:
+     * - {@link verifyApiKey} → `{ kind: 'api_key', key_id }`
+     * - {@link verifyBearer} → `{ kind: 'oauth', client_id, scopes, expires_at }`
+     * - {@link verifySignatureAsAuthenticator} → `{ kind: 'http_sig', keyid, agent_url, verified_at }`
+     *
+     * `serve()` propagates this into `req.auth.extra.credential`, where the
+     * dispatcher hoists it onto `ctx.authInfo.credential` for adopter
+     * `resolveAccount` callbacks AND for the `BuyerAgentRegistry.resolve`
+     * call. Adopters with custom `authenticate` functions can populate this
+     * directly to opt into the discriminated-credential surface; otherwise
+     * `BuyerAgentRegistry` factories return `null` (no credential = no
+     * known agent) and the framework's request flow is unchanged.
+     *
+     * The `http_sig.agent_url` is cryptographically verified (the verifier
+     * derives it from the `agents[]` entry whose `jwks_uri` resolved the
+     * `keyid` per adcontextprotocol/adcp#3831). Security-relevant decisions
+     * MUST read it from this variant, not from any informational field
+     * elsewhere on the request.
+     */
+    credential?: AdcpCredential;
+    /**
+     * Adopter-provided extension data. Stamp this in your `verifyApiKey.verify`
+     * callback (or any custom `authenticate` function) to carry pre-hash data
+     * derived from the raw token — prefix patterns, tenant IDs, test-kit flags —
+     * that you can't recover from the hashed `key_id` in `credential`.
+     *
+     * `serve()` propagates this into `req.auth.extra` and from there to
+     * `BuyerAgentResolveInput.extra`, where `BuyerAgentRegistry.bearerOnly` and
+     * `mixed` factories forward it as the second argument to `resolveByCredential`.
+     *
+     * Do NOT put raw token values, passwords, or other secrets here. Treat it
+     * with the same care as `credential` fields — avoid logging, and never
+     * include in thrown `Error` messages (the framework may project
+     * `err.message` into `error.details.reason` on the wire).
+     *
+     * @example
+     * ```ts
+     * verifyApiKey({
+     *   verify: token => {
+     *     if (!DEMO_PATTERN.test(token)) return null;
+     *     return { principal: `static:demo:${token}`, extra: { demo_token: token } };
+     *   },
+     * })
+     * // Then in bearerOnly:
+     * BuyerAgentRegistry.bearerOnly({
+     *   resolveByCredential: (cred, extra) => {
+     *     const token = extra?.demo_token as string | undefined;
+     *     return token?.startsWith('demo-billing-passthrough-')
+     *       ? Promise.resolve(demoAgent)
+     *       : Promise.resolve(null);
+     *   },
+     * })
+     * ```
+     */
+    extra?: Record<string, unknown>;
     [key: string]: unknown;
 }
 /**

package/dist/lib/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/server/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAC5D,OAAO,EAAiC,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,MAAM,CAAC;AAC7F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAGnE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBASjC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,IAAI,CAAC;AAE9C;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEvF;;;;;;GAMG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAMjE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAAqD,CAAC;AAE/F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAAsD,CAAC;AAEhG;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,OAAO,MAA4D,CAAC;AAE7G;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4HAA4H;AAC5H,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,GAAG,mBAAmB,GAAG,SAAS,CAE5F;AAOD;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAG/E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAElF;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAGhF;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAErF;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CActE;AAMD,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;CAC9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,aAAa,CAgBxE;AAMD,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,mBAAmB,KAAK,MAAM,CAAC,CAAC;IACrH,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,UAAU,CAAC,CAAC;CAC5D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,aAAa,CA8DxE;AA0BD;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,GAAG,cAAc,EAAE,aAAa,EAAE,GAAG,aAAa,CA+BvE;AAMD,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,iBAAiB,GAAG,eAAe,GAAG,oBAAoB,CAAC;IACnE,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,yBAAyB,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,cAAc,EACnB,OAAO,GAAE,0BAA+B,GACvC,IAAI,CA2BN;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,GAAG,IAAI,CAgB1F"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/lib/server/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAE5D,OAAO,EAAiC,KAAK,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,MAAM,CAAC;AAC7F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAkBhE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,mBASjC,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAEtD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,6GAA6G;IAC7G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,IAAI,CAAC;AAE9C;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEvF;;;;;;GAMG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAMjE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAAqD,CAAC;AAE/F;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,EAAE,OAAO,MAAsD,CAAC;AAEhG;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,OAAO,MAA4D,CAAC;AAE7G;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,2GAA2G;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4HAA4H;AAC5H,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,GAAG,mBAAmB,GAAG,SAAS,CAE5F;AAOD;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAG/E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAElF;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAGhF;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAErF;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CActE;AAMD,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;CAC9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,aAAa,CA0CxE;AAMD,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,eAAe,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,mBAAmB,KAAK,MAAM,CAAC,CAAC;IACrH,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,UAAU,CAAC,CAAC;CAC5D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,aAAa,CAwFxE;AA0BD;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,GAAG,cAAc,EAAE,aAAa,EAAE,GAAG,aAAa,CA+BvE;AAMD,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,iBAAiB,GAAG,eAAe,GAAG,oBAAoB,CAAC;IACnE,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACnB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,yBAAyB,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,cAAc,EACnB,OAAO,GAAE,0BAA+B,GACvC,IAAI,CA2BN;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,GAAG,IAAI,CAgB1F"}

package/dist/lib/server/auth.js

@@ -12,8 +12,24 @@ exports.verifyBearer = verifyBearer;
 exports.anyOf = anyOf;
 exports.respondUnauthorized = respondUnauthorized;
 exports.signatureErrorCodeFromCause = signatureErrorCodeFromCause;
+const node_crypto_1 = require("node:crypto");
 const jose_1 = require("jose");
 const errors_1 = require("../signing/errors");
+/**
+ * Hash an api-key bearer token into a stable opaque identifier suitable
+ * for `credential.key_id`. The raw token MUST NOT appear on the credential
+ * — anything reading `credential.key_id` (handlers, `accounts.resolve`,
+ * `BuyerAgentRegistry.resolveByCredential`, log lines that flow through
+ * `details.reason`) would otherwise leak the secret.
+ *
+ * SHA-256 truncated to 32 hex chars (128 bits): collision-resistant
+ * enough for an opaque correlator, short enough to be readable in logs.
+ * Adopters who want full-hash or full-token forms wire their own
+ * authenticator and stamp the `credential` directly.
+ */
+function hashApiKeyToken(token) {
+    return (0, node_crypto_1.createHash)('sha256').update(token).digest('hex').slice(0, 32);
+}
 /**
  * Default JWT algorithm allowlist. Asymmetric only — HS-family is intentionally
  * excluded to prevent algorithm-confusion attacks where a JWKS public key is
@@ -158,12 +174,39 @@ function verifyApiKey(options) {
         const token = extractBearerToken(req);
         if (!token)
             return null;
+        // ALWAYS stamp an api_key credential — adopter-provided credentials
+        // on the matched principal are NOT honored here. Allowing an api-key
+        // entry to claim `credential: { kind: 'http_sig', ... }` would let
+        // an adopter (or attacker who can write the keys map) forge signed-
+        // path identity — `signingOnly` and `mixed` registry factories would
+        // route the request as if it were verifier-attested. The api-key
+        // path has no signature proof, so the credential MUST be `api_key`
+        // regardless of what the matched record carries. Same posture for
+        // the dynamic `verify` path below.
+        //
+        // `key_id` is a SHA-256 hash prefix of the raw token, not the token
+        // itself — `credential.key_id` flows broadly through `ctx.authInfo`,
+        // handlers, and downstream code that may log structured context.
+        // Adopters with custom api-key authenticators that need a different
+        // `key_id` shape stamp their own credential and skip this path.
+        const apiKeyCredential = { kind: 'api_key', key_id: hashApiKeyToken(token) };
         if (options.keys && Object.prototype.hasOwnProperty.call(options.keys, token)) {
-            return { ...options.keys[token], token };
+            const matched = options.keys[token];
+            return {
+                ...matched,
+                token,
+                credential: apiKeyCredential,
+            };
         }
         if (options.verify) {
             const result = await options.verify(token);
-            return result ? { ...result, token: result.token ?? token } : null;
+            if (!result)
+                return null;
+            return {
+                ...result,
+                token: result.token ?? token,
+                credential: apiKeyCredential,
+            };
         }
         return null;
     };
@@ -244,11 +287,36 @@ function verifyBearer(options) {
                 });
             }
         }
+        // Prefer `payload.client_id` over `payload.sub` per RFC 9068 §2.2:
+        // `sub` is the resource-owner subject (often the user); `client_id`
+        // is the OAuth client identity (the buyer agent for AdCP traffic).
+        // For the client-credentials grant where `sub === client_id` both
+        // resolve to the same value; for authorization-code flows where
+        // `sub` is a user, falling back to `sub` would mis-route registry
+        // lookups keyed by client identity.
+        //
+        // When neither is a usable string, omit the `credential` entirely
+        // — `BuyerAgentRegistry` sees `null` (no credential = no known
+        // agent) instead of bucketing every unauthenticated principal into
+        // a single `'unknown'` row.
+        const clientIdFromPayload = typeof payload.client_id === 'string' && payload.client_id.length > 0
+            ? payload.client_id
+            : typeof payload.sub === 'string' && payload.sub.length > 0
+                ? payload.sub
+                : undefined;
         const principal = {
-            principal: typeof payload.sub === 'string' ? payload.sub : 'unknown',
+            principal: clientIdFromPayload ?? 'unknown',
             token,
             scopes,
             claims: payload,
+            ...(clientIdFromPayload !== undefined && {
+                credential: {
+                    kind: 'oauth',
+                    client_id: clientIdFromPayload,
+                    scopes,
+                    ...(typeof payload.exp === 'number' && { expires_at: payload.exp }),
+                },
+            }),
         };
         if (typeof payload.exp === 'number')
             principal.expiresAt = payload.exp;

package/dist/lib/server/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/lib/server/auth.ts"],"names":[],"mappings":";;;AAiKA,wDAEC;AAUD,oEAGC;AAMD,8DAEC;AAMD,sEAGC;AAKD,oEAEC;AAWD,gDAcC;AAiCD,oCAgBC;AA8DD,oCA8DC;AAiCD,sBA+BC;AAgDD,kDA+BC;AAQD,kEAgBC;AAxhBD,+BAA6F;AAE7F,8CAA0D;AAE1D;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,8EAA8E;AACjE,QAAA,mCAAmC,GAAG,EAAE,CAAC;AA6CtD;;;;;;GAMG;AACH,MAAa,SAAU,SAAQ,KAAK;IACzB,aAAa,CAAS;IAC/B,YAAY,aAAqB,EAAE,OAA6B;QAC9D,KAAK,CAAC,aAAa,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS;YAAG,IAAoC,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChG,CAAC;CACF;AARD,8BAQC;AAED;;;;;;;;GAQG;AACU,QAAA,mBAAmB,GAAkB,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAE/F;;;;;;;;;;;GAWG;AACU,QAAA,mBAAmB,GAAkB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAkB,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAgB7G,4HAA4H;AAC5H,SAAgB,sBAAsB,CAAC,GAAoB;IACzD,OAAQ,GAAgF,CAAC,kCAA0B,CAAC,CAAC;AACvH,CAAC;AAOD;;GAEG;AACH,SAAgB,4BAA4B,CAAC,IAAmB;IAC7D,IAAsC,CAAC,2BAAmB,CAAC,GAAG,IAAI,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,IAA+B;IACvE,OAAO,CAAC,CAAC,IAAI,IAAK,IAAsC,CAAC,2BAAmB,CAAC,KAAK,IAAI,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,SAAgB,6BAA6B,CAAC,IAAmB;IAC9D,IAAsC,CAAC,2BAAmB,CAAC,GAAG,IAAI,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,4BAA4B,CAAC,IAA+B;IAC1E,OAAO,CAAC,CAAC,IAAI,IAAK,IAAsC,CAAC,2BAAmB,CAAC,KAAK,IAAI,CAAC;AACzF,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,GAAoB;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3E,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAoBD;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,OAA4B;IACvD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,EAAC,GAAG,EAAC,EAAE;QACjB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAE,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AA2CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,YAAY,CAAC,OAA4B;IACvD,MAAM,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;IAC5D,MAAM,iBAAiB,GAAuC;QAC5D,UAAU,EAAE,8BAAsB,CAAC,KAAK,EAAE;QAC1C,cAAc,EAAE,2CAAmC;QACnD,GAAG,OAAO,CAAC,UAAU;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,MAAM,mBAAmB,GAAiC,YAAY;QACpE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAkB,EAAE,CAAC;IACnE,OAAO,KAAK,EAAC,GAAG,EAAC,EAAE;QACjB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,OAAmB,CAAC;QACxB,IAAI,aAA+B,CAAC;QACpC,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,gEAAgE;gBAChE,kEAAkE;gBAClE,yDAAyD;gBACzD,2DAA2D;gBAC3D,gEAAgE;gBAChE,gCAAgC;gBAChC,MAAM,GAAG,GAAwB,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7E,QAAQ,GAAI,OAAO,CAAC,QAAmE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpG,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,sEAAsE;gBACtE,MAAM,IAAI,SAAS,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,aAAa,GAAG,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,mBAAuC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4EAA4E;YAC5E,iEAAiE;YACjE,MAAM,IAAI,SAAS,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE;oBACzC,KAAK,EAAE,IAAI,KAAK,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAkB;YAC/B,SAAS,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YACpE,KAAK;YACL,MAAM;YACN,MAAM,EAAE,OAAO;SAChB,CAAC;QACF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAmB;IACxC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,GAAI,OAAO,CAAC,KAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GAAI,OAA0C,CAAC,GAAG,CAAC;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAgB,KAAK,CAAC,GAAG,cAA+B;IACtD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,mEAAmE;gBACnE,6EAA6E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAkB,KAAK,EAAC,GAAG,EAAC,EAAE;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAsCD;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CACjC,IAAqB,EACrB,GAAmB,EACnB,UAAsC,EAAE;IAExC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,UAAU,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,qBAAqB,GAAG,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,UAAU,YAAY,CAAC,OAAO,CAAC,cAAe,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,gBAAgB;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE1G,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE;QACnC,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACpD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;QACzF,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,IAAI,0BAA0B;KAC1E,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CAAC,GAAY;IACtD,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,qCAAqC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAW,CAAC;IACnC,IAAI,OAAO,GAAY,GAAG,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,OAAO,IAAI,IAAI,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,YAAY,8BAAqB;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,GAAI,OAA+B,CAAC,KAAK,CAAC;QACjD,IAAI,EAAE,CAAC;IACT,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,wEAAwE;IACxE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/lib/server/auth.ts"],"names":[],"mappings":";;;AA6OA,wDAEC;AAUD,oEAGC;AAMD,8DAEC;AAMD,sEAGC;AAKD,oEAEC;AAWD,gDAcC;AAiCD,oCA0CC;AA8DD,oCAwFC;AAiCD,sBA+BC;AAgDD,kDA+BC;AAQD,kEAgBC;AAxpBD,6CAAyC;AACzC,+BAA6F;AAE7F,8CAA0D;AAG1D;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,8EAA8E;AACjE,QAAA,mCAAmC,GAAG,EAAE,CAAC;AAuGtD;;;;;;GAMG;AACH,MAAa,SAAU,SAAQ,KAAK;IACzB,aAAa,CAAS;IAC/B,YAAY,aAAqB,EAAE,OAA6B;QAC9D,KAAK,CAAC,aAAa,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS;YAAG,IAAoC,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAChG,CAAC;CACF;AARD,8BAQC;AAED;;;;;;;;GAQG;AACU,QAAA,mBAAmB,GAAkB,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAE/F;;;;;;;;;;;GAWG;AACU,QAAA,mBAAmB,GAAkB,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAkB,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAgB7G,4HAA4H;AAC5H,SAAgB,sBAAsB,CAAC,GAAoB;IACzD,OAAQ,GAAgF,CAAC,kCAA0B,CAAC,CAAC;AACvH,CAAC;AAOD;;GAEG;AACH,SAAgB,4BAA4B,CAAC,IAAmB;IAC7D,IAAsC,CAAC,2BAAmB,CAAC,GAAG,IAAI,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,IAA+B;IACvE,OAAO,CAAC,CAAC,IAAI,IAAK,IAAsC,CAAC,2BAAmB,CAAC,KAAK,IAAI,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,SAAgB,6BAA6B,CAAC,IAAmB;IAC9D,IAAsC,CAAC,2BAAmB,CAAC,GAAG,IAAI,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAgB,4BAA4B,CAAC,IAA+B;IAC1E,OAAO,CAAC,CAAC,IAAI,IAAK,IAAsC,CAAC,2BAAmB,CAAC,KAAK,IAAI,CAAC;AACzF,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,GAAoB;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACvC,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3E,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAoBD;;;;;;;;;;;;GAYG;AACH,SAAgB,YAAY,CAAC,OAA4B;IACvD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,EAAC,GAAG,EAAC,EAAE;QACjB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,mCAAmC;QACnC,EAAE;QACF,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,oEAAoE;QACpE,gEAAgE;QAChE,MAAM,gBAAgB,GAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC;YACrC,OAAO;gBACL,GAAG,OAAO;gBACV,KAAK;gBACL,UAAU,EAAE,gBAAgB;aAC7B,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO;gBACL,GAAG,MAAM;gBACT,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;gBAC5B,UAAU,EAAE,gBAAgB;aAC7B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AA2CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,YAAY,CAAC,OAA4B;IACvD,MAAM,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;IAC5D,MAAM,iBAAiB,GAAuC;QAC5D,UAAU,EAAE,8BAAsB,CAAC,KAAK,EAAE;QAC1C,cAAc,EAAE,2CAAmC;QACnD,GAAG,OAAO,CAAC,UAAU;QACrB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,MAAM,mBAAmB,GAAiC,YAAY;QACpE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAkB,EAAE,CAAC;IACnE,OAAO,KAAK,EAAC,GAAG,EAAC,EAAE;QACjB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,OAAmB,CAAC;QACxB,IAAI,aAA+B,CAAC;QACpC,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,gEAAgE;gBAChE,kEAAkE;gBAClE,yDAAyD;gBACzD,2DAA2D;gBAC3D,gEAAgE;gBAChE,gCAAgC;gBAChC,MAAM,GAAG,GAAwB,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC7E,QAAQ,GAAI,OAAO,CAAC,QAAmE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACpG,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,sEAAsE;gBACtE,MAAM,IAAI,SAAS,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,aAAa,GAAG,EAAE,GAAG,iBAAiB,EAAE,QAAQ,EAAE,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,mBAAuC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4EAA4E;YAC5E,iEAAiE;YACjE,MAAM,IAAI,SAAS,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,SAAS,CAAC,qBAAqB,EAAE;oBACzC,KAAK,EAAE,IAAI,KAAK,CAAC,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,oCAAoC;QACpC,EAAE;QACF,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,4BAA4B;QAC5B,MAAM,mBAAmB,GACvB,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YACnE,CAAC,CAAC,OAAO,CAAC,SAAS;YACnB,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;gBACzD,CAAC,CAAC,OAAO,CAAC,GAAG;gBACb,CAAC,CAAC,SAAS,CAAC;QAClB,MAAM,SAAS,GAAkB;YAC/B,SAAS,EAAE,mBAAmB,IAAI,SAAS;YAC3C,KAAK;YACL,MAAM;YACN,MAAM,EAAE,OAAO;YACf,GAAG,CAAC,mBAAmB,KAAK,SAAS,IAAI;gBACvC,UAAU,EAAE;oBACV,IAAI,EAAE,OAAgB;oBACtB,SAAS,EAAE,mBAAmB;oBAC9B,MAAM;oBACN,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;iBACpE;aACF,CAAC;SACH,CAAC;QACF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,SAAS,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAmB;IACxC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,GAAI,OAAO,CAAC,KAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GAAI,OAA0C,CAAC,GAAG,CAAC;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAgB,KAAK,CAAC,GAAG,cAA+B;IACtD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,mEAAmE;gBACnE,6EAA6E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAkB,KAAK,EAAC,GAAG,EAAC,EAAE;QAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAsCD;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CACjC,IAAqB,EACrB,GAAmB,EACnB,UAAsC,EAAE;IAExC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,UAAU,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,qBAAqB,GAAG,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC;IACnE,oEAAoE;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,UAAU,YAAY,CAAC,OAAO,CAAC,cAAe,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,gBAAgB;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE1G,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE;QACnC,cAAc,EAAE,kBAAkB;QAClC,kBAAkB,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACpD,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;QACzF,iBAAiB,EAAE,OAAO,CAAC,gBAAgB,IAAI,0BAA0B;KAC1E,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B,CAAC,GAAY;IACtD,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,qCAAqC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAW,CAAC;IACnC,IAAI,OAAO,GAAY,GAAG,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,OAAO,IAAI,IAAI,IAAI,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,YAAY,8BAAqB;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,GAAI,OAA+B,CAAC,KAAK,CAAC;QACjD,IAAI,EAAE,CAAC;IACT,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,wEAAwE;IACxE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC"}

package/dist/lib/server/create-adcp-server.d.ts

@@ -41,6 +41,8 @@ import type { ZodRawShapeCompat, AnySchema } from '@modelcontextprotocol/sdk/ser
 import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
 import { type AdcpServer } from './adcp-server';
 import type { TaskStore, TaskMessageQueue } from './tasks';
+import type { BuyerAgent, BuyerAgentRegistry } from './decisioning/buyer-agent';
+import type { ResolvedAuthInfo } from './decisioning/account';
 import type { AdcpStateStore } from './state-store';
 import { type McpToolResponse } from './responses';
 import type { IdempotencyStore } from './idempotency';
@@ -50,8 +52,8 @@ import type { JwksResolver } from '../signing/jwks';
 import type { ReplayStore } from '../signing/replay';
 import type { RevocationStore } from '../signing/revocation';
 import type { ContentDigestPolicy } from '../signing/types';
-import type { GetProductsRequestSchema, CreateMediaBuyRequestSchema, UpdateMediaBuyRequestSchema, GetMediaBuysRequestSchema, GetMediaBuyDeliveryRequestSchema, ProvidePerformanceFeedbackRequestSchema, ListCreativeFormatsRequestSchema, BuildCreativeRequestSchema, GetCreativeDeliveryRequestSchema, ListCreativesRequestSchema, SyncCreativesRequestSchema, GetSignalsRequestSchema, ActivateSignalRequestSchema, ListAccountsRequestSchema, SyncAccountsRequestSchema, SyncGovernanceRequestSchema, GetAccountFinancialsRequestSchema, ReportUsageRequestSchema, SyncEventSourcesRequestSchema, LogEventRequestSchema, SyncAudiencesRequestSchema, SyncCatalogsRequestSchema, CreatePropertyListRequestSchema, UpdatePropertyListRequestSchema, GetPropertyListRequestSchema, ListPropertyListsRequestSchema, DeletePropertyListRequestSchema, CreateCollectionListRequestSchema, UpdateCollectionListRequestSchema, GetCollectionListRequestSchema, ListCollectionListsRequestSchema, DeleteCollectionListRequestSchema, ListContentStandardsRequestSchema, GetContentStandardsRequestSchema, CreateContentStandardsRequestSchema, UpdateContentStandardsRequestSchema, CalibrateContentRequestSchema, ValidateContentDeliveryRequestSchema, GetMediaBuyArtifactsRequestSchema, GetCreativeFeaturesRequestSchema, SyncPlansRequestSchema, CheckGovernanceRequestSchema, ReportPlanOutcomeRequestSchema, GetPlanAuditLogsRequestSchema, SIGetOfferingRequestSchema, SIInitiateSessionRequestSchema, SISendMessageRequestSchema, SITerminateSessionRequestSchema, PreviewCreativeRequestSchema, GetBrandIdentityRequestSchema, GetRightsRequestSchema, AcquireRightsRequestSchema } from '../types/schemas.generated';
-import type { AcquireRightsAcquired, AcquireRightsPendingApproval, AcquireRightsRejected, GetBrandIdentitySuccess, GetRightsSuccess } from '../types/core.generated';
+import type { GetProductsRequestSchema, CreateMediaBuyRequestSchema, UpdateMediaBuyRequestSchema, GetMediaBuysRequestSchema, GetMediaBuyDeliveryRequestSchema, ProvidePerformanceFeedbackRequestSchema, ListCreativeFormatsRequestSchema, BuildCreativeRequestSchema, GetCreativeDeliveryRequestSchema, ListCreativesRequestSchema, SyncCreativesRequestSchema, GetSignalsRequestSchema, ActivateSignalRequestSchema, ListAccountsRequestSchema, SyncAccountsRequestSchema, SyncGovernanceRequestSchema, GetAccountFinancialsRequestSchema, ReportUsageRequestSchema, SyncEventSourcesRequestSchema, LogEventRequestSchema, SyncAudiencesRequestSchema, SyncCatalogsRequestSchema, CreatePropertyListRequestSchema, UpdatePropertyListRequestSchema, GetPropertyListRequestSchema, ListPropertyListsRequestSchema, DeletePropertyListRequestSchema, CreateCollectionListRequestSchema, UpdateCollectionListRequestSchema, GetCollectionListRequestSchema, ListCollectionListsRequestSchema, DeleteCollectionListRequestSchema, ListContentStandardsRequestSchema, GetContentStandardsRequestSchema, CreateContentStandardsRequestSchema, UpdateContentStandardsRequestSchema, CalibrateContentRequestSchema, ValidateContentDeliveryRequestSchema, GetMediaBuyArtifactsRequestSchema, GetCreativeFeaturesRequestSchema, SyncPlansRequestSchema, CheckGovernanceRequestSchema, ReportPlanOutcomeRequestSchema, GetPlanAuditLogsRequestSchema, SIGetOfferingRequestSchema, SIInitiateSessionRequestSchema, SISendMessageRequestSchema, SITerminateSessionRequestSchema, PreviewCreativeRequestSchema, GetBrandIdentityRequestSchema, GetRightsRequestSchema, AcquireRightsRequestSchema, UpdateRightsRequestSchema } from '../types/schemas.generated';
+import type { AcquireRightsAcquired, AcquireRightsPendingApproval, AcquireRightsRejected, UpdateRightsResponse, UpdateRightsSuccess, GetBrandIdentitySuccess, GetRightsSuccess } from '../types/core.generated';
 import type { GetProductsResponse, CreateMediaBuySuccess, CreateMediaBuyResponse, UpdateMediaBuySuccess, UpdateMediaBuyResponse, GetMediaBuysResponse, GetMediaBuyDeliveryResponse, ListAccountsResponse, ListCreativeFormatsResponse, ProvidePerformanceFeedbackSuccess, ProvidePerformanceFeedbackResponse, BuildCreativeSuccess, BuildCreativeMultiSuccess, BuildCreativeResponse, GetCreativeDeliveryResponse, ListCreativesResponse, SyncCreativesSuccess, SyncCreativesResponse, GetSignalsResponse, ActivateSignalSuccess, ActivateSignalResponse, GetAdCPCapabilitiesResponse, CreatePropertyListResponse, UpdatePropertyListResponse, GetPropertyListResponse, ListPropertyListsResponse, DeletePropertyListResponse, CreateCollectionListResponse, UpdateCollectionListResponse, GetCollectionListResponse, ListCollectionListsResponse, DeleteCollectionListResponse, SyncPlansResponse, CheckGovernanceResponse, ReportPlanOutcomeResponse, GetPlanAuditLogsResponse, SIGetOfferingResponse, SIInitiateSessionResponse, SISendMessageResponse, SITerminateSessionResponse, SyncEventSourcesSuccess, SyncEventSourcesResponse, LogEventSuccess, LogEventResponse, SyncAudiencesSuccess, SyncAudiencesResponse, SyncCatalogsSuccess, SyncCatalogsResponse, SyncAccountsSuccess, SyncAccountsResponse, SyncGovernanceSuccess, SyncGovernanceResponse, GetAccountFinancialsSuccess, GetAccountFinancialsResponse, GetCreativeFeaturesResponse, ReportUsageResponse, PreviewCreativeResponse, AccountReference, BrandReference, ListContentStandardsResponse, GetContentStandardsResponse, CreateContentStandardsResponse, UpdateContentStandardsResponse, CalibrateContentResponse, ValidateContentDeliveryResponse, GetMediaBuyArtifactsResponse } from '../types/tools.generated';
 import type { MediaBuyFeatures, AccountCapabilities, CreativeCapabilities } from '../utils/capabilities';
 import type { MediaChannel } from '../types/tools.generated';
@@ -75,22 +77,36 @@ export interface AdcpLogger {
  */
 export interface HandlerContext<TAccount = unknown> {
     account?: TAccount;
+    /**
+     * Resolved buyer agent for this request, populated by `BuyerAgentRegistry`
+     * when an `agentRegistry` is configured on the server (Phase 1 of #1269).
+     * Carries the durable commercial relationship — status, billing
+     * capabilities, default account terms — distinct from the per-request
+     * credential. Undefined when no registry is configured OR when the
+     * registry returned `null` for the request's credential.
+     */
+    agent?: BuyerAgent;
     /** Session scoping key derived from the request. Populated when `resolveSessionKey` is configured. */
     sessionKey?: string;
     /** State store for persisting domain objects (media buys, accounts, creatives). */
     store: AdcpStateStore;
     /**
-     * Authentication info for the caller, when `ServeOptions.authenticate` is configured.
-     * Populated from the MCP SDK's `extra.authInfo`, which `serve()` sets from the auth
-     * principal. Use this to enforce per-principal authorization in handlers.
+     * Authentication info for the caller, when `ServeOptions.authenticate` is
+     * configured. Populated from the MCP SDK's `extra.authInfo`, which
+     * `serve()` sets from the auth principal. Use this to enforce
+     * per-principal authorization in handlers.
+     *
+     * Stage 3 of #1269 added the kind-discriminated `credential` and the
+     * `operator` fields. The legacy `token` / `clientId` / `scopes` are
+     * preserved as optional fields through the deprecation cycle; new code
+     * should read `credential` and switch on its `kind`.
+     *
+     * Buyer-agent identity post-resolution is on `ctx.agent` (the resolved
+     * `BuyerAgent` record), NOT here — this surface only carries
+     * authentication information about the credential, not the registry
+     * lookup result.
      */
-    authInfo?: {
-        token: string;
-        clientId: string;
-        scopes: string[];
-        expiresAt?: number;
-        extra?: Record<string, unknown>;
-    };
+    authInfo?: ResolvedAuthInfo;
     /**
      * Emit a signed webhook to a buyer's `push_notification_config.url`.
      * Populated when `AdcpServerConfig.webhooks` is configured. Handles
@@ -112,6 +128,8 @@ export interface SessionKeyContext<TAccount = unknown> {
     toolName: AdcpServerToolName;
     params: Record<string, unknown>;
     account?: TAccount;
+    /** Resolved buyer agent (Phase 1 of #1269), when `agentRegistry` is configured. */
+    agent?: BuyerAgent;
 }
 /**
  * Request context passed to `resolveAccount` so the resolver can inspect the
@@ -130,6 +148,15 @@ export interface ResolveAccountContext {
      * MCP request. Undefined when no `authenticate` is configured on `serve()`.
      */
     authInfo?: HandlerContext['authInfo'];
+    /**
+     * Resolved buyer agent (Phase 1 of #1269), when an `agentRegistry` is
+     * configured on the server. Adopters whose `accounts.resolve` shape varies
+     * with the buyer agent's commercial relationship (e.g., agency-mediated
+     * vs. direct billing) read it here without re-resolving from `authInfo`.
+     * Undefined when no registry is configured OR when the registry returned
+     * null for the request's credential.
+     */
+    agent?: BuyerAgent;
 }
 /**
  * Narrow `ctx.sessionKey` from `string | undefined` to `string`. Use this in
@@ -416,6 +443,11 @@ export interface AdcpToolMap {
         result: AcquireRightsAcquired | AcquireRightsPendingApproval | AcquireRightsRejected;
         response: AcquireRightsAcquired | AcquireRightsPendingApproval | AcquireRightsRejected;
     };
+    update_rights: {
+        params: z.input<typeof UpdateRightsRequestSchema>;
+        result: UpdateRightsSuccess;
+        response: UpdateRightsResponse;
+    };
 }
 export type AdcpServerToolName = keyof AdcpToolMap;
 /**
@@ -530,16 +562,26 @@ export interface SponsoredIntelligenceHandlers<TAccount = unknown> {
     terminateSession?: DomainHandler<'si_terminate_session', TAccount>;
 }
 /**
- * Brand rights covers identity and licensing workflows. `update_rights` and
- * `creative_approval` are intentionally not exposed here — the spec models
- * creative approval as a webhook (POST to `approval_webhook` returned from
- * `acquire_rights`), and neither has published JSON schemas yet. Implement
- * those as regular HTTP endpoints outside the MCP surface until schemas land.
+ * Brand rights covers identity and licensing workflows.
+ *
+ * `update_rights` is a first-class mutating tool — modify an existing rights
+ * grant (extend dates, adjust impression caps, change pricing, pause/resume).
+ * Schemas published in AdCP 3.0.x; framework dispatch parallels
+ * `acquire_rights`.
+ *
+ * `creative_approval` is intentionally NOT in this handler bag — the spec
+ * models it as an HTTP webhook (the buyer POSTs to the `approval_webhook`
+ * URL returned from `acquire_rights`), not as an MCP/A2A tool. Adopters
+ * wire the receiver to `BrandRightsPlatform.reviewCreativeApproval` and
+ * use `creativeApproved` / `creativeApprovalRejected` /
+ * `creativeApprovalPendingReview` / `creativeApprovalError` from
+ * `@adcp/sdk/server` to build the webhook response.
  */
 export interface BrandRightsHandlers<TAccount = unknown> {
     getBrandIdentity?: DomainHandler<'get_brand_identity', TAccount>;
     getRights?: DomainHandler<'get_rights', TAccount>;
     acquireRights?: DomainHandler<'acquire_rights', TAccount>;
+    updateRights?: DomainHandler<'update_rights', TAccount>;
 }
 export interface AdcpCapabilitiesConfig {
     major_versions?: number[];
@@ -713,6 +755,78 @@ export interface AdcpSignedRequestsState {
  * tests or boot diagnostics.
  */
 export declare const ADCP_SIGNED_REQUESTS_STATE: unique symbol;
+/**
+ * Symbol marking that a server's `instructions` was supplied as a function
+ * (lazy / per-session form) rather than a static string. `serve()` reads
+ * this to refuse `reuseAgent: true` — the function is captured once at
+ * construction and would not re-evaluate per session under server reuse.
+ *
+ * Internal contract between `createAdcpServer` and `serve()`. Adopters
+ * who instantiate `McpServer` directly (without `createAdcpServer`) and
+ * want their own marker semantics should not import this symbol.
+ */
+export declare const ADCP_INSTRUCTIONS_FN: unique symbol;
+/**
+ * Pre-resolution session context passed to a function-form `instructions`.
+ * Slim by design — no `account` (resolution hasn't run yet at MCP `initialize`
+ * time, which is the natural eval moment for per-session instructions).
+ *
+ * Both fields are reserved: today they are always `undefined` because the
+ * framework's `serve()` does not yet plumb auth + registry state into the
+ * factory before MCP `initialize`. Adopters who need tenant identity should
+ * use closures captured in their factory's HTTP-scoped state. The shape is
+ * forward-compatible: when the framework wires authInfo/agent through, the
+ * fields will populate without breaking existing function bodies.
+ *
+ * @see AdcpServerConfig.instructions
+ * @public
+ */
+export interface SessionContext {
+    /**
+     * @reserved Always `undefined` in v6.x. The framework does not yet plumb
+     * `authInfo` into the factory before MCP `initialize` — use closures
+     * captured in your factory's HTTP-scoped state for tenant identity today.
+     * Forward-compatible: when the framework wires this through, your
+     * `ctx.authInfo?.…` reads start returning real values without breaking
+     * existing function bodies.
+     */
+    readonly authInfo?: ResolvedAuthInfo;
+    /**
+     * @reserved Always `undefined` in v6.x. The framework does not yet plumb
+     * the resolved `BuyerAgent` into the factory before MCP `initialize` —
+     * use closures captured in your factory's HTTP-scoped state for tenant
+     * identity today. Forward-compatible: when the framework wires this
+     * through, your `ctx.agent?.…` reads start returning real values without
+     * breaking existing function bodies.
+     */
+    readonly agent?: BuyerAgent;
+}
+/**
+ * Behavior when a function-form `instructions` callback throws or its
+ * returned Promise rejects.
+ *
+ * - `'skip'` (default) — log server-side, treat as `undefined` (no
+ *   instructions). Right for prose-of-flavor (brand manifests, marketing
+ *   copy) where a registry fetch failure must not kill the buyer's session.
+ * - `'fail'` — rethrow (sync) / re-reject (async). The MCP `initialize`
+ *   handshake then fails at the transport layer (this is NOT an
+ *   `adcp_error` envelope — it kills the session). Right for adopters
+ *   whose instructions carry load-bearing policy where stale/missing
+ *   guidance is worse than a connection retry.
+ *
+ * @public
+ */
+export type OnInstructionsError = 'skip' | 'fail';
+/**
+ * A value that is either `T` directly or a `Promise<T>`.
+ *
+ * Used in callback signatures that support both synchronous and asynchronous
+ * returns (e.g. `instructions`), so adopters can return either a plain
+ * string or an `async` function without separate overloads.
+ *
+ * @public
+ */
+export type MaybePromise<T> = T | Promise<T>;
 /**
  * Shape of the preTransport function attached by `createAdcpServer` when
  * `signedRequests` is configured. Returns `true` if the middleware has already
@@ -726,7 +840,7 @@ export type AdcpPreTransport = (req: import('http').IncomingMessage & {
  * Declarative registration for a tool outside {@link AdcpToolMap} — seller
  * extensions (e.g. collection-list helpers), test-harness endpoints
  * (`comply_test_controller`), or AdCP surfaces whose JSON Schemas haven't
- * landed in the framework yet (`creative_approval`, `update_rights`).
+ * landed in the framework yet.
  *
  * These tools **bypass the framework's spec-tool pipeline**:
  * idempotency middleware, governance pre-checks, account resolution,
@@ -849,6 +963,33 @@ export interface AdcpServerConfig<TAccount = unknown> {
      * don't need tenant scoping (publisher-wide format catalogs).
      */
     resolveAccountFromAuth?: (ctx: ResolveAccountContext) => Promise<TAccount | null>;
+    /**
+     * Buyer-agent identity registry — Phase 1 of #1269. Optional. When
+     * configured, framework calls `agentRegistry.resolve(authInfo)` once per
+     * request after `authInfo` is populated and before `resolveAccount`. The
+     * resolved {@link BuyerAgent} is threaded through `ctx.agent` to
+     * `resolveAccount`, `resolveAccountFromAuth`, `resolveSessionKey`, and
+     * the specialism handlers.
+     *
+     * Adopters construct via {@link BuyerAgentRegistry.signingOnly},
+     * {@link BuyerAgentRegistry.bearerOnly}, or {@link BuyerAgentRegistry.mixed}.
+     * When omitted, `ctx.agent` stays `undefined` and the framework's request
+     * flow is unchanged — strict opt-in.
+     *
+     * Behavior:
+     * - Registry returns a `BuyerAgent` → framework freezes the record (and
+     *   its `billing_capabilities` Set) and sets `ctx.agent`.
+     * - Registry returns `null` → `ctx.agent` stays undefined; dispatch
+     *   continues. Status enforcement (`suspended`/`blocked`) and per-agent
+     *   billing rejection are Stage 4 / Phase 2 work.
+     * - Registry throws → framework returns `SERVICE_UNAVAILABLE`. Inner
+     *   error logged server-side.
+     *
+     * Phase 1 ships the seam; the framework consumes the resolved record but
+     * does not yet enforce billing capabilities or status. Phase 2 (#1292)
+     * wires those once the SDK pin moves to AdCP 3.1.
+     */
+    agentRegistry?: BuyerAgentRegistry;
     /**
      * Derive a session-scoping key from the request. Populates `ctx.sessionKey`
      * so handlers don't re-implement key derivation (tenant, brand, publisher
@@ -929,7 +1070,66 @@ export interface AdcpServerConfig<TAccount = unknown> {
      * the principal is still the authenticated buyer.
      */
     resolveIdempotencyPrincipal?: (ctx: HandlerContext<TAccount>, params: IdempotencyPrincipalParams, toolName: AdcpServerToolName) => string | undefined;
-    instructions?: string;
+    /**
+     * Server-level prose surfaced on MCP `initialize`. Two forms:
+     *
+     * 1. **Static string** (the historical form) — captured at construction,
+     *    same value for every session.
+     * 2. **Function** `(ctx: SessionContext) => string | undefined` — re-evaluated
+     *    each time `createAdcpServer` is called. Under the canonical
+     *    `serve({ reuseAgent: false })` flow (the default) the factory
+     *    runs per HTTP request, which under streamable-HTTP MCP is per
+     *    session — so the closure can surface tenant-shaped prose (per-buyer
+     *    brand manifests, storefront copy, "premium vs standard" partner
+     *    guidance).
+     *
+     * **Eval moment.** Strictly: once per `createAdcpServer` invocation.
+     * `serve({ reuseAgent: false })` makes that "per HTTP request, which is
+     * per session for streamable-HTTP MCP." Custom transports / hand-rolled
+     * dispatch must invoke `createAdcpServer` per session themselves to
+     * preserve the per-session semantic. `reuseAgent: true` would fire the
+     * function once for the lifetime of the shared agent — which defeats
+     * the purpose, so `serve()` refuses that combination at the first
+     * request.
+     *
+     * **`SessionContext` is reserved.** `authInfo` and `agent` are typed for
+     * forward compatibility but currently always `undefined` — the framework
+     * does not yet plumb auth/registry state into the factory. **Use closures
+     * captured in your factory's HTTP-scoped state for tenant identity today;
+     * `ctx.agent`/`ctx.authInfo` reads silently return `undefined` and ship
+     * empty prose to prod.** The function body will pick up populated fields
+     * when the framework wires them through.
+     *
+     * @example Per-tenant prose via factory closure (recommended pattern):
+     * ```ts
+     * serve(({ taskStore, host }) => createAdcpServer({
+     *   // host is HTTP-scoped — captured in the closure, NOT from ctx.
+     *   instructions: () => brandManifests.get(host)?.intro ?? defaultProse,
+     *   // ... rest of config
+     * }));
+     * ```
+     *
+     * **Async functions are supported.** The framework awaits the returned
+     * Promise during MCP `initialize` — the session does not proceed until
+     * the promise settles. A slow fetch adds session-establishment latency,
+     * not per-tool latency; add a timeout inside your function if needed
+     * (e.g. `Promise.race([fetchProse(), timeout(2000)])`). A rejected
+     * promise is governed by `onInstructionsError`: `'skip'` (default) logs
+     * and sends no instructions; `'fail'` causes the `initialize` handshake
+     * to fail, dropping the session.
+     *
+     * @see SessionContext
+     * @see onInstructionsError
+     */
+    instructions?: string | ((ctx: SessionContext) => MaybePromise<string | undefined>);
+    /**
+     * Behavior when a function-form `instructions` callback throws. Defaults
+     * to `'skip'` — best-effort prose (brand manifests, marketing copy)
+     * should not kill the buyer's session on a registry fetch failure.
+     * Set `'fail'` for adopters whose instructions carry load-bearing
+     * policy. See {@link OnInstructionsError}.
+     */
+    onInstructionsError?: OnInstructionsError;
     taskStore?: TaskStore;
     taskMessageQueue?: TaskMessageQueue;
     /**
@@ -1010,8 +1210,7 @@ export interface AdcpServerConfig<TAccount = unknown> {
      * Gives sellers a declarative extension point without reaching for the
      * `getSdkServer()` escape hatch. Typical callers:
      *
-     *   - AdCP surfaces whose JSON Schemas haven't landed yet
-     *     (`creative_approval`, `update_rights`).
+     *   - AdCP surfaces whose JSON Schemas haven't landed yet.
      *   - Governance specialism helpers (`*_collection_list` family).
      *   - Test-harness tools (`comply_test_controller` — prefer
      *     {@link registerTestController} which wraps this).