@adcp/sdk 6.7.0 → 6.9.0

package/ADCP_VERSION

@@ -1 +1 @@
-3.0.5
+3.0.6

package/bin/adcp.js

@@ -1028,14 +1028,26 @@ ARGUMENTS:
                                             signing tasks, inventory-list
                                             targeting, and CAPI for delivery
                                             validation.
+                       sponsored-intelligence
+                                            Brand-agent platform (Salesforce
+                                            Agentforce / OpenAI Assistants
+                                            shaped) with conversational
+                                            offerings, stateful session
+                                            transcripts, and ACP transaction
+                                            handoff. Adapter wraps it to
+                                            expose si_get_offering /
+                                            si_initiate_session /
+                                            si_send_message /
+                                            si_terminate_session.
 
 OPTIONS:
   --port N           Listen port. Default: 4500.
   --api-key KEY      Override the static bearer credential. Only applies to
                      specialisms with static-bearer auth (signal-marketplace,
-                     creative-template). Ignored for OAuth specialisms
-                     (sales-social) — those issue tokens via the OAuth flow.
-                     Defaults to a stable test key printed at boot.
+                     creative-template, sponsored-intelligence). Ignored for
+                     OAuth specialisms (sales-social) — those issue tokens via
+                     the OAuth flow. Defaults to a stable test key printed at
+                     boot.
 
 NOTES:
   These mock servers represent the *upstream* platform an adopter wraps,

package/compliance/cache/{3.0.5 → 3.0.6}/domains/media-buy/scenarios/inventory_list_targeting.yaml

@@ -68,6 +68,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
 
           context:
             correlation_id: "inventory_list_targeting--get_products_brief"
@@ -112,6 +113,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
           idempotency_key: "inventory-list-targeting-create-v1"
           start_time: "2026-07-01T00:00:00Z"
           end_time: "2026-09-30T23:59:59Z"
@@ -169,6 +171,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
           media_buy_ids:
             - "$context.media_buy_id"
 
@@ -212,6 +215,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
           media_buy_id: "$context.media_buy_id"
           packages:
             - package_id: "$context.package_id"
@@ -248,6 +252,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
           media_buy_ids:
             - "$context.media_buy_id"
 

package/compliance/cache/{3.0.5 → 3.0.6}/index.json

@@ -1,6 +1,6 @@
 {
-  "adcp_version": "3.0.5",
-  "generated_at": "2026-05-02T21:51:32.508Z",
+  "adcp_version": "3.0.6",
+  "generated_at": "2026-05-03T17:47:32.344Z",
   "universal": [
     "capability-discovery",
     "collection-lists-pagination-integrity",

package/compliance/cache/{3.0.5 → 3.0.6}/protocols/media-buy/scenarios/inventory_list_targeting.yaml

@@ -68,6 +68,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
 
           context:
             correlation_id: "inventory_list_targeting--get_products_brief"
@@ -112,6 +113,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
           idempotency_key: "inventory-list-targeting-create-v1"
           start_time: "2026-07-01T00:00:00Z"
           end_time: "2026-09-30T23:59:59Z"
@@ -169,6 +171,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
           media_buy_ids:
             - "$context.media_buy_id"
 
@@ -212,6 +215,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
           media_buy_id: "$context.media_buy_id"
           packages:
             - package_id: "$context.package_id"
@@ -248,6 +252,7 @@ phases:
             brand:
               domain: "acmeoutdoor.example"
             operator: "pinnacle-agency.example"
+            sandbox: true
           media_buy_ids:
             - "$context.media_buy_id"
 

package/compliance/cache/{3.0.5 → 3.0.6}/specialisms/sales-guaranteed/index.yaml

@@ -317,7 +317,7 @@ phases:
             correlation_id: "sales_guaranteed--create_media_buy"
         context_outputs:
           - name: media_buy_id
-            path: "media_buy_id"
+            path: "task_completion.media_buy_id"
         validations:
           - check: response_schema
             description: "Response matches create-media-buy-response.json schema"

package/compliance/cache/{3.0.5 → 3.0.6}/universal/storyboard-schema.yaml

@@ -381,6 +381,21 @@
 #             storyboard run)
 #       path: string (JSON path against this step's response body, e.g.
 #             "media_buy_id", "accounts[0].account_id", "plans[0].plan_id")
+#
+#   Special path prefix `task_completion.<inner>`: when the immediate response
+#   is a non-terminal task envelope (status `submitted` / `working` /
+#   `input-required`, carrying a `task_id`), the runner polls `tasks/get`
+#   until the task reaches a terminal state and resolves `<inner>` against
+#   the completion artifact's `data` instead of the immediate response. Use
+#   for captures whose value only exists on the completion artifact — e.g.
+#   the seller-assigned `media_buy_id` on an IO-signing / async-signed HITL
+#   flow where `create_media_buy` returns `submitted` and the ID lands on
+#   the completion artifact. Without the prefix, the literal key
+#   `task_completion` is looked up on the immediate response, which fails
+#   as `capture_path_not_resolvable`. Requires runner >= adcp-client v6.7;
+#   older runners treat the prefix as a literal key. See adcp-client#1417
+#   (rationale) and adcp-client#1426 (implementation).
+#
 #   Runner behavior:
 #   - Captures occur AFTER the step's validations pass. A failed step MUST NOT
 #     populate the context accumulator — downstream $context.<name> references

package/dist/lib/adapters/derived-account-store.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Derived `AccountStore` factory for `resolution: 'derived'` single-tenant
+ * agents — there is no `account_id` on the wire and the auth principal alone
+ * identifies the tenant. Most self-hosted broadcasters, retail-media operators
+ * in proxy mode, and creative-only adapters (audiostack, flashtalking) where
+ * every API call is scoped by the buyer's per-request credential.
+ *
+ * Pairs with the existing reference adapters. Pick by asking *who creates the
+ * account?*:
+ * - **Buyer self-onboards via `sync_accounts`** → {@link InMemoryImplicitAccountStore}
+ *   (Shape A, `resolution: 'implicit'`).
+ * - **Upstream OAuth API owns the roster** → {@link createOAuthPassthroughResolver}
+ *   (Shape B, `resolution: 'explicit'`).
+ * - **Publisher ops curates the roster** → {@link createRosterAccountStore}
+ *   (Shape C, `resolution: 'explicit'`).
+ * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`
+ *   (this file, Shape D, `resolution: 'derived'`).
+ *
+ * Closes adcp-client#1462. Replaces the ~25–30 LOC of `if (!authInfo.token) throw
+ * AUTH_REQUIRED; return { id: ..., ctx_metadata: { accessToken } }` boilerplate
+ * Shape D adopters write today.
+ *
+ * @see docs/guides/account-resolution.md
+ * @public
+ */
+import type { Account, AccountStore, ResolveContext } from '../server/decisioning/account';
+/**
+ * Options for {@link createDerivedAccountStore}.
+ *
+ * @public
+ */
+export interface DerivedAccountStoreOptions<TCtxMeta = Record<string, unknown>> {
+    /**
+     * Build the singleton account from the request context. Called on every
+     * `resolve()` (no caching — the tenant is per-request because the auth
+     * principal varies). The returned account's `id` is typically a stable
+     * literal (e.g. `'audiostack'`, `'__publisher_wide__'`); single-tenant
+     * adapters have no buyer-supplied account_id to reflect back.
+     *
+     * **DO NOT put credentials in `ctx_metadata`.** See
+     * `docs/guides/CTX-METADATA-SAFETY.md` for the rationale. The wire-strip
+     * protects buyer responses but does NOT protect server-side log lines,
+     * error envelopes, or adopter-generated strings (e.g. `JSON.stringify(account)`
+     * in an error message). Re-derive the bearer from `ctx.authInfo` per
+     * request inside specialism methods instead.
+     *
+     * Adopters MAY omit `authInfo` from the returned `Account` — the framework
+     * auto-attaches the principal from `ctx.authInfo` when absent (matches
+     * Shape A/B/C semantics).
+     */
+    toAccount: (ctx: ResolveContext | undefined) => Account<TCtxMeta>;
+    /**
+     * Skip the `AUTH_REQUIRED` precheck. Defaults to `false` — the factory
+     * throws `AdcpError('AUTH_REQUIRED')` when `ctx.authInfo` is absent or
+     * carries no credential, matching the canonical Shape D pattern (every
+     * call must authenticate).
+     *
+     * Set to `true` for genuinely unauthenticated single-tenant agents (rare —
+     * public format catalogs, signed-request-only agents that authenticate
+     * out-of-band). When `true`, `toAccount` runs unconditionally.
+     *
+     * If you're tempted to set this because tests don't carry `authInfo`,
+     * fix the tests instead — `serve({ authenticate })` should populate
+     * `ctx.authInfo` from your test harness (or use `dispatchTestRequest`
+     * which threads a synthetic principal). The escape hatch is for
+     * production agents that legitimately accept unauthenticated traffic,
+     * not for working around fixture gaps.
+     *
+     * @default false
+     */
+    skipAuthCheck?: boolean;
+}
+/**
+ * Build an `AccountStore<TCtxMeta>` for single-tenant agents whose tenant is
+ * derived from the auth principal alone (no `account_id` on the wire).
+ *
+ * The factory:
+ * 1. Sets `resolution: 'derived'`.
+ * 2. Throws `AdcpError('AUTH_REQUIRED')` when `ctx.authInfo` carries no
+ *    credential (skip with `skipAuthCheck: true`). The check accepts the
+ *    discriminated `credential` shape (preferred) AND the deprecated
+ *    `token` / `clientId` fields populated by pre-#1269 authenticators —
+ *    fail-closed only when none of the three are present.
+ * 3. Calls `toAccount(ctx)` and returns the result. Buyer-supplied
+ *    `AccountReference` is ignored — single-tenant by definition.
+ * 4. Omits `list` / `upsert` — single-tenant adapters have nothing to
+ *    enumerate or write. Adopters who want either compose via spread.
+ *
+ * **When NOT to use this.** If two different auth principals should resolve
+ * to two different `account.id` values, you want Shape B
+ * ({@link createOAuthPassthroughResolver}) or `createTenantStore` — NOT this
+ * factory. Misusing Shape D in a multi-tenant deployment routes every buyer
+ * to the same singleton id and breaks tenant isolation silently (no error,
+ * no log). The factory is single-tenant by design — `toAccount(ctx)` should
+ * return the same `id` for every principal that calls it.
+ *
+ * @example AudioStack-shaped creative adapter:
+ * ```ts
+ * import { createDerivedAccountStore } from '@adcp/sdk/server';
+ *
+ * const accounts = createDerivedAccountStore<AudioStackAccountMeta>({
+ *   toAccount: (ctx) => ({
+ *     id: 'audiostack',
+ *     name: 'AudioStack',
+ *     status: 'active',
+ *     ctx_metadata: {},                     // tokens stay on ctx.authInfo, not here
+ *   }),
+ * });
+ * ```
+ *
+ * @example Single-tenant retail-media proxy with derived display name:
+ * ```ts
+ * const accounts = createDerivedAccountStore<{ tenantId: string }>({
+ *   toAccount: (ctx) => {
+ *     const cred = ctx?.authInfo?.credential;
+ *     const tenantId = cred?.kind === 'oauth' ? cred.client_id
+ *                    : cred?.kind === 'api_key' ? cred.key_id
+ *                    : 'public';
+ *     return {
+ *       id: 'criteo',
+ *       name: `Criteo (${tenantId})`,
+ *       status: 'active',
+ *       ctx_metadata: { tenantId },
+ *     };
+ *   },
+ * });
+ * ```
+ *
+ * @example Compose `upsert` for adapters that ALSO want a buyer-driven
+ * write path (rare for Shape D, but possible):
+ * ```ts
+ * const accounts: AccountStore<MyMeta> = {
+ *   ...createDerivedAccountStore({ toAccount }),
+ *   upsert: async (refs, ctx) => mySync(refs, ctx),
+ * };
+ * ```
+ *
+ * **Buyer-supplied `account_id` is refused at the framework boundary.**
+ * Since adcp-client#1468, the framework throws `AdcpError('INVALID_REQUEST',
+ * { field: 'account.account_id' })` BEFORE reaching this resolver when a
+ * `'derived'`-mode platform receives an inline `account_id` — same shape
+ * as `'implicit'`'s long-standing refusal (#1364), with a single-tenant
+ * message instead of the `sync_accounts`-first guidance. The factory
+ * itself ignores any `account_id` that does reach it (defensive belt +
+ * braces), but adopters can rely on the framework refusal as the
+ * canonical surface. Hand-rolled `'derived'` stores get the same
+ * enforcement automatically.
+ *
+ * @public
+ */
+export declare function createDerivedAccountStore<TCtxMeta = Record<string, unknown>>(options: DerivedAccountStoreOptions<TCtxMeta>): AccountStore<TCtxMeta>;
+//# sourceMappingURL=derived-account-store.d.ts.map

package/dist/lib/adapters/derived-account-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-account-store.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/derived-account-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAG3F;;;;GAIG;AACH,MAAM,WAAW,0BAA0B,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5E;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAElE;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,GAC5C,YAAY,CAAC,QAAQ,CAAC,CAgBxB"}

package/dist/lib/adapters/derived-account-store.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * Derived `AccountStore` factory for `resolution: 'derived'` single-tenant
+ * agents — there is no `account_id` on the wire and the auth principal alone
+ * identifies the tenant. Most self-hosted broadcasters, retail-media operators
+ * in proxy mode, and creative-only adapters (audiostack, flashtalking) where
+ * every API call is scoped by the buyer's per-request credential.
+ *
+ * Pairs with the existing reference adapters. Pick by asking *who creates the
+ * account?*:
+ * - **Buyer self-onboards via `sync_accounts`** → {@link InMemoryImplicitAccountStore}
+ *   (Shape A, `resolution: 'implicit'`).
+ * - **Upstream OAuth API owns the roster** → {@link createOAuthPassthroughResolver}
+ *   (Shape B, `resolution: 'explicit'`).
+ * - **Publisher ops curates the roster** → {@link createRosterAccountStore}
+ *   (Shape C, `resolution: 'explicit'`).
+ * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`
+ *   (this file, Shape D, `resolution: 'derived'`).
+ *
+ * Closes adcp-client#1462. Replaces the ~25–30 LOC of `if (!authInfo.token) throw
+ * AUTH_REQUIRED; return { id: ..., ctx_metadata: { accessToken } }` boilerplate
+ * Shape D adopters write today.
+ *
+ * @see docs/guides/account-resolution.md
+ * @public
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDerivedAccountStore = createDerivedAccountStore;
+const async_outcome_1 = require("../server/decisioning/async-outcome");
+/**
+ * Build an `AccountStore<TCtxMeta>` for single-tenant agents whose tenant is
+ * derived from the auth principal alone (no `account_id` on the wire).
+ *
+ * The factory:
+ * 1. Sets `resolution: 'derived'`.
+ * 2. Throws `AdcpError('AUTH_REQUIRED')` when `ctx.authInfo` carries no
+ *    credential (skip with `skipAuthCheck: true`). The check accepts the
+ *    discriminated `credential` shape (preferred) AND the deprecated
+ *    `token` / `clientId` fields populated by pre-#1269 authenticators —
+ *    fail-closed only when none of the three are present.
+ * 3. Calls `toAccount(ctx)` and returns the result. Buyer-supplied
+ *    `AccountReference` is ignored — single-tenant by definition.
+ * 4. Omits `list` / `upsert` — single-tenant adapters have nothing to
+ *    enumerate or write. Adopters who want either compose via spread.
+ *
+ * **When NOT to use this.** If two different auth principals should resolve
+ * to two different `account.id` values, you want Shape B
+ * ({@link createOAuthPassthroughResolver}) or `createTenantStore` — NOT this
+ * factory. Misusing Shape D in a multi-tenant deployment routes every buyer
+ * to the same singleton id and breaks tenant isolation silently (no error,
+ * no log). The factory is single-tenant by design — `toAccount(ctx)` should
+ * return the same `id` for every principal that calls it.
+ *
+ * @example AudioStack-shaped creative adapter:
+ * ```ts
+ * import { createDerivedAccountStore } from '@adcp/sdk/server';
+ *
+ * const accounts = createDerivedAccountStore<AudioStackAccountMeta>({
+ *   toAccount: (ctx) => ({
+ *     id: 'audiostack',
+ *     name: 'AudioStack',
+ *     status: 'active',
+ *     ctx_metadata: {},                     // tokens stay on ctx.authInfo, not here
+ *   }),
+ * });
+ * ```
+ *
+ * @example Single-tenant retail-media proxy with derived display name:
+ * ```ts
+ * const accounts = createDerivedAccountStore<{ tenantId: string }>({
+ *   toAccount: (ctx) => {
+ *     const cred = ctx?.authInfo?.credential;
+ *     const tenantId = cred?.kind === 'oauth' ? cred.client_id
+ *                    : cred?.kind === 'api_key' ? cred.key_id
+ *                    : 'public';
+ *     return {
+ *       id: 'criteo',
+ *       name: `Criteo (${tenantId})`,
+ *       status: 'active',
+ *       ctx_metadata: { tenantId },
+ *     };
+ *   },
+ * });
+ * ```
+ *
+ * @example Compose `upsert` for adapters that ALSO want a buyer-driven
+ * write path (rare for Shape D, but possible):
+ * ```ts
+ * const accounts: AccountStore<MyMeta> = {
+ *   ...createDerivedAccountStore({ toAccount }),
+ *   upsert: async (refs, ctx) => mySync(refs, ctx),
+ * };
+ * ```
+ *
+ * **Buyer-supplied `account_id` is refused at the framework boundary.**
+ * Since adcp-client#1468, the framework throws `AdcpError('INVALID_REQUEST',
+ * { field: 'account.account_id' })` BEFORE reaching this resolver when a
+ * `'derived'`-mode platform receives an inline `account_id` — same shape
+ * as `'implicit'`'s long-standing refusal (#1364), with a single-tenant
+ * message instead of the `sync_accounts`-first guidance. The factory
+ * itself ignores any `account_id` that does reach it (defensive belt +
+ * braces), but adopters can rely on the framework refusal as the
+ * canonical surface. Hand-rolled `'derived'` stores get the same
+ * enforcement automatically.
+ *
+ * @public
+ */
+function createDerivedAccountStore(options) {
+    const skipAuthCheck = options.skipAuthCheck ?? false;
+    return {
+        resolution: 'derived',
+        async resolve(_ref, ctx) {
+            if (!skipAuthCheck && !hasAuthSignal(ctx)) {
+                throw new async_outcome_1.AdcpError('AUTH_REQUIRED', {
+                    message: 'Single-tenant agent requires an authenticated principal; no credential on ctx.authInfo.',
+                    recovery: 'correctable',
+                });
+            }
+            return options.toAccount(ctx);
+        },
+    };
+}
+/**
+ * True when `ctx.authInfo` carries any usable credential signal — the
+ * discriminated `credential` shape (preferred, post-#1269) OR the deprecated
+ * `token` / `clientId` fields still populated by pre-Stage-3 authenticators
+ * during the N+1 deprecation window. Fail-closed only when none are present.
+ */
+function hasAuthSignal(ctx) {
+    const authInfo = ctx?.authInfo;
+    if (!authInfo)
+        return false;
+    return authInfo.credential !== undefined || authInfo.token !== undefined || authInfo.clientId !== undefined;
+}
+//# sourceMappingURL=derived-account-store.js.map

package/dist/lib/adapters/derived-account-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-account-store.js","sourceRoot":"","sources":["../../../src/lib/adapters/derived-account-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AAoIH,8DAkBC;AAlJD,uEAAgE;AAkDhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6EG;AACH,SAAgB,yBAAyB,CACvC,OAA6C;IAE7C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;IAErD,OAAO;QACL,UAAU,EAAE,SAAS;QAErB,KAAK,CAAC,OAAO,CAAC,IAAkC,EAAE,GAAoB;YACpE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,yBAAS,CAAC,eAAe,EAAE;oBACnC,OAAO,EAAE,yFAAyF;oBAClG,QAAQ,EAAE,aAAa;iBACxB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAA+B;IACpD,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;IAC/B,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC;AAC9G,CAAC"}

package/dist/lib/adapters/implicit-account-store.d.ts

@@ -11,7 +11,7 @@
  * implementations. See `docs/guides/account-resolution.md` for key
  * derivation guidance, error contracts, and TTL recommendations.
  *
- * **Picking an AccountStore?** Three reference shapes by *who creates the
+ * **Picking an AccountStore?** Four reference shapes by *who creates the
  * account*:
  * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`
  *   (this file, Shape A).
@@ -19,6 +19,8 @@
  *   (Shape B, returns just `resolve`).
  * - **Publisher ops curates the roster** → `createRosterAccountStore`
  *   (Shape C, complete AccountStore).
+ * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`
+ *   (Shape D, `resolution: 'derived'`).
  *
  * @see docs/guides/account-resolution.md
  * @public

package/dist/lib/adapters/implicit-account-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"implicit-account-store.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/implicit-account-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,0BAA0B,CAAC;AACjF,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EAEZ,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAM/B;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAWnF;AAiBD;;;GAGG;AACH,MAAM,WAAW,2BAA2B,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC7E;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/G;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,MAAM,GAAG,SAAS,CAAC;IAE3D;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,qBAAa,4BAA4B,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,YAAW,YAAY,CAAC,QAAQ,CAAC;IAC7G,QAAQ,CAAC,UAAU,EAAG,UAAU,CAAU;IAE1C,OAAO,CAAC,MAAM,CAA4C;IAC1D,OAAO,CAAC,MAAM,CAAqD;IACnE,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAG+B;gBAExC,OAAO,CAAC,EAAE,2BAA2B,CAAC,QAAQ,CAAC;IAQ3D;;;;;;;;;;;;;;;OAeG;IACG,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAc1G;;;;;;;;;;;;;;OAcG;IACG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAqH9F,uCAAuC;IACvC,KAAK,IAAI,IAAI;IAIb;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS;IAIvD,2EAA2E;IAC3E,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}
+{"version":3,"file":"implicit-account-store.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/implicit-account-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAkB,MAAM,0BAA0B,CAAC;AACjF,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EAEZ,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAM/B;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAWnF;AAiBD;;;GAGG;AACH,MAAM,WAAW,2BAA2B,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC7E;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/G;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,MAAM,GAAG,SAAS,CAAC;IAE3D;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAyCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,qBAAa,4BAA4B,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAE,YAAW,YAAY,CAAC,QAAQ,CAAC;IAC7G,QAAQ,CAAC,UAAU,EAAG,UAAU,CAAU;IAE1C,OAAO,CAAC,MAAM,CAA4C;IAC1D,OAAO,CAAC,MAAM,CAAqD;IACnE,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAG+B;gBAExC,OAAO,CAAC,EAAE,2BAA2B,CAAC,QAAQ,CAAC;IAQ3D;;;;;;;;;;;;;;;OAeG;IACG,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAc1G;;;;;;;;;;;;;;OAcG;IACG,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAqH9F,uCAAuC;IACvC,KAAK,IAAI,IAAI;IAIb;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS;IAIvD,2EAA2E;IAC3E,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/lib/adapters/implicit-account-store.js

@@ -12,7 +12,7 @@
  * implementations. See `docs/guides/account-resolution.md` for key
  * derivation guidance, error contracts, and TTL recommendations.
  *
- * **Picking an AccountStore?** Three reference shapes by *who creates the
+ * **Picking an AccountStore?** Four reference shapes by *who creates the
  * account*:
  * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`
  *   (this file, Shape A).
@@ -20,6 +20,8 @@
  *   (Shape B, returns just `resolve`).
  * - **Publisher ops curates the roster** → `createRosterAccountStore`
  *   (Shape C, complete AccountStore).
+ * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`
+ *   (Shape D, `resolution: 'derived'`).
  *
  * @see docs/guides/account-resolution.md
  * @public

package/dist/lib/adapters/implicit-account-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"implicit-account-store.js","sourceRoot":"","sources":["../../../src/lib/adapters/implicit-account-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AA4BH,oDAWC;AA3BD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAgB,oBAAoB,CAAC,QAA0B;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,SAAS,aAAa,CAAC,GAAqB;IAC1C,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,MAAM,GAAI,CAAC,CAAC,OAAO,CAAyC,EAAE,CAAC,QAAQ,CAAuB,CAAC;IACrG,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAuB,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAwB,CAAC,CAAC;IAC7D,OAAO,GAAG,MAAM,IAAI,EAAE,IAAI,QAAQ,IAAI,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACpE,CAAC;AAkDD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,mBAAmB,CAC1B,GAAqB,EACrB,IAAqB;IAErB,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAA+B,CAAC;IACvD,MAAM,QAAQ,GAAI,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,MAAM,UAAU,GACb,CAAC,CAAC,YAAY,CAAwB;QACvC,CAAC,KAAK,IAAI,QAAQ,IAAI,KAAK;YACzB,CAAC,CAAC,GAAI,KAA4B,CAAC,MAAM,IAAI,QAAQ,GAAG,aAAa,EAAE;YACvE,CAAC,CAAC,OAAO,QAAQ,GAAG,aAAa,EAAE,CAAC,CAAC;IACzC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,QAA6B;QACrC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjC,YAAY,EAAE,EAAwC;KACvD,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAa,4BAA4B;IAC9B,UAAU,GAAG,UAAmB,CAAC;IAElC,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAClD,MAAM,CAAqD;IAC3D,MAAM,CAAS;IACf,aAAa,CAG+B;IAEpD,YAAY,OAA+C;QACzD,IAAI,CAAC,aAAa;YAChB,OAAO,EAAE,YAAY;gBACpB,mBAAqG,CAAC;QACzG,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,oBAAoB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,OAAO,CAAC,IAAkC,EAAE,GAAoB;QACpE,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CAAC,IAAwB,EAAE,GAAoB;QACzD,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;QAE/B,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBACpB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,OAAO;oBACL,KAAK,EAAG,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,SAAS,EAAqB;oBAC9F,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE;oBACrD,MAAM,EAAE,QAAiB;oBACzB,MAAM,EAAE,UAA+B;oBACvC,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,aAAa;4BACnB,OAAO,EACL,QAAQ,KAAK,SAAS;gCACpB,CAAC,CAAC,wEAAwE;gCAC1E,CAAC,CAAC,sFAAsF;yBAC7F;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiE,CAAC;QAC9F,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE;oBACjD,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE;oBAC9B,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAwB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,IAAI,GAA4B,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,GAAG,EAAE,CAAC;gBACR,gEAAgE;gBAChE,qEAAqE;gBACrE,mEAAmE;gBACnE,4CAA4C;gBAC5C,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,MAAM,KAAK,GACT,GAAG,CAAC,OAAO,CAAC,KAAK;oBAChB,CAAC,CAAC,OAAO,CAAgC;oBACzC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAqB,CAAC;gBACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAK,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC;oBACR,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;oBAC1B,KAAK;oBACL,QAAQ;oBACR,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACtB,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;iBAC3B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,MAAM,KAAK,GACT,OAAO,CAAC,KAAK,IAAK,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAqB,CAAC;gBAC5G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAK,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;gBACjF,IAAI,CAAC,IAAI,CAAC;oBACR,UAAU,EAAE,OAAO,CAAC,EAAE;oBACtB,KAAK;oBACL,QAAQ;oBACR,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,sEAAsE;gBACtE,iEAAiE;gBACjE,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;gBACzE,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC;oBACR,KAAK,EAAG,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,SAAS,EAAqB;oBAC9F,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE;oBACrD,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,UAA+B;oBACvC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,eAAe;IACf,8EAA8E;IAE9E,uCAAuC;IACvC,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAA0B;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAtMD,oEAsMC"}
+{"version":3,"file":"implicit-account-store.js","sourceRoot":"","sources":["../../../src/lib/adapters/implicit-account-store.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AA4BH,oDAWC;AA3BD,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAgB,oBAAoB,CAAC,QAA0B;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;QAClC,KAAK,UAAU;YACb,OAAO,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,SAAS,aAAa,CAAC,GAAqB;IAC1C,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,MAAM,GAAI,CAAC,CAAC,OAAO,CAAyC,EAAE,CAAC,QAAQ,CAAuB,CAAC;IACrG,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAuB,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAwB,CAAC,CAAC;IAC7D,OAAO,GAAG,MAAM,IAAI,EAAE,IAAI,QAAQ,IAAI,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACpE,CAAC;AAkDD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,mBAAmB,CAC1B,GAAqB,EACrB,IAAqB;IAErB,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAA+B,CAAC;IACvD,MAAM,QAAQ,GAAI,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,MAAM,UAAU,GACb,CAAC,CAAC,YAAY,CAAwB;QACvC,CAAC,KAAK,IAAI,QAAQ,IAAI,KAAK;YACzB,CAAC,CAAC,GAAI,KAA4B,CAAC,MAAM,IAAI,QAAQ,GAAG,aAAa,EAAE;YACvE,CAAC,CAAC,OAAO,QAAQ,GAAG,aAAa,EAAE,CAAC,CAAC;IACzC,OAAO;QACL,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,QAA6B;QACrC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;QACrC,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjC,YAAY,EAAE,EAAwC;KACvD,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAa,4BAA4B;IAC9B,UAAU,GAAG,UAAmB,CAAC;IAElC,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAClD,MAAM,CAAqD;IAC3D,MAAM,CAAS;IACf,aAAa,CAG+B;IAEpD,YAAY,OAA+C;QACzD,IAAI,CAAC,aAAa;YAChB,OAAO,EAAE,YAAY;gBACpB,mBAAqG,CAAC;QACzG,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,oBAAoB,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,OAAO,CAAC,IAAkC,EAAE,GAAoB;QACpE,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CAAC,IAAwB,EAAE,GAAoB;QACzD,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;QAE/B,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBACpB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,OAAO;oBACL,KAAK,EAAG,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,SAAS,EAAqB;oBAC9F,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE;oBACrD,MAAM,EAAE,QAAiB;oBACzB,MAAM,EAAE,UAA+B;oBACvC,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,aAAa;4BACnB,OAAO,EACL,QAAQ,KAAK,SAAS;gCACpB,CAAC,CAAC,wEAAwE;gCAC1E,CAAC,CAAC,sFAAsF;yBAC7F;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiE,CAAC;QAC9F,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE;oBACjD,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE;oBAC9B,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAwB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,MAAM,IAAI,GAA4B,EAAE,CAAC;QAEzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,GAAG,EAAE,CAAC;gBACR,gEAAgE;gBAChE,qEAAqE;gBACrE,mEAAmE;gBACnE,4CAA4C;gBAC5C,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,MAAM,KAAK,GACT,GAAG,CAAC,OAAO,CAAC,KAAK;oBAChB,CAAC,CAAC,OAAO,CAAgC;oBACzC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAqB,CAAC;gBACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAK,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;gBACrF,IAAI,CAAC,IAAI,CAAC;oBACR,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;oBAC1B,KAAK;oBACL,QAAQ;oBACR,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACtB,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM;iBAC3B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACnD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,MAAM,KAAK,GACT,OAAO,CAAC,KAAK,IAAK,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAqB,CAAC;gBAC5G,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAK,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE,CAAC;gBACjF,IAAI,CAAC,IAAI,CAAC;oBACR,UAAU,EAAE,OAAO,CAAC,EAAE;oBACtB,KAAK;oBACL,QAAQ;oBACR,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,sEAAsE;gBACtE,iEAAiE;gBACjE,OAAO,CAAC,KAAK,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;gBACzE,MAAM,CAAC,GAAG,GAA8B,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC;oBACR,KAAK,EAAG,CAAC,CAAC,OAAO,CAAgC,IAAK,EAAE,MAAM,EAAE,SAAS,EAAqB;oBAC9F,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAwB,IAAI,EAAE;oBACrD,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,UAA+B;oBACvC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,eAAe;IACf,8EAA8E;IAE9E,uCAAuC;IACvC,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAA0B;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;CACF;AAtMD,oEAsMC"}

package/dist/lib/adapters/index.d.ts

@@ -20,4 +20,5 @@ export { SISessionManager, AISISessionManager, type ISISessionManager, type SISe
 export { InMemoryImplicitAccountStore, defaultImplicitKeyFn, type ImplicitAccountStoreOptions, } from './implicit-account-store';
 export { createOAuthPassthroughResolver, type OAuthPassthroughResolverOptions } from './oauth-passthrough-resolver';
 export { createRosterAccountStore, type RosterAccountStoreOptions } from './roster-account-store';
+export { createDerivedAccountStore, type DerivedAccountStoreOptions } from './derived-account-store';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,YAAY,EACZ,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,0BAA0B,CAAC;AAMlC,OAAO,EAAE,8BAA8B,EAAE,KAAK,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAOpH,OAAO,EAAE,wBAAwB,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,YAAY,EACZ,uBAAuB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,0BAA0B,CAAC;AAMlC,OAAO,EAAE,8BAA8B,EAAE,KAAK,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAOpH,OAAO,EAAE,wBAAwB,EAAE,KAAK,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAMlG,OAAO,EAAE,yBAAyB,EAAE,KAAK,0BAA0B,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/lib/adapters/index.js

@@ -14,7 +14,7 @@
  * - InMemoryImplicitAccountStore: AccountStore for resolution: 'implicit' platforms
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRosterAccountStore = exports.createOAuthPassthroughResolver = exports.defaultImplicitKeyFn = exports.InMemoryImplicitAccountStore = exports.defaultSISessionManager = exports.SIErrorCodes = exports.AISISessionManager = exports.SISessionManager = exports.isGovernanceAdapterError = exports.GovernanceAdapterErrorCodes = exports.defaultGovernanceAdapter = exports.GovernanceAdapter = exports.defaultProposalManager = exports.ProposalErrorCodes = exports.AIProposalManager = exports.ProposalManager = exports.defaultPropertyListAdapter = exports.isPropertyListError = exports.PropertyListErrorCodes = exports.PropertyListAdapter = exports.defaultContentStandardsAdapter = exports.isContentStandardsError = exports.ContentStandardsErrorCodes = exports.ContentStandardsAdapter = void 0;
+exports.createDerivedAccountStore = exports.createRosterAccountStore = exports.createOAuthPassthroughResolver = exports.defaultImplicitKeyFn = exports.InMemoryImplicitAccountStore = exports.defaultSISessionManager = exports.SIErrorCodes = exports.AISISessionManager = exports.SISessionManager = exports.isGovernanceAdapterError = exports.GovernanceAdapterErrorCodes = exports.defaultGovernanceAdapter = exports.GovernanceAdapter = exports.defaultProposalManager = exports.ProposalErrorCodes = exports.AIProposalManager = exports.ProposalManager = exports.defaultPropertyListAdapter = exports.isPropertyListError = exports.PropertyListErrorCodes = exports.PropertyListAdapter = exports.defaultContentStandardsAdapter = exports.isContentStandardsError = exports.ContentStandardsErrorCodes = exports.ContentStandardsAdapter = void 0;
 // Content Standards
 var content_standards_adapter_1 = require("./content-standards-adapter");
 Object.defineProperty(exports, "ContentStandardsAdapter", { enumerable: true, get: function () { return content_standards_adapter_1.ContentStandardsAdapter; } });
@@ -62,4 +62,10 @@ Object.defineProperty(exports, "createOAuthPassthroughResolver", { enumerable: t
 // where the roster lives.
 var roster_account_store_1 = require("./roster-account-store");
 Object.defineProperty(exports, "createRosterAccountStore", { enumerable: true, get: function () { return roster_account_store_1.createRosterAccountStore; } });
+// Derived AccountStore — Shape D factory for `resolution: 'derived'` single-
+// tenant agents (no account_id on the wire; auth principal alone identifies
+// the tenant). Closes adcp-client#1462. Replaces ~25–30 LOC of bearer-extract +
+// throw-AUTH_REQUIRED + return-singleton boilerplate Shape D adopters write today.
+var derived_account_store_1 = require("./derived-account-store");
+Object.defineProperty(exports, "createDerivedAccountStore", { enumerable: true, get: function () { return derived_account_store_1.createDerivedAccountStore; } });
 //# sourceMappingURL=index.js.map

package/dist/lib/adapters/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/adapters/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAEH,oBAAoB;AACpB,yEAOqC;AANnC,oIAAA,uBAAuB,OAAA;AAGvB,uIAAA,0BAA0B,OAAA;AAC1B,oIAAA,uBAAuB,OAAA;AACvB,2IAAA,8BAA8B,OAAA;AAGhC,iBAAiB;AACjB,iEAOiC;AAN/B,4HAAA,mBAAmB,OAAA;AAGnB,+HAAA,sBAAsB,OAAA;AACtB,4HAAA,mBAAmB,OAAA;AACnB,mIAAA,0BAA0B,OAAA;AAG5B,sBAAsB;AACtB,uDAO4B;AAN1B,mHAAA,eAAe,OAAA;AACf,qHAAA,iBAAiB,OAAA;AAGjB,sHAAA,kBAAkB,OAAA;AAClB,0HAAA,sBAAsB,OAAA;AAGxB,4CAA4C;AAC5C,2DAS8B;AAR5B,uHAAA,iBAAiB,OAAA;AACjB,8HAAA,wBAAwB,OAAA;AAKxB,iIAAA,2BAA2B,OAAA;AAC3B,8HAAA,wBAAwB,OAAA;AAG1B,kCAAkC;AAClC,2DAO8B;AAN5B,sHAAA,gBAAgB,OAAA;AAChB,wHAAA,kBAAkB,OAAA;AAGlB,kHAAA,YAAY,OAAA;AACZ,6HAAA,uBAAuB,OAAA;AAGzB,+EAA+E;AAC/E,mEAIkC;AAHhC,sIAAA,4BAA4B,OAAA;AAC5B,8HAAA,oBAAoB,OAAA;AAItB,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,mCAAmC;AACnC,2EAAoH;AAA3G,4IAAA,8BAA8B,OAAA;AAEvC,4EAA4E;AAC5E,gFAAgF;AAChF,yEAAyE;AACzE,+EAA+E;AAC/E,0BAA0B;AAC1B,+DAAkG;AAAzF,gIAAA,wBAAwB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/adapters/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAEH,oBAAoB;AACpB,yEAOqC;AANnC,oIAAA,uBAAuB,OAAA;AAGvB,uIAAA,0BAA0B,OAAA;AAC1B,oIAAA,uBAAuB,OAAA;AACvB,2IAAA,8BAA8B,OAAA;AAGhC,iBAAiB;AACjB,iEAOiC;AAN/B,4HAAA,mBAAmB,OAAA;AAGnB,+HAAA,sBAAsB,OAAA;AACtB,4HAAA,mBAAmB,OAAA;AACnB,mIAAA,0BAA0B,OAAA;AAG5B,sBAAsB;AACtB,uDAO4B;AAN1B,mHAAA,eAAe,OAAA;AACf,qHAAA,iBAAiB,OAAA;AAGjB,sHAAA,kBAAkB,OAAA;AAClB,0HAAA,sBAAsB,OAAA;AAGxB,4CAA4C;AAC5C,2DAS8B;AAR5B,uHAAA,iBAAiB,OAAA;AACjB,8HAAA,wBAAwB,OAAA;AAKxB,iIAAA,2BAA2B,OAAA;AAC3B,8HAAA,wBAAwB,OAAA;AAG1B,kCAAkC;AAClC,2DAO8B;AAN5B,sHAAA,gBAAgB,OAAA;AAChB,wHAAA,kBAAkB,OAAA;AAGlB,kHAAA,YAAY,OAAA;AACZ,6HAAA,uBAAuB,OAAA;AAGzB,+EAA+E;AAC/E,mEAIkC;AAHhC,sIAAA,4BAA4B,OAAA;AAC5B,8HAAA,oBAAoB,OAAA;AAItB,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,mCAAmC;AACnC,2EAAoH;AAA3G,4IAAA,8BAA8B,OAAA;AAEvC,4EAA4E;AAC5E,gFAAgF;AAChF,yEAAyE;AACzE,+EAA+E;AAC/E,0BAA0B;AAC1B,+DAAkG;AAAzF,gIAAA,wBAAwB,OAAA;AAEjC,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,mFAAmF;AACnF,iEAAqG;AAA5F,kIAAA,yBAAyB,OAAA"}

package/dist/lib/adapters/oauth-passthrough-resolver.d.ts

@@ -14,7 +14,7 @@
  *
  * Closes adcp-client#1363.
  *
- * **Picking an AccountStore?** Three reference shapes by *who creates the
+ * **Picking an AccountStore?** Four reference shapes by *who creates the
  * account*:
  * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`
  *   (Shape A).
@@ -22,6 +22,8 @@
  *   (this file, Shape B, returns just `resolve`).
  * - **Publisher ops curates the roster** → `createRosterAccountStore`
  *   (Shape C, complete AccountStore).
+ * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`
+ *   (Shape D, `resolution: 'derived'`).
  *
  * @public
  */

package/dist/lib/adapters/oauth-passthrough-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-passthrough-resolver.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/oauth-passthrough-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAElF;;;;GAIG;AACH,MAAM,WAAW,+BAA+B,CAAC,YAAY,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/F;;;;;OAKG;IACH,UAAU,EAAE,kBAAkB,CAAC;IAE/B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,YAAY,GAAG,MAAM,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,KAAK,WAAW,GAAG,SAAS,CAAC;IAE9E;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,KAAK,MAAM,CAAC;QAC/D,qFAAqF;QACrF,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5C,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAElC,OAAO,EAAE,+BAA+B,CAAC,YAAY,EAAE,QAAQ,CAAC,GAC/D,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CA2DhG"}
+{"version":3,"file":"oauth-passthrough-resolver.d.ts","sourceRoot":"","sources":["../../../src/lib/adapters/oauth-passthrough-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAElF;;;;GAIG;AACH,MAAM,WAAW,+BAA+B,CAAC,YAAY,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC/F;;;;;OAKG;IACH,UAAU,EAAE,kBAAkB,CAAC;IAE/B;;;OAGG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,YAAY,GAAG,MAAM,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,KAAK,WAAW,GAAG,SAAS,CAAC;IAE9E;;;;;;;;;;;;OAYG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAErF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,KAAK,MAAM,CAAC;QAC/D,qFAAqF;QACrF,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAgB,8BAA8B,CAC5C,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5C,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAElC,OAAO,EAAE,+BAA+B,CAAC,YAAY,EAAE,QAAQ,CAAC,GAC/D,CAAC,GAAG,EAAE,gBAAgB,GAAG,SAAS,EAAE,GAAG,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CA2DhG"}

package/dist/lib/adapters/oauth-passthrough-resolver.js

@@ -15,7 +15,7 @@
  *
  * Closes adcp-client#1363.
  *
- * **Picking an AccountStore?** Three reference shapes by *who creates the
+ * **Picking an AccountStore?** Four reference shapes by *who creates the
  * account*:
  * - **Buyer self-onboards via `sync_accounts`** → `InMemoryImplicitAccountStore`
  *   (Shape A).
@@ -23,6 +23,8 @@
  *   (this file, Shape B, returns just `resolve`).
  * - **Publisher ops curates the roster** → `createRosterAccountStore`
  *   (Shape C, complete AccountStore).
+ * - **No account concept — auth principal IS the tenant** → `createDerivedAccountStore`
+ *   (Shape D, `resolution: 'derived'`).
  *
  * @public
  */