@adcp/sdk 13.0.1 → 13.0.3

package/ADCP_VERSION

@@ -1 +1 @@
-3.1.15
+3.1.20

package/bin/adcp.js

@@ -1047,6 +1047,10 @@ function parseAgentOptions(args) {
   const debug = args.includes('--debug') || process.env.ADCP_DEBUG === 'true';
   const dryRun = args.includes('--dry-run');
   const allowHttp = args.includes('--allow-http');
+  // Migration escape hatch for compatibility harnesses that are testing
+  // transport/version behavior against a known schema-invalid legacy seller.
+  // Normal local compliance runs remain strict by default.
+  const strictResponseSchemaValidation = !args.includes('--no-strict-response-schema-validation');
   // `--no-sandbox` forces `account.sandbox: false` (production) on every
   // request the runner builds. The default behavior leaves the field unset
   // (spec-equivalent to false), but agents that key sandbox routing on
@@ -1185,6 +1189,7 @@ function parseAgentOptions(args) {
     debug,
     dryRun,
     allowHttp,
+    strictResponseSchemaValidation,
     noSandbox,
     assertsSeededState,
     positionalArgs,
@@ -1963,6 +1968,11 @@ SUBCOMMANDS:
   step <agent> <id> <step_id>  Run a single step (stateless, LLM-friendly)
 
 RUN OPTIONS (full assessment):
+  Response-schema checks are strict and grading by default, matching the
+  hosted compliance grader. JSON output includes strict_validation_summary.
+  --no-strict-response-schema-validation
+                      Keep packaged-schema strict failures diagnostic-only.
+                      Intended only for temporary legacy migration harnesses.
   --tracks TRACKS     Comma-separated tracks to include in the report
   --storyboards IDS   Comma-separated storyboard/bundle IDs to run
   --compliance-version VERSION
@@ -2851,6 +2861,7 @@ async function handleStoryboardRun(args) {
     ...(fileComplianceOptions.complianceDir && { complianceDir: fileComplianceOptions.complianceDir }),
     ...(fileComplianceOptions.adcpVersion && { adcpVersion: fileComplianceOptions.adcpVersion }),
     ...(fileComplianceOptions.schemaRoot && { schemaRoot: fileComplianceOptions.schemaRoot }),
+    ...(!opts.strictResponseSchemaValidation && { strictResponseSchemaValidation: false }),
     ...(opts.noSandbox && { sandbox: false, disable_sandbox: true }),
     ...(opts.assertsSeededState && { assertsSeededState: true }),
     ...(mergedRunHeaders && { headers: mergedRunHeaders }),
@@ -3689,6 +3700,7 @@ async function handleLocalAgentStoryboardRun(modulePath, args, opts) {
       compliance: resolveOptions,
       ...(opts.complianceVersion ||
       opts.schemaRoot ||
+      !opts.strictResponseSchemaValidation ||
       opts.noSandbox ||
       opts.assertsSeededState ||
       opts.loadedTestKit !== undefined
@@ -3696,6 +3708,7 @@ async function handleLocalAgentStoryboardRun(modulePath, args, opts) {
             runStoryboardOptions: {
               ...(opts.complianceVersion && !opts.complianceDir && { adcpVersion: opts.complianceVersion }),
               ...(opts.schemaRoot && { schemaRoot: opts.schemaRoot }),
+              ...(!opts.strictResponseSchemaValidation && { strictResponseSchemaValidation: false }),
               ...(opts.noSandbox && { sandbox: false, disable_sandbox: true }),
               ...(opts.assertsSeededState && { assertsSeededState: true }),
               ...(opts.loadedTestKit !== undefined && { test_kit: opts.loadedTestKit }),
@@ -4129,6 +4142,7 @@ async function handleMultiInstanceStoryboardRun(args, opts, urls) {
     ...(runComplianceDir && { complianceDir: runComplianceDir }),
     ...(runAdcpVersion && { adcpVersion: runAdcpVersion }),
     ...(runSchemaRoot && { schemaRoot: runSchemaRoot }),
+    ...(!opts.strictResponseSchemaValidation && { strictResponseSchemaValidation: false }),
     ...(opts.noSandbox && { sandbox: false, disable_sandbox: true }),
     ...(opts.assertsSeededState && { assertsSeededState: true }),
     ...(opts.loadedTestKit !== undefined && { test_kit: opts.loadedTestKit }),
@@ -4409,6 +4423,7 @@ async function handleAgentsRoutedStoryboardRun(args, opts, routing) {
     ...(runComplianceDir && { complianceDir: runComplianceDir }),
     ...(runAdcpVersion && { adcpVersion: runAdcpVersion }),
     ...(runSchemaRoot && { schemaRoot: runSchemaRoot }),
+    ...(!opts.strictResponseSchemaValidation && { strictResponseSchemaValidation: false }),
     ...(opts.noSandbox && { sandbox: false, disable_sandbox: true }),
     ...(opts.assertsSeededState && { assertsSeededState: true }),
     ...(opts.loadedTestKit !== undefined && { test_kit: opts.loadedTestKit }),
@@ -4621,6 +4636,7 @@ async function runFullAssessment(agentArg, rawArgs, parsedOpts) {
     ...(opts.complianceVersion && { version: opts.complianceVersion }),
     ...(opts.complianceDir && { complianceDir: opts.complianceDir }),
     ...(opts.schemaRoot && { schemaRoot: opts.schemaRoot }),
+    ...(!opts.strictResponseSchemaValidation && { strictResponseSchemaValidation: false }),
     ...(opts.hostedStableLineAlias && { hostedStableLineAlias: opts.hostedStableLineAlias }),
   };
 
@@ -4762,7 +4778,16 @@ async function runFullAssessment(agentArg, rawArgs, parsedOpts) {
 async function handleStoryboardStepCmd(args) {
   const { getComplianceStoryboardById, runStoryboardStep } = await import('../dist/lib/testing/storyboard/index.js');
   let opts = parseAgentOptions(args);
-  let { authToken, authScheme, protocolFlag, jsonOutput, positionalArgs, complianceVersion, schemaRoot } = opts;
+  let {
+    authToken,
+    authScheme,
+    protocolFlag,
+    jsonOutput,
+    positionalArgs,
+    complianceVersion,
+    schemaRoot,
+    strictResponseSchemaValidation,
+  } = opts;
 
   enforceStrictFlags(args, warnRemovedFlags(args));
 
@@ -4774,7 +4799,16 @@ async function handleStoryboardStepCmd(args) {
     exitTestKitSelectionError(err, jsonOutput);
   }
 
-  ({ authToken, authScheme, protocolFlag, jsonOutput, positionalArgs, complianceVersion, schemaRoot } = opts);
+  ({
+    authToken,
+    authScheme,
+    protocolFlag,
+    jsonOutput,
+    positionalArgs,
+    complianceVersion,
+    schemaRoot,
+    strictResponseSchemaValidation,
+  } = opts);
   const { resolveOptions } = parseComplianceSelection(args);
 
   const agentArg = positionalArgs[0];
@@ -4830,6 +4864,7 @@ async function handleStoryboardStepCmd(args) {
     ...(opts.complianceDir && { complianceDir: opts.complianceDir }),
     ...(schemaRoot && { schemaRoot }),
     ...(opts.loadedTestKit !== undefined && { test_kit: opts.loadedTestKit }),
+    ...(!strictResponseSchemaValidation && { strictResponseSchemaValidation: false }),
     ...buildResolvedAuthOption({
       resolvedAuth,
       resolvedAuthScheme,

package/compliance/cache/{3.1.15 → 3.1.20}/domains/media-buy/index.yaml

@@ -1,5 +1,5 @@
 id: media_buy_seller
-version: "1.0.0"
+version: "1.0.1"
 title: "Media buy seller agent"
 category: media_buy_seller
 summary: "Seller agent that receives briefs, returns products, accepts media buys, and reports delivery."
@@ -587,6 +587,9 @@ phases:
 
   - id: creative_sync
     title: "Creative sync"
+    requires_capability:
+      path: creative.has_creative_library
+      equals: true
     narrative: |
       With the media buy confirmed, the buyer syncs creative assets to your platform.
       Each package in the buy has creative format requirements — the buyer discovered
@@ -745,6 +748,7 @@ phases:
 
   - id: delivery_monitoring
     title: "Delivery and reporting"
+    depends_on: [create_buy]
     narrative: |
       The campaign is live. The buyer monitors delivery through two tasks:
       get_media_buys for status and get_media_buy_delivery for performance metrics.

package/compliance/cache/{3.1.15.previous/protocols → 3.1.20/domains}/media-buy/scenarios/creative_fate_after_cancellation.yaml

@@ -1,5 +1,5 @@
 id: media_buy_seller/creative_fate_after_cancellation
-version: "1.0.0"
+version: "1.0.1"
 title: "Creative lifecycle is decoupled from media buy lifecycle"
 category: media_buy_seller
 summary: "Validates that canceling a media buy releases package-creative assignments but leaves the underlying creatives in the library with their review state intact, and that buyers can reuse released creatives on a new buy."
@@ -12,6 +12,10 @@ required_tools:
   - sync_creatives
   - list_creatives
 
+requires_capability:
+  path: creative.has_creative_library
+  equals: true
+
 narrative: |
   Per the creative library model (docs/creative/creative-libraries#creative-state-and-assignment-state-are-separate)
   and the Media Buy State Transitions rule, canceling or rejecting a media buy

package/compliance/cache/{3.1.15/protocols → 3.1.20/domains}/media-buy/scenarios/dependency_impairment.yaml

@@ -1,5 +1,5 @@
 id: media_buy_seller/dependency_impairment
-version: "2.0.0"
+version: "2.0.1"
 title: "Dependency impairment end-to-end — resource transition propagates to media buy health"
 category: media_buy_seller
 summary: "Forces a creative from approved → rejected on a non-terminal media buy, verifies the buy reflects health: impaired with a matching impairments[] entry, and recovers via assignment swap to a different creative (canonical recovery vector — re-approval of the same creative_id is uncommon in production)."
@@ -13,19 +13,13 @@ required_tools:
   - update_media_buy
   - comply_test_controller
 
-# Capability gate: this scenario grades the snapshot-coherence surface, so it
-# runs only for sellers that declare media_buy.propagation_surfaces including
-# "snapshot". Webhook-only or out_of_band sellers grade not_applicable instead
-# of false-failing on a contract that does not apply to them — the opt-out the
-# propagation_surfaces schema already documents (get-adcp-capabilities-response.json)
-# but that was never wired into this scenario. Requires the `contains:` matcher
-# (@adcp/sdk >= 7.70). Sellers that OMIT propagation_surfaces inherit the
-# ["snapshot"] default and are graded here only on @adcp/sdk >= 9.2.0, which
-# materializes capability-gate schema defaults; earlier runners skip them as
-# not_applicable (adcp-client#2278).
+# The 3.1 runner supports one storyboard-level capability predicate. Gate the
+# whole creative workflow on the library declaration, then repeat the snapshot
+# predicate on every phase so webhook-only and out_of_band sellers remain out
+# of scope as well.
 requires_capability:
-  path: media_buy.propagation_surfaces
-  contains: "snapshot"
+  path: creative.has_creative_library
+  equals: true
 
 narrative: |
   Per the dependency-impairment surface ([adcp#2855](https://github.com/adcontextprotocol/adcp/issues/2855)
@@ -118,6 +112,9 @@ prerequisites:
 
 phases:
   - id: setup
+    requires_capability: &snapshot_gate
+      path: media_buy.propagation_surfaces
+      contains: "snapshot"
     title: "Create an active buy with a creative assignment"
     narrative: |
       Discover a product, create a media buy, sync one creative into the library
@@ -339,6 +336,7 @@ phases:
             description: "Controller acknowledged the directive"
 
   - id: baseline_healthy
+    requires_capability: *snapshot_gate
     title: "Baseline: buy reads as healthy, no impairments"
     narrative: |
       With the creative at approved and assigned, the buy MUST report
@@ -383,6 +381,7 @@ phases:
             description: "impairments[] is empty (or absent) in the baseline — no resources are offline yet"
 
   - id: transition_offline
+    requires_capability: *snapshot_gate
     title: "Force the creative to rejected"
     narrative: |
       The seller transitions the creative from approved → rejected via
@@ -422,6 +421,7 @@ phases:
             description: "Controller acknowledged the rejection directive"
 
   - id: verify_impaired
+    requires_capability: *snapshot_gate
     title: "Buy reads as impaired with a matching impairments[] entry"
     narrative: |
       After the rejection, the buy MUST report `health: impaired` and
@@ -520,6 +520,7 @@ phases:
             description: "At least one impairment entry matches the rejected creative, affected package, and rejected transition (forward rule)"
 
   - id: swap_recovery
+    requires_capability: *snapshot_gate
     title: "Recover via assignment swap — different creative replaces the rejected one"
     narrative: |
       Sync a second creative (B) into the library as approved, then use

package/compliance/cache/{3.1.15/protocols → 3.1.20/domains}/media-buy/scenarios/dependency_impairment_cardinality.yaml

@@ -1,5 +1,5 @@
 id: media_buy_seller/dependency_impairment_cardinality
-version: "1.0.0"
+version: "1.0.1"
 title: "Dependency impairment cardinality — impairments[] tracks each offline resource independently"
 category: media_buy_seller
 summary: "Two creatives on two packages of the same buy. Rejects them sequentially and verifies impairments[] grows 0 → 1 → 2; recovers them sequentially via swap-assignment and verifies impairments[] shrinks 2 → 1 → 0. Pressure-tests the inverse rule under cardinality — a seller emitting any impairment entry rather than the right one fails."
@@ -13,19 +13,13 @@ required_tools:
   - update_media_buy
   - comply_test_controller
 
-# Capability gate: this scenario grades the snapshot-coherence surface, so it
-# runs only for sellers that declare media_buy.propagation_surfaces including
-# "snapshot". Webhook-only or out_of_band sellers grade not_applicable instead
-# of false-failing on a contract that does not apply to them — the opt-out the
-# propagation_surfaces schema already documents (get-adcp-capabilities-response.json)
-# but that was never wired into this scenario. Requires the `contains:` matcher
-# (@adcp/sdk >= 7.70). Sellers that OMIT propagation_surfaces inherit the
-# ["snapshot"] default and are graded here only on @adcp/sdk >= 9.2.0, which
-# materializes capability-gate schema defaults; earlier runners skip them as
-# not_applicable (adcp-client#2278).
+# The 3.1 runner supports one storyboard-level capability predicate. Gate the
+# whole creative workflow on the library declaration, then repeat the snapshot
+# predicate on every phase so webhook-only and out_of_band sellers remain out
+# of scope as well.
 requires_capability:
-  path: media_buy.propagation_surfaces
-  contains: "snapshot"
+  path: creative.has_creative_library
+  equals: true
 
 narrative: |
   The base dependency_impairment scenario tests forward + inverse + health-iff
@@ -98,6 +92,9 @@ prerequisites:
 
 phases:
   - id: setup
+    requires_capability: &snapshot_gate
+      path: media_buy.propagation_surfaces
+      contains: "snapshot"
     title: "Create a buy with two packages, two creatives, two assignments"
     narrative: |
       Discover a product, create a buy with two packages (same product is
@@ -396,6 +393,7 @@ phases:
             description: "impairments[] is empty (cardinality zero baseline)"
 
   - id: reject_first_cardinality_one
+    requires_capability: *snapshot_gate
     title: "Reject creative A — impairments[] cardinality 1, scoped to package_a"
     narrative: |
       Force creative A to rejected. The buy MUST report exactly ONE
@@ -525,6 +523,7 @@ phases:
           # an `array_length` check kind — tracked in a follow-up.
 
   - id: reject_second_cardinality_two
+    requires_capability: *snapshot_gate
     title: "Reject creative B — impairments[] grows to cardinality 2"
     narrative: |
       Force creative B to rejected. The buy MUST report exactly TWO
@@ -643,6 +642,7 @@ phases:
           # a creative that isn't offline, failing the invariant.
 
   - id: recover_first_via_swap
+    requires_capability: *snapshot_gate
     title: "Swap package_a's binding to a fresh creative C — cardinality back to 1"
     narrative: |
       Sync creative C (approved), then update_media_buy to swap
@@ -800,6 +800,7 @@ phases:
             description: "impairments[1] MUST NOT exist — the swap recovered A's dependency; only B remains rejected. Cardinality decrement check."
 
   - id: recover_second_via_swap
+    requires_capability: *snapshot_gate
     title: "Swap package_b's binding to a fresh creative D — cardinality back to 0"
     narrative: |
       Sync creative D (approved), swap package_b's binding from B → D, read

package/compliance/cache/3.1.20/domains/media-buy/scenarios/inventory_list_no_match.yaml

@@ -0,0 +1,229 @@
+id: media_buy_seller/inventory_list_no_match
+version: "1.0.1"
+title: "Seller handles a property_list reference that matches zero inventory"
+category: media_buy_seller
+summary: "Verifies a seller preserves a no-match property list on an accepted buy or returns a structured error."
+track: media_buy
+required_tools:
+  - get_products
+  - create_media_buy
+
+requires_capability:
+  path: "media_buy.features.property_list_filtering"
+  equals: true
+
+narrative: |
+  Not every buyer list matches every seller's inventory. A buyer may point at a
+  property_list of domains this seller does not carry. The seller must handle
+  that gracefully:
+
+  - Accept the buy and surface a zero-delivery expectation through reporting, OR
+  - Return an informative typed AdCP error on create_media_buy with findings the
+    buyer can act on.
+
+  What the seller must NOT do: crash, return a misleading non-zero forecast, or
+  silently drop the targeting and deliver against unintended inventory. Each of
+  those is a real failure mode we've seen in adapter integrations.
+
+  This scenario exercises the no-match path using the test kit's pre-populated
+  no_match_properties list.
+
+agent:
+  interaction_model: media_buy_seller
+  capabilities:
+    - sells_media
+    - supports_property_list_targeting
+  examples:
+    - "Sellers that validate inventory against buyer-supplied lists"
+
+caller:
+  role: buyer_agent
+  example: "Pinnacle Agency (buyer)"
+
+prerequisites:
+  description: |
+    The seller must resolve PropertyListReference against its own inventory and
+    report a truthful outcome when nothing matches.
+  test_kit: "test-kits/acme-outdoor.yaml"
+
+phases:
+  - id: discover
+    title: "Discover products"
+    steps:
+      - id: get_products_brief
+        title: "Discover products"
+        task: get_products
+        schema_ref: "media-buy/get-products-request.json"
+        response_schema_ref: "media-buy/get-products-response.json"
+        doc_ref: "/media-buy/task-reference/get_products"
+        comply_scenario: full_sales_flow
+        stateful: false
+        expected: |
+          Return products the seller carries.
+        sample_request:
+          buying_mode: "brief"
+          brief: "Outdoor lifestyle programming. Q3 flight."
+          filters:
+            is_fixed_price: true
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+
+          context:
+            correlation_id: "inventory_list_no_match--get_products_brief"
+        context_outputs:
+          - path: "products[0].product_id"
+            key: "product_id"
+          - path: "products[0].pricing_options[0].pricing_option_id"
+            key: "pricing_option_id"
+        validations:
+          - check: response_schema
+            description: "Response matches get-products-response.json schema"
+          - check: field_present
+            path: "products[0].pricing_options[0].fixed_price"
+            description: "The captured pricing option is fixed-price; fixed-price storyboards do not send bid_price"
+
+  - id: no_match_accept_path
+    title: "Accept and preserve the no-match property list"
+    optional: true
+    branch_set:
+      id: property_list_no_match_handled
+      semantics: any_of
+    narrative: |
+      A seller may accept the buy when it preserves the property-list targeting
+      and its downstream reporting makes the zero-delivery expectation clear.
+      This is one of the two conformant outcomes in the 3.1 contract; the peer
+      branch covers structured rejection.
+
+    steps:
+      - id: create_buy_no_match_accept
+        title: "Accept create_media_buy against an empty intersection"
+        task: create_media_buy
+        schema_ref: "media-buy/create-media-buy-request.json"
+        response_schema_ref: "media-buy/create-media-buy-response.json"
+        doc_ref: "/media-buy/task-reference/create_media_buy"
+        comply_scenario: create_media_buy
+        stateful: true
+        contributes: true
+        expected: |
+          Accept the buy with a valid media-buy artifact that retains the
+          property-list targeting. The seller remains responsible for surfacing
+          the zero-delivery expectation through its reporting behavior.
+        sample_request:
+          brand:
+            domain: "acmeoutdoor.example"
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+          idempotency_key: "$generate:uuid_v4#inventory_list_no_match_accept"
+          start_time: "asap"
+          end_time: "2099-09-30T23:59:59Z"
+          packages:
+            - product_id: "$context.product_id"
+              budget: 10000
+              pricing_option_id: "$context.pricing_option_id"
+              targeting_overlay:
+                property_list:
+                  agent_url: "https://governance.pinnacle-agency.example"
+                  list_id: "acme_outdoor_no_match_v1"
+          context:
+            correlation_id: "inventory_list_no_match--accept"
+        validations:
+          - check: response_schema
+            description: "Accepted response matches create-media-buy-response.json"
+          - check: field_present
+            path: "media_buy_id"
+            description: "Accepted response returns a media_buy_id"
+          - check: field_value
+            path: "packages[0].targeting_overlay.property_list.list_id"
+            value: "acme_outdoor_no_match_v1"
+            description: "Accepted response preserves the no-match property-list targeting"
+          - check: field_present
+            path: "context"
+            description: "Accepted response echoes back the context object"
+          - check: field_value
+            path: "context.correlation_id"
+            value: "inventory_list_no_match--accept"
+            description: "Context correlation_id returned unchanged"
+
+  - id: no_match_reject_path
+    title: "Reject the no-match buy with a structured error"
+    optional: true
+    branch_set:
+      id: property_list_no_match_handled
+      semantics: any_of
+    narrative: |
+      A seller may instead reject the same well-formed request. This branch makes
+      that documented 3.1 outcome reachable by marking the error as expected and
+      requiring a typed AdCP error response with preserved correlation context.
+
+    steps:
+      - id: create_buy_no_match_reject
+        title: "Reject create_media_buy against an empty intersection"
+        task: create_media_buy
+        schema_ref: "media-buy/create-media-buy-request.json"
+        response_schema_ref: "media-buy/create-media-buy-response.json"
+        doc_ref: "/media-buy/task-reference/create_media_buy"
+        comply_scenario: create_media_buy
+        expect_error: true
+        negative_path: payload_well_formed
+        stateful: true
+        contributes: true
+        expected: |
+          Reject with a well-formed AdCP error explaining that the property list
+          matches no available inventory. The 3.1 contract does not mandate one
+          specific error code for this condition.
+        sample_request:
+          brand:
+            domain: "acmeoutdoor.example"
+          account:
+            brand:
+              domain: "acmeoutdoor.example"
+            operator: "pinnacle-agency.example"
+          idempotency_key: "$generate:uuid_v4#inventory_list_no_match_reject"
+          start_time: "asap"
+          end_time: "2099-09-30T23:59:59Z"
+          packages:
+            - product_id: "$context.product_id"
+              budget: 10000
+              pricing_option_id: "$context.pricing_option_id"
+              targeting_overlay:
+                property_list:
+                  agent_url: "https://governance.pinnacle-agency.example"
+                  list_id: "acme_outdoor_no_match_v1"
+          context:
+            correlation_id: "inventory_list_no_match--reject"
+        validations:
+          - check: response_schema
+            description: "Rejected response matches create-media-buy-response.json"
+          - check: error_code
+            description: "Rejected response carries a typed AdCP error code"
+          - check: field_present
+            path: "context"
+            description: "Rejected response echoes back the context object"
+          - check: field_value
+            path: "context.correlation_id"
+            value: "inventory_list_no_match--reject"
+            description: "Context correlation_id returned unchanged"
+
+  - id: no_match_outcome_assertion
+    title: "Require one documented no-match outcome"
+    narrative: |
+      Synthetic assertion over the accept and reject branches. Either a valid
+      zero-delivery acceptance path or a structured rejection satisfies the 3.1
+      no-match contract.
+    steps:
+      - id: assert_property_list_no_match_handled
+        title: "Require handling from either branch"
+        task: assert_contribution
+        comply_scenario: create_media_buy
+        stateful: false
+        expected: |
+          At least one no-match outcome contributed
+          property_list_no_match_handled.
+        validations:
+          - check: any_of
+            allowed_values: ["property_list_no_match_handled"]
+            description: "Seller must either accept while preserving the targeting or return a structured rejection."