@adcp/sdk 14.0.0-rc.32 → 14.0.0-rc.33

package/bin/adcp-storyboard-summary.js

@@ -19,6 +19,7 @@ const { writeFileSync } = require('node:fs');
 
 function escapeMarkdownCell(s) {
   return String(s ?? '')
+    .replace(/\\/g, '\\\\')
     .replace(/\|/g, '\\|')
     .replace(/\n/g, ' ');
 }

package/dist/lib/conformance/oracle.js

@@ -56,17 +56,33 @@ const STACK_TRACE_REGEXES = [
   /\.go:\d+ \+0x[0-9a-f]+/,
   // PHP: `#7 /var/www/foo.php(42): Bar->baz()` — numbered frame with file:line
   /#\d+ [^\s]+\.php\(\d+\):/,
-  // JVM: `\n\tat com.foo.Bar.method(Bar.java:42)` — fully-qualified
-  // method with source:line. Anchored to whitespace/newline so an
-  // echoed Javadoc reference in prose (`"at com.foo.Bar(Bar.java:42)"`)
-  // doesn't trigger the detector — real stack frames sit on their own
-  // indented line.
-  /(?:\\n\s*|^\s+|\n\s+)at [\w$.]+\.[\w$]+\([\w$]+\.(?:java|kt|kts|scala|groovy):\d+\)/,
   // .NET: `at Foo.Bar.Baz() in /path/to/X.cs:line 42` — method invocation
   // followed by ` in ` and a file:line marker. The method-name charset
   // includes parens/brackets for generic and overloaded signatures.
   /at [\w.<>`,()[\]]+ in [^:\s]+\.(?:cs|vb|fs):line \d+/
 ];
+const JVM_STACK_FRAME = /^at [\w$.]+\.[\w$]+\([\w$]+\.(?:java|kt|kts|scala|groovy):\d+\)\s*/;
+function isJsonFramingSuffix(value) {
+  if (!value.startsWith('"')) return false;
+  for (let index = 1; index < value.length; index++) {
+    const char = value[index];
+    if (char !== "}" && char !== "]" && char !== "," && char !== " " && char !== "	") return false;
+  }
+  return true;
+}
+function hasJvmStackFrame(haystack) {
+  const lines = haystack.replaceAll("\\n", "\n").split("\n");
+  for (const [index, line] of lines.entries()) {
+    const candidate = line.trimStart();
+    if (index > 0 || candidate !== line) {
+      const match = JVM_STACK_FRAME.exec(candidate);
+      if (match && (match[0].length === candidate.length || isJsonFramingSuffix(candidate.slice(match[0].length)))) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 const FS_PATH_SIGNATURES = [/\/Users\/[^ "']+/, /\/home\/[^ "']+/, /[A-Z]:\\\\Users\\\\/];
 let cachedAjv = null;
 function getAjv() {
@@ -160,6 +176,10 @@ function checkNoStackLeak(result, failures) {
       return;
     }
   }
+  if (hasJvmStackFrame(haystack)) {
+    failures.push(`stack trace leak (matched ${JVM_STACK_FRAME.source})`);
+    return;
+  }
   for (const rx of STACK_TRACE_REGEXES) {
     if (rx.test(haystack)) {
       failures.push(`stack trace leak (matched ${rx.source})`);

package/dist/lib/conformance/oracle.mjs

@@ -22,17 +22,33 @@ const STACK_TRACE_REGEXES = [
   /\.go:\d+ \+0x[0-9a-f]+/,
   // PHP: `#7 /var/www/foo.php(42): Bar->baz()` — numbered frame with file:line
   /#\d+ [^\s]+\.php\(\d+\):/,
-  // JVM: `\n\tat com.foo.Bar.method(Bar.java:42)` — fully-qualified
-  // method with source:line. Anchored to whitespace/newline so an
-  // echoed Javadoc reference in prose (`"at com.foo.Bar(Bar.java:42)"`)
-  // doesn't trigger the detector — real stack frames sit on their own
-  // indented line.
-  /(?:\\n\s*|^\s+|\n\s+)at [\w$.]+\.[\w$]+\([\w$]+\.(?:java|kt|kts|scala|groovy):\d+\)/,
   // .NET: `at Foo.Bar.Baz() in /path/to/X.cs:line 42` — method invocation
   // followed by ` in ` and a file:line marker. The method-name charset
   // includes parens/brackets for generic and overloaded signatures.
   /at [\w.<>`,()[\]]+ in [^:\s]+\.(?:cs|vb|fs):line \d+/
 ];
+const JVM_STACK_FRAME = /^at [\w$.]+\.[\w$]+\([\w$]+\.(?:java|kt|kts|scala|groovy):\d+\)\s*/;
+function isJsonFramingSuffix(value) {
+  if (!value.startsWith('"')) return false;
+  for (let index = 1; index < value.length; index++) {
+    const char = value[index];
+    if (char !== "}" && char !== "]" && char !== "," && char !== " " && char !== "	") return false;
+  }
+  return true;
+}
+function hasJvmStackFrame(haystack) {
+  const lines = haystack.replaceAll("\\n", "\n").split("\n");
+  for (const [index, line] of lines.entries()) {
+    const candidate = line.trimStart();
+    if (index > 0 || candidate !== line) {
+      const match = JVM_STACK_FRAME.exec(candidate);
+      if (match && (match[0].length === candidate.length || isJsonFramingSuffix(candidate.slice(match[0].length)))) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
 const FS_PATH_SIGNATURES = [/\/Users\/[^ "']+/, /\/home\/[^ "']+/, /[A-Z]:\\\\Users\\\\/];
 let cachedAjv = null;
 function getAjv() {
@@ -126,6 +142,10 @@ function checkNoStackLeak(result, failures) {
       return;
     }
   }
+  if (hasJvmStackFrame(haystack)) {
+    failures.push(`stack trace leak (matched ${JVM_STACK_FRAME.source})`);
+    return;
+  }
   for (const rx of STACK_TRACE_REGEXES) {
     if (rx.test(haystack)) {
       failures.push(`stack trace leak (matched ${rx.source})`);

package/dist/lib/core/SingleAgentClient.js

@@ -5488,6 +5488,8 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       ...options?.signal && { signal: options.signal },
       ...clientRequestTimeoutMs !== void 0 && { timeout: clientRequestTimeoutMs }
     };
+    const discoveryAdcpVersion = this.getWireAdcpVersion();
+    const mcpListParams = (0, import_version.parseAdcpMajorVersion)(discoveryAdcpVersion) >= 3 ? { _meta: { adcp_version: (0, import_version.toReleasePrecisionVersion)(discoveryAdcpVersion) } } : void 0;
     const ensureReadAuthToken = async () => {
       if (!this.normalizedAgent.oauth_client_credentials) return this.normalizedAgent.auth_token;
       const { ensureClientCredentialsTokens, getAgentStorage } = await import("../auth/oauth/index.js");
@@ -5504,7 +5506,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         const mcpClient2 = this.normalizedAgent._inProcessMcpClient;
         const toolsList = await withResponseSizeLimit(
           maxResponseBytes,
-          () => mcpClient2.listTools(void 0, mcpRequestOptions)
+          () => mcpClient2.listTools(mcpListParams, mcpRequestOptions)
         );
         const tools = toolsList.tools.map((tool) => ({
           name: tool.name,
@@ -5557,6 +5559,9 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         maxResponseBytes,
         () => tryListModernMCPTools(agent.agent_uri, readAuthToken, this.normalizedAgent.headers, {
           authProvider,
+          ...mcpListParams?._meta.adcp_version !== void 0 && {
+            adcpVersion: mcpListParams._meta.adcp_version
+          },
           signal: options?.signal,
           requestTimeoutMs: transport?.requestTimeoutMs,
           fetchFn: transport?.trustedFetchFn,
@@ -5582,7 +5587,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       try {
         const toolsList = await withResponseSizeLimit(
           maxResponseBytes,
-          () => mcpClient.listTools(void 0, mcpRequestOptions)
+          () => mcpClient.listTools(mcpListParams, mcpRequestOptions)
         );
         const tools = toolsList.tools.map((tool) => ({
           name: tool.name,

package/dist/lib/core/SingleAgentClient.mjs

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import * as schemas from "../types/schemas.generated.mjs";
 import { ADCP_ENVELOPE_FIELDS } from "../types/adcp.mjs";
-import { parseAdcpMajorVersion } from "../version.mjs";
+import { parseAdcpMajorVersion, toReleasePrecisionVersion } from "../version.mjs";
 import {
   isAdcpVersionSupported,
   isAdcpVersionAtLeast,
@@ -5542,6 +5542,8 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       ...options?.signal && { signal: options.signal },
       ...clientRequestTimeoutMs !== void 0 && { timeout: clientRequestTimeoutMs }
     };
+    const discoveryAdcpVersion = this.getWireAdcpVersion();
+    const mcpListParams = parseAdcpMajorVersion(discoveryAdcpVersion) >= 3 ? { _meta: { adcp_version: toReleasePrecisionVersion(discoveryAdcpVersion) } } : void 0;
     const ensureReadAuthToken = async () => {
       if (!this.normalizedAgent.oauth_client_credentials) return this.normalizedAgent.auth_token;
       const { ensureClientCredentialsTokens, getAgentStorage } = await import("../auth/oauth/index.mjs");
@@ -5558,7 +5560,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         const mcpClient2 = this.normalizedAgent._inProcessMcpClient;
         const toolsList = await withResponseSizeLimit(
           maxResponseBytes,
-          () => mcpClient2.listTools(void 0, mcpRequestOptions)
+          () => mcpClient2.listTools(mcpListParams, mcpRequestOptions)
         );
         const tools = toolsList.tools.map((tool) => ({
           name: tool.name,
@@ -5611,6 +5613,9 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         maxResponseBytes,
         () => tryListModernMCPTools(agent.agent_uri, readAuthToken, this.normalizedAgent.headers, {
           authProvider,
+          ...mcpListParams?._meta.adcp_version !== void 0 && {
+            adcpVersion: mcpListParams._meta.adcp_version
+          },
           signal: options?.signal,
           requestTimeoutMs: transport?.requestTimeoutMs,
           fetchFn: transport?.trustedFetchFn,
@@ -5636,7 +5641,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       try {
         const toolsList = await withResponseSizeLimit(
           maxResponseBytes,
-          () => mcpClient.listTools(void 0, mcpRequestOptions)
+          () => mcpClient.listTools(mcpListParams, mcpRequestOptions)
         );
         const tools = toolsList.tools.map((tool) => ({
           name: tool.name,

package/dist/lib/core/TaskExecutor.js

@@ -1673,6 +1673,9 @@ class TaskExecutor {
   }
   externalTaskObservationKey(observation) {
     return (0, import_crypto.createHmac)("sha256", EXTERNAL_TASK_OBSERVATION_HMAC_KEY).update(
+      // This keyed digest deduplicates canonical task observations; it does
+      // not store or verify passwords. Agent responses are over-tainted.
+      // codeql[js/insufficient-password-hash]
       (0, import_jcs.canonicalize)({
         status: observation.status,
         serverTaskId: observation.serverTaskId ?? null,

package/dist/lib/core/TaskExecutor.mjs

@@ -1647,6 +1647,9 @@ class TaskExecutor {
   }
   externalTaskObservationKey(observation) {
     return createHmac("sha256", EXTERNAL_TASK_OBSERVATION_HMAC_KEY).update(
+      // This keyed digest deduplicates canonical task observations; it does
+      // not store or verify passwords. Agent responses are over-tainted.
+      // codeql[js/insufficient-password-hash]
       canonicalize({
         status: observation.status,
         serverTaskId: observation.serverTaskId ?? null,

package/dist/lib/index.d.mts

@@ -163,7 +163,7 @@ export type { Error as TaskErrorDetail } from './types/core.generated.mjs';
 export { STANDARD_ERROR_CODES, isStandardErrorCode, getErrorRecovery } from './types/error-codes.mjs';
 export type { StandardErrorCode, ErrorRecovery } from './types/error-codes.mjs';
 export { adcpError, legacyCapabilitiesResponse, legacyProductsResponse, legacyMediaBuyResponse, legacyDeliveryResponse, legacyListAccountsResponse, legacyListCreativeFormatsResponse, legacyUpdateMediaBuyResponse, legacyGetMediaBuysResponse, legacyPerformanceFeedbackResponse, legacyBuildCreativeResponse, legacyBuildCreativeMultiResponse, legacyPreviewCreativeResponse, legacyCreativeDeliveryResponse, legacyListCreativesResponse, legacyListPropertyListsResponse, legacyListCollectionListsResponse, legacyListContentStandardsResponse, legacyGetPlanAuditLogsResponse, legacySyncCreativesResponse, legacyGetSignalsResponse, legacyActivateSignalResponse, legacyCancelMediaBuyResponse, legacyAcquireRightsResponse, legacyAcquireRightsAcquired, legacyAcquireRightsPendingApproval, legacyAcquireRightsRejected, legacySyncAccountsResponse, legacySyncGovernanceResponse, legacyReportUsageResponse, validActionsForStatus, MEDIA_BUY_TRANSITIONS, CREATIVE_ASSET_TRANSITIONS, isLegalMediaBuyTransition, isLegalCreativeTransition, assertMediaBuyTransition, assertCreativeTransition, getAccountMode, isSandboxOrMockAccount, assertSandboxAccount, taskToolResponse, registerAdcpTaskTool, createTaskCapableServer, InMemoryTaskStore, isTerminal, serve, taskScopeFromPrincipal, UnknownHostError, hostname, resolveHost, verifyIntrospection, registerTestController, handleTestControllerRequest, TestControllerError, toMcpResponse, TOOL_INPUT_SHAPE, CONTROLLER_SCENARIOS, DISCOVERY_ARM_SCENARIOS, SEED_SCENARIOS, SESSION_ENTRY_CAP, enforceMapCap, createSeedFixtureCache, PostgresTaskStore, cleanupExpiredTasks, getMcpTasksMigration, MCP_TASKS_MIGRATION, ADCP_PRE_TRANSPORT, checkGovernance, governanceDeniedError, DEFAULT_REPORTING_CAPABILITIES, InMemoryStateStore, PostgresStateStore, getAdcpStateMigration, ADCP_STATE_MIGRATION, StateError, PatchConflictError, SESSION_KEY_FIELD, createSessionedStore, scopedStore, patchWithRetry, isPutIfMatchConflict, requireSessionKey, structuredSerialize, structuredDeserialize, createIdempotencyStore, memoryBackend, pgBackend, getIdempotencyMigration, IDEMPOTENCY_MIGRATION, cleanupExpiredIdempotency, redisBackend, createLazyBackend, hashPayload, IdempotencyClaimOwnershipError, getServeRequestContext, ADCP_SERVE_REQUEST_CONTEXT, createA2AAdapter, A2AInvocationError, MCP_APP_RESOURCE_MIME_TYPE, ADCP_MIRRORED_STRUCTURED_CONTENT_META_KEY, } from './server/index.mjs';
-export type { AdcpErrorOptions, AdcpErrorResponse, McpToolResponse, ValidAction, CancelMediaBuyInput, AdcpTaskToolConfig, TaskStore, TaskMessageQueue, CreateTaskOptions, ToolTaskHandler, CreateTaskRequestHandlerExtra, TaskRequestHandlerExtra, CreateTaskResult, GetTaskResult, Task, ServeContext, ServeOptions, PgQueryable, PostgresTaskStoreOptions, TestControllerStore, TestControllerStoreFactory, TestControllerStoreOrFactory, ControllerScenario, SeedScenario, SeedFixtureCache, SessionContext, OnInstructionsError, MaybePromise, LegacyAdcpServerConfig, LegacyAdcpToolMap, AdcpServerToolName, AdcpCapabilitiesConfig, LegacyAdcpCustomToolConfig, McpAppUiMeta, McpAppMeta, AdcpMcpResourceDefinition, McpAppResourceCsp, McpAppResourcePermissions, McpAppResourceUiMeta, McpAppResourceMeta, McpAppResourceReadContext, AdcpLogger, LegacyHandlerContext, LegacyMediaBuyHandlers, LegacySignalsHandlers, LegacyCreativeHandlers, LegacyGovernanceHandlers, LegacyAccountHandlers, LegacyEventTrackingHandlers, LegacySponsoredIntelligenceHandlers, SignedRequestsConfig, AdcpPreTransport, AdcpServer, AdcpServerTransport, AdcpTestRequest, AdcpTestToolsCallRequest, AdcpTestResponse, AdcpInvokeOptions, StructuredContentFallbackTransport, StructuredContentTextFallback, StructuredContentTextFallbackContext, CheckGovernanceOptions, GovernanceCallResult, GovernanceApproved, GovernanceDenied, GovernanceConditions, AdcpStateStore, ListOptions as StateListOptions, ListResult as StateListResult, PostgresStateStoreOptions, InMemoryStateStoreOptions, VersionedDocument, PutIfMatchResult, PatchWithRetryOptions, StateErrorCode, SessionKeyContext, IdempotencyStore, IdempotencyStoreConfig, IdempotencyBackend, IdempotencyCacheEntry, IdempotencyCheckResult, MemoryBackendOptions, PgBackendOptions, RedisBackendOptions, RedisBackendClient, RedisLikeClient, LazyBackendFactory, LazyBackendOptions, A2AAdapter, A2AAdapterOptions, A2AAgentCardOverrides, A2AAgentCapabilitiesOverride, A2AAgentSkillOverride, A2AMountOptions, ExpressAppLike, LegacyHttpSecurityScheme, LegacySecurityScheme, AccountMode, RequireCacheScopeWhenProducts, ServerPayload, GetProductsPayload, CreateMediaBuyPayload, UpdateMediaBuyPayload, GetMediaBuysPayload, GetMediaBuyDeliveryPayload, ListCreativesPayload, GetCreativeDeliveryPayload, CanonicalPreviewCreativePayload, PreviewCreativePayload, LegacyGetProductsPayload, LegacyCreateMediaBuyPayload, LegacyUpdateMediaBuyPayload, LegacyGetMediaBuysPayload, LegacyGetMediaBuyDeliveryPayload, LegacyListCreativesPayload, LegacyGetCreativeDeliveryPayload, LegacyListCreativeFormatsPayload, LegacyListCreativeFormatsResponsePayload, LegacyListCreativeFormatsServerPayload, LegacyBuildCreativePayload, LegacyBuildCreativeMultiPayload, LegacyBuildCreativeVariantPayload, LegacyPreviewCreativePayload, SyncCreativesPayload, SyncCreativesSuccessPayload, SyncCreativesErrorPayload, } from './server/index.mjs';
+export type { AdcpErrorOptions, AdcpErrorResponse, McpToolResponse, ValidAction, CancelMediaBuyInput, AdcpTaskToolConfig, TaskStore, TaskMessageQueue, CreateTaskOptions, ToolTaskHandler, CreateTaskRequestHandlerExtra, TaskRequestHandlerExtra, CreateTaskResult, GetTaskResult, Task, ServeContext, ServeOptions, PgQueryable, PostgresTaskStoreOptions, TestControllerStore, TestControllerStoreFactory, TestControllerStoreOrFactory, ControllerScenario, SeedScenario, SeedFixtureCache, SessionContext, OnInstructionsError, MaybePromise, LegacyAdcpServerConfig, LegacyAdcpToolMap, AdcpServerToolName, AdcpCapabilitiesConfig, LegacyAdcpCustomToolConfig, LegacyAdcpCustomToolHandler, LegacyAdcpCustomToolHandlerExtra, McpAppUiMeta, McpAppMeta, AdcpMcpResourceDefinition, McpAppResourceCsp, McpAppResourcePermissions, McpAppResourceUiMeta, McpAppResourceMeta, McpAppResourceReadContext, AdcpLogger, LegacyHandlerContext, LegacyMediaBuyHandlers, LegacySignalsHandlers, LegacyCreativeHandlers, LegacyGovernanceHandlers, LegacyAccountHandlers, LegacyEventTrackingHandlers, LegacySponsoredIntelligenceHandlers, SignedRequestsConfig, AdcpPreTransport, AdcpServer, AdcpServerTransport, AdcpTestRequest, AdcpTestToolsCallRequest, AdcpTestResponse, AdcpInvokeOptions, StructuredContentFallbackTransport, StructuredContentTextFallback, StructuredContentTextFallbackContext, CheckGovernanceOptions, GovernanceCallResult, GovernanceApproved, GovernanceDenied, GovernanceConditions, AdcpStateStore, ListOptions as StateListOptions, ListResult as StateListResult, PostgresStateStoreOptions, InMemoryStateStoreOptions, VersionedDocument, PutIfMatchResult, PatchWithRetryOptions, StateErrorCode, SessionKeyContext, IdempotencyStore, IdempotencyStoreConfig, IdempotencyBackend, IdempotencyCacheEntry, IdempotencyCheckResult, MemoryBackendOptions, PgBackendOptions, RedisBackendOptions, RedisBackendClient, RedisLikeClient, LazyBackendFactory, LazyBackendOptions, A2AAdapter, A2AAdapterOptions, A2AAgentCardOverrides, A2AAgentCapabilitiesOverride, A2AAgentSkillOverride, A2AMountOptions, ExpressAppLike, LegacyHttpSecurityScheme, LegacySecurityScheme, AccountMode, RequireCacheScopeWhenProducts, ServerPayload, GetProductsPayload, CreateMediaBuyPayload, UpdateMediaBuyPayload, GetMediaBuysPayload, GetMediaBuyDeliveryPayload, ListCreativesPayload, GetCreativeDeliveryPayload, CanonicalPreviewCreativePayload, PreviewCreativePayload, LegacyGetProductsPayload, LegacyCreateMediaBuyPayload, LegacyUpdateMediaBuyPayload, LegacyGetMediaBuysPayload, LegacyGetMediaBuyDeliveryPayload, LegacyListCreativesPayload, LegacyGetCreativeDeliveryPayload, LegacyListCreativeFormatsPayload, LegacyListCreativeFormatsResponsePayload, LegacyListCreativeFormatsServerPayload, LegacyBuildCreativePayload, LegacyBuildCreativeMultiPayload, LegacyBuildCreativeVariantPayload, LegacyPreviewCreativePayload, SyncCreativesPayload, SyncCreativesSuccessPayload, SyncCreativesErrorPayload, } from './server/index.mjs';
 export { isRetryable, getRetryDelay } from './utils/retry.mjs';
 export { decideRetry, BuyerRetryPolicy } from './utils/buyer-retry-policy.mjs';
 export type { RetryDecision, RetryContext, RetryDecisionOverride } from './utils/buyer-retry-policy.mjs';

package/dist/lib/index.d.ts

@@ -163,7 +163,7 @@ export type { Error as TaskErrorDetail } from './types/core.generated';
 export { STANDARD_ERROR_CODES, isStandardErrorCode, getErrorRecovery } from './types/error-codes';
 export type { StandardErrorCode, ErrorRecovery } from './types/error-codes';
 export { adcpError, legacyCapabilitiesResponse, legacyProductsResponse, legacyMediaBuyResponse, legacyDeliveryResponse, legacyListAccountsResponse, legacyListCreativeFormatsResponse, legacyUpdateMediaBuyResponse, legacyGetMediaBuysResponse, legacyPerformanceFeedbackResponse, legacyBuildCreativeResponse, legacyBuildCreativeMultiResponse, legacyPreviewCreativeResponse, legacyCreativeDeliveryResponse, legacyListCreativesResponse, legacyListPropertyListsResponse, legacyListCollectionListsResponse, legacyListContentStandardsResponse, legacyGetPlanAuditLogsResponse, legacySyncCreativesResponse, legacyGetSignalsResponse, legacyActivateSignalResponse, legacyCancelMediaBuyResponse, legacyAcquireRightsResponse, legacyAcquireRightsAcquired, legacyAcquireRightsPendingApproval, legacyAcquireRightsRejected, legacySyncAccountsResponse, legacySyncGovernanceResponse, legacyReportUsageResponse, validActionsForStatus, MEDIA_BUY_TRANSITIONS, CREATIVE_ASSET_TRANSITIONS, isLegalMediaBuyTransition, isLegalCreativeTransition, assertMediaBuyTransition, assertCreativeTransition, getAccountMode, isSandboxOrMockAccount, assertSandboxAccount, taskToolResponse, registerAdcpTaskTool, createTaskCapableServer, InMemoryTaskStore, isTerminal, serve, taskScopeFromPrincipal, UnknownHostError, hostname, resolveHost, verifyIntrospection, registerTestController, handleTestControllerRequest, TestControllerError, toMcpResponse, TOOL_INPUT_SHAPE, CONTROLLER_SCENARIOS, DISCOVERY_ARM_SCENARIOS, SEED_SCENARIOS, SESSION_ENTRY_CAP, enforceMapCap, createSeedFixtureCache, PostgresTaskStore, cleanupExpiredTasks, getMcpTasksMigration, MCP_TASKS_MIGRATION, ADCP_PRE_TRANSPORT, checkGovernance, governanceDeniedError, DEFAULT_REPORTING_CAPABILITIES, InMemoryStateStore, PostgresStateStore, getAdcpStateMigration, ADCP_STATE_MIGRATION, StateError, PatchConflictError, SESSION_KEY_FIELD, createSessionedStore, scopedStore, patchWithRetry, isPutIfMatchConflict, requireSessionKey, structuredSerialize, structuredDeserialize, createIdempotencyStore, memoryBackend, pgBackend, getIdempotencyMigration, IDEMPOTENCY_MIGRATION, cleanupExpiredIdempotency, redisBackend, createLazyBackend, hashPayload, IdempotencyClaimOwnershipError, getServeRequestContext, ADCP_SERVE_REQUEST_CONTEXT, createA2AAdapter, A2AInvocationError, MCP_APP_RESOURCE_MIME_TYPE, ADCP_MIRRORED_STRUCTURED_CONTENT_META_KEY, } from './server';
-export type { AdcpErrorOptions, AdcpErrorResponse, McpToolResponse, ValidAction, CancelMediaBuyInput, AdcpTaskToolConfig, TaskStore, TaskMessageQueue, CreateTaskOptions, ToolTaskHandler, CreateTaskRequestHandlerExtra, TaskRequestHandlerExtra, CreateTaskResult, GetTaskResult, Task, ServeContext, ServeOptions, PgQueryable, PostgresTaskStoreOptions, TestControllerStore, TestControllerStoreFactory, TestControllerStoreOrFactory, ControllerScenario, SeedScenario, SeedFixtureCache, SessionContext, OnInstructionsError, MaybePromise, LegacyAdcpServerConfig, LegacyAdcpToolMap, AdcpServerToolName, AdcpCapabilitiesConfig, LegacyAdcpCustomToolConfig, McpAppUiMeta, McpAppMeta, AdcpMcpResourceDefinition, McpAppResourceCsp, McpAppResourcePermissions, McpAppResourceUiMeta, McpAppResourceMeta, McpAppResourceReadContext, AdcpLogger, LegacyHandlerContext, LegacyMediaBuyHandlers, LegacySignalsHandlers, LegacyCreativeHandlers, LegacyGovernanceHandlers, LegacyAccountHandlers, LegacyEventTrackingHandlers, LegacySponsoredIntelligenceHandlers, SignedRequestsConfig, AdcpPreTransport, AdcpServer, AdcpServerTransport, AdcpTestRequest, AdcpTestToolsCallRequest, AdcpTestResponse, AdcpInvokeOptions, StructuredContentFallbackTransport, StructuredContentTextFallback, StructuredContentTextFallbackContext, CheckGovernanceOptions, GovernanceCallResult, GovernanceApproved, GovernanceDenied, GovernanceConditions, AdcpStateStore, ListOptions as StateListOptions, ListResult as StateListResult, PostgresStateStoreOptions, InMemoryStateStoreOptions, VersionedDocument, PutIfMatchResult, PatchWithRetryOptions, StateErrorCode, SessionKeyContext, IdempotencyStore, IdempotencyStoreConfig, IdempotencyBackend, IdempotencyCacheEntry, IdempotencyCheckResult, MemoryBackendOptions, PgBackendOptions, RedisBackendOptions, RedisBackendClient, RedisLikeClient, LazyBackendFactory, LazyBackendOptions, A2AAdapter, A2AAdapterOptions, A2AAgentCardOverrides, A2AAgentCapabilitiesOverride, A2AAgentSkillOverride, A2AMountOptions, ExpressAppLike, LegacyHttpSecurityScheme, LegacySecurityScheme, AccountMode, RequireCacheScopeWhenProducts, ServerPayload, GetProductsPayload, CreateMediaBuyPayload, UpdateMediaBuyPayload, GetMediaBuysPayload, GetMediaBuyDeliveryPayload, ListCreativesPayload, GetCreativeDeliveryPayload, CanonicalPreviewCreativePayload, PreviewCreativePayload, LegacyGetProductsPayload, LegacyCreateMediaBuyPayload, LegacyUpdateMediaBuyPayload, LegacyGetMediaBuysPayload, LegacyGetMediaBuyDeliveryPayload, LegacyListCreativesPayload, LegacyGetCreativeDeliveryPayload, LegacyListCreativeFormatsPayload, LegacyListCreativeFormatsResponsePayload, LegacyListCreativeFormatsServerPayload, LegacyBuildCreativePayload, LegacyBuildCreativeMultiPayload, LegacyBuildCreativeVariantPayload, LegacyPreviewCreativePayload, SyncCreativesPayload, SyncCreativesSuccessPayload, SyncCreativesErrorPayload, } from './server';
+export type { AdcpErrorOptions, AdcpErrorResponse, McpToolResponse, ValidAction, CancelMediaBuyInput, AdcpTaskToolConfig, TaskStore, TaskMessageQueue, CreateTaskOptions, ToolTaskHandler, CreateTaskRequestHandlerExtra, TaskRequestHandlerExtra, CreateTaskResult, GetTaskResult, Task, ServeContext, ServeOptions, PgQueryable, PostgresTaskStoreOptions, TestControllerStore, TestControllerStoreFactory, TestControllerStoreOrFactory, ControllerScenario, SeedScenario, SeedFixtureCache, SessionContext, OnInstructionsError, MaybePromise, LegacyAdcpServerConfig, LegacyAdcpToolMap, AdcpServerToolName, AdcpCapabilitiesConfig, LegacyAdcpCustomToolConfig, LegacyAdcpCustomToolHandler, LegacyAdcpCustomToolHandlerExtra, McpAppUiMeta, McpAppMeta, AdcpMcpResourceDefinition, McpAppResourceCsp, McpAppResourcePermissions, McpAppResourceUiMeta, McpAppResourceMeta, McpAppResourceReadContext, AdcpLogger, LegacyHandlerContext, LegacyMediaBuyHandlers, LegacySignalsHandlers, LegacyCreativeHandlers, LegacyGovernanceHandlers, LegacyAccountHandlers, LegacyEventTrackingHandlers, LegacySponsoredIntelligenceHandlers, SignedRequestsConfig, AdcpPreTransport, AdcpServer, AdcpServerTransport, AdcpTestRequest, AdcpTestToolsCallRequest, AdcpTestResponse, AdcpInvokeOptions, StructuredContentFallbackTransport, StructuredContentTextFallback, StructuredContentTextFallbackContext, CheckGovernanceOptions, GovernanceCallResult, GovernanceApproved, GovernanceDenied, GovernanceConditions, AdcpStateStore, ListOptions as StateListOptions, ListResult as StateListResult, PostgresStateStoreOptions, InMemoryStateStoreOptions, VersionedDocument, PutIfMatchResult, PatchWithRetryOptions, StateErrorCode, SessionKeyContext, IdempotencyStore, IdempotencyStoreConfig, IdempotencyBackend, IdempotencyCacheEntry, IdempotencyCheckResult, MemoryBackendOptions, PgBackendOptions, RedisBackendOptions, RedisBackendClient, RedisLikeClient, LazyBackendFactory, LazyBackendOptions, A2AAdapter, A2AAdapterOptions, A2AAgentCardOverrides, A2AAgentCapabilitiesOverride, A2AAgentSkillOverride, A2AMountOptions, ExpressAppLike, LegacyHttpSecurityScheme, LegacySecurityScheme, AccountMode, RequireCacheScopeWhenProducts, ServerPayload, GetProductsPayload, CreateMediaBuyPayload, UpdateMediaBuyPayload, GetMediaBuysPayload, GetMediaBuyDeliveryPayload, ListCreativesPayload, GetCreativeDeliveryPayload, CanonicalPreviewCreativePayload, PreviewCreativePayload, LegacyGetProductsPayload, LegacyCreateMediaBuyPayload, LegacyUpdateMediaBuyPayload, LegacyGetMediaBuysPayload, LegacyGetMediaBuyDeliveryPayload, LegacyListCreativesPayload, LegacyGetCreativeDeliveryPayload, LegacyListCreativeFormatsPayload, LegacyListCreativeFormatsResponsePayload, LegacyListCreativeFormatsServerPayload, LegacyBuildCreativePayload, LegacyBuildCreativeMultiPayload, LegacyBuildCreativeVariantPayload, LegacyPreviewCreativePayload, SyncCreativesPayload, SyncCreativesSuccessPayload, SyncCreativesErrorPayload, } from './server';
 export { isRetryable, getRetryDelay } from './utils/retry';
 export { decideRetry, BuyerRetryPolicy } from './utils/buyer-retry-policy';
 export type { RetryDecision, RetryContext, RetryDecisionOverride } from './utils/buyer-retry-policy';

package/dist/lib/protocols/mcp-modern.d.mts

@@ -36,6 +36,8 @@ export interface ModernMCPConnectionOptions {
     requestTimeoutMs?: number;
     fetchFn?: typeof fetch;
     allowPrivateIp?: boolean;
+    /** SDK-selected AdCP release-precision version for tools/list discovery. */
+    adcpVersion?: string;
     /** Use the v2 SDK's negotiated legacy client instead of handing off to v1. */
     handleLegacy?: boolean;
 }

package/dist/lib/protocols/mcp-modern.d.ts

@@ -36,6 +36,8 @@ export interface ModernMCPConnectionOptions {
     requestTimeoutMs?: number;
     fetchFn?: typeof fetch;
     allowPrivateIp?: boolean;
+    /** SDK-selected AdCP release-precision version for tools/list discovery. */
+    adcpVersion?: string;
     /** Use the v2 SDK's negotiated legacy client instead of handing off to v1. */
     handleLegacy?: boolean;
 }

package/dist/lib/protocols/mcp-modern.js

@@ -509,10 +509,13 @@ async function tryListModernMCPTools(agentUrl, authToken, customHeaders, options
   const listTools = async (connectedClient) => {
     if (connectedClient.getProtocolEra() !== "modern") return { handled: false };
     const resolvedRequestTimeoutMs = (0, import_abort.resolveClientRequestTimeoutMs)(options.requestTimeoutMs);
-    const result = await connectedClient.listTools(void 0, {
-      ...options.signal && { signal: options.signal },
-      ...resolvedRequestTimeoutMs !== void 0 && { timeout: resolvedRequestTimeoutMs }
-    });
+    const result = await connectedClient.listTools(
+      options.adcpVersion === void 0 ? void 0 : { _meta: { adcp_version: options.adcpVersion } },
+      {
+        ...options.signal && { signal: options.signal },
+        ...resolvedRequestTimeoutMs !== void 0 && { timeout: resolvedRequestTimeoutMs }
+      }
+    );
     return { handled: true, tools: result.tools };
   };
   try {

package/dist/lib/protocols/mcp-modern.mjs

@@ -503,10 +503,13 @@ async function tryListModernMCPTools(agentUrl, authToken, customHeaders, options
   const listTools = async (connectedClient) => {
     if (connectedClient.getProtocolEra() !== "modern") return { handled: false };
     const resolvedRequestTimeoutMs = resolveClientRequestTimeoutMs(options.requestTimeoutMs);
-    const result = await connectedClient.listTools(void 0, {
-      ...options.signal && { signal: options.signal },
-      ...resolvedRequestTimeoutMs !== void 0 && { timeout: resolvedRequestTimeoutMs }
-    });
+    const result = await connectedClient.listTools(
+      options.adcpVersion === void 0 ? void 0 : { _meta: { adcp_version: options.adcpVersion } },
+      {
+        ...options.signal && { signal: options.signal },
+        ...resolvedRequestTimeoutMs !== void 0 && { timeout: resolvedRequestTimeoutMs }
+      }
+    );
     return { handled: true, tools: result.tools };
   };
   try {

package/dist/lib/protocols/mcp.js

@@ -93,8 +93,9 @@ function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, t
   if (scopeKey) parts.push(scopeKey);
   return parts.join("::");
 }
+const CACHE_DISAMBIGUATOR_SALT = (0, import_node_crypto.randomBytes)(32);
 function cacheDisambiguator(value) {
-  return (0, import_node_crypto.createHmac)("sha256", "").update(value).digest("hex").slice(0, 16);
+  return Buffer.from((0, import_node_crypto.hkdfSync)("sha256", value, CACHE_DISAMBIGUATOR_SALT, "adcp-mcp-cache-key", 32)).toString("hex");
 }
 function extractAuthHeader(headers) {
   if (!headers) return void 0;

package/dist/lib/protocols/mcp.mjs

@@ -10,7 +10,7 @@ import {
 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
-import { createHmac } from "node:crypto";
+import { hkdfSync, randomBytes } from "node:crypto";
 import { createMCPRequestHeaders } from "../auth/index.mjs";
 import { is401Error } from "../errors/index.mjs";
 import { withSpan, injectTraceHeaders } from "../observability/tracing.mjs";
@@ -80,8 +80,9 @@ function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, t
   if (scopeKey) parts.push(scopeKey);
   return parts.join("::");
 }
+const CACHE_DISAMBIGUATOR_SALT = randomBytes(32);
 function cacheDisambiguator(value) {
-  return createHmac("sha256", "").update(value).digest("hex").slice(0, 16);
+  return Buffer.from(hkdfSync("sha256", value, CACHE_DISAMBIGUATOR_SALT, "adcp-mcp-cache-key", 32)).toString("hex");
 }
 function extractAuthHeader(headers) {
   if (!headers) return void 0;

package/dist/lib/registry/types.generated.d.mts

@@ -4214,7 +4214,7 @@ export interface components {
             adcp_version: string;
             verified_at: string;
             /** @description Specialisms demonstrably passed (enums/specialism.json). Preview specialisms are excluded from stable badges. */
-            verified_specialisms: ("audience-sync" | "brand-rights" | "collection-lists" | "content-standards" | "creative-ad-server" | "creative-generative" | "creative-template" | "creative-transformers" | "governance-aware-seller" | "governance-delivery-monitor" | "governance-spend-authority" | "property-lists" | "sales-broadcast-tv" | "sales-catalog-driven" | "sales-dooh" | "sales-guaranteed" | "sales-non-guaranteed" | "sales-proposal-mode" | "sales-social" | "signal-marketplace" | "signal-owned" | "signed-requests" | "sponsored-intelligence")[];
+            verified_specialisms: ("audience-sync" | "brand-rights" | "buyer-activation" | "buyer-discovery" | "buyer-monitoring" | "buyer-negotiation" | "buyer-recovery" | "collection-lists" | "content-standards" | "creative-ad-server" | "creative-generative" | "creative-template" | "creative-transformers" | "governance-aware-seller" | "governance-delivery-monitor" | "governance-spend-authority" | "property-lists" | "sales-broadcast-tv" | "sales-catalog-driven" | "sales-dooh" | "sales-guaranteed" | "sales-non-guaranteed" | "sales-proposal-mode" | "sales-social" | "signal-marketplace" | "orchestrator-multi-agent" | "signal-owned" | "signed-requests" | "sponsored-intelligence")[];
             /** @description Verification axes earned. 'spec' = AdCP storyboards pass for the declared specialisms. 'live' = AAO has observed real production traffic via canonical campaigns. Always non-empty when a badge is present; an absent badge is conveyed by the parent record being omitted, not by an empty array. */
             verification_modes: ("spec" | "live")[];
             verified_protocol_version: string | null;

package/dist/lib/registry/types.generated.d.ts

@@ -4214,7 +4214,7 @@ export interface components {
             adcp_version: string;
             verified_at: string;
             /** @description Specialisms demonstrably passed (enums/specialism.json). Preview specialisms are excluded from stable badges. */
-            verified_specialisms: ("audience-sync" | "brand-rights" | "collection-lists" | "content-standards" | "creative-ad-server" | "creative-generative" | "creative-template" | "creative-transformers" | "governance-aware-seller" | "governance-delivery-monitor" | "governance-spend-authority" | "property-lists" | "sales-broadcast-tv" | "sales-catalog-driven" | "sales-dooh" | "sales-guaranteed" | "sales-non-guaranteed" | "sales-proposal-mode" | "sales-social" | "signal-marketplace" | "signal-owned" | "signed-requests" | "sponsored-intelligence")[];
+            verified_specialisms: ("audience-sync" | "brand-rights" | "buyer-activation" | "buyer-discovery" | "buyer-monitoring" | "buyer-negotiation" | "buyer-recovery" | "collection-lists" | "content-standards" | "creative-ad-server" | "creative-generative" | "creative-template" | "creative-transformers" | "governance-aware-seller" | "governance-delivery-monitor" | "governance-spend-authority" | "property-lists" | "sales-broadcast-tv" | "sales-catalog-driven" | "sales-dooh" | "sales-guaranteed" | "sales-non-guaranteed" | "sales-proposal-mode" | "sales-social" | "signal-marketplace" | "orchestrator-multi-agent" | "signal-owned" | "signed-requests" | "sponsored-intelligence")[];
             /** @description Verification axes earned. 'spec' = AdCP storyboards pass for the declared specialisms. 'live' = AAO has observed real production traffic via canonical campaigns. Always non-empty when a badge is present; an absent badge is conveyed by the parent record being omitted, not by an empty array. */
             verification_modes: ("spec" | "live")[];
             verified_protocol_version: string | null;

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-09-05T12:48:14.056Z"
+  "synced_at": "2026-09-07T02:22:39.478Z"
 }

package/dist/lib/server/a2a-adapter.js

@@ -385,9 +385,8 @@ function buildAgentCard(server, overrides) {
     throw new Error("createA2AAdapter: only the JSONRPC A2A transport is supported");
   }
   const registeredTools = listRegisteredTools(server);
-  const tools = registeredTools.filter(
-    (toolName) => (0, import_adcp_server.isToolAvailableForVersion)(server, toolName, server.getAdcpVersion())
-  );
+  const discoveryVersion = (0, import_adcp_server.resolveDiscoveryVersion)(server);
+  const tools = registeredTools.filter((toolName) => (0, import_adcp_server.isToolAvailableForVersion)(server, toolName, discoveryVersion));
   const availableTools = new Set(tools);
   const registeredToolSet = new Set(registeredTools);
   const skills = filterPublicAgentCardSkills(

package/dist/lib/server/a2a-adapter.mjs

@@ -12,7 +12,8 @@ import { redactSecrets } from "../utils/redact-secrets.mjs";
 import {
   getSdkServer,
   isToolAvailableForVersion,
-  listRegisteredToolNames
+  listRegisteredToolNames,
+  resolveDiscoveryVersion
 } from "./adcp-server.mjs";
 class RedactingA2ATaskStore {
   constructor(delegate) {
@@ -370,9 +371,8 @@ function buildAgentCard(server, overrides) {
     throw new Error("createA2AAdapter: only the JSONRPC A2A transport is supported");
   }
   const registeredTools = listRegisteredTools(server);
-  const tools = registeredTools.filter(
-    (toolName) => isToolAvailableForVersion(server, toolName, server.getAdcpVersion())
-  );
+  const discoveryVersion = resolveDiscoveryVersion(server);
+  const tools = registeredTools.filter((toolName) => isToolAvailableForVersion(server, toolName, discoveryVersion));
   const availableTools = new Set(tools);
   const registeredToolSet = new Set(registeredTools);
   const skills = filterPublicAgentCardSkills(

package/dist/lib/server/adcp-server.d.mts

@@ -289,15 +289,24 @@ export interface AdcpServer {
      */
     invoke(options: AdcpInvokeOptions): Promise<McpToolResponse>;
     /**
-     * Returns the AdCP protocol version this server is configured to speak.
+     * Returns the newest AdCP protocol version this server can serve.
      *
      * Defaults to {@link ADCP_VERSION} (the GA version the SDK ships against)
      * unless overridden via `createAdcpServer({ adcpVersion })`. This is the
      * protocol version, **not** the publisher's app version (`config.version`).
      *
      * Plumbing surface — Stage 2 of the multi-version refactor exposes the
-     * configured value but does not yet vary validator/schema selection by
+     * configured ceiling but does not yet vary validator/schema selection by
      * version. Wire-shape adapters key off this getter in subsequent stages.
      */
     getAdcpVersion(): string;
+    /**
+     * Returns the AdCP protocol version selected when a caller supplies no
+     * `adcp_version` or `adcp_major_version` claim.
+     *
+     * Defaults to {@link getAdcpVersion} unless the server config declares a
+     * lower `defaultAdcpVersion`. This lets one endpoint retain a conservative
+     * wire default while making newer explicitly versioned routes reachable.
+     */
+    getDefaultAdcpVersion(): string;
 }

package/dist/lib/server/adcp-server.d.ts

@@ -289,15 +289,24 @@ export interface AdcpServer {
      */
     invoke(options: AdcpInvokeOptions): Promise<McpToolResponse>;
     /**
-     * Returns the AdCP protocol version this server is configured to speak.
+     * Returns the newest AdCP protocol version this server can serve.
      *
      * Defaults to {@link ADCP_VERSION} (the GA version the SDK ships against)
      * unless overridden via `createAdcpServer({ adcpVersion })`. This is the
      * protocol version, **not** the publisher's app version (`config.version`).
      *
      * Plumbing surface — Stage 2 of the multi-version refactor exposes the
-     * configured value but does not yet vary validator/schema selection by
+     * configured ceiling but does not yet vary validator/schema selection by
      * version. Wire-shape adapters key off this getter in subsequent stages.
      */
     getAdcpVersion(): string;
+    /**
+     * Returns the AdCP protocol version selected when a caller supplies no
+     * `adcp_version` or `adcp_major_version` claim.
+     *
+     * Defaults to {@link getAdcpVersion} unless the server config declares a
+     * lower `defaultAdcpVersion`. This lets one endpoint retain a conservative
+     * wire default while making newer explicitly versioned routes reachable.
+     */
+    getDefaultAdcpVersion(): string;
 }

package/dist/lib/server/adcp-server.js

@@ -90,7 +90,7 @@ function setDiscoveryVersionResolver(server, resolver) {
 }
 function resolveDiscoveryVersion(server, requestedVersion) {
   const resolver = server[ADCP_DISCOVERY_VERSION_RESOLVER];
-  return resolver ? resolver(requestedVersion) : server.getAdcpVersion();
+  return resolver ? resolver(requestedVersion) : server.getDefaultAdcpVersion?.() ?? server.getAdcpVersion();
 }
 function setMcpToolProfile(server, profile) {
   Object.defineProperty(server, ADCP_MCP_TOOL_PROFILE, {
@@ -254,7 +254,8 @@ function wrapMcpServer(inner, compliance, adcpVersion = import_version.ADCP_VERS
     // runtime dispatcher is a single function that narrows by method.
     dispatchTestRequest: dispatch,
     invoke,
-    getAdcpVersion: () => adcpVersion
+    getAdcpVersion: () => adcpVersion,
+    getDefaultAdcpVersion: () => options.defaultAdcpVersion ?? adcpVersion
   };
   return wrapper;
 }

package/dist/lib/server/adcp-server.mjs

@@ -40,7 +40,7 @@ function setDiscoveryVersionResolver(server, resolver) {
 }
 function resolveDiscoveryVersion(server, requestedVersion) {
   const resolver = server[ADCP_DISCOVERY_VERSION_RESOLVER];
-  return resolver ? resolver(requestedVersion) : server.getAdcpVersion();
+  return resolver ? resolver(requestedVersion) : server.getDefaultAdcpVersion?.() ?? server.getAdcpVersion();
 }
 function setMcpToolProfile(server, profile) {
   Object.defineProperty(server, ADCP_MCP_TOOL_PROFILE, {
@@ -204,7 +204,8 @@ function wrapMcpServer(inner, compliance, adcpVersion = ADCP_VERSION, options =
     // runtime dispatcher is a single function that narrows by method.
     dispatchTestRequest: dispatch,
     invoke,
-    getAdcpVersion: () => adcpVersion
+    getAdcpVersion: () => adcpVersion,
+    getDefaultAdcpVersion: () => options.defaultAdcpVersion ?? adcpVersion
   };
   return wrapper;
 }