@adcp/sdk 14.0.0-rc.39 → 14.0.0-rc.40

package/docs/migration-14.x-rc-worksheet.md

@@ -11,8 +11,8 @@ below as the publication/deployment gate.
 
 | Fact | Value |
 | --- | --- |
-| Exact npm package | `@adcp/sdk@14.0.0-rc.39` |
-| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@14.0.0-rc.39 dist.integrity` |
+| Exact npm package | `@adcp/sdk@14.0.0-rc.40` |
+| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@14.0.0-rc.40 dist.integrity` |
 | Node.js runtime | `^20.19.0 || >=22.12.0` |
 | Default AdCP wire release | `3.2.0-rc.3` |
 | Maintained wire releases | `v2.5`, `v2.6`, `v3`, `3.0.0`, `3.0`, `3.0.1`, `3.0.2`, `3.0.3`, `3.0.4`, `3.0.5`, `3.0.6`, `3.0.7`, `3.0.8`, `3.0.9`, `3.0.10`, `3.0.11`, `3.0.12`, `3.0.13`, `3.0.14`, `3.0.15`, `3.0.16`, `3.0.17`, `3.0.18`, `3.0.19`, `3.0.20`, `3.0.21`, `3.0.22`, `3.0.23`, `3.0.24`, `3.0.25`, `3.1.0`, `3.1`, `3.1.1`, `3.1.2`, `3.1.3`, `3.1.4`, `3.1.5`, `3.1.6`, `3.1.7`, `3.1.8`, `3.1.9`, `3.1.10`, `3.1.11`, `3.1.12`, `3.1.13`, `3.1.14`, `3.1.15`, `3.1.16`, `3.1.17`, `3.1.18`, `3.2.0-rc.3`, `3.2-rc.3` |
@@ -21,8 +21,8 @@ below as the publication/deployment gate.
 Install exact production inputs rather than a moving prerelease range:
 
 ```bash
-npm install --save-exact '@adcp/sdk@14.0.0-rc.39'
-npm view '@adcp/sdk@14.0.0-rc.39' dist.integrity
+npm install --save-exact '@adcp/sdk@14.0.0-rc.40'
+npm view '@adcp/sdk@14.0.0-rc.40' dist.integrity
 ```
 
 ### Required and optional peers

package/examples/README.md

@@ -202,3 +202,5 @@ npm run dev
 ```
 
 See the main README for full testing framework documentation.
+
+Supply-path verification: [supply-path-verification.ts](supply-path-verification.ts) reads owner, host, agent and collection from environment variables and prints a live evidence-bearing verdict.

package/examples/supply-path-verification.ts

@@ -0,0 +1,29 @@
+/** Run with: npx tsx examples/supply-path-verification.ts */
+import { verifySupplyPath } from '@adcp/sdk';
+
+async function main(): Promise<void> {
+  const owner = process.env.SUPPLY_PATH_OWNER;
+  const host = process.env.SUPPLY_PATH_HOST;
+  const agent = process.env.SUPPLY_PATH_AGENT;
+  const collection = process.env.SUPPLY_PATH_COLLECTION;
+  if (!owner || !host || !agent || !collection) {
+    throw new Error('Set SUPPLY_PATH_OWNER, SUPPLY_PATH_HOST, SUPPLY_PATH_AGENT and SUPPLY_PATH_COLLECTION');
+  }
+  const result = await verifySupplyPath(
+    {
+      owner_domain: owner,
+      host_domain: host,
+      agent_url: agent,
+      collection_id: collection,
+    },
+    { source: 'authoritative' }
+  );
+  console.log(JSON.stringify(result, null, 2));
+  // Example policy: only the strongest, authoritative supply-path state passes.
+  if (result.state !== 'verified_owner_sold') process.exitCode = 1;
+}
+
+main().catch(error => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/sdk",
-  "version": "14.0.0-rc.39",
+  "version": "14.0.0-rc.40",
   "description": "AdCP SDK — client, server, and compliance harnesses for the AdContext Protocol (MCP + A2A)",
   "workspaces": [
     ".",
@@ -538,6 +538,7 @@
     "examples/adcp.config.json",
     "examples/reliable-reporting-service/README.md",
     "examples/seller-3.2-starter.ts",
+    "examples/supply-path-verification.ts",
     "examples/comply-controller-seller.ts",
     "examples/seller-test-controller.ts",
     "examples/gcp-kms-signing-provider.ts",