@adcp/sdk 14.2.0 → 14.3.0

package/dist/lib/server/create-adcp-server.js

@@ -65,6 +65,7 @@ var import_envelope_status_compat = require('../utils/envelope-status-compat.js'
 var import_schema_validator = require('../validation/schema-validator.js');
 var import_sync_reporting_status_envelope = require('../validation/sync-reporting-status-envelope.js');
 var import_schema_errors = require('../validation/schema-errors.js');
+var import_diagnostic_limits = require('../validation/diagnostic-limits.js');
 var import_idempotency2 = require('./idempotency/index.js');
 var import_webhook_emitter = require('./webhook-emitter.js');
 var import_middleware = require('../signing/middleware.js');
@@ -2287,7 +2288,7 @@ function createAdcpServer(config) {
     const validationMode = effectiveRequestValidationMode(extra);
     const accountIssues = protocolTaskAccountExtensionIssues(params);
     const outcome = validationMode === "off" ? { valid: true, issues: [], schemaId: void 0 } : (0, import_schema_validator.validateRequest)(toolName, params, requestServedRelease(params)?.validationVersion ?? adcpVersion);
-    const issues = [...outcome.valid ? [] : outcome.issues, ...accountIssues];
+    const issues = [...accountIssues, ...outcome.valid ? [] : outcome.issues];
     if (issues.length === 0) return void 0;
     if (validationMode === "strict" || accountIssues.length > 0) {
       return (0, import_errors2.adcpError)(
@@ -2838,7 +2839,9 @@ function createAdcpServer(config) {
                 })
               );
             }
-            let issues = idempotencyDisabled && requestIsStateChanging ? outcome.issues.filter((i) => !(i.keyword === "required" && i.pointer === "/idempotency_key")) : outcome.issues;
+            let issues = idempotencyDisabled && requestIsStateChanging ? outcome.issues.filter(
+              (i) => !(i.keyword === "required" && i.pointer === "/idempotency_key" && !(0, import_diagnostic_limits.validationDiagnosticsTruncated)([i]))
+            ) : outcome.issues;
             if (toolName === "sync_accounts" && effectiveFrameworkRequestValidationMode === "strict") {
               const eventIssues = issues.filter(isAccountNotificationEventIssue);
               if (eventIssues.length > 0 && eventIssues.length === issues.length) {

package/dist/lib/server/create-adcp-server.mjs

@@ -98,6 +98,7 @@ import { STATUS_FREE_SYNC_RESPONSE_TOOLS } from "../utils/envelope-status-compat
 import { validateRequest, validateResponse, formatIssues } from "../validation/schema-validator.mjs";
 import { validateSyncReportingStatusEnvelope } from "../validation/sync-reporting-status-envelope.mjs";
 import { buildAdcpValidationErrorPayload } from "../validation/schema-errors.mjs";
+import { validationDiagnosticsTruncated } from "../validation/diagnostic-limits.mjs";
 import { hashPayload, IdempotencyClaimOwnershipError } from "./idempotency/index.mjs";
 import {
   createWebhookEmitter
@@ -2359,7 +2360,7 @@ function createAdcpServer(config) {
     const validationMode = effectiveRequestValidationMode(extra);
     const accountIssues = protocolTaskAccountExtensionIssues(params);
     const outcome = validationMode === "off" ? { valid: true, issues: [], schemaId: void 0 } : validateRequest(toolName, params, requestServedRelease(params)?.validationVersion ?? adcpVersion);
-    const issues = [...outcome.valid ? [] : outcome.issues, ...accountIssues];
+    const issues = [...accountIssues, ...outcome.valid ? [] : outcome.issues];
     if (issues.length === 0) return void 0;
     if (validationMode === "strict" || accountIssues.length > 0) {
       return adcpError(
@@ -2910,7 +2911,9 @@ function createAdcpServer(config) {
                 })
               );
             }
-            let issues = idempotencyDisabled && requestIsStateChanging ? outcome.issues.filter((i) => !(i.keyword === "required" && i.pointer === "/idempotency_key")) : outcome.issues;
+            let issues = idempotencyDisabled && requestIsStateChanging ? outcome.issues.filter(
+              (i) => !(i.keyword === "required" && i.pointer === "/idempotency_key" && !validationDiagnosticsTruncated([i]))
+            ) : outcome.issues;
             if (toolName === "sync_accounts" && effectiveFrameworkRequestValidationMode === "strict") {
               const eventIssues = issues.filter(isAccountNotificationEventIssue);
               if (eventIssues.length > 0 && eventIssues.length === issues.length) {

package/dist/lib/signing/canonicalize.d.mts

@@ -68,5 +68,7 @@ export declare function formatSignatureParams(components: ReadonlyArray<string>,
  * non-transitional produce different A-labels for the same input, which
  * would open a signer/verifier canonicalization differential. Accepts
  * both absolute (`scheme://…`) and scheme-relative (`//…`) URL shapes.
+ * The transport taxonomy classifies the received URI as malformed. Diagnostic
+ * step 1 is SDK-local parsing, not the checklist's signature-header parser.
  */
 export declare function rejectNonAsciiHost(rawUrl: string): void;

package/dist/lib/signing/canonicalize.d.ts

@@ -68,5 +68,7 @@ export declare function formatSignatureParams(components: ReadonlyArray<string>,
  * non-transitional produce different A-labels for the same input, which
  * would open a signer/verifier canonicalization differential. Accepts
  * both absolute (`scheme://…`) and scheme-relative (`//…`) URL shapes.
+ * The transport taxonomy classifies the received URI as malformed. Diagnostic
+ * step 1 is SDK-local parsing, not the checklist's signature-header parser.
  */
 export declare function rejectNonAsciiHost(rawUrl: string): void;

package/dist/lib/signing/canonicalize.js

@@ -269,7 +269,7 @@ function rejectNonAsciiHost(rawUrl) {
   for (let i = 0; i < authority.length; i++) {
     if (authority.charCodeAt(i) > 127) {
       throw new import_errors.RequestSignatureError(
-        "request_signature_header_malformed",
+        "request_target_uri_malformed",
         1,
         "URL authority contains non-ASCII bytes; use the A-label (Punycode) form"
       );

package/dist/lib/signing/canonicalize.mjs

@@ -239,7 +239,7 @@ function rejectNonAsciiHost(rawUrl) {
   for (let i = 0; i < authority.length; i++) {
     if (authority.charCodeAt(i) > 127) {
       throw new RequestSignatureError(
-        "request_signature_header_malformed",
+        "request_target_uri_malformed",
         1,
         "URL authority contains non-ASCII bytes; use the A-label (Punycode) form"
       );

package/dist/lib/signing/verifier.js

@@ -99,7 +99,7 @@ async function verifyRequestSignature(request, options) {
   if (!parsedSig) throw parseError;
   const effectiveEncoding = pinnedBinaryEncoding ?? parsedEncoding;
   const canonicalizationProfile = effectiveEncoding === "rfc8941-base64" ? "3.2" : "legacy";
-  if (canonicalizationProfile === "legacy") (0, import_canonicalize.rejectNonAsciiHost)(request.url);
+  (0, import_canonicalize.rejectNonAsciiHost)(request.url);
   validateSingleValuedCoveredHeaders(parsedInput.components, request);
   requireParams(parsedInput);
   if (parsedInput.params.tag !== import_types.REQUEST_SIGNING_TAG) {

package/dist/lib/signing/verifier.mjs

@@ -92,7 +92,7 @@ async function verifyRequestSignature(request, options) {
   if (!parsedSig) throw parseError;
   const effectiveEncoding = pinnedBinaryEncoding ?? parsedEncoding;
   const canonicalizationProfile = effectiveEncoding === "rfc8941-base64" ? "3.2" : "legacy";
-  if (canonicalizationProfile === "legacy") rejectNonAsciiHost(request.url);
+  rejectNonAsciiHost(request.url);
   validateSingleValuedCoveredHeaders(parsedInput.components, request);
   requireParams(parsedInput);
   if (parsedInput.params.tag !== REQUEST_SIGNING_TAG) {

package/dist/lib/testing/storyboard/request-signing/builder.js

@@ -192,6 +192,7 @@ const MUTATIONS = {
   // transport-ungradable by the live probe because no HTTP client can route
   // to that intentionally invalid host spelling.
   "profile-3.2/negative/001-base64url-sf-binary": (vector, _keys, options) => passthrough(vector, options),
+  "profile-3.2/negative/001-no-signature-header": delegateToRoot("001-no-signature-header"),
   "profile-3.2/negative/002-multiple-trailing-dots": (vector, _keys, options) => passthrough(vector, options),
   "profile-3.2/negative/002-wrong-tag": delegateToRoot("002-wrong-tag"),
   "profile-3.2/negative/003-expired-signature": delegateToRoot("003-expired-signature"),
@@ -208,6 +209,7 @@ const MUTATIONS = {
   "profile-3.2/negative/008-unknown-keyid": delegateToRoot("008-unknown-keyid"),
   "profile-3.2/negative/009-key-ops-missing-verify": delegateToRoot("009-key-ops-missing-verify"),
   "profile-3.2/negative/010-content-digest-mismatch": delegateToRoot("010-content-digest-mismatch"),
+  "profile-3.2/negative/011-malformed-header": delegateToRoot("011-malformed-header"),
   "profile-3.2/negative/012-missing-expires-param": delegateToRoot("012-missing-expires-param"),
   "profile-3.2/negative/013-expires-le-created": delegateToRoot("013-expires-le-created"),
   "profile-3.2/negative/014-missing-nonce-param": delegateToRoot("014-missing-nonce-param"),
@@ -220,8 +222,18 @@ const MUTATIONS = {
   },
   "profile-3.2/negative/016-replayed-nonce": delegateToRoot("016-replayed-nonce"),
   "profile-3.2/negative/017-key-revoked": delegateToRoot("017-key-revoked"),
+  "profile-3.2/negative/019-signature-without-signature-input": delegateToRoot("019-signature-without-signature-input"),
   "profile-3.2/negative/020-rate-abuse": delegateToRoot("020-rate-abuse"),
-  "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch")
+  "profile-3.2/negative/021-duplicate-signature-input-label": delegateToRoot("021-duplicate-signature-input-label"),
+  "profile-3.2/negative/022-multi-valued-content-type": delegateToRoot("022-multi-valued-content-type"),
+  "profile-3.2/negative/023-multi-valued-content-digest": delegateToRoot("023-multi-valued-content-digest"),
+  "profile-3.2/negative/024-unquoted-string-param": delegateToRoot("024-unquoted-string-param"),
+  "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch"),
+  "profile-3.2/negative/026-non-ascii-host": delegateToRoot("026-non-ascii-host"),
+  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": delegateToRoot(
+    "027-webhook-registration-authentication-unsigned"
+  ),
+  "profile-3.2/negative/028-unsigned-protocol-method-required": delegateToRoot("028-unsigned-protocol-method-required")
 };
 function delegateToRoot(rootId) {
   return (vector, keys, options) => {

package/dist/lib/testing/storyboard/request-signing/builder.mjs

@@ -175,6 +175,7 @@ const MUTATIONS = {
   // transport-ungradable by the live probe because no HTTP client can route
   // to that intentionally invalid host spelling.
   "profile-3.2/negative/001-base64url-sf-binary": (vector, _keys, options) => passthrough(vector, options),
+  "profile-3.2/negative/001-no-signature-header": delegateToRoot("001-no-signature-header"),
   "profile-3.2/negative/002-multiple-trailing-dots": (vector, _keys, options) => passthrough(vector, options),
   "profile-3.2/negative/002-wrong-tag": delegateToRoot("002-wrong-tag"),
   "profile-3.2/negative/003-expired-signature": delegateToRoot("003-expired-signature"),
@@ -191,6 +192,7 @@ const MUTATIONS = {
   "profile-3.2/negative/008-unknown-keyid": delegateToRoot("008-unknown-keyid"),
   "profile-3.2/negative/009-key-ops-missing-verify": delegateToRoot("009-key-ops-missing-verify"),
   "profile-3.2/negative/010-content-digest-mismatch": delegateToRoot("010-content-digest-mismatch"),
+  "profile-3.2/negative/011-malformed-header": delegateToRoot("011-malformed-header"),
   "profile-3.2/negative/012-missing-expires-param": delegateToRoot("012-missing-expires-param"),
   "profile-3.2/negative/013-expires-le-created": delegateToRoot("013-expires-le-created"),
   "profile-3.2/negative/014-missing-nonce-param": delegateToRoot("014-missing-nonce-param"),
@@ -203,8 +205,18 @@ const MUTATIONS = {
   },
   "profile-3.2/negative/016-replayed-nonce": delegateToRoot("016-replayed-nonce"),
   "profile-3.2/negative/017-key-revoked": delegateToRoot("017-key-revoked"),
+  "profile-3.2/negative/019-signature-without-signature-input": delegateToRoot("019-signature-without-signature-input"),
   "profile-3.2/negative/020-rate-abuse": delegateToRoot("020-rate-abuse"),
-  "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch")
+  "profile-3.2/negative/021-duplicate-signature-input-label": delegateToRoot("021-duplicate-signature-input-label"),
+  "profile-3.2/negative/022-multi-valued-content-type": delegateToRoot("022-multi-valued-content-type"),
+  "profile-3.2/negative/023-multi-valued-content-digest": delegateToRoot("023-multi-valued-content-digest"),
+  "profile-3.2/negative/024-unquoted-string-param": delegateToRoot("024-unquoted-string-param"),
+  "profile-3.2/negative/025-jwk-alg-crv-mismatch": delegateToRoot("025-jwk-alg-crv-mismatch"),
+  "profile-3.2/negative/026-non-ascii-host": delegateToRoot("026-non-ascii-host"),
+  "profile-3.2/negative/027-webhook-registration-authentication-unsigned": delegateToRoot(
+    "027-webhook-registration-authentication-unsigned"
+  ),
+  "profile-3.2/negative/028-unsigned-protocol-method-required": delegateToRoot("028-unsigned-protocol-method-required")
 };
 function delegateToRoot(rootId) {
   return (vector, keys, options) => {

package/dist/lib/testing/storyboard/request-signing/grader.js

@@ -134,6 +134,7 @@ const TRANSPORT_UNGRADABLE = {
   // agent as Punycode, defeating the parse-time check. Direct verifier
   // tests exercise this edge.
   "026-non-ascii-host": "HTTP transport punycodes U-labels before the request leaves the client; verified at the library level.",
+  "profile-3.2/negative/026-non-ascii-host": "HTTP transport punycodes U-labels before the request leaves the client; verified at the library level.",
   "profile-3.2/negative/002-multiple-trailing-dots": "HTTP transport cannot route to an intentionally malformed DNS authority; verified at the library level."
 };
 function semanticVectorExclusion(vector, declaredCapability) {

package/dist/lib/testing/storyboard/request-signing/grader.mjs

@@ -113,6 +113,7 @@ const TRANSPORT_UNGRADABLE = {
   // agent as Punycode, defeating the parse-time check. Direct verifier
   // tests exercise this edge.
   "026-non-ascii-host": "HTTP transport punycodes U-labels before the request leaves the client; verified at the library level.",
+  "profile-3.2/negative/026-non-ascii-host": "HTTP transport punycodes U-labels before the request leaves the client; verified at the library level.",
   "profile-3.2/negative/002-multiple-trailing-dots": "HTTP transport cannot route to an intentionally malformed DNS authority; verified at the library level."
 };
 function semanticVectorExclusion(vector, declaredCapability) {

package/dist/lib/testing/storyboard/request-signing/vector-loader.js

@@ -39,7 +39,7 @@ function selectRequestSigningVectors(loaded, signingProfileVersion) {
 }
 function signingProfileForAdcpVersion(version) {
   const match = /^(\d+)\.(\d+)/.exec(version ?? "");
-  return match && Number(match[1]) === 3 && Number(match[2]) === 2 ? "3.2" : void 0;
+  return match && (Number(match[1]) > 3 || Number(match[1]) === 3 && Number(match[2]) >= 2) ? "3.2" : void 0;
 }
 const ERROR_CODES = /* @__PURE__ */ new Set([
   "request_signature_required",

package/dist/lib/testing/storyboard/request-signing/vector-loader.mjs

@@ -11,7 +11,7 @@ function selectRequestSigningVectors(loaded, signingProfileVersion) {
 }
 function signingProfileForAdcpVersion(version) {
   const match = /^(\d+)\.(\d+)/.exec(version ?? "");
-  return match && Number(match[1]) === 3 && Number(match[2]) === 2 ? "3.2" : void 0;
+  return match && (Number(match[1]) > 3 || Number(match[1]) === 3 && Number(match[2]) >= 2) ? "3.2" : void 0;
 }
 const ERROR_CODES = /* @__PURE__ */ new Set([
   "request_signature_required",

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "14.2.0";
+export declare const RUNNER_CAPABILITY_VERSION = "14.3.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "14.2.0";
+export declare const RUNNER_CAPABILITY_VERSION = "14.3.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/utils/pointer-utils.d.mts

@@ -0,0 +1,2 @@
+/** Translate SDK JSON Pointers to the AdCP error.field JSONPath-lite notation. */
+export declare function jsonPointerToJsonPathLite(pointer: string): string | undefined;

package/dist/lib/utils/pointer-utils.d.ts

@@ -0,0 +1,2 @@
+/** Translate SDK JSON Pointers to the AdCP error.field JSONPath-lite notation. */
+export declare function jsonPointerToJsonPathLite(pointer: string): string | undefined;

package/dist/lib/utils/pointer-utils.js

@@ -0,0 +1,43 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pointer_utils_exports = {};
+__export(pointer_utils_exports, {
+  jsonPointerToJsonPathLite: () => jsonPointerToJsonPathLite
+});
+module.exports = __toCommonJS(pointer_utils_exports);
+function jsonPointerToJsonPathLite(pointer) {
+  if (pointer === "" || pointer === "/") return "$";
+  if (!pointer.startsWith("/")) return void 0;
+  let field = "";
+  for (const encoded of pointer.slice(1).split("/")) {
+    const segment = encoded.replace(/~1/g, "/").replace(/~0/g, "~");
+    if (/^(0|[1-9][0-9]*)$/.test(segment)) {
+      field += `${field ? "" : "$"}[${segment}]`;
+    } else if (/^[A-Za-z_][A-Za-z0-9_-]*$/.test(segment)) {
+      field += field ? `.${segment}` : segment;
+    } else {
+      field += `${field ? "" : "$"}[${JSON.stringify(segment)}]`;
+    }
+  }
+  return field;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  jsonPointerToJsonPathLite
+});

package/dist/lib/utils/pointer-utils.mjs

@@ -0,0 +1,19 @@
+function jsonPointerToJsonPathLite(pointer) {
+  if (pointer === "" || pointer === "/") return "$";
+  if (!pointer.startsWith("/")) return void 0;
+  let field = "";
+  for (const encoded of pointer.slice(1).split("/")) {
+    const segment = encoded.replace(/~1/g, "/").replace(/~0/g, "~");
+    if (/^(0|[1-9][0-9]*)$/.test(segment)) {
+      field += `${field ? "" : "$"}[${segment}]`;
+    } else if (/^[A-Za-z_][A-Za-z0-9_-]*$/.test(segment)) {
+      field += field ? `.${segment}` : segment;
+    } else {
+      field += `${field ? "" : "$"}[${JSON.stringify(segment)}]`;
+    }
+  }
+  return field;
+}
+export {
+  jsonPointerToJsonPathLite
+};

package/dist/lib/validation/diagnostic-limits.d.mts

@@ -0,0 +1,4 @@
+import type { ValidationIssue } from './schema-validator.mjs';
+export declare function validationDiagnosticsTruncated(issues: readonly ValidationIssue[]): boolean;
+/** Retain actionable diagnostics with a visible marker when count/bytes overflow. */
+export declare function boundValidationIssues(issues: Iterable<ValidationIssue>): ValidationIssue[];

package/dist/lib/validation/diagnostic-limits.d.ts

@@ -0,0 +1,4 @@
+import type { ValidationIssue } from './schema-validator';
+export declare function validationDiagnosticsTruncated(issues: readonly ValidationIssue[]): boolean;
+/** Retain actionable diagnostics with a visible marker when count/bytes overflow. */
+export declare function boundValidationIssues(issues: Iterable<ValidationIssue>): ValidationIssue[];

package/dist/lib/validation/diagnostic-limits.js

@@ -0,0 +1,57 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var diagnostic_limits_exports = {};
+__export(diagnostic_limits_exports, {
+  boundValidationIssues: () => boundValidationIssues,
+  validationDiagnosticsTruncated: () => validationDiagnosticsTruncated
+});
+module.exports = __toCommonJS(diagnostic_limits_exports);
+const MAX_ISSUES = 100;
+const MAX_ISSUE_BYTES = 64 * 1024;
+const MAX_SINGLE_ISSUE_BYTES = 8 * 1024;
+const OMITTED_MESSAGE = "Validation failed; additional diagnostics omitted because the diagnostic limit was reached.";
+const OMITTED_BYTES = 8 * 1024;
+function validationDiagnosticsTruncated(issues) {
+  return issues.some((issue) => issue.message === OMITTED_MESSAGE);
+}
+function boundValidationIssues(issues) {
+  const bounded = [];
+  let bytes = 2;
+  for (const issue of issues) {
+    const issueBytes = Buffer.byteLength(JSON.stringify(issue), "utf8") + 1;
+    if (bounded.length >= MAX_ISSUES || issueBytes > MAX_SINGLE_ISSUE_BYTES || bytes + issueBytes + OMITTED_BYTES > MAX_ISSUE_BYTES) {
+      const omitted = bounded.length === MAX_ISSUES ? bounded.pop() : issue;
+      bounded.push({
+        pointer: Buffer.byteLength(omitted.pointer, "utf8") <= 1024 ? omitted.pointer : "/",
+        keyword: Buffer.byteLength(omitted.keyword, "utf8") <= 128 ? omitted.keyword : "type",
+        message: OMITTED_MESSAGE,
+        schemaPath: ""
+      });
+      break;
+    }
+    bounded.push(issue);
+    bytes += issueBytes;
+  }
+  return bounded;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  boundValidationIssues,
+  validationDiagnosticsTruncated
+});

package/dist/lib/validation/diagnostic-limits.mjs

@@ -0,0 +1,32 @@
+const MAX_ISSUES = 100;
+const MAX_ISSUE_BYTES = 64 * 1024;
+const MAX_SINGLE_ISSUE_BYTES = 8 * 1024;
+const OMITTED_MESSAGE = "Validation failed; additional diagnostics omitted because the diagnostic limit was reached.";
+const OMITTED_BYTES = 8 * 1024;
+function validationDiagnosticsTruncated(issues) {
+  return issues.some((issue) => issue.message === OMITTED_MESSAGE);
+}
+function boundValidationIssues(issues) {
+  const bounded = [];
+  let bytes = 2;
+  for (const issue of issues) {
+    const issueBytes = Buffer.byteLength(JSON.stringify(issue), "utf8") + 1;
+    if (bounded.length >= MAX_ISSUES || issueBytes > MAX_SINGLE_ISSUE_BYTES || bytes + issueBytes + OMITTED_BYTES > MAX_ISSUE_BYTES) {
+      const omitted = bounded.length === MAX_ISSUES ? bounded.pop() : issue;
+      bounded.push({
+        pointer: Buffer.byteLength(omitted.pointer, "utf8") <= 1024 ? omitted.pointer : "/",
+        keyword: Buffer.byteLength(omitted.keyword, "utf8") <= 128 ? omitted.keyword : "type",
+        message: OMITTED_MESSAGE,
+        schemaPath: ""
+      });
+      break;
+    }
+    bounded.push(issue);
+    bytes += issueBytes;
+  }
+  return bounded;
+}
+export {
+  boundValidationIssues,
+  validationDiagnosticsTruncated
+};

package/dist/lib/validation/schema-errors.d.mts

@@ -9,8 +9,9 @@ export interface ValidationErrorDetails {
     tool: string;
     /** Which side of the exchange — request (outgoing) or response (incoming). */
     side: 'request' | 'response';
-    /** All failures, each with a JSON Pointer to the bad field. */
+    /** Bounded failures, each with a JSON Pointer to the bad field. */
     issues: ValidationIssue[];
+    issues_truncated?: boolean;
 }
 /**
  * Build a `ValidationError` thrown by strict-mode client hooks. Keeps the
@@ -34,6 +35,7 @@ export interface AdcpValidationErrorDetails {
     issues: Array<Omit<ValidationIssue, 'schemaPath'> & {
         schemaPath?: string;
     }>;
+    issues_truncated?: boolean;
 }
 /**
  * Serialize issues for the server-side `adcpError('VALIDATION_ERROR', ...)` call.

package/dist/lib/validation/schema-errors.d.ts

@@ -9,8 +9,9 @@ export interface ValidationErrorDetails {
     tool: string;
     /** Which side of the exchange — request (outgoing) or response (incoming). */
     side: 'request' | 'response';
-    /** All failures, each with a JSON Pointer to the bad field. */
+    /** Bounded failures, each with a JSON Pointer to the bad field. */
     issues: ValidationIssue[];
+    issues_truncated?: boolean;
 }
 /**
  * Build a `ValidationError` thrown by strict-mode client hooks. Keeps the
@@ -34,6 +35,7 @@ export interface AdcpValidationErrorDetails {
     issues: Array<Omit<ValidationIssue, 'schemaPath'> & {
         schemaPath?: string;
     }>;
+    issues_truncated?: boolean;
 }
 /**
  * Serialize issues for the server-side `adcpError('VALIDATION_ERROR', ...)` call.

package/dist/lib/validation/schema-errors.js

@@ -24,6 +24,8 @@ __export(schema_errors_exports, {
 module.exports = __toCommonJS(schema_errors_exports);
 var import_errors = require('../errors/index.js');
 var import_schema_validator = require('./schema-validator.js');
+var import_pointer_utils = require('../utils/pointer-utils.js');
+var import_diagnostic_limits = require('./diagnostic-limits.js');
 function buildIssueProseSuffix(issue, rootSchemaId) {
   const parts = [];
   if (issue.schemaId && issue.schemaId !== rootSchemaId) parts.push(`schema: ${issue.schemaId}`);
@@ -33,14 +35,21 @@ function buildIssueProseSuffix(issue, rootSchemaId) {
   return parts.length > 0 ? ` (${parts.join("; ")})` : "";
 }
 function buildValidationError(tool, side, issues) {
+  issues = (0, import_diagnostic_limits.boundValidationIssues)(issues);
   const first = issues[0];
   const field = first?.pointer ?? "/";
   const constraint = first ? `${first.keyword}: ${first.message}${buildIssueProseSuffix(first, void 0)}` : "schema validation failed";
   const err = new import_errors.ValidationError(field, void 0, `${tool} ${side}: ${constraint}`);
-  err.details = { tool, side, issues };
+  err.details = {
+    tool,
+    side,
+    issues,
+    ...(0, import_diagnostic_limits.validationDiagnosticsTruncated)(issues) && { issues_truncated: true }
+  };
   return err;
 }
 function buildAdcpValidationErrorPayload(tool, side, issues, options = {}) {
+  issues = (0, import_diagnostic_limits.boundValidationIssues)(issues);
   const first = issues[0];
   let message;
   if (first != null) {
@@ -52,9 +61,15 @@ function buildAdcpValidationErrorPayload(tool, side, issues, options = {}) {
   const payload = {
     message,
     issues: emittedIssues,
-    details: { tool, side, issues: emittedIssues }
+    details: {
+      tool,
+      side,
+      issues: emittedIssues,
+      ...(0, import_diagnostic_limits.validationDiagnosticsTruncated)(issues) && { issues_truncated: true }
+    }
   };
-  if (first?.pointer) payload.field = first.pointer;
+  const field = first && (0, import_pointer_utils.jsonPointerToJsonPathLite)(first.pointer);
+  if (field !== void 0) payload.field = field;
   return payload;
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/lib/validation/schema-errors.mjs

@@ -1,5 +1,7 @@
 import { ValidationError } from "../errors/index.mjs";
 import { formatDiscriminator } from "./schema-validator.mjs";
+import { jsonPointerToJsonPathLite } from "../utils/pointer-utils.mjs";
+import { boundValidationIssues, validationDiagnosticsTruncated } from "./diagnostic-limits.mjs";
 function buildIssueProseSuffix(issue, rootSchemaId) {
   const parts = [];
   if (issue.schemaId && issue.schemaId !== rootSchemaId) parts.push(`schema: ${issue.schemaId}`);
@@ -9,14 +11,21 @@ function buildIssueProseSuffix(issue, rootSchemaId) {
   return parts.length > 0 ? ` (${parts.join("; ")})` : "";
 }
 function buildValidationError(tool, side, issues) {
+  issues = boundValidationIssues(issues);
   const first = issues[0];
   const field = first?.pointer ?? "/";
   const constraint = first ? `${first.keyword}: ${first.message}${buildIssueProseSuffix(first, void 0)}` : "schema validation failed";
   const err = new ValidationError(field, void 0, `${tool} ${side}: ${constraint}`);
-  err.details = { tool, side, issues };
+  err.details = {
+    tool,
+    side,
+    issues,
+    ...validationDiagnosticsTruncated(issues) && { issues_truncated: true }
+  };
   return err;
 }
 function buildAdcpValidationErrorPayload(tool, side, issues, options = {}) {
+  issues = boundValidationIssues(issues);
   const first = issues[0];
   let message;
   if (first != null) {
@@ -28,9 +37,15 @@ function buildAdcpValidationErrorPayload(tool, side, issues, options = {}) {
   const payload = {
     message,
     issues: emittedIssues,
-    details: { tool, side, issues: emittedIssues }
+    details: {
+      tool,
+      side,
+      issues: emittedIssues,
+      ...validationDiagnosticsTruncated(issues) && { issues_truncated: true }
+    }
   };
-  if (first?.pointer) payload.field = first.pointer;
+  const field = first && jsonPointerToJsonPathLite(first.pointer);
+  if (field !== void 0) payload.field = field;
   return payload;
 }
 export {