@adcp/sdk 14.2.0 → 14.4.0

package/dist/lib/validation/schema-validator.js

@@ -29,6 +29,7 @@ var import_schema_loader = require('./schema-loader.js');
 var import_version = require('../version.js');
 var import_hints = require('./hints.js');
 var import_envelope_status_compat = require('../utils/envelope-status-compat.js');
+var import_diagnostic_limits = require('./diagnostic-limits.js');
 const OK = Object.freeze({ valid: true, issues: [], variant: "skipped" });
 function extractSchemaId(schemaPath, rootSchema, registeredIds) {
   if (schemaPath.startsWith("#") || schemaPath === "") {
@@ -80,6 +81,59 @@ function resolveSchemaPath(rootSchema, schemaPath) {
   }
   return cursor;
 }
+function* expandNotErrors(errors, rootSchema, payload) {
+  for (const error of errors) {
+    const rule = error.keyword === "not" ? resolveSchemaPath(rootSchema, error.schemaPath) : void 0;
+    const branches = rule && typeof rule === "object" ? rule.anyOf : void 0;
+    if (!Array.isArray(branches) || branches.length === 0 || Object.keys(rule).length !== 1) {
+      yield error;
+      continue;
+    }
+    let instance = payload;
+    if (error.instancePath) {
+      for (const encoded of error.instancePath.slice(1).split("/")) {
+        const key = encoded.replace(/~1/g, "/").replace(/~0/g, "~");
+        if (instance == null || typeof instance !== "object" || !Object.hasOwn(instance, key)) {
+          instance = void 0;
+          break;
+        }
+        instance = instance[key];
+      }
+    }
+    const keys = /* @__PURE__ */ new Set();
+    let opaqueBranch = false;
+    if (instance != null && typeof instance === "object" && !Array.isArray(instance)) {
+      for (const branch of branches) {
+        if (branch == null || typeof branch !== "object" || Object.keys(branch).length !== 1 || !Array.isArray(branch.required) || branch.required.length !== 1 || typeof branch.required[0] !== "string") {
+          opaqueBranch = true;
+          continue;
+        }
+        const key = branch.required[0];
+        if (Object.hasOwn(instance, key) && instance[key] !== void 0) keys.add(key);
+      }
+    }
+    if (keys.size === 0) {
+      yield error;
+      continue;
+    }
+    for (const key of keys) {
+      yield {
+        ...error,
+        instancePath: `${error.instancePath}/${key.replace(/~/g, "~0").replace(/\//g, "~1")}`,
+        message: `${key} cannot be set here`
+      };
+    }
+    if (opaqueBranch) yield error;
+  }
+}
+function formatValidationIssues(errors, ctx, payload) {
+  function* formatted() {
+    for (const error of expandNotErrors(compactUnionErrors(errors, ctx.rootSchema), ctx.rootSchema, payload)) {
+      yield enrichWithVariants(formatIssue(error, ctx), ctx.rootSchema);
+    }
+  }
+  return ctx.toolName === "sync_accounts" ? [...formatted()] : (0, import_diagnostic_limits.boundValidationIssues)(formatted());
+}
 function compactUnionErrors(errors, rootSchema) {
   if (errors.length === 0) return [...errors];
   const errorsByOneOfPath = /* @__PURE__ */ new Map();
@@ -249,10 +303,9 @@ function validateRequest(toolName, payload, version) {
   if (valid) return { valid: true, issues: [], variant: "request", ...rootSchemaId && { schemaId: rootSchemaId } };
   const registeredIds = (0, import_schema_loader.getRegisteredSchemaIds)(version);
   const ctx = { rootSchema, registeredIds, toolName };
-  const compacted = compactUnionErrors(validator.errors ?? [], rootSchema);
   return {
     valid: false,
-    issues: compacted.map((e) => formatIssue(e, ctx)).map((i) => enrichWithVariants(i, rootSchema)),
+    issues: formatValidationIssues(validator.errors ?? [], ctx, payload),
     variant: "request",
     ...rootSchemaId && { schemaId: rootSchemaId }
   };
@@ -314,10 +367,9 @@ function validateResponse(toolName, payload, version) {
   }
   const registeredIds = (0, import_schema_loader.getRegisteredSchemaIds)(version);
   const ctx = { rootSchema, registeredIds, toolName };
-  const compacted = compactUnionErrors(effective.errors ?? [], rootSchema);
   return {
     valid: false,
-    issues: compacted.map((e) => formatIssue(e, ctx)).map((i) => enrichWithVariants(i, rootSchema)),
+    issues: formatValidationIssues(effective.errors ?? [], ctx, normalizedPayload),
     variant: usedVariant,
     ...rootSchemaId && { schemaId: rootSchemaId },
     ...fallbackFields

package/dist/lib/validation/schema-validator.mjs

@@ -2,6 +2,7 @@ import { getValidator, getRegisteredSchemaIds } from "./schema-loader.mjs";
 import { parseAdcpMajorVersion } from "../version.mjs";
 import { findHint } from "./hints.mjs";
 import { injectLegacyEnvelopeStatus } from "../utils/envelope-status-compat.mjs";
+import { boundValidationIssues } from "./diagnostic-limits.mjs";
 const OK = Object.freeze({ valid: true, issues: [], variant: "skipped" });
 function extractSchemaId(schemaPath, rootSchema, registeredIds) {
   if (schemaPath.startsWith("#") || schemaPath === "") {
@@ -53,6 +54,59 @@ function resolveSchemaPath(rootSchema, schemaPath) {
   }
   return cursor;
 }
+function* expandNotErrors(errors, rootSchema, payload) {
+  for (const error of errors) {
+    const rule = error.keyword === "not" ? resolveSchemaPath(rootSchema, error.schemaPath) : void 0;
+    const branches = rule && typeof rule === "object" ? rule.anyOf : void 0;
+    if (!Array.isArray(branches) || branches.length === 0 || Object.keys(rule).length !== 1) {
+      yield error;
+      continue;
+    }
+    let instance = payload;
+    if (error.instancePath) {
+      for (const encoded of error.instancePath.slice(1).split("/")) {
+        const key = encoded.replace(/~1/g, "/").replace(/~0/g, "~");
+        if (instance == null || typeof instance !== "object" || !Object.hasOwn(instance, key)) {
+          instance = void 0;
+          break;
+        }
+        instance = instance[key];
+      }
+    }
+    const keys = /* @__PURE__ */ new Set();
+    let opaqueBranch = false;
+    if (instance != null && typeof instance === "object" && !Array.isArray(instance)) {
+      for (const branch of branches) {
+        if (branch == null || typeof branch !== "object" || Object.keys(branch).length !== 1 || !Array.isArray(branch.required) || branch.required.length !== 1 || typeof branch.required[0] !== "string") {
+          opaqueBranch = true;
+          continue;
+        }
+        const key = branch.required[0];
+        if (Object.hasOwn(instance, key) && instance[key] !== void 0) keys.add(key);
+      }
+    }
+    if (keys.size === 0) {
+      yield error;
+      continue;
+    }
+    for (const key of keys) {
+      yield {
+        ...error,
+        instancePath: `${error.instancePath}/${key.replace(/~/g, "~0").replace(/\//g, "~1")}`,
+        message: `${key} cannot be set here`
+      };
+    }
+    if (opaqueBranch) yield error;
+  }
+}
+function formatValidationIssues(errors, ctx, payload) {
+  function* formatted() {
+    for (const error of expandNotErrors(compactUnionErrors(errors, ctx.rootSchema), ctx.rootSchema, payload)) {
+      yield enrichWithVariants(formatIssue(error, ctx), ctx.rootSchema);
+    }
+  }
+  return ctx.toolName === "sync_accounts" ? [...formatted()] : boundValidationIssues(formatted());
+}
 function compactUnionErrors(errors, rootSchema) {
   if (errors.length === 0) return [...errors];
   const errorsByOneOfPath = /* @__PURE__ */ new Map();
@@ -222,10 +276,9 @@ function validateRequest(toolName, payload, version) {
   if (valid) return { valid: true, issues: [], variant: "request", ...rootSchemaId && { schemaId: rootSchemaId } };
   const registeredIds = getRegisteredSchemaIds(version);
   const ctx = { rootSchema, registeredIds, toolName };
-  const compacted = compactUnionErrors(validator.errors ?? [], rootSchema);
   return {
     valid: false,
-    issues: compacted.map((e) => formatIssue(e, ctx)).map((i) => enrichWithVariants(i, rootSchema)),
+    issues: formatValidationIssues(validator.errors ?? [], ctx, payload),
     variant: "request",
     ...rootSchemaId && { schemaId: rootSchemaId }
   };
@@ -287,10 +340,9 @@ function validateResponse(toolName, payload, version) {
   }
   const registeredIds = getRegisteredSchemaIds(version);
   const ctx = { rootSchema, registeredIds, toolName };
-  const compacted = compactUnionErrors(effective.errors ?? [], rootSchema);
   return {
     valid: false,
-    issues: compacted.map((e) => formatIssue(e, ctx)).map((i) => enrichWithVariants(i, rootSchema)),
+    issues: formatValidationIssues(effective.errors ?? [], ctx, normalizedPayload),
     variant: usedVariant,
     ...rootSchemaId && { schemaId: rootSchemaId },
     ...fallbackFields

package/dist/lib/version.d.mts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "14.2.0";
+export declare const LIBRARY_VERSION = "14.4.0";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "14.2.0";
+    readonly library: "14.4.0";
     readonly adcp: "3.2.1";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2"];
-    readonly generatedAt: "2026-10-05T12:32:54.072Z";
+    readonly generatedAt: "2026-10-06T19:00:01.077Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.d.ts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "14.2.0";
+export declare const LIBRARY_VERSION = "14.4.0";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "14.2.0";
+    readonly library: "14.4.0";
     readonly adcp: "3.2.1";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2"];
-    readonly generatedAt: "2026-10-05T12:32:54.072Z";
+    readonly generatedAt: "2026-10-06T19:00:01.077Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.js

@@ -31,7 +31,7 @@ __export(version_exports, {
   toReleasePrecisionVersion: () => toReleasePrecisionVersion
 });
 module.exports = __toCommonJS(version_exports);
-const LIBRARY_VERSION = "14.2.0";
+const LIBRARY_VERSION = "14.4.0";
 const ADCP_VERSION = "3.2.1";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -95,10 +95,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2"
 ];
 const VERSION_INFO = {
-  library: "14.2.0",
+  library: "14.4.0",
   adcp: "3.2.1",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-05T12:32:54.072Z"
+  generatedAt: "2026-10-06T19:00:01.077Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/dist/lib/version.mjs

@@ -1,4 +1,4 @@
-const LIBRARY_VERSION = "14.2.0";
+const LIBRARY_VERSION = "14.4.0";
 const ADCP_VERSION = "3.2.1";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -62,10 +62,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2"
 ];
 const VERSION_INFO = {
-  library: "14.2.0",
+  library: "14.4.0",
   adcp: "3.2.1",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-05T12:32:54.072Z"
+  generatedAt: "2026-10-06T19:00:01.077Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/docs/TYPE-SUMMARY.md

@@ -1,7 +1,7 @@
 # AdCP Type Summary
 
-> Generated at: 2026-10-05
-> @adcp/sdk v14.2.0
+> Generated at: 2026-10-06
+> @adcp/sdk v14.4.0
 
 Curated reference of the types that matter for using the AdCP client. For full generated types see `src/lib/types/tools.generated.ts` and `src/lib/types/core.generated.ts`.
 

package/docs/llms.txt

@@ -1,7 +1,7 @@
 # Ad Context Protocol (AdCP)
 
-> Generated at: 2026-10-05
-> Library: @adcp/sdk v14.2.0
+> Generated at: 2026-10-06
+> Library: @adcp/sdk v14.4.0
 > AdCP major version: 3
 > Canonical URL: https://adcontextprotocol.github.io/adcp-client/llms.txt
 > Note: the `Library` stamp reflects the package.json version at doc-generation time. The narrative below describes the surface that lands on the next-published minor — including any 6.7 helpers documented here ahead of the release tag.

package/docs/migration-14.x-rc-worksheet.md

@@ -11,8 +11,8 @@ below as the publication/deployment gate.
 
 | Fact | Value |
 | --- | --- |
-| Exact npm package | `@adcp/sdk@14.2.0` |
-| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@14.2.0 dist.integrity` |
+| Exact npm package | `@adcp/sdk@14.4.0` |
+| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@14.4.0 dist.integrity` |
 | Node.js runtime | `^20.19.0 || >=22.12.0` |
 | Default AdCP wire release | `3.2.1` |
 | Maintained wire releases | `v2.5`, `v2.6`, `v3`, `3.0.0`, `3.0`, `3.0.1`, `3.0.2`, `3.0.3`, `3.0.4`, `3.0.5`, `3.0.6`, `3.0.7`, `3.0.8`, `3.0.9`, `3.0.10`, `3.0.11`, `3.0.12`, `3.0.13`, `3.0.14`, `3.0.15`, `3.0.16`, `3.0.17`, `3.0.18`, `3.0.19`, `3.0.20`, `3.0.21`, `3.0.22`, `3.0.23`, `3.0.24`, `3.0.25`, `3.1.0`, `3.1`, `3.1.1`, `3.1.2`, `3.1.3`, `3.1.4`, `3.1.5`, `3.1.6`, `3.1.7`, `3.1.8`, `3.1.9`, `3.1.10`, `3.1.11`, `3.1.12`, `3.1.13`, `3.1.14`, `3.1.15`, `3.1.16`, `3.1.17`, `3.1.18`, `3.1.19`, `3.1.20`, `3.1.21`, `3.1.22`, `3.1.23`, `3.1.24`, `3.2.1`, `3.2` |
@@ -21,8 +21,8 @@ below as the publication/deployment gate.
 Install exact production inputs rather than a moving range or dist-tag:
 
 ```bash
-npm install --save-exact '@adcp/sdk@14.2.0'
-npm view '@adcp/sdk@14.2.0' dist.integrity
+npm install --save-exact '@adcp/sdk@14.4.0'
+npm view '@adcp/sdk@14.4.0' dist.integrity
 ```
 
 ### Required and optional peers
@@ -32,7 +32,7 @@ Install the peer packages used by your application at versions satisfying these
 | Peer | Supported range | Installation |
 | --- | --- | --- |
 | `@a2a-js/sdk` | `^1.0.1` | Required |
-| `@modelcontextprotocol/sdk` | `^1.24.0` | Required |
+| `@modelcontextprotocol/sdk` | `^1.31.0` | Required |
 | `@opentelemetry/api` | `^1.0.0` | Optional |
 | `redis` | `^4.6.0 || ^5.0.0 || ^6.0.0` | Optional |
 | `zod` | `^4.1.5` | Required |

package/docs/migration-oauth-issuer-bindings.md

@@ -0,0 +1,82 @@
+# OAuth issuer bindings
+
+The corrective release after SDK 14.3.0 upgrades the official MCP client and
+server to 2.2.0 and requires the legacy `@modelcontextprotocol/sdk` peer at
+`^1.31.0`. These versions address
+[GHSA-6qxp-vccf-f47h](https://github.com/advisories/GHSA-6qxp-vccf-f47h).
+Installations pinned to legacy SDK 1.24–1.30 must upgrade that peer dependency.
+The legacy OAuth transport rejects vulnerable versions even if package-manager
+peer checks were bypassed. The Node.js requirement remains `^20.19.0 || >=22.12.0`.
+
+OAuth refresh tokens and client secrets belong to an authorization server.
+`AgentOAuthTokens` and `AgentOAuthClient` now preserve an optional `issuer`
+field through the SDK's conversions, providers, and file storage. Newly saved
+credentials receive their binding from the authorization flow. The provider
+persists discovery alongside the pending PKCE verifier and clears that temporary
+state after exchange; a callback uses the original authorization server even if
+resource discovery changes while the browser is away. Custom `OAuthConfigStorage`
+implementations must preserve `oauth_discovery_state` alongside `oauth_code_verifier`. Web flows
+validate the discovered server's metadata issuer before registration and
+token exchange; diagnostic refreshes validate it before sending credentials.
+The provider refuses a changed authorization server before replacing a trusted
+confidential registration or reusing a refresh token. Clear credentials explicitly
+if an independently verified server migration requires a fresh registration.
+
+File storage saves the OAuth fields as an authoritative snapshot: omitted tokens,
+client, verifier, or discovery state are deleted. Load the complete agent from
+storage before creating a provider; keep unrelated persisted fields as before.
+
+## Existing saved credentials
+
+`MCPOAuthProvider` refuses to reuse a saved refresh token or client secret
+without a valid issuer, with `oauth_issuer_required`. The web flow and
+diagnostic runner also refuse mismatched bindings. Access-token-only and
+public-client configurations do not require a new field. A saved unbound refresh
+token blocks every call through the provider, even while its access token is
+still valid; clear the saved credentials before reconnecting.
+
+For a saved CLI alias, run `adcp <alias> --clear-oauth`, then
+`adcp <alias> --oauth` to sign in again.
+
+For legacy saved credentials, clear `oauth_tokens` and any confidential
+`oauth_client` registration, then sign in again. Alternatively, an operator
+may add the authorization-server issuer established independently from
+trusted registration records. **Do not infer it from the current MCP server's
+discovery metadata**, an access token's unverified claims, or its resource URL.
+If the issuer is unknown, sign in again. Raw `issuer: null` is treated as absent for access-token-only and public-client
+configurations; secrets still require a valid string issuer.
+
+```ts
+agent.oauth_tokens = {
+  ...agent.oauth_tokens!,
+  issuer: 'https://auth.example.com', // independently verified token issuer
+};
+agent.oauth_client = {
+  ...agent.oauth_client!,
+  issuer: 'https://auth.example.com', // where this client was registered
+};
+```
+
+An issuer is an authorization-server URL, including its tenant path when one
+exists. A single trailing slash difference is tolerated for credential
+comparison; distinct tenant paths remain distinct. Stored pending web flows
+containing an unbound confidential client must be restarted.
+
+## Custom providers
+
+Preserve the complete `issuer` field passed to `saveTokens()` and
+`saveClientInformation()`, and return it from the corresponding getters. Add
+an independently verified issuer to pre-registered client information. The
+upstream bundled `ClientCredentialsProvider`, `PrivateKeyJwtProvider`,
+`StaticPrivateKeyJwtProvider`, and `CrossAppAccessProvider` also need
+`expectedIssuer` configured. These are adopter-owned provider settings; a
+dependency upgrade cannot reconstruct the ownership of older credentials.
+
+Calls made directly to the upstream `exchangeAuthorization()` and
+`refreshAuthorization()` helpers need their own credential-issuer checks.
+The SDK's web-flow and diagnosis helpers perform those checks. The SDK's
+client-credentials flow uses an explicitly configured token endpoint rather
+than selecting one from MCP server discovery.
+
+If affected credentials were sent to an untrusted authorization server,
+follow the upstream advisory's credential-rotation guidance.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/sdk",
-  "version": "14.2.0",
+  "version": "14.4.0",
   "description": "AdCP SDK — client, server, and compliance harnesses for the AdContext Protocol (MCP + A2A)",
   "workspaces": [
     ".",
@@ -713,10 +713,10 @@
     "email": "bugs@adcontextprotocol.org"
   },
   "dependencies": {
-    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/client": "2.2.0",
     "@modelcontextprotocol/ext-apps": "2.0.0",
     "@modelcontextprotocol/node": "2.0.0",
-    "@modelcontextprotocol/server": "2.0.0",
+    "@modelcontextprotocol/server": "2.2.0",
     "@types/ws": "^8.18.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
@@ -733,7 +733,7 @@
   },
   "peerDependencies": {
     "@a2a-js/sdk": "^1.0.1",
-    "@modelcontextprotocol/sdk": "^1.24.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "@opentelemetry/api": "^1.0.0",
     "redis": "^4.6.0 || ^5.0.0 || ^6.0.0",
     "zod": "^4.1.5"
@@ -753,7 +753,7 @@
     "@changesets/cli": "^3.0.3",
     "@commitlint/cli": "^20.5.3",
     "@commitlint/config-conventional": "^20.5.3",
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.31.0",
     "@opentelemetry/api": "^1.9.1",
     "@types/express": "4.17.25",
     "@types/node": "^20.19.43",
@@ -790,7 +790,7 @@
     "js-yaml": "^4.1.1",
     "@apidevtools/json-schema-ref-parser@^15.0.0": {
       ".": "$@apidevtools/json-schema-ref-parser",
-      "js-yaml": "^5.2.2"
+      "js-yaml": "^5.4.3"
     },
     "@changesets/parse": {
       "js-yaml": "^3.15.2"

package/skills/call-adcp-agent/SKILL.md

@@ -112,7 +112,7 @@ Every validation failure produces:
   "adcp_error": {
     "code": "VALIDATION_ERROR",
     "recovery": "correctable",
-    "field": "/first/offending/pointer",
+    "field": "account",
     "issues": [
       {
         "pointer": "/account",
@@ -130,7 +130,10 @@ Every validation failure produces:
 ```
 
 - `issues[].pointer` — RFC 6901 JSON Pointer to the field.
+- `field` — the first issue's pointer translated to JSONPath-lite (for example, `packages[0].targeting`). Parse `issues[].pointer` when you need JSON Pointer notation.
 - `issues[].keyword` — AJV keyword (`required`, `type`, `oneOf`, `anyOf`, `additionalProperties`, `format`, `enum`).
+- `not` presence guards name individually forbidden fields (for example, `product_id cannot be set here`). Compound guards retain their original diagnostic.
+- `adcp_error.details.issues_truncated` — when true, the diagnostic list reached its count or byte limit. Fix the displayed failures and retry to see any remaining failures.
 - `issues[].variants` — when the keyword is `oneOf` or `anyOf`, each entry lists one variant's `required` + declared `properties`. **Pick ONE variant**, send only its `required` fields. This is the fastest recovery path when you didn't know the field was a union.
 - `issues[].discriminator` — when an SDK ≥6.7 picks a "best surviving variant" of a const-discriminated union, this is the `[{field, value}, …]` pairs that variant requires. Reads as the validator's verdict on which branch you were inferred to be targeting. Example: `discriminator: [{field: 'type', value: 'key_value'}]` plus `pointer: '/deployments/0/activation_key/key'` and `keyword: 'required'` means "you picked the `key_value` activation_key variant and it requires top-level `key` and `value`." Compound discriminators like `audience-selector`'s `(type, value_type)` produce two-entry arrays.
 - `issues[].schemaId` — `$id` of the rejecting schema. For tools served from the bundled tree this is usually the response root; for flat-tree tools it can land on the deeper sub-schema. Diagnostic only; the actionable lever is `discriminator` + `variants` + `pointer`.