@adcp/sdk 15.5.0 → 15.7.0

package/README.md

@@ -57,8 +57,23 @@ Large workspaces should keep the generated schema surface out of the default typ
 | Client, server, signing, and response helpers | `@adcp/sdk`, `@adcp/sdk/client`, `@adcp/sdk/server`, or another focused runtime subpath |
 | One tool's request/response types             | `@adcp/sdk/types/<tool>` such as `@adcp/sdk/types/sync-accounts`                        |
 | Runtime Zod schemas and tool schema maps      | `@adcp/sdk/schemas`                                                                     |
+| Runtime Zod schemas in browser UIs            | `@adcp/sdk/schemas/browser`                                                             |
 | Broad generated protocol type barrel          | `@adcp/sdk/types`                                                                       |
 
+Browser widgets and dashboards can validate AdCP objects with the generated Zod schemas:
+
+```ts
+import {
+  EventSourceHealthSchema,
+  SyncAudiencesResponseSchema,
+  SyncEventSourcesResponseSchema,
+} from '@adcp/sdk/schemas/browser';
+
+const health = EventSourceHealthSchema.parse(rawHealth);
+```
+
+The browser entry also exports `GetProductsRequestSchema` and `LegacyGetProductsRequestSchema`, `BiddingPolicySchema`, `CanonicalBudgetAllocationSchema`, and the strict `SyncCreatives*` validators, with the same validation behavior as the Node entry. It has no Node built-ins in its import graph. JSON Schema loading and tool registration helpers remain available from `@adcp/sdk/schemas`. The generated schemas still initialize together, so importing one schema can retain the full generated module in a browser bundle; per-schema tree-shaking is tracked in [#3178](https://github.com/adcontextprotocol/adcp-client/issues/3178).
+
 ### Focused client runtime (`@adcp/sdk/client/core`)
 
 Applications that only call AdCP agents can avoid evaluating the SDK's server,

package/dist/lib/auth/oauth/index.d.mts

@@ -37,6 +37,7 @@ export { DEFAULT_CLIENT_METADATA, OAuthError, OAuthCancelledError, OAuthTimeoutE
 export { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler.mjs';
 export { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler.mjs';
 export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, AgentChangedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow.mjs';
+export { serializePendingWebFlow, parsePendingWebFlow } from './pending-web-flow.mjs';
 export { MCPOAuthProvider } from './MCPOAuthProvider.mjs';
 import { MCPOAuthProvider } from './MCPOAuthProvider.mjs';
 import type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types.mjs';

package/dist/lib/auth/oauth/index.d.ts

@@ -37,6 +37,7 @@ export { DEFAULT_CLIENT_METADATA, OAuthError, OAuthCancelledError, OAuthTimeoutE
 export { CLIFlowHandler, type CLIFlowHandlerConfig } from './CLIFlowHandler';
 export { NonInteractiveFlowHandler, type NonInteractiveFlowHandlerConfig } from './NonInteractiveFlowHandler';
 export { startWebOAuthFlow, completeWebOAuthFlow, safeReturnTo, InMemoryPendingFlowStore, InvalidOrExpiredFlowError, StateMismatchError, BrowserBindingRequiredError, TokenExchangeError, ProtectedResourceMetadataError, AgentVanishedDuringFlowError, AgentChangedDuringFlowError, ConfidentialClientNotAllowedError, DEFAULT_WEB_FLOW_TTL_MS, type PendingWebFlow, type PendingWebFlowStore, type PendingFlowStore, type StartWebFlowOptions, type StartWebFlowResult, type CompleteWebFlowOptions, type CompleteWebFlowResult, } from './web-flow';
+export { serializePendingWebFlow, parsePendingWebFlow } from './pending-web-flow';
 export { MCPOAuthProvider } from './MCPOAuthProvider';
 import { MCPOAuthProvider } from './MCPOAuthProvider';
 import type { OAuthClientMetadata, OAuthConfigStorage, AgentConfig } from './types';

package/dist/lib/auth/oauth/index.js

@@ -62,11 +62,13 @@ __export(oauth_exports, {
   hasValidatedMcpAuthorizationRequirements: () => import_authorization_required.hasValidatedMcpAuthorizationRequirements,
   isEnvSecretReference: () => import_secret_resolver.isEnvSecretReference,
   isOAuthRequired: () => isOAuthRequired,
+  parsePendingWebFlow: () => import_pending_web_flow.parsePendingWebFlow,
   parseWWWAuthenticate: () => import_diagnostics.parseWWWAuthenticate,
   probeAuthChallenge: () => import_authorization_required.probeAuthChallenge,
   resolveSecret: () => import_secret_resolver.resolveSecret,
   runAuthDiagnosis: () => import_diagnose.runAuthDiagnosis,
   safeReturnTo: () => import_web_flow.safeReturnTo,
+  serializePendingWebFlow: () => import_pending_web_flow.serializePendingWebFlow,
   startWebOAuthFlow: () => import_web_flow.startWebOAuthFlow,
   supportsDynamicRegistration: () => import_discovery.supportsDynamicRegistration,
   supportsOAuth: () => import_discovery.supportsOAuth,
@@ -81,6 +83,7 @@ var import_types = require('./types.js');
 var import_CLIFlowHandler = require('./CLIFlowHandler.js');
 var import_NonInteractiveFlowHandler = require('./NonInteractiveFlowHandler.js');
 var import_web_flow = require('./web-flow.js');
+var import_pending_web_flow = require('./pending-web-flow.js');
 var import_MCPOAuthProvider = require('./MCPOAuthProvider.js');
 var import_MCPOAuthProvider2 = require('./MCPOAuthProvider.js');
 var import_CLIFlowHandler2 = require('./CLIFlowHandler.js');
@@ -214,11 +217,13 @@ function getEffectiveAuthToken(agent) {
   hasValidatedMcpAuthorizationRequirements,
   isEnvSecretReference,
   isOAuthRequired,
+  parsePendingWebFlow,
   parseWWWAuthenticate,
   probeAuthChallenge,
   resolveSecret,
   runAuthDiagnosis,
   safeReturnTo,
+  serializePendingWebFlow,
   startWebOAuthFlow,
   supportsDynamicRegistration,
   supportsOAuth,

package/dist/lib/auth/oauth/index.mjs

@@ -25,6 +25,7 @@ import {
   ConfidentialClientNotAllowedError,
   DEFAULT_WEB_FLOW_TTL_MS
 } from "./web-flow.mjs";
+import { serializePendingWebFlow, parsePendingWebFlow } from "./pending-web-flow.mjs";
 import { MCPOAuthProvider } from "./MCPOAuthProvider.mjs";
 import { MCPOAuthProvider as MCPOAuthProvider2 } from "./MCPOAuthProvider.mjs";
 import { CLIFlowHandler as CLIFlowHandler2 } from "./CLIFlowHandler.mjs";
@@ -183,11 +184,13 @@ export {
   hasValidatedMcpAuthorizationRequirements,
   isEnvSecretReference,
   isOAuthRequired,
+  parsePendingWebFlow,
   parseWWWAuthenticate,
   probeAuthChallenge,
   resolveSecret,
   runAuthDiagnosis,
   safeReturnTo,
+  serializePendingWebFlow,
   startWebOAuthFlow,
   supportsDynamicRegistration,
   supportsOAuth,

package/dist/lib/auth/oauth/pending-web-flow.d.mts

@@ -0,0 +1,16 @@
+import type { PendingWebFlow } from './web-flow.mjs';
+/**
+ * Serialize a pending flow for a durable store, preserving unknown fields.
+ * Throws for malformed SDK fields or JSON.stringify failures. The payload
+ * contains PKCE/client secrets; the store owns encryption, TTL and atomic consume.
+ */
+export declare function serializePendingWebFlow(flow: PendingWebFlow): string;
+/**
+ * Validate a JSON string or decoded JSON value (e.g. PostgreSQL jsonb), and revive
+ * createdAt/expiresAt as Dates. Unknown fields (including client metadata)
+ * pass through unchanged. Malformed input
+ * returns null. Expiry and issuer trust are enforced by the store/callback,
+ * not by this parser; legacy rows without a frozen issuer remain parseable.
+ * The store must also bind the parsed state to the key it consumed.
+ */
+export declare function parsePendingWebFlow(json: unknown): PendingWebFlow | null;

package/dist/lib/auth/oauth/pending-web-flow.d.ts

@@ -0,0 +1,16 @@
+import type { PendingWebFlow } from './web-flow';
+/**
+ * Serialize a pending flow for a durable store, preserving unknown fields.
+ * Throws for malformed SDK fields or JSON.stringify failures. The payload
+ * contains PKCE/client secrets; the store owns encryption, TTL and atomic consume.
+ */
+export declare function serializePendingWebFlow(flow: PendingWebFlow): string;
+/**
+ * Validate a JSON string or decoded JSON value (e.g. PostgreSQL jsonb), and revive
+ * createdAt/expiresAt as Dates. Unknown fields (including client metadata)
+ * pass through unchanged. Malformed input
+ * returns null. Expiry and issuer trust are enforced by the store/callback,
+ * not by this parser; legacy rows without a frozen issuer remain parseable.
+ * The store must also bind the parsed state to the key it consumed.
+ */
+export declare function parsePendingWebFlow(json: unknown): PendingWebFlow | null;

package/dist/lib/auth/oauth/pending-web-flow.js

@@ -0,0 +1,66 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var pending_web_flow_exports = {};
+__export(pending_web_flow_exports, {
+  parsePendingWebFlow: () => parsePendingWebFlow,
+  serializePendingWebFlow: () => serializePendingWebFlow
+});
+module.exports = __toCommonJS(pending_web_flow_exports);
+var import_auth = require("@modelcontextprotocol/sdk/shared/auth.js");
+var import_zod = require("zod");
+const persistedDate = import_zod.z.iso.datetime({ offset: true }).transform((value) => new Date(value)).pipe(import_zod.z.date());
+const pendingWebFlowShape = {
+  state: import_zod.z.string(),
+  agentId: import_zod.z.string(),
+  agentUrl: import_zod.z.string(),
+  codeVerifier: import_zod.z.string(),
+  redirectUri: import_zod.z.string(),
+  resource: import_zod.z.string().optional(),
+  resourceOverride: import_zod.z.string().optional(),
+  resourceOverrideAction: import_zod.z.enum(["set", "clear"]).optional(),
+  resourceOverrideSnapshot: import_zod.z.string().nullable().optional(),
+  scope: import_zod.z.string().optional(),
+  authorizationServerUrl: import_zod.z.string(),
+  authorizationServerIssuer: import_zod.z.string().optional(),
+  // The MCP schema strips extensions and catches invalid issuer values. Stored
+  // credentials must retain extensions and reject a malformed issuer instead.
+  clientInformation: import_auth.OAuthClientInformationSchema.extend({ issuer: import_zod.z.string().optional() }).loose(),
+  createdAt: persistedDate,
+  expiresAt: persistedDate,
+  carry: import_zod.z.record(import_zod.z.string(), import_zod.z.unknown()).optional()
+};
+const persistedPendingWebFlowSchema = import_zod.z.looseObject(pendingWebFlowShape);
+function serializePendingWebFlow(flow) {
+  const json = JSON.stringify(flow);
+  if (!parsePendingWebFlow(json)) throw new TypeError("Invalid PendingWebFlow payload");
+  return json;
+}
+function parsePendingWebFlow(json) {
+  try {
+    const parsed = persistedPendingWebFlowSchema.safeParse(typeof json === "string" ? JSON.parse(json) : json);
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parsePendingWebFlow,
+  serializePendingWebFlow
+});

package/dist/lib/auth/oauth/pending-web-flow.mjs

@@ -0,0 +1,41 @@
+import { OAuthClientInformationSchema } from "@modelcontextprotocol/sdk/shared/auth.js";
+import { z } from "zod";
+const persistedDate = z.iso.datetime({ offset: true }).transform((value) => new Date(value)).pipe(z.date());
+const pendingWebFlowShape = {
+  state: z.string(),
+  agentId: z.string(),
+  agentUrl: z.string(),
+  codeVerifier: z.string(),
+  redirectUri: z.string(),
+  resource: z.string().optional(),
+  resourceOverride: z.string().optional(),
+  resourceOverrideAction: z.enum(["set", "clear"]).optional(),
+  resourceOverrideSnapshot: z.string().nullable().optional(),
+  scope: z.string().optional(),
+  authorizationServerUrl: z.string(),
+  authorizationServerIssuer: z.string().optional(),
+  // The MCP schema strips extensions and catches invalid issuer values. Stored
+  // credentials must retain extensions and reject a malformed issuer instead.
+  clientInformation: OAuthClientInformationSchema.extend({ issuer: z.string().optional() }).loose(),
+  createdAt: persistedDate,
+  expiresAt: persistedDate,
+  carry: z.record(z.string(), z.unknown()).optional()
+};
+const persistedPendingWebFlowSchema = z.looseObject(pendingWebFlowShape);
+function serializePendingWebFlow(flow) {
+  const json = JSON.stringify(flow);
+  if (!parsePendingWebFlow(json)) throw new TypeError("Invalid PendingWebFlow payload");
+  return json;
+}
+function parsePendingWebFlow(json) {
+  try {
+    const parsed = persistedPendingWebFlowSchema.safeParse(typeof json === "string" ? JSON.parse(json) : json);
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+export {
+  parsePendingWebFlow,
+  serializePendingWebFlow
+};

package/dist/lib/auth/oauth/web-flow.js

@@ -223,7 +223,7 @@ async function completeWebOAuthFlow(opts) {
     throw new StateMismatchError();
   }
   const flow = await pendingFlowStore.consume(state);
-  if (!flow || flow.expiresAt.getTime() < Date.now()) {
+  if (!flow || flow.expiresAt.getTime() <= Date.now()) {
     throw new InvalidOrExpiredFlowError(state);
   }
   const guardedFetch = createSsrfSafeOAuthFetch(fetchFn, allowHttp);
@@ -345,14 +345,14 @@ class InMemoryPendingFlowStore {
     const flow = this.flows.get(state);
     if (!flow) return null;
     this.flows.delete(state);
-    if (flow.expiresAt.getTime() < Date.now()) return null;
+    if (flow.expiresAt.getTime() <= Date.now()) return null;
     return flow;
   }
   async cleanupExpired() {
     const now = Date.now();
     let removed = 0;
     for (const [state, flow] of this.flows) {
-      if (flow.expiresAt.getTime() < now) {
+      if (flow.expiresAt.getTime() <= now) {
         this.flows.delete(state);
         removed++;
       }

package/dist/lib/auth/oauth/web-flow.mjs

@@ -202,7 +202,7 @@ async function completeWebOAuthFlow(opts) {
     throw new StateMismatchError();
   }
   const flow = await pendingFlowStore.consume(state);
-  if (!flow || flow.expiresAt.getTime() < Date.now()) {
+  if (!flow || flow.expiresAt.getTime() <= Date.now()) {
     throw new InvalidOrExpiredFlowError(state);
   }
   const guardedFetch = createSsrfSafeOAuthFetch(fetchFn, allowHttp);
@@ -324,14 +324,14 @@ class InMemoryPendingFlowStore {
     const flow = this.flows.get(state);
     if (!flow) return null;
     this.flows.delete(state);
-    if (flow.expiresAt.getTime() < Date.now()) return null;
+    if (flow.expiresAt.getTime() <= Date.now()) return null;
     return flow;
   }
   async cleanupExpired() {
     const now = Date.now();
     let removed = 0;
     for (const [state, flow] of this.flows) {
-      if (flow.expiresAt.getTime() < now) {
+      if (flow.expiresAt.getTime() <= now) {
         this.flows.delete(state);
         removed++;
       }

package/dist/lib/registry/types.generated.d.mts

@@ -1825,7 +1825,11 @@ export interface paths {
          */
         put: operations["connectAgent"];
         post?: never;
-        delete?: never;
+        /**
+         * Clear saved bearer or basic credentials
+         * @description Clear the selected organization's static credential while retaining OAuth configuration and compliance history. Requires authentication and ownership.
+         */
+        delete: operations["removeAgentAuthToken"];
         options?: never;
         head?: never;
         patch?: never;
@@ -10662,6 +10666,64 @@ export interface operations {
             };
         };
     };
+    removeAgentAuthToken: {
+        parameters: {
+            query?: {
+                org?: string;
+            };
+            header?: never;
+            path: {
+                encodedUrl: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Static credential cleared */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Invalid parameters */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not authorized */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     saveAgentOAuthClientCredentials: {
         parameters: {
             query?: never;

package/dist/lib/registry/types.generated.d.ts

@@ -1825,7 +1825,11 @@ export interface paths {
          */
         put: operations["connectAgent"];
         post?: never;
-        delete?: never;
+        /**
+         * Clear saved bearer or basic credentials
+         * @description Clear the selected organization's static credential while retaining OAuth configuration and compliance history. Requires authentication and ownership.
+         */
+        delete: operations["removeAgentAuthToken"];
         options?: never;
         head?: never;
         patch?: never;
@@ -10662,6 +10666,64 @@ export interface operations {
             };
         };
     };
+    removeAgentAuthToken: {
+        parameters: {
+            query?: {
+                org?: string;
+            };
+            header?: never;
+            path: {
+                encodedUrl: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Static credential cleared */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Invalid parameters */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Authentication required */
+            401: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Not authorized */
+            403: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+            /** @description Server error */
+            500: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Error"];
+                };
+            };
+        };
+    };
     saveAgentOAuthClientCredentials: {
         parameters: {
             query?: never;

package/dist/lib/reporting/azure/index.d.mts

@@ -0,0 +1,26 @@
+import type { BlobServiceClient } from '@azure/storage-blob';
+import type { ReportingRowObjectProviderV1 } from '../ledger/row-storage-object.mjs';
+export interface CreateAzureBlobReportingRowObjectProviderOptionsV1 {
+    /** Official client used by bindings without a `credentialRef`. */
+    client?: BlobServiceClient;
+    /**
+     * Official clients keyed by `credentialRef`. This map is the closed set of
+     * references a binding may name; an unknown reference fails `UNSAFE_BINDING`.
+     * Endpoint and credentials come only from these clients.
+     */
+    clients?: Readonly<Record<string, BlobServiceClient>>;
+}
+/**
+ * Azure Blob Storage row-object provider (`@adcp/sdk/reporting/azure`).
+ *
+ * Inject official `BlobServiceClient`s with host-owned credentials (managed
+ * identity, workload identity). Bindings use `location: { account, container }`;
+ * the selected client must belong to `account`. Writes are block-blob uploads
+ * with `If-None-Match: *`. Blob versioning must be enabled on the storage account:
+ * the recorded native version is the write-unique `versionId` and pins every read
+ * and delete, so a delayed delete can never remove a later write that re-created
+ * identical bytes at the same key (ETags are content-derived and cannot fence that).
+ * The probe refuses accounts without versioning and proves create-only behaviour
+ * empirically.
+ */
+export declare function createAzureBlobReportingRowObjectProviderV1(options: CreateAzureBlobReportingRowObjectProviderOptionsV1): ReportingRowObjectProviderV1;

package/dist/lib/reporting/azure/index.d.ts

@@ -0,0 +1,26 @@
+import type { BlobServiceClient } from '@azure/storage-blob';
+import type { ReportingRowObjectProviderV1 } from '../ledger/row-storage-object';
+export interface CreateAzureBlobReportingRowObjectProviderOptionsV1 {
+    /** Official client used by bindings without a `credentialRef`. */
+    client?: BlobServiceClient;
+    /**
+     * Official clients keyed by `credentialRef`. This map is the closed set of
+     * references a binding may name; an unknown reference fails `UNSAFE_BINDING`.
+     * Endpoint and credentials come only from these clients.
+     */
+    clients?: Readonly<Record<string, BlobServiceClient>>;
+}
+/**
+ * Azure Blob Storage row-object provider (`@adcp/sdk/reporting/azure`).
+ *
+ * Inject official `BlobServiceClient`s with host-owned credentials (managed
+ * identity, workload identity). Bindings use `location: { account, container }`;
+ * the selected client must belong to `account`. Writes are block-blob uploads
+ * with `If-None-Match: *`. Blob versioning must be enabled on the storage account:
+ * the recorded native version is the write-unique `versionId` and pins every read
+ * and delete, so a delayed delete can never remove a later write that re-created
+ * identical bytes at the same key (ETags are content-derived and cannot fence that).
+ * The probe refuses accounts without versioning and proves create-only behaviour
+ * empirically.
+ */
+export declare function createAzureBlobReportingRowObjectProviderV1(options: CreateAzureBlobReportingRowObjectProviderOptionsV1): ReportingRowObjectProviderV1;