@adcp/sdk 15.9.1 → 15.9.3

package/dist/lib/core/TaskExecutor.js

@@ -47,6 +47,7 @@ var import_signedRequestRejection = require('../protocols/signedRequestRejection
 var import_errors = require('../errors/index.js');
 var import_client_hooks = require('../validation/client-hooks.js');
 var import_schema_validator = require('../validation/schema-validator.js');
+var import_schema_loader = require('../validation/schema-loader.js');
 var import_version = require('../version.js');
 var import_response_unwrapper = require('../utils/response-unwrapper.js');
 var import_error_extraction = require('../utils/error-extraction.js');
@@ -4397,7 +4398,10 @@ class TaskExecutor {
     const mode = this.responseValidationMode;
     const logViolations = this.config.logSchemaViolations !== false;
     try {
-      const validationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
+      let validationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
+      if (taskName === "get_adcp_capabilities" && validationVersion !== "v2.5") {
+        validationVersion = (0, import_schema_loader.resolveServedValidationVersion)(response, validationVersion);
+      }
       const normalizedResponse = this.normalizeResponseForValidation(response, taskName, validationVersion === "v2.5");
       const outcome = (0, import_client_hooks.validateIncomingResponse)(taskName, normalizedResponse, mode, void 0, validationVersion);
       if (outcome.valid) return { valid: true, errors: [] };

package/dist/lib/core/TaskExecutor.mjs

@@ -15,6 +15,7 @@ import {
   resolveValidationModes
 } from "../validation/client-hooks.mjs";
 import { formatIssues } from "../validation/schema-validator.mjs";
+import { resolveServedValidationVersion } from "../validation/schema-loader.mjs";
 import { ADCP_VERSION } from "../version.mjs";
 import { unwrapProtocolResponse, isAdcpOperationSuccess } from "../utils/response-unwrapper.mjs";
 import { extractAdcpErrorInfo, extractCorrelationId } from "../utils/error-extraction.mjs";
@@ -4370,7 +4371,10 @@ class TaskExecutor {
     const mode = this.responseValidationMode;
     const logViolations = this.config.logSchemaViolations !== false;
     try {
-      const validationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? ADCP_VERSION;
+      let validationVersion = (serverVersion ?? this.lastKnownServerVersion) === "v2" ? "v2.5" : this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? ADCP_VERSION;
+      if (taskName === "get_adcp_capabilities" && validationVersion !== "v2.5") {
+        validationVersion = resolveServedValidationVersion(response, validationVersion);
+      }
       const normalizedResponse = this.normalizeResponseForValidation(response, taskName, validationVersion === "v2.5");
       const outcome = validateIncomingResponse(taskName, normalizedResponse, mode, void 0, validationVersion);
       if (outcome.valid) return { valid: true, errors: [] };

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-10-14T11:39:27.882Z"
+  "synced_at": "2026-10-16T14:52:19.557Z"
 }

package/dist/lib/testing/client.js

@@ -50,6 +50,7 @@ var import_ssrf_fetch = require('../net/ssrf-fetch.js');
 var import_version = require('../version.js');
 var import_node_crypto = require("node:crypto");
 var import_client_hooks = require('../validation/client-hooks.js');
+var import_schema_loader = require('../validation/schema-loader.js');
 var import_error_extraction = require('../utils/error-extraction.js');
 var import_client = require('../signing/client.js');
 var import_storage_registry = require('../auth/oauth/storage-registry.js');
@@ -418,7 +419,7 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
           caps.data,
           "strict",
           void 0,
-          schemaAdcpVersion ?? client.getAdcpVersion()
+          (0, import_schema_loader.resolveServedValidationVersion)(caps.data, schemaAdcpVersion ?? client.getAdcpVersion())
         );
         if (!validation.valid) {
           profile.capabilities_schema_issues = validation.issues.map((issue) => ({

package/dist/lib/testing/client.mjs

@@ -10,6 +10,7 @@ import { SsrfRefusedError } from "../net/ssrf-fetch.mjs";
 import { ADCP_VERSION, toReleasePrecisionVersion } from "../version.mjs";
 import { createHmac, hkdfSync, randomBytes } from "node:crypto";
 import { validateIncomingResponse } from "../validation/client-hooks.mjs";
+import { resolveServedValidationVersion } from "../validation/schema-loader.mjs";
 import { extractVersionUnsupportedDetails } from "../utils/error-extraction.mjs";
 import { buildAgentSigningContext } from "../signing/client.mjs";
 import { bindAgentStorage } from "../auth/oauth/storage-registry.mjs";
@@ -378,7 +379,7 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
           caps.data,
           "strict",
           void 0,
-          schemaAdcpVersion ?? client.getAdcpVersion()
+          resolveServedValidationVersion(caps.data, schemaAdcpVersion ?? client.getAdcpVersion())
         );
         if (!validation.valid) {
           profile.capabilities_schema_issues = validation.issues.map((issue) => ({

package/dist/lib/testing/scenarios/capabilities.js

@@ -239,7 +239,7 @@ function crossValidateProtocolsAndTools(capabilities, tools) {
     creative: import_capabilities.CREATIVE_TOOLS,
     sponsored_intelligence: import_capabilities.SPONSORED_INTELLIGENCE_TOOLS,
     trusted_match: import_capabilities.TRUSTED_MATCH_TOOLS,
-    compliance: import_capabilities.COMPLIANCE_TOOLS
+    compliance_testing: import_capabilities.COMPLIANCE_TOOLS
   };
   const perProtocolDiffs = {};
   for (const protocol of capabilities.protocols) {

package/dist/lib/testing/scenarios/capabilities.mjs

@@ -225,7 +225,7 @@ function crossValidateProtocolsAndTools(capabilities, tools) {
     creative: CREATIVE_TOOLS,
     sponsored_intelligence: SPONSORED_INTELLIGENCE_TOOLS,
     trusted_match: TRUSTED_MATCH_TOOLS,
-    compliance: COMPLIANCE_TOOLS
+    compliance_testing: COMPLIANCE_TOOLS
   };
   const perProtocolDiffs = {};
   for (const protocol of capabilities.protocols) {

package/dist/lib/testing/storyboard/junit.js

@@ -82,8 +82,9 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     const suiteGroup = options.suite_groups?.[sb.storyboard_id];
     const suiteClassname = suiteGroup ? `${suiteGroup}.${sb.storyboard_id}` : sb.storyboard_id;
     const suiteCases = [];
-    let suiteFailures = sb.failed_count;
+    let suiteFailures = 0;
     let representedSkipped = 0;
+    let suiteSkipped = 0;
     const passPhases = sb.passes?.length ? sb.passes.map((pass) => ({ label: `Pass ${pass.pass_index} \u203A `, phases: pass.phases })) : [{ label: "", phases: sb.phases }];
     for (const pass of passPhases) {
       for (const phase of pass.phases) {
@@ -93,6 +94,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
           const time = ((step.duration_ms || 0) / 1e3).toFixed(3);
           if (step.skipped) {
             representedSkipped += 1;
+            suiteSkipped += 1;
             totalSkipped += 1;
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -102,7 +104,6 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
             continue;
           }
           if (!step.passed) {
-            totalFailures += 1;
             const failureDetails = [
               step.error,
               ...step.validations.filter((v) => !v.passed).map(
@@ -114,6 +115,17 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
               // report body.
               ...hintLines(step.hints)
             ].filter(Boolean).join("\n");
+            if (step.counts_toward_failure === false) {
+              suiteCases.push(
+                `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
+      <system-out>${xmlEscape(`Optional phase failure; excluded from storyboard verdict.
+${failureDetails}`)}</system-out>
+    </testcase>`
+              );
+              continue;
+            }
+            totalFailures += 1;
+            suiteFailures += 1;
             const message = step.error || firstHintMessage(step) || "validation failed";
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -136,6 +148,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     if (hasStoryboardFixtureSkip) {
       totalTests += 1;
       totalSkipped += 1;
+      suiteSkipped += 1;
       suiteCases.push(
         `    <testcase classname="${xmlEscape(suiteClassname)}" name="Fixture resolution" time="0.000">
       <skipped message="${xmlEscape(fixtureGap.detail)}"/>
@@ -159,7 +172,7 @@ ${assertion.error}` : ""}`;
     totalDuration += sb.total_duration_ms || 0;
     const suiteTests = suiteCases.length;
     suites.push(
-      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${sb.skipped_count}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
+      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${suiteSkipped}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
 ` + suiteCases.join("\n") + `
   </testsuite>`
     );

package/dist/lib/testing/storyboard/junit.mjs

@@ -58,8 +58,9 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     const suiteGroup = options.suite_groups?.[sb.storyboard_id];
     const suiteClassname = suiteGroup ? `${suiteGroup}.${sb.storyboard_id}` : sb.storyboard_id;
     const suiteCases = [];
-    let suiteFailures = sb.failed_count;
+    let suiteFailures = 0;
     let representedSkipped = 0;
+    let suiteSkipped = 0;
     const passPhases = sb.passes?.length ? sb.passes.map((pass) => ({ label: `Pass ${pass.pass_index} \u203A `, phases: pass.phases })) : [{ label: "", phases: sb.phases }];
     for (const pass of passPhases) {
       for (const phase of pass.phases) {
@@ -69,6 +70,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
           const time = ((step.duration_ms || 0) / 1e3).toFixed(3);
           if (step.skipped) {
             representedSkipped += 1;
+            suiteSkipped += 1;
             totalSkipped += 1;
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -78,7 +80,6 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
             continue;
           }
           if (!step.passed) {
-            totalFailures += 1;
             const failureDetails = [
               step.error,
               ...step.validations.filter((v) => !v.passed).map(
@@ -90,6 +91,17 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
               // report body.
               ...hintLines(step.hints)
             ].filter(Boolean).join("\n");
+            if (step.counts_toward_failure === false) {
+              suiteCases.push(
+                `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
+      <system-out>${xmlEscape(`Optional phase failure; excluded from storyboard verdict.
+${failureDetails}`)}</system-out>
+    </testcase>`
+              );
+              continue;
+            }
+            totalFailures += 1;
+            suiteFailures += 1;
             const message = step.error || firstHintMessage(step) || "validation failed";
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -112,6 +124,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     if (hasStoryboardFixtureSkip) {
       totalTests += 1;
       totalSkipped += 1;
+      suiteSkipped += 1;
       suiteCases.push(
         `    <testcase classname="${xmlEscape(suiteClassname)}" name="Fixture resolution" time="0.000">
       <skipped message="${xmlEscape(fixtureGap.detail)}"/>
@@ -135,7 +148,7 @@ ${assertion.error}` : ""}`;
     totalDuration += sb.total_duration_ms || 0;
     const suiteTests = suiteCases.length;
     suites.push(
-      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${sb.skipped_count}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
+      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${suiteSkipped}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
 ` + suiteCases.join("\n") + `
   </testsuite>`
     );

package/dist/lib/testing/storyboard/runner.js

@@ -548,6 +548,7 @@ function applyBranchSetGrading(phases, phaseResults, branchSetByPhaseId, contrib
       step.skip = { reason: "peer_branch_taken", detail };
       delete step.error;
       delete step.adcp_error;
+      delete step.counts_toward_failure;
       skippedDelta++;
       regraded = true;
     }
@@ -2646,6 +2647,8 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         if (!phase.optional || (routingContext ? routedOauthPresent.has(assignment.instanceIndex) : presenceDetected)) {
           failedCount++;
           countedAsFailed.add(result2);
+        } else if (!result2.validations.some((validation) => validation.check === "assertion" && !validation.passed)) {
+          result2.counts_toward_failure = false;
         }
         if (step.stateful) {
           phaseStatefulCascades.set(phase.id, null);
@@ -3657,9 +3660,20 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && (0, import_idempotency.requestUsesIdempotency)(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
+  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
+  let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    if (useSdkAuthOverride) {
+      if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
+      authOverrideClient = createAuthOverrideClient(
+        runState.agentUrl,
+        options.protocol ?? "mcp",
+        options,
+        rawProbeHeaders
+      );
+    }
   } catch (err) {
     return {
       step_id: step.id,
@@ -3674,7 +3688,8 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
       extraction: { path: "none" }
     };
   }
-  const useRawProbe = rawProbeHeaders !== void 0;
+  const useRawProbe = rawProbeHeaders !== void 0 && !useSdkAuthOverride;
+  const stepClient = () => authOverrideClient ?? client;
   let taskResult;
   let stepResult;
   let caughtError;
@@ -3758,7 +3773,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     const started = Date.now();
     try {
       if (options.protocol === "a2a") {
-        const probeClient = createA2AAuthOverrideClient(runState.agentUrl, options, rawProbeHeaders ?? {});
+        const probeClient = createAuthOverrideClient(runState.agentUrl, "a2a", options, rawProbeHeaders ?? {});
         const captured = await (0, import_rawResponseCapture.withRawResponseCapture)(
           () => (0, import_client.runStep)(
             step.title,
@@ -3853,7 +3868,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     let a2aCaptures;
     if (step.parallel_dispatch) {
       const started = Date.now();
-      crossResponses = await (0, import_parallel_dispatch.runParallelDispatches)(client, effectiveStep.task, request, {
+      crossResponses = await (0, import_parallel_dispatch.runParallelDispatches)(stepClient(), effectiveStep.task, request, {
         spec: step.parallel_dispatch,
         keyMinter: import_idempotency.generateIdempotencyKey,
         correlationPrefix: step.id,
@@ -3890,7 +3905,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
         };
       }
     } else {
-      const dispatch = () => (0, import_task_map.executeStoryboardTask)(client, effectiveStep.task, request, {
+      const dispatch = () => (0, import_task_map.executeStoryboardTask)(stepClient(), effectiveStep.task, request, {
         skipIdempotencyAutoInject: testsIdempotencyKeyOmission,
         skipAccountValidation: testsMissingAccount,
         skipRequestValidation: testsSchemaInvalidRequest,
@@ -5699,8 +5714,10 @@ function defaultAuthHeadersForRawProbe(options) {
 }
 function sessionProbeRoutingHeaders(options) {
   const headers = {};
+  const runSecrets = runCredentialValues(options);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (!SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase())) continue;
+    if (runSecrets.some((secret) => value.includes(secret))) continue;
     try {
       assertSafeAuthHeaderPart(value, `options.headers.${name}`);
     } catch {
@@ -5725,35 +5742,62 @@ function setHeaderIfAbsent(headers, name, value, label) {
 }
 function runCredentialValues(options) {
   const values = [];
+  const pushHeaderToken = (value) => {
+    values.push(value, value.replace(/^[\t ]+|[\t ]+$/g, ""));
+  };
+  const pushUserPass = (userpass) => {
+    values.push(userpass, Buffer.from(userpass).toString("base64"));
+    const separator = userpass.indexOf(":");
+    if (separator >= 0) values.push(userpass.slice(separator + 1));
+  };
   const auth = options.auth;
-  if (auth?.type === "bearer" && typeof auth.token === "string") values.push(auth.token);
+  if (auth?.type === "bearer" && typeof auth.token === "string") pushHeaderToken(auth.token);
   if (auth?.type === "basic") {
     if (typeof auth.password === "string") values.push(auth.password);
     if (typeof auth.username === "string" && typeof auth.password === "string") {
-      values.push(`${auth.username}:${auth.password}`);
+      pushUserPass(`${auth.username}:${auth.password}`);
     }
   }
   if (auth?.type === "oauth" || auth?.type === "oauth_client_credentials") {
     const token = auth.tokens?.access_token;
-    if (typeof token === "string") values.push(token);
+    if (typeof token === "string") pushHeaderToken(token);
   }
   const kit = options.test_kit?.auth;
-  if (typeof kit?.api_key === "string") values.push(kit.api_key);
+  if (typeof kit?.api_key === "string") pushHeaderToken(kit.api_key);
   const basic = kit?.basic;
   if (typeof basic?.password === "string") values.push(basic.password);
   if (typeof basic?.username === "string" && typeof basic?.password === "string") {
-    values.push(`${basic.username}:${basic.password}`);
+    pushUserPass(`${basic.username}:${basic.password}`);
   }
-  if (typeof basic?.credentials === "string") values.push(basic.credentials);
+  if (typeof basic?.credentials === "string") pushUserPass(basic.credentials);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (typeof value !== "string" || value.length === 0) continue;
-    if (AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) || isCredentialHeaderName(name)) values.push(value);
+    if (!AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) && !isCredentialHeaderName(name)) continue;
+    pushHeaderToken(value);
+    const scheme = /^(Bearer|Basic|Token|ApiKey)\s+(.+)$/i.exec(value.trim());
+    if (scheme?.[1] !== void 0 && scheme[2] !== void 0) {
+      const payload = scheme[2].trim();
+      values.push(payload);
+      if (/^Basic$/i.test(scheme[1]) && /^[A-Za-z0-9+/]+={0,2}$/.test(payload)) {
+        const bytes = Buffer.from(payload, "base64");
+        const decoded = bytes.toString("utf8");
+        if (bytes.toString("base64").replace(/=+$/, "") === payload.replace(/=+$/, "") && Buffer.from(decoded, "utf8").equals(bytes) && !/[\x00-\x1f\x7f]/.test(decoded) && decoded.includes(":")) {
+          pushUserPass(decoded);
+        }
+      }
+    }
   }
   return values.filter((value) => value.trim().length > 0);
 }
 const SESSION_PROBE_ROUTING_HEADERS = /* @__PURE__ */ new Set([
   "x-tenant-id",
   "x-tenant",
+  // AdCP's own tenant-routing header (`src/lib/testing/types.ts` names it as
+  // the canonical example). Omitting it meant a run that routes on it had the
+  // header classified as unknown: dropped from session probes, and — once the
+  // isolated-client value test landed — silently strippable on a credential
+  // collision, which reroutes the step to another tenant.
+  "x-adcp-tenant",
   "x-account",
   "x-account-id",
   "x-routing-key",
@@ -5772,16 +5816,17 @@ function unroutableProbeHeader(options) {
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     const lower = name.toLowerCase();
     if (SESSION_PROBE_ROUTING_HEADERS.has(lower)) {
+      if (runSecrets.some((secret) => value.includes(secret))) return { name, reason: "credential_collision" };
       try {
         assertSafeAuthHeaderPart(value, `options.headers.${name}`);
       } catch {
-        return name;
+        return { name, reason: "malformed" };
       }
       continue;
     }
     if (AUTH_OVERRIDE_HEADER_NAMES.has(lower)) continue;
     if (runSecrets.some((secret) => value.includes(secret))) continue;
-    return name;
+    return { name, reason: "unknown" };
   }
   return void 0;
 }
@@ -6015,11 +6060,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   }
   const unroutable = unroutableProbeHeader(options);
   if (unroutable !== void 0) {
-    return {
-      kind: "skip",
-      reason: "session_probe_ungradable",
-      detail: `The runner cannot classify run header "${escapeControlChars(unroutable.slice(0, 64))}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`
-    };
+    const name = escapeControlChars(unroutable.name.slice(0, 64));
+    const detail = unroutable.reason === "credential_collision" ? `Routing header "${name}" has a value containing a credential this run holds. Nothing was graded: forwarding it could authenticate the unauthenticated probe, and dropping it could change tenants. Choose a routing value or suite credential that does not collide.` : unroutable.reason === "malformed" ? `Routing header "${name}" contains invalid header characters. Nothing was graded because dropping it could change tenants. Correct this run header before retrying the probe.` : `The runner cannot classify run header "${name}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`;
+    return { kind: "skip", reason: "session_probe_ungradable", detail };
   }
   const routing = sessionProbeRoutingHeaders(options);
   let headers;
@@ -6052,6 +6095,11 @@ function authHeadersForStep(directive, options) {
   if ("value" in directive && directive.value) {
     value = directive.value;
   } else if ("from_test_kit" in directive && directive.from_test_kit) {
+    if (typeof directive.from_test_kit === "string") {
+      throw new Error(
+        "Named test-kit API-key paths are not supported; use from_test_kit: true only for the primary key."
+      );
+    }
     value = options.test_kit?.auth?.api_key;
     if (!value) {
       throw new Error(
@@ -6068,6 +6116,13 @@ function authHeadersForStep(directive, options) {
   }
   return { authorization: `Bearer ${value}` };
 }
+const HTTP_PROBE_ONLY_CHECKS = /* @__PURE__ */ new Set([
+  "http_status",
+  "http_status_in",
+  "probe_passed",
+  "on_401_require_header",
+  "resource_equals_agent_url"
+]);
 const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "authorization",
   "proxy-authorization",
@@ -6076,14 +6131,28 @@ const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-api-key"
 ]);
 const AUTH_OVERRIDE_CREDENTIAL_HEADER_RE = /(^|[-_])(auth(?:entication|orization)?|credentials?|secrets?|tokens?|keys?|api[-_]?keys?|access[-_]?keys?|private[-_]?keys?|password|passwd|signatures?|cert(?:ificate)?s?)([-_]|$)/i;
+const AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE = /(auth(?:entication|orization)?|credentials?|secrets?|tokens?|passwords?|passwd|signatures?|certificates?|bearer|(?:api|access|private|session|auth|secret|client|app|master|signing|shared|subscription)keys?|(?:client|tls|ssl)certs?)$/i;
 function isCredentialHeaderName(name) {
   const normalized = name.toLowerCase();
-  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized);
+  if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
+  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
-  const headers = Object.fromEntries(
-    Object.entries(options.headers ?? {}).filter(([name]) => !isCredentialHeaderName(name))
-  );
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+  const runSecrets = runCredentialValues(options);
+  const headers = {};
+  for (const [name, value] of Object.entries(options.headers ?? {})) {
+    const isRouting = SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase());
+    if (!isRouting && isCredentialHeaderName(name)) continue;
+    if (typeof value === "string" && runSecrets.some((secret) => value.includes(secret))) {
+      if (isRouting) {
+        throw new Error(
+          `options.headers.${name} is a routing header but its value contains a credential this run holds; an isolated step cannot both route correctly and withhold the suite principal. Choose a routing value or suite credential that does not collide.`
+        );
+      }
+      continue;
+    }
+    headers[name] = value;
+  }
   let auth;
   for (const [name, value] of Object.entries(authHeaders)) {
     if (name.toLowerCase() === "authorization" && value.startsWith("Bearer ")) {
@@ -6092,9 +6161,9 @@ function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
       headers[name] = value;
     }
   }
-  return (0, import_client.createTestClient)(agentUrl, "a2a", {
+  return (0, import_client.createTestClient)(agentUrl, protocol, {
     ...options,
-    protocol: "a2a",
+    protocol,
     auth,
     test_kit: void 0,
     _client: void 0,

package/dist/lib/testing/storyboard/runner.mjs

@@ -570,6 +570,7 @@ function applyBranchSetGrading(phases, phaseResults, branchSetByPhaseId, contrib
       step.skip = { reason: "peer_branch_taken", detail };
       delete step.error;
       delete step.adcp_error;
+      delete step.counts_toward_failure;
       skippedDelta++;
       regraded = true;
     }
@@ -2668,6 +2669,8 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         if (!phase.optional || (routingContext ? routedOauthPresent.has(assignment.instanceIndex) : presenceDetected)) {
           failedCount++;
           countedAsFailed.add(result2);
+        } else if (!result2.validations.some((validation) => validation.check === "assertion" && !validation.passed)) {
+          result2.counts_toward_failure = false;
         }
         if (step.stateful) {
           phaseStatefulCascades.set(phase.id, null);
@@ -3679,9 +3682,20 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && requestUsesIdempotency(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
+  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
+  let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    if (useSdkAuthOverride) {
+      if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
+      authOverrideClient = createAuthOverrideClient(
+        runState.agentUrl,
+        options.protocol ?? "mcp",
+        options,
+        rawProbeHeaders
+      );
+    }
   } catch (err) {
     return {
       step_id: step.id,
@@ -3696,7 +3710,8 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
       extraction: { path: "none" }
     };
   }
-  const useRawProbe = rawProbeHeaders !== void 0;
+  const useRawProbe = rawProbeHeaders !== void 0 && !useSdkAuthOverride;
+  const stepClient = () => authOverrideClient ?? client;
   let taskResult;
   let stepResult;
   let caughtError;
@@ -3780,7 +3795,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     const started = Date.now();
     try {
       if (options.protocol === "a2a") {
-        const probeClient = createA2AAuthOverrideClient(runState.agentUrl, options, rawProbeHeaders ?? {});
+        const probeClient = createAuthOverrideClient(runState.agentUrl, "a2a", options, rawProbeHeaders ?? {});
         const captured = await withRawResponseCapture(
           () => runStep(
             step.title,
@@ -3875,7 +3890,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     let a2aCaptures;
     if (step.parallel_dispatch) {
       const started = Date.now();
-      crossResponses = await runParallelDispatches(client, effectiveStep.task, request, {
+      crossResponses = await runParallelDispatches(stepClient(), effectiveStep.task, request, {
         spec: step.parallel_dispatch,
         keyMinter: generateIdempotencyKey,
         correlationPrefix: step.id,
@@ -3912,7 +3927,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
         };
       }
     } else {
-      const dispatch = () => executeStoryboardTask(client, effectiveStep.task, request, {
+      const dispatch = () => executeStoryboardTask(stepClient(), effectiveStep.task, request, {
         skipIdempotencyAutoInject: testsIdempotencyKeyOmission,
         skipAccountValidation: testsMissingAccount,
         skipRequestValidation: testsSchemaInvalidRequest,
@@ -5721,8 +5736,10 @@ function defaultAuthHeadersForRawProbe(options) {
 }
 function sessionProbeRoutingHeaders(options) {
   const headers = {};
+  const runSecrets = runCredentialValues(options);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (!SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase())) continue;
+    if (runSecrets.some((secret) => value.includes(secret))) continue;
     try {
       assertSafeAuthHeaderPart(value, `options.headers.${name}`);
     } catch {
@@ -5747,35 +5764,62 @@ function setHeaderIfAbsent(headers, name, value, label) {
 }
 function runCredentialValues(options) {
   const values = [];
+  const pushHeaderToken = (value) => {
+    values.push(value, value.replace(/^[\t ]+|[\t ]+$/g, ""));
+  };
+  const pushUserPass = (userpass) => {
+    values.push(userpass, Buffer.from(userpass).toString("base64"));
+    const separator = userpass.indexOf(":");
+    if (separator >= 0) values.push(userpass.slice(separator + 1));
+  };
   const auth = options.auth;
-  if (auth?.type === "bearer" && typeof auth.token === "string") values.push(auth.token);
+  if (auth?.type === "bearer" && typeof auth.token === "string") pushHeaderToken(auth.token);
   if (auth?.type === "basic") {
     if (typeof auth.password === "string") values.push(auth.password);
     if (typeof auth.username === "string" && typeof auth.password === "string") {
-      values.push(`${auth.username}:${auth.password}`);
+      pushUserPass(`${auth.username}:${auth.password}`);
     }
   }
   if (auth?.type === "oauth" || auth?.type === "oauth_client_credentials") {
     const token = auth.tokens?.access_token;
-    if (typeof token === "string") values.push(token);
+    if (typeof token === "string") pushHeaderToken(token);
   }
   const kit = options.test_kit?.auth;
-  if (typeof kit?.api_key === "string") values.push(kit.api_key);
+  if (typeof kit?.api_key === "string") pushHeaderToken(kit.api_key);
   const basic = kit?.basic;
   if (typeof basic?.password === "string") values.push(basic.password);
   if (typeof basic?.username === "string" && typeof basic?.password === "string") {
-    values.push(`${basic.username}:${basic.password}`);
+    pushUserPass(`${basic.username}:${basic.password}`);
   }
-  if (typeof basic?.credentials === "string") values.push(basic.credentials);
+  if (typeof basic?.credentials === "string") pushUserPass(basic.credentials);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (typeof value !== "string" || value.length === 0) continue;
-    if (AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) || isCredentialHeaderName(name)) values.push(value);
+    if (!AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) && !isCredentialHeaderName(name)) continue;
+    pushHeaderToken(value);
+    const scheme = /^(Bearer|Basic|Token|ApiKey)\s+(.+)$/i.exec(value.trim());
+    if (scheme?.[1] !== void 0 && scheme[2] !== void 0) {
+      const payload = scheme[2].trim();
+      values.push(payload);
+      if (/^Basic$/i.test(scheme[1]) && /^[A-Za-z0-9+/]+={0,2}$/.test(payload)) {
+        const bytes = Buffer.from(payload, "base64");
+        const decoded = bytes.toString("utf8");
+        if (bytes.toString("base64").replace(/=+$/, "") === payload.replace(/=+$/, "") && Buffer.from(decoded, "utf8").equals(bytes) && !/[\x00-\x1f\x7f]/.test(decoded) && decoded.includes(":")) {
+          pushUserPass(decoded);
+        }
+      }
+    }
   }
   return values.filter((value) => value.trim().length > 0);
 }
 const SESSION_PROBE_ROUTING_HEADERS = /* @__PURE__ */ new Set([
   "x-tenant-id",
   "x-tenant",
+  // AdCP's own tenant-routing header (`src/lib/testing/types.ts` names it as
+  // the canonical example). Omitting it meant a run that routes on it had the
+  // header classified as unknown: dropped from session probes, and — once the
+  // isolated-client value test landed — silently strippable on a credential
+  // collision, which reroutes the step to another tenant.
+  "x-adcp-tenant",
   "x-account",
   "x-account-id",
   "x-routing-key",
@@ -5794,16 +5838,17 @@ function unroutableProbeHeader(options) {
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     const lower = name.toLowerCase();
     if (SESSION_PROBE_ROUTING_HEADERS.has(lower)) {
+      if (runSecrets.some((secret) => value.includes(secret))) return { name, reason: "credential_collision" };
       try {
         assertSafeAuthHeaderPart(value, `options.headers.${name}`);
       } catch {
-        return name;
+        return { name, reason: "malformed" };
       }
       continue;
     }
     if (AUTH_OVERRIDE_HEADER_NAMES.has(lower)) continue;
     if (runSecrets.some((secret) => value.includes(secret))) continue;
-    return name;
+    return { name, reason: "unknown" };
   }
   return void 0;
 }
@@ -6037,11 +6082,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   }
   const unroutable = unroutableProbeHeader(options);
   if (unroutable !== void 0) {
-    return {
-      kind: "skip",
-      reason: "session_probe_ungradable",
-      detail: `The runner cannot classify run header "${escapeControlChars(unroutable.slice(0, 64))}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`
-    };
+    const name = escapeControlChars(unroutable.name.slice(0, 64));
+    const detail = unroutable.reason === "credential_collision" ? `Routing header "${name}" has a value containing a credential this run holds. Nothing was graded: forwarding it could authenticate the unauthenticated probe, and dropping it could change tenants. Choose a routing value or suite credential that does not collide.` : unroutable.reason === "malformed" ? `Routing header "${name}" contains invalid header characters. Nothing was graded because dropping it could change tenants. Correct this run header before retrying the probe.` : `The runner cannot classify run header "${name}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`;
+    return { kind: "skip", reason: "session_probe_ungradable", detail };
   }
   const routing = sessionProbeRoutingHeaders(options);
   let headers;
@@ -6074,6 +6117,11 @@ function authHeadersForStep(directive, options) {
   if ("value" in directive && directive.value) {
     value = directive.value;
   } else if ("from_test_kit" in directive && directive.from_test_kit) {
+    if (typeof directive.from_test_kit === "string") {
+      throw new Error(
+        "Named test-kit API-key paths are not supported; use from_test_kit: true only for the primary key."
+      );
+    }
     value = options.test_kit?.auth?.api_key;
     if (!value) {
       throw new Error(
@@ -6090,6 +6138,13 @@ function authHeadersForStep(directive, options) {
   }
   return { authorization: `Bearer ${value}` };
 }
+const HTTP_PROBE_ONLY_CHECKS = /* @__PURE__ */ new Set([
+  "http_status",
+  "http_status_in",
+  "probe_passed",
+  "on_401_require_header",
+  "resource_equals_agent_url"
+]);
 const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "authorization",
   "proxy-authorization",
@@ -6098,14 +6153,28 @@ const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-api-key"
 ]);
 const AUTH_OVERRIDE_CREDENTIAL_HEADER_RE = /(^|[-_])(auth(?:entication|orization)?|credentials?|secrets?|tokens?|keys?|api[-_]?keys?|access[-_]?keys?|private[-_]?keys?|password|passwd|signatures?|cert(?:ificate)?s?)([-_]|$)/i;
+const AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE = /(auth(?:entication|orization)?|credentials?|secrets?|tokens?|passwords?|passwd|signatures?|certificates?|bearer|(?:api|access|private|session|auth|secret|client|app|master|signing|shared|subscription)keys?|(?:client|tls|ssl)certs?)$/i;
 function isCredentialHeaderName(name) {
   const normalized = name.toLowerCase();
-  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized);
+  if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
+  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
-  const headers = Object.fromEntries(
-    Object.entries(options.headers ?? {}).filter(([name]) => !isCredentialHeaderName(name))
-  );
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+  const runSecrets = runCredentialValues(options);
+  const headers = {};
+  for (const [name, value] of Object.entries(options.headers ?? {})) {
+    const isRouting = SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase());
+    if (!isRouting && isCredentialHeaderName(name)) continue;
+    if (typeof value === "string" && runSecrets.some((secret) => value.includes(secret))) {
+      if (isRouting) {
+        throw new Error(
+          `options.headers.${name} is a routing header but its value contains a credential this run holds; an isolated step cannot both route correctly and withhold the suite principal. Choose a routing value or suite credential that does not collide.`
+        );
+      }
+      continue;
+    }
+    headers[name] = value;
+  }
   let auth;
   for (const [name, value] of Object.entries(authHeaders)) {
     if (name.toLowerCase() === "authorization" && value.startsWith("Bearer ")) {
@@ -6114,9 +6183,9 @@ function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
       headers[name] = value;
     }
   }
-  return createTestClient(agentUrl, "a2a", {
+  return createTestClient(agentUrl, protocol, {
     ...options,
-    protocol: "a2a",
+    protocol,
     auth,
     test_kit: void 0,
     _client: void 0,

package/dist/lib/testing/storyboard/types.d.mts

@@ -2395,6 +2395,12 @@ export interface StoryboardStepResult {
     title: string;
     task: string;
     passed: boolean;
+    /**
+     * False when a failed step is diagnostic only and does not count toward
+     * the storyboard verdict (for example, an optional discovery phase).
+     * Absent on ordinary failures, including mandatory OAuth and invariant checks.
+     */
+    counts_toward_failure?: boolean;
     /** True when the step was not executed */
     skipped?: boolean;
     /**

package/dist/lib/testing/storyboard/types.d.ts

@@ -2395,6 +2395,12 @@ export interface StoryboardStepResult {
     title: string;
     task: string;
     passed: boolean;
+    /**
+     * False when a failed step is diagnostic only and does not count toward
+     * the storyboard verdict (for example, an optional discovery phase).
+     * Absent on ordinary failures, including mandatory OAuth and invariant checks.
+     */
+    counts_toward_failure?: boolean;
     /** True when the step was not executed */
     skipped?: boolean;
     /**

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.9.1";
+export declare const RUNNER_CAPABILITY_VERSION = "15.9.3";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.9.1";
+export declare const RUNNER_CAPABILITY_VERSION = "15.9.3";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/validation/schema-loader.js

@@ -46,6 +46,7 @@ __export(schema_loader_exports, {
   listValidatorKeys: () => listValidatorKeys,
   registerExternalSchemaRoot: () => registerExternalSchemaRoot,
   resolveBundleKey: () => resolveBundleKey,
+  resolveServedValidationVersion: () => resolveServedValidationVersion,
   schemaAllowsTopLevelField: () => schemaAllowsTopLevelField,
   toReleasePrecisionWire: () => toReleasePrecisionWire,
   unregisterExternalSchemaRoot: () => unregisterExternalSchemaRoot,
@@ -718,6 +719,29 @@ function hasSchemaBundle(version) {
     return false;
   }
 }
+const SERVED_RELEASE_MAJOR = /^(\d+)\.\d+(?:-[a-zA-Z0-9.-]+)?$/;
+const NUMERIC_PIN_MAJOR = /^(\d+)\.\d+/;
+function resolveServedValidationVersion(response, pinnedVersion) {
+  const pinMajor = NUMERIC_PIN_MAJOR.exec(pinnedVersion)?.[1];
+  if (pinMajor === void 0) return pinnedVersion;
+  try {
+    if (isExternalSchemaRootActive(pinnedVersion)) return pinnedVersion;
+  } catch {
+    return pinnedVersion;
+  }
+  const echoed = response !== null && typeof response === "object" ? response.adcp_version : void 0;
+  if (typeof echoed !== "string") return pinnedVersion;
+  const echoMajor = SERVED_RELEASE_MAJOR.exec(echoed)?.[1];
+  if (echoMajor === void 0 || echoMajor !== pinMajor) return pinnedVersion;
+  let pinnedRelease;
+  try {
+    pinnedRelease = toReleasePrecisionWire(pinnedVersion);
+  } catch {
+    return pinnedVersion;
+  }
+  if (echoed === pinnedRelease) return pinnedVersion;
+  return hasSchemaBundle(echoed) ? echoed : pinnedVersion;
+}
 const mcpToolSchemaCache = /* @__PURE__ */ new Map();
 const mcpToolSummaryCache = /* @__PURE__ */ new Map();
 function boundedMcpToolSummary(value) {
@@ -981,6 +1005,7 @@ function cloneJsonValue(value) {
   listValidatorKeys,
   registerExternalSchemaRoot,
   resolveBundleKey,
+  resolveServedValidationVersion,
   schemaAllowsTopLevelField,
   toReleasePrecisionWire,
   unregisterExternalSchemaRoot,

package/dist/lib/validation/schema-loader.mjs

@@ -668,6 +668,29 @@ function hasSchemaBundle(version) {
     return false;
   }
 }
+const SERVED_RELEASE_MAJOR = /^(\d+)\.\d+(?:-[a-zA-Z0-9.-]+)?$/;
+const NUMERIC_PIN_MAJOR = /^(\d+)\.\d+/;
+function resolveServedValidationVersion(response, pinnedVersion) {
+  const pinMajor = NUMERIC_PIN_MAJOR.exec(pinnedVersion)?.[1];
+  if (pinMajor === void 0) return pinnedVersion;
+  try {
+    if (isExternalSchemaRootActive(pinnedVersion)) return pinnedVersion;
+  } catch {
+    return pinnedVersion;
+  }
+  const echoed = response !== null && typeof response === "object" ? response.adcp_version : void 0;
+  if (typeof echoed !== "string") return pinnedVersion;
+  const echoMajor = SERVED_RELEASE_MAJOR.exec(echoed)?.[1];
+  if (echoMajor === void 0 || echoMajor !== pinMajor) return pinnedVersion;
+  let pinnedRelease;
+  try {
+    pinnedRelease = toReleasePrecisionWire(pinnedVersion);
+  } catch {
+    return pinnedVersion;
+  }
+  if (echoed === pinnedRelease) return pinnedVersion;
+  return hasSchemaBundle(echoed) ? echoed : pinnedVersion;
+}
 const mcpToolSchemaCache = /* @__PURE__ */ new Map();
 const mcpToolSummaryCache = /* @__PURE__ */ new Map();
 function boundedMcpToolSummary(value) {
@@ -930,6 +953,7 @@ export {
   listValidatorKeys,
   registerExternalSchemaRoot,
   resolveBundleKey,
+  resolveServedValidationVersion,
   schemaAllowsTopLevelField,
   toReleasePrecisionWire,
   unregisterExternalSchemaRoot,

package/dist/lib/version.d.mts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "15.9.1";
+export declare const LIBRARY_VERSION = "15.9.3";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "15.9.1";
+    readonly library: "15.9.3";
     readonly adcp: "3.2.4";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
-    readonly generatedAt: "2026-10-14T11:09:46.080Z";
+    readonly generatedAt: "2026-10-16T14:25:50.306Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.d.ts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "15.9.1";
+export declare const LIBRARY_VERSION = "15.9.3";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "15.9.1";
+    readonly library: "15.9.3";
     readonly adcp: "3.2.4";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
-    readonly generatedAt: "2026-10-14T11:09:46.080Z";
+    readonly generatedAt: "2026-10-16T14:25:50.306Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.js

@@ -31,7 +31,7 @@ __export(version_exports, {
   toReleasePrecisionVersion: () => toReleasePrecisionVersion
 });
 module.exports = __toCommonJS(version_exports);
-const LIBRARY_VERSION = "15.9.1";
+const LIBRARY_VERSION = "15.9.3";
 const ADCP_VERSION = "3.2.4";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -98,10 +98,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2.4"
 ];
 const VERSION_INFO = {
-  library: "15.9.1",
+  library: "15.9.3",
   adcp: "3.2.4",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-14T11:09:46.080Z"
+  generatedAt: "2026-10-16T14:25:50.306Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/dist/lib/version.mjs

@@ -1,4 +1,4 @@
-const LIBRARY_VERSION = "15.9.1";
+const LIBRARY_VERSION = "15.9.3";
 const ADCP_VERSION = "3.2.4";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -65,10 +65,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2.4"
 ];
 const VERSION_INFO = {
-  library: "15.9.1",
+  library: "15.9.3",
   adcp: "3.2.4",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-14T11:09:46.080Z"
+  generatedAt: "2026-10-16T14:25:50.306Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/docs/TYPE-SUMMARY.md

@@ -1,7 +1,7 @@
 # AdCP Type Summary
 
-> Generated at: 2026-10-14
-> @adcp/sdk v15.9.1
+> Generated at: 2026-10-16
+> @adcp/sdk v15.9.3
 
 Curated reference of the types that matter for using the AdCP client. For full generated types see `src/lib/types/tools.generated.ts` and `src/lib/types/core.generated.ts`.
 

package/docs/llms.txt

@@ -1,7 +1,7 @@
 # Ad Context Protocol (AdCP)
 
-> Generated at: 2026-10-14
-> Library: @adcp/sdk v15.9.1
+> Generated at: 2026-10-16
+> Library: @adcp/sdk v15.9.3
 > AdCP major version: 3
 > Canonical URL: https://adcontextprotocol.github.io/adcp-client/llms.txt
 > Note: the `Library` stamp reflects the package.json version at doc-generation time. The narrative below describes the surface that lands on the next-published minor — including any 6.7 helpers documented here ahead of the release tag.

package/docs/migration-14.x-rc-worksheet.md

@@ -11,8 +11,8 @@ below as the publication/deployment gate.
 
 | Fact | Value |
 | --- | --- |
-| Exact npm package | `@adcp/sdk@15.9.1` |
-| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@15.9.1 dist.integrity` |
+| Exact npm package | `@adcp/sdk@15.9.3` |
+| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@15.9.3 dist.integrity` |
 | Node.js runtime | `^20.19.0 || >=22.12.0` |
 | Default AdCP wire release | `3.2.4` |
 | Maintained wire releases | `v2.5`, `v2.6`, `v3`, `3.0.0`, `3.0`, `3.0.1`, `3.0.2`, `3.0.3`, `3.0.4`, `3.0.5`, `3.0.6`, `3.0.7`, `3.0.8`, `3.0.9`, `3.0.10`, `3.0.11`, `3.0.12`, `3.0.13`, `3.0.14`, `3.0.15`, `3.0.16`, `3.0.17`, `3.0.18`, `3.0.19`, `3.0.20`, `3.0.21`, `3.0.22`, `3.0.23`, `3.0.24`, `3.0.25`, `3.1.0`, `3.1`, `3.1.1`, `3.1.2`, `3.1.3`, `3.1.4`, `3.1.5`, `3.1.6`, `3.1.7`, `3.1.8`, `3.1.9`, `3.1.10`, `3.1.11`, `3.1.12`, `3.1.13`, `3.1.14`, `3.1.15`, `3.1.16`, `3.1.17`, `3.1.18`, `3.1.19`, `3.1.20`, `3.1.21`, `3.1.22`, `3.1.23`, `3.1.24`, `3.2.1`, `3.2`, `3.2.2`, `3.2.3`, `3.2.4` |
@@ -21,8 +21,8 @@ below as the publication/deployment gate.
 Install exact production inputs rather than a moving range or dist-tag:
 
 ```bash
-npm install --save-exact '@adcp/sdk@15.9.1'
-npm view '@adcp/sdk@15.9.1' dist.integrity
+npm install --save-exact '@adcp/sdk@15.9.3'
+npm view '@adcp/sdk@15.9.3' dist.integrity
 ```
 
 ### Required and optional peers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/sdk",
-  "version": "15.9.1",
+  "version": "15.9.3",
   "description": "AdCP SDK — client, server, and compliance harnesses for the AdContext Protocol (MCP + A2A)",
   "workspaces": [
     ".",