@adcp/sdk 15.9.2 → 15.9.4

package/dist/lib/testing/storyboard/runner.mjs

@@ -570,6 +570,7 @@ function applyBranchSetGrading(phases, phaseResults, branchSetByPhaseId, contrib
       step.skip = { reason: "peer_branch_taken", detail };
       delete step.error;
       delete step.adcp_error;
+      delete step.counts_toward_failure;
       skippedDelta++;
       regraded = true;
     }
@@ -2668,6 +2669,8 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         if (!phase.optional || (routingContext ? routedOauthPresent.has(assignment.instanceIndex) : presenceDetected)) {
           failedCount++;
           countedAsFailed.add(result2);
+        } else if (!result2.validations.some((validation) => validation.check === "assertion" && !validation.passed)) {
+          result2.counts_toward_failure = false;
         }
         if (step.stateful) {
           phaseStatefulCascades.set(phase.id, null);
@@ -3679,9 +3682,20 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && requestUsesIdempotency(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
+  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
+  let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    if (useSdkAuthOverride) {
+      if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
+      authOverrideClient = createAuthOverrideClient(
+        runState.agentUrl,
+        options.protocol ?? "mcp",
+        options,
+        rawProbeHeaders
+      );
+    }
   } catch (err) {
     return {
       step_id: step.id,
@@ -3696,7 +3710,8 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
       extraction: { path: "none" }
     };
   }
-  const useRawProbe = rawProbeHeaders !== void 0;
+  const useRawProbe = rawProbeHeaders !== void 0 && !useSdkAuthOverride;
+  const stepClient = () => authOverrideClient ?? client;
   let taskResult;
   let stepResult;
   let caughtError;
@@ -3780,7 +3795,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     const started = Date.now();
     try {
       if (options.protocol === "a2a") {
-        const probeClient = createA2AAuthOverrideClient(runState.agentUrl, options, rawProbeHeaders ?? {});
+        const probeClient = createAuthOverrideClient(runState.agentUrl, "a2a", options, rawProbeHeaders ?? {});
         const captured = await withRawResponseCapture(
           () => runStep(
             step.title,
@@ -3875,7 +3890,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     let a2aCaptures;
     if (step.parallel_dispatch) {
       const started = Date.now();
-      crossResponses = await runParallelDispatches(client, effectiveStep.task, request, {
+      crossResponses = await runParallelDispatches(stepClient(), effectiveStep.task, request, {
         spec: step.parallel_dispatch,
         keyMinter: generateIdempotencyKey,
         correlationPrefix: step.id,
@@ -3912,7 +3927,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
         };
       }
     } else {
-      const dispatch = () => executeStoryboardTask(client, effectiveStep.task, request, {
+      const dispatch = () => executeStoryboardTask(stepClient(), effectiveStep.task, request, {
         skipIdempotencyAutoInject: testsIdempotencyKeyOmission,
         skipAccountValidation: testsMissingAccount,
         skipRequestValidation: testsSchemaInvalidRequest,
@@ -5721,8 +5736,10 @@ function defaultAuthHeadersForRawProbe(options) {
 }
 function sessionProbeRoutingHeaders(options) {
   const headers = {};
+  const runSecrets = runCredentialValues(options);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (!SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase())) continue;
+    if (runSecrets.some((secret) => value.includes(secret))) continue;
     try {
       assertSafeAuthHeaderPart(value, `options.headers.${name}`);
     } catch {
@@ -5747,35 +5764,62 @@ function setHeaderIfAbsent(headers, name, value, label) {
 }
 function runCredentialValues(options) {
   const values = [];
+  const pushHeaderToken = (value) => {
+    values.push(value, value.replace(/^[\t ]+|[\t ]+$/g, ""));
+  };
+  const pushUserPass = (userpass) => {
+    values.push(userpass, Buffer.from(userpass).toString("base64"));
+    const separator = userpass.indexOf(":");
+    if (separator >= 0) values.push(userpass.slice(separator + 1));
+  };
   const auth = options.auth;
-  if (auth?.type === "bearer" && typeof auth.token === "string") values.push(auth.token);
+  if (auth?.type === "bearer" && typeof auth.token === "string") pushHeaderToken(auth.token);
   if (auth?.type === "basic") {
     if (typeof auth.password === "string") values.push(auth.password);
     if (typeof auth.username === "string" && typeof auth.password === "string") {
-      values.push(`${auth.username}:${auth.password}`);
+      pushUserPass(`${auth.username}:${auth.password}`);
     }
   }
   if (auth?.type === "oauth" || auth?.type === "oauth_client_credentials") {
     const token = auth.tokens?.access_token;
-    if (typeof token === "string") values.push(token);
+    if (typeof token === "string") pushHeaderToken(token);
   }
   const kit = options.test_kit?.auth;
-  if (typeof kit?.api_key === "string") values.push(kit.api_key);
+  if (typeof kit?.api_key === "string") pushHeaderToken(kit.api_key);
   const basic = kit?.basic;
   if (typeof basic?.password === "string") values.push(basic.password);
   if (typeof basic?.username === "string" && typeof basic?.password === "string") {
-    values.push(`${basic.username}:${basic.password}`);
+    pushUserPass(`${basic.username}:${basic.password}`);
   }
-  if (typeof basic?.credentials === "string") values.push(basic.credentials);
+  if (typeof basic?.credentials === "string") pushUserPass(basic.credentials);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (typeof value !== "string" || value.length === 0) continue;
-    if (AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) || isCredentialHeaderName(name)) values.push(value);
+    if (!AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) && !isCredentialHeaderName(name)) continue;
+    pushHeaderToken(value);
+    const scheme = /^(Bearer|Basic|Token|ApiKey)\s+(.+)$/i.exec(value.trim());
+    if (scheme?.[1] !== void 0 && scheme[2] !== void 0) {
+      const payload = scheme[2].trim();
+      values.push(payload);
+      if (/^Basic$/i.test(scheme[1]) && /^[A-Za-z0-9+/]+={0,2}$/.test(payload)) {
+        const bytes = Buffer.from(payload, "base64");
+        const decoded = bytes.toString("utf8");
+        if (bytes.toString("base64").replace(/=+$/, "") === payload.replace(/=+$/, "") && Buffer.from(decoded, "utf8").equals(bytes) && !/[\x00-\x1f\x7f]/.test(decoded) && decoded.includes(":")) {
+          pushUserPass(decoded);
+        }
+      }
+    }
   }
   return values.filter((value) => value.trim().length > 0);
 }
 const SESSION_PROBE_ROUTING_HEADERS = /* @__PURE__ */ new Set([
   "x-tenant-id",
   "x-tenant",
+  // AdCP's own tenant-routing header (`src/lib/testing/types.ts` names it as
+  // the canonical example). Omitting it meant a run that routes on it had the
+  // header classified as unknown: dropped from session probes, and — once the
+  // isolated-client value test landed — silently strippable on a credential
+  // collision, which reroutes the step to another tenant.
+  "x-adcp-tenant",
   "x-account",
   "x-account-id",
   "x-routing-key",
@@ -5794,16 +5838,17 @@ function unroutableProbeHeader(options) {
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     const lower = name.toLowerCase();
     if (SESSION_PROBE_ROUTING_HEADERS.has(lower)) {
+      if (runSecrets.some((secret) => value.includes(secret))) return { name, reason: "credential_collision" };
       try {
         assertSafeAuthHeaderPart(value, `options.headers.${name}`);
       } catch {
-        return name;
+        return { name, reason: "malformed" };
       }
       continue;
     }
     if (AUTH_OVERRIDE_HEADER_NAMES.has(lower)) continue;
     if (runSecrets.some((secret) => value.includes(secret))) continue;
-    return name;
+    return { name, reason: "unknown" };
   }
   return void 0;
 }
@@ -6037,11 +6082,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   }
   const unroutable = unroutableProbeHeader(options);
   if (unroutable !== void 0) {
-    return {
-      kind: "skip",
-      reason: "session_probe_ungradable",
-      detail: `The runner cannot classify run header "${escapeControlChars(unroutable.slice(0, 64))}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`
-    };
+    const name = escapeControlChars(unroutable.name.slice(0, 64));
+    const detail = unroutable.reason === "credential_collision" ? `Routing header "${name}" has a value containing a credential this run holds. Nothing was graded: forwarding it could authenticate the unauthenticated probe, and dropping it could change tenants. Choose a routing value or suite credential that does not collide.` : unroutable.reason === "malformed" ? `Routing header "${name}" contains invalid header characters. Nothing was graded because dropping it could change tenants. Correct this run header before retrying the probe.` : `The runner cannot classify run header "${name}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`;
+    return { kind: "skip", reason: "session_probe_ungradable", detail };
   }
   const routing = sessionProbeRoutingHeaders(options);
   let headers;
@@ -6074,6 +6117,11 @@ function authHeadersForStep(directive, options) {
   if ("value" in directive && directive.value) {
     value = directive.value;
   } else if ("from_test_kit" in directive && directive.from_test_kit) {
+    if (typeof directive.from_test_kit === "string") {
+      throw new Error(
+        "Named test-kit API-key paths are not supported; use from_test_kit: true only for the primary key."
+      );
+    }
     value = options.test_kit?.auth?.api_key;
     if (!value) {
       throw new Error(
@@ -6090,6 +6138,13 @@ function authHeadersForStep(directive, options) {
   }
   return { authorization: `Bearer ${value}` };
 }
+const HTTP_PROBE_ONLY_CHECKS = /* @__PURE__ */ new Set([
+  "http_status",
+  "http_status_in",
+  "probe_passed",
+  "on_401_require_header",
+  "resource_equals_agent_url"
+]);
 const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "authorization",
   "proxy-authorization",
@@ -6098,14 +6153,28 @@ const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-api-key"
 ]);
 const AUTH_OVERRIDE_CREDENTIAL_HEADER_RE = /(^|[-_])(auth(?:entication|orization)?|credentials?|secrets?|tokens?|keys?|api[-_]?keys?|access[-_]?keys?|private[-_]?keys?|password|passwd|signatures?|cert(?:ificate)?s?)([-_]|$)/i;
+const AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE = /(auth(?:entication|orization)?|credentials?|secrets?|tokens?|passwords?|passwd|signatures?|certificates?|bearer|(?:api|access|private|session|auth|secret|client|app|master|signing|shared|subscription)keys?|(?:client|tls|ssl)certs?)$/i;
 function isCredentialHeaderName(name) {
   const normalized = name.toLowerCase();
-  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized);
+  if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
+  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
-  const headers = Object.fromEntries(
-    Object.entries(options.headers ?? {}).filter(([name]) => !isCredentialHeaderName(name))
-  );
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+  const runSecrets = runCredentialValues(options);
+  const headers = {};
+  for (const [name, value] of Object.entries(options.headers ?? {})) {
+    const isRouting = SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase());
+    if (!isRouting && isCredentialHeaderName(name)) continue;
+    if (typeof value === "string" && runSecrets.some((secret) => value.includes(secret))) {
+      if (isRouting) {
+        throw new Error(
+          `options.headers.${name} is a routing header but its value contains a credential this run holds; an isolated step cannot both route correctly and withhold the suite principal. Choose a routing value or suite credential that does not collide.`
+        );
+      }
+      continue;
+    }
+    headers[name] = value;
+  }
   let auth;
   for (const [name, value] of Object.entries(authHeaders)) {
     if (name.toLowerCase() === "authorization" && value.startsWith("Bearer ")) {
@@ -6114,9 +6183,9 @@ function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
       headers[name] = value;
     }
   }
-  return createTestClient(agentUrl, "a2a", {
+  return createTestClient(agentUrl, protocol, {
     ...options,
-    protocol: "a2a",
+    protocol,
     auth,
     test_kit: void 0,
     _client: void 0,

package/dist/lib/testing/storyboard/types.d.mts

@@ -30,7 +30,7 @@ export interface Storyboard {
     version: string;
     /**
      * AdCP compliance cache version this storyboard was loaded from, e.g.
-     * "3.1.24" or "3.2.1". Injected by the local cache loader; not
+     * "3.1.29" or "3.2.1". Injected by the local cache loader; not
      * authored in storyboard YAML.
      */
     adcp_version?: string;
@@ -2395,6 +2395,12 @@ export interface StoryboardStepResult {
     title: string;
     task: string;
     passed: boolean;
+    /**
+     * False when a failed step is diagnostic only and does not count toward
+     * the storyboard verdict (for example, an optional discovery phase).
+     * Absent on ordinary failures, including mandatory OAuth and invariant checks.
+     */
+    counts_toward_failure?: boolean;
     /** True when the step was not executed */
     skipped?: boolean;
     /**

package/dist/lib/testing/storyboard/types.d.ts

@@ -30,7 +30,7 @@ export interface Storyboard {
     version: string;
     /**
      * AdCP compliance cache version this storyboard was loaded from, e.g.
-     * "3.1.24" or "3.2.1". Injected by the local cache loader; not
+     * "3.1.29" or "3.2.1". Injected by the local cache loader; not
      * authored in storyboard YAML.
      */
     adcp_version?: string;
@@ -2395,6 +2395,12 @@ export interface StoryboardStepResult {
     title: string;
     task: string;
     passed: boolean;
+    /**
+     * False when a failed step is diagnostic only and does not count toward
+     * the storyboard verdict (for example, an optional discovery phase).
+     * Absent on ordinary failures, including mandatory OAuth and invariant checks.
+     */
+    counts_toward_failure?: boolean;
     /** True when the step was not executed */
     skipped?: boolean;
     /**

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.9.2";
+export declare const RUNNER_CAPABILITY_VERSION = "15.9.4";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.9.2";
+export declare const RUNNER_CAPABILITY_VERSION = "15.9.4";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/types/manifest.generated.d.mts

@@ -1,5 +1,5 @@
 /**
- * Manifest-derived constants for AdCP 3.2.4.
+ * Manifest-derived constants for AdCP 3.2.5.
  *
  * Single source of truth for tool↔protocol grouping, error-code metadata
  * (description + recovery + suggestion), and specialism→required-tools
@@ -9,8 +9,8 @@
  * previously lived in `src/lib/utils/capabilities.ts` and
  * `src/lib/types/error-codes.ts`.
  *
- * Source: `schemas/cache/3.2.4/manifest.json` (adcp_version: 3.2.4, generated_at:
- * 2026-10-11T21:23:01.435Z). Re-run `npm run sync-schemas` then
+ * Source: `schemas/cache/3.2.5/manifest.json` (adcp_version: 3.2.5, generated_at:
+ * 2026-10-16T16:46:24.874Z). Re-run `npm run sync-schemas` then
  * `npm run generate-manifest-derived` to refresh after a spec bump.
  */
 export type ErrorRecovery = 'transient' | 'correctable' | 'terminal';

package/dist/lib/types/manifest.generated.d.ts

@@ -1,5 +1,5 @@
 /**
- * Manifest-derived constants for AdCP 3.2.4.
+ * Manifest-derived constants for AdCP 3.2.5.
  *
  * Single source of truth for tool↔protocol grouping, error-code metadata
  * (description + recovery + suggestion), and specialism→required-tools
@@ -9,8 +9,8 @@
  * previously lived in `src/lib/utils/capabilities.ts` and
  * `src/lib/types/error-codes.ts`.
  *
- * Source: `schemas/cache/3.2.4/manifest.json` (adcp_version: 3.2.4, generated_at:
- * 2026-10-11T21:23:01.435Z). Re-run `npm run sync-schemas` then
+ * Source: `schemas/cache/3.2.5/manifest.json` (adcp_version: 3.2.5, generated_at:
+ * 2026-10-16T16:46:24.874Z). Re-run `npm run sync-schemas` then
  * `npm run generate-manifest-derived` to refresh after a spec bump.
  */
 export type ErrorRecovery = 'transient' | 'correctable' | 'terminal';

package/dist/lib/types/per-tool-index.json

@@ -1,6 +1,6 @@
 {
   "$comment": "Index of per-tool .d.ts slices shipped under @adcp/sdk/types/<tool>. Agentic adopters use this to resolve spec snake_case tool names to the kebab-case subpath.",
-  "version": "3.2.4",
+  "version": "3.2.5",
   "tools": {
     "accept_proposal": {
       "subpath": "@adcp/sdk/types/accept-proposal",

package/dist/lib/version.d.mts

@@ -1,11 +1,11 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "15.9.2";
+export declare const LIBRARY_VERSION = "15.9.4";
 /**
  * AdCP specification version this library is built for
  */
-export declare const ADCP_VERSION = "3.2.4";
+export declare const ADCP_VERSION = "3.2.5";
 /**
  * AdCP major version sent with every request (adcp_major_version field).
  * Sellers validate this against their supported versions and return
@@ -19,7 +19,7 @@ export declare const ADCP_MAJOR_VERSION = 3;
  * this list by hand; bumping the AdCP pin via `npm run sync-version`
  * extends it.
  */
-export declare const COMPATIBLE_ADCP_VERSIONS: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
+export declare const COMPATIBLE_ADCP_VERSIONS: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.1.25", "3.1.26", "3.1.27", "3.1.28", "3.1.29", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4", "3.2.5"];
 /**
  * String literal union of every AdCP version the SDK formally supports.
  *
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "15.9.2";
-    readonly adcp: "3.2.4";
-    readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
-    readonly generatedAt: "2026-10-15T19:20:29.059Z";
+    readonly library: "15.9.4";
+    readonly adcp: "3.2.5";
+    readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.1.25", "3.1.26", "3.1.27", "3.1.28", "3.1.29", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4", "3.2.5"];
+    readonly generatedAt: "2026-10-16T23:12:08.652Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.d.ts

@@ -1,11 +1,11 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "15.9.2";
+export declare const LIBRARY_VERSION = "15.9.4";
 /**
  * AdCP specification version this library is built for
  */
-export declare const ADCP_VERSION = "3.2.4";
+export declare const ADCP_VERSION = "3.2.5";
 /**
  * AdCP major version sent with every request (adcp_major_version field).
  * Sellers validate this against their supported versions and return
@@ -19,7 +19,7 @@ export declare const ADCP_MAJOR_VERSION = 3;
  * this list by hand; bumping the AdCP pin via `npm run sync-version`
  * extends it.
  */
-export declare const COMPATIBLE_ADCP_VERSIONS: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
+export declare const COMPATIBLE_ADCP_VERSIONS: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.1.25", "3.1.26", "3.1.27", "3.1.28", "3.1.29", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4", "3.2.5"];
 /**
  * String literal union of every AdCP version the SDK formally supports.
  *
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "15.9.2";
-    readonly adcp: "3.2.4";
-    readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
-    readonly generatedAt: "2026-10-15T19:20:29.059Z";
+    readonly library: "15.9.4";
+    readonly adcp: "3.2.5";
+    readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.1.25", "3.1.26", "3.1.27", "3.1.28", "3.1.29", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4", "3.2.5"];
+    readonly generatedAt: "2026-10-16T23:12:08.652Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.js

@@ -31,8 +31,8 @@ __export(version_exports, {
   toReleasePrecisionVersion: () => toReleasePrecisionVersion
 });
 module.exports = __toCommonJS(version_exports);
-const LIBRARY_VERSION = "15.9.2";
-const ADCP_VERSION = "3.2.4";
+const LIBRARY_VERSION = "15.9.4";
+const ADCP_VERSION = "3.2.5";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
   "v2.5",
@@ -91,17 +91,23 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.1.22",
   "3.1.23",
   "3.1.24",
+  "3.1.25",
+  "3.1.26",
+  "3.1.27",
+  "3.1.28",
+  "3.1.29",
   "3.2.1",
   "3.2",
   "3.2.2",
   "3.2.3",
-  "3.2.4"
+  "3.2.4",
+  "3.2.5"
 ];
 const VERSION_INFO = {
-  library: "15.9.2",
-  adcp: "3.2.4",
+  library: "15.9.4",
+  adcp: "3.2.5",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-15T19:20:29.059Z"
+  generatedAt: "2026-10-16T23:12:08.652Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/dist/lib/version.mjs

@@ -1,5 +1,5 @@
-const LIBRARY_VERSION = "15.9.2";
-const ADCP_VERSION = "3.2.4";
+const LIBRARY_VERSION = "15.9.4";
+const ADCP_VERSION = "3.2.5";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
   "v2.5",
@@ -58,17 +58,23 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.1.22",
   "3.1.23",
   "3.1.24",
+  "3.1.25",
+  "3.1.26",
+  "3.1.27",
+  "3.1.28",
+  "3.1.29",
   "3.2.1",
   "3.2",
   "3.2.2",
   "3.2.3",
-  "3.2.4"
+  "3.2.4",
+  "3.2.5"
 ];
 const VERSION_INFO = {
-  library: "15.9.2",
-  adcp: "3.2.4",
+  library: "15.9.4",
+  adcp: "3.2.5",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-15T19:20:29.059Z"
+  generatedAt: "2026-10-16T23:12:08.652Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/docs/CLI.md

@@ -297,7 +297,7 @@ adcp storyboard run myagent --storyboards creative-template
 adcp storyboard run myagent --tracks core,products,media_buy
 
 # Pin the compliance cache/spec line used for storyboard resolution
-adcp storyboard run myagent --compliance-version 3.0.12
+adcp storyboard run myagent --compliance-version 3.1.29
 
 # Recommended for CI: --json for machine-readable output + --strict-flags
 # so stale flags fail the build instead of passing advisory warnings.
@@ -320,7 +320,7 @@ Useful flags:
 
 - `--storyboards ID,...`: Run specific storyboard or bundle IDs instead of capability-driven selection
 - `--tracks core,products,...`: Restrict the run to specific tracks
-- `--compliance-version VERSION`: Select a packaged compliance cache/spec line, for example `3.1.24` or `3.2.3`; use the same flag with `storyboard list`, `show`, and `step` when reproducing a pinned run
+- `--compliance-version VERSION`: Select a packaged compliance cache/spec line, for example `3.1.29` or `3.2.5`; use the same flag with `storyboard list`, `show`, and `step` when reproducing a pinned run
 - `--compliance-dir PATH`: Use a specific compliance cache directory, mainly for local protocol/cache development
 - `--brief TEXT`: Override the default sample discovery brief
 - `--dry-run`: Preview steps without executing

package/docs/TYPE-SUMMARY.md

@@ -1,7 +1,7 @@
 # AdCP Type Summary
 
-> Generated at: 2026-10-15
-> @adcp/sdk v15.9.2
+> Generated at: 2026-10-16
+> @adcp/sdk v15.9.4
 
 Curated reference of the types that matter for using the AdCP client. For full generated types see `src/lib/types/tools.generated.ts` and `src/lib/types/core.generated.ts`.
 

package/docs/guides/CONFORMANCE.md

@@ -241,7 +241,7 @@ nightly job to broaden coverage.
 ## Canonical principal and reporting-core storyboards
 
 `@adcp/sdk/compliance-fixtures` ships the protocol-authored AdCP
-3.2.4 `universal/principal` and `universal/reporting-core`
+3.2.5 `universal/principal` and `universal/reporting-core`
 storyboards as stable, runner-ready fixtures:
 
 ```ts

package/docs/guides/MEDIA-BUY-3.2-COMPATIBILITY.md

@@ -5,7 +5,7 @@ routes it can still **call**. A 3.2 seller should make the compact lifecycle the
 obvious path for new buyers without breaking a 3.0 or 3.1 buyer that already
 calls the established names.
 
-The SDK is pinned to the signed `3.2.3` bundle. It retains the converged
+The SDK is pinned to the signed `3.2.5` bundle. It retains the converged
 RC.0 product-identity, daypart-timezone, and flat-rate loop-position and
 slot-span surface, and adds the Reliable Reporting 1.0 core, managed-delivery,
 and reconciled-billing schema contracts. Beta.5 introduced the normative async identity,

package/docs/guides/REPORTING-LEDGER.md

@@ -1703,7 +1703,7 @@ In AdCP 3.2, `next_expected_at` has two deliberately different summary meanings.
 
 ## Consumer status ingest
 
-The SDK is pinned to AdCP 3.2.3 and exposes `sync_reporting_status` from the ledger subpath. Its request, response, consumer-status, obligation, issue, delivery-capabilities, and reporting-status types come from the published 3.2.3 schema bundle.
+The SDK is pinned to AdCP 3.2.5 and exposes `sync_reporting_status` from the ledger subpath. Its request, response, consumer-status, obligation, issue, delivery-capabilities, and reporting-status types come from the published 3.2.5 schema bundle.
 
 ```ts
 const syncReportingStatus = createSyncReportingStatusHandler(store, {