@adcp/sdk 15.9.4 → 15.9.6

package/dist/lib/registry/types.d.ts

@@ -144,9 +144,10 @@ export type SavePropertyRequest = Omit<RegistrySavePropertyRequest, 'authorized_
 /** Response from POST /api/properties/save (200) */
 export type SavePropertyResponse = operations['saveProperty']['responses']['200']['content']['application/json'];
 type RegistryResolveIdentifiersRequest = NonNullable<operations['resolveIdentifiers']['requestBody']>['content']['application/json'];
-/** Request body for POST /api/registry/resolve. `mode` defaults to `resolve` server-side. */
-export type ResolveIdentifiersRequest = Omit<RegistryResolveIdentifiersRequest, 'mode'> & {
+/** Request body for POST /api/registry/resolve. Mode and sandbox use the registry's defaults when omitted. */
+export type ResolveIdentifiersRequest = Omit<RegistryResolveIdentifiersRequest, 'mode' | 'sandbox'> & {
     mode?: RegistryResolveIdentifiersRequest['mode'];
+    sandbox?: RegistryResolveIdentifiersRequest['sandbox'];
 };
 /** Response from POST /api/registry/resolve (200) */
 export type ResolveIdentifiersResponse = operations['resolveIdentifiers']['responses']['200']['content']['application/json'];

package/dist/lib/registry/types.generated.d.mts

@@ -283,7 +283,7 @@ export interface paths {
         put?: never;
         /**
          * Save property
-         * @description Save or update a hosted property in the registry. Requires authentication. For existing properties, creates a revision-tracked edit. For new properties, creates the property directly. Cannot edit authoritative properties managed via adagents.json.
+         * @description Save or update a hosted property in the registry. Requires authentication. For bulk identifier contributions use resolveIdentifiers instead (up to 10,000 identifiers per request). This endpoint is limited to 60 requests/hour per user/IP. publisher_domain must be a lowercase hostname without a URL, port, whitespace, wildcard, or trailing dot. Reserved test domains are rejected unless sandbox is true. With sandbox: true the request is validated and a simulated result is returned without reading or writing a hosted property; the ID is ephemeral. For existing properties, creates a revision-tracked edit. For new properties, creates the property directly. Cannot edit authoritative properties managed via adagents.json.
          *
          *     This is an identity-only write surface: the stored document always carries `authorized_agents: []`. Sales authorization lives solely in the publisher's own origin `adagents.json`; the community registry cannot mint or carry it. Any `authorized_agents` sent in the request body is ignored.
          */
@@ -4892,6 +4892,11 @@ export interface components {
          */
         OrganizationRevenueTier: "under_1m" | "1m_5m" | "5m_50m" | "50m_250m" | "250m_1b" | "1b_plus";
         ResolveResponse: {
+            /**
+             * @description Present for a non-persistent sandbox simulation. New property handles are ephemeral.
+             * @enum {boolean}
+             */
+            sandbox?: true;
             resolved: components["schemas"]["ResolvedEntry"][];
             summary: {
                 total: number;
@@ -4915,30 +4920,30 @@ export interface components {
         CatalogIdentifier: {
             /** @example domain */
             type: string;
-            /** @example nytimes.com */
+            /** @example streamhaus.com */
             value: string;
         };
+        /** @description Up to 10,000 identifiers plus provenance. resolve requires authentication and contributes unknown identifiers; lookup is read-only. Domain/subdomain values must follow core/identifier.json; production rejects reserved test domains. sandbox: true simulates contributions without writes. */
         ResolveRequest: {
             /** @description Identifiers to resolve (and, in resolve mode, contribute). Max 10,000 per call for all callers. */
             identifiers: components["schemas"]["CatalogIdentifier"][];
             provenance: components["schemas"]["FactProvenance"];
             /**
-             * @description `resolve` (default) contributes the identifiers, auto-creates missing catalog entries, logs demand activity, and returns rids — requires authentication. `lookup` is a pure read: no write, no activity log, no auth.
+             * @description resolve (default) contributes identifiers, creates missing catalog entries, and logs activity; authentication is required. lookup is a public read with no writes or activity logging.
              * @default resolve
              * @enum {string}
              */
             mode: "resolve" | "lookup";
+            /** @description Simulate contributions without storing properties, identifiers, facts, or activity. Reads existing catalog data; new handles are ephemeral. Reserved test domains are allowed only in sandbox mode. Defaults to false when omitted. */
+            sandbox?: boolean;
         };
         FactProvenance: {
             /**
-             * @description How the caller knows these identifiers — the trust/audit envelope on the fact. Determines the confidence the catalog assigns. `crawl` is reserved for server-side pipelines; callers use the others.
+             * @description How the caller knows these identifiers — the trust/audit envelope on the fact. Determines the confidence the catalog assigns. crawl is reserved for server-side pipelines; callers use the others.
              * @enum {string}
              */
             type: "agency_allowlist" | "publisher_declaration" | "impression_log" | "ssp_inventory" | "deal_history" | "crawl" | "data_partner" | "member_assertion";
-            /**
-             * @description Optional free-text annotation (campaign, dataset).
-             * @example unilever_q3
-             */
+            /** @description Optional free-text annotation (campaign, dataset). */
             context?: string;
         };
         CatalogDisputeTriageResult: {
@@ -5731,6 +5736,11 @@ export interface operations {
                 "application/json": {
                     /** @example examplepub.com */
                     publisher_domain: string;
+                    /**
+                     * @description Validate and simulate a save without persisting it. Allows reserved test hostnames.
+                     * @default false
+                     */
+                    sandbox?: boolean;
                     /**
                      * @description Ignored. Community-registry rows never assert sales authorization — the owner's origin adagents.json is the sole authorization source — so any value here is dropped and the stored document carries authorized_agents:[].
                      * @example []
@@ -5770,6 +5780,8 @@ export interface operations {
                         success: true;
                         message: string;
                         id: string;
+                        /** @enum {boolean} */
+                        sandbox?: true;
                         revision_number?: number;
                     };
                 };
@@ -8475,7 +8487,7 @@ export interface operations {
     getAgentAuthorizations: {
         parameters: {
             query: {
-                /** @description Agent URL to look up. Canonicalized server-side (lowercased, trailing slashes trimmed). */
+                /** @description Agent URL to look up. Canonicalized server-side per AdCP URL canonicalization: the scheme and host fold, the path does not. */
                 agent_url: string;
                 /** @description `effective` (default) applies override layer; `raw` reads base table. */
                 include?: "raw" | "effective";

package/dist/lib/registry/types.generated.d.ts

@@ -283,7 +283,7 @@ export interface paths {
         put?: never;
         /**
          * Save property
-         * @description Save or update a hosted property in the registry. Requires authentication. For existing properties, creates a revision-tracked edit. For new properties, creates the property directly. Cannot edit authoritative properties managed via adagents.json.
+         * @description Save or update a hosted property in the registry. Requires authentication. For bulk identifier contributions use resolveIdentifiers instead (up to 10,000 identifiers per request). This endpoint is limited to 60 requests/hour per user/IP. publisher_domain must be a lowercase hostname without a URL, port, whitespace, wildcard, or trailing dot. Reserved test domains are rejected unless sandbox is true. With sandbox: true the request is validated and a simulated result is returned without reading or writing a hosted property; the ID is ephemeral. For existing properties, creates a revision-tracked edit. For new properties, creates the property directly. Cannot edit authoritative properties managed via adagents.json.
          *
          *     This is an identity-only write surface: the stored document always carries `authorized_agents: []`. Sales authorization lives solely in the publisher's own origin `adagents.json`; the community registry cannot mint or carry it. Any `authorized_agents` sent in the request body is ignored.
          */
@@ -4892,6 +4892,11 @@ export interface components {
          */
         OrganizationRevenueTier: "under_1m" | "1m_5m" | "5m_50m" | "50m_250m" | "250m_1b" | "1b_plus";
         ResolveResponse: {
+            /**
+             * @description Present for a non-persistent sandbox simulation. New property handles are ephemeral.
+             * @enum {boolean}
+             */
+            sandbox?: true;
             resolved: components["schemas"]["ResolvedEntry"][];
             summary: {
                 total: number;
@@ -4915,30 +4920,30 @@ export interface components {
         CatalogIdentifier: {
             /** @example domain */
             type: string;
-            /** @example nytimes.com */
+            /** @example streamhaus.com */
             value: string;
         };
+        /** @description Up to 10,000 identifiers plus provenance. resolve requires authentication and contributes unknown identifiers; lookup is read-only. Domain/subdomain values must follow core/identifier.json; production rejects reserved test domains. sandbox: true simulates contributions without writes. */
         ResolveRequest: {
             /** @description Identifiers to resolve (and, in resolve mode, contribute). Max 10,000 per call for all callers. */
             identifiers: components["schemas"]["CatalogIdentifier"][];
             provenance: components["schemas"]["FactProvenance"];
             /**
-             * @description `resolve` (default) contributes the identifiers, auto-creates missing catalog entries, logs demand activity, and returns rids — requires authentication. `lookup` is a pure read: no write, no activity log, no auth.
+             * @description resolve (default) contributes identifiers, creates missing catalog entries, and logs activity; authentication is required. lookup is a public read with no writes or activity logging.
              * @default resolve
              * @enum {string}
              */
             mode: "resolve" | "lookup";
+            /** @description Simulate contributions without storing properties, identifiers, facts, or activity. Reads existing catalog data; new handles are ephemeral. Reserved test domains are allowed only in sandbox mode. Defaults to false when omitted. */
+            sandbox?: boolean;
         };
         FactProvenance: {
             /**
-             * @description How the caller knows these identifiers — the trust/audit envelope on the fact. Determines the confidence the catalog assigns. `crawl` is reserved for server-side pipelines; callers use the others.
+             * @description How the caller knows these identifiers — the trust/audit envelope on the fact. Determines the confidence the catalog assigns. crawl is reserved for server-side pipelines; callers use the others.
              * @enum {string}
              */
             type: "agency_allowlist" | "publisher_declaration" | "impression_log" | "ssp_inventory" | "deal_history" | "crawl" | "data_partner" | "member_assertion";
-            /**
-             * @description Optional free-text annotation (campaign, dataset).
-             * @example unilever_q3
-             */
+            /** @description Optional free-text annotation (campaign, dataset). */
             context?: string;
         };
         CatalogDisputeTriageResult: {
@@ -5731,6 +5736,11 @@ export interface operations {
                 "application/json": {
                     /** @example examplepub.com */
                     publisher_domain: string;
+                    /**
+                     * @description Validate and simulate a save without persisting it. Allows reserved test hostnames.
+                     * @default false
+                     */
+                    sandbox?: boolean;
                     /**
                      * @description Ignored. Community-registry rows never assert sales authorization — the owner's origin adagents.json is the sole authorization source — so any value here is dropped and the stored document carries authorized_agents:[].
                      * @example []
@@ -5770,6 +5780,8 @@ export interface operations {
                         success: true;
                         message: string;
                         id: string;
+                        /** @enum {boolean} */
+                        sandbox?: true;
                         revision_number?: number;
                     };
                 };
@@ -8475,7 +8487,7 @@ export interface operations {
     getAgentAuthorizations: {
         parameters: {
             query: {
-                /** @description Agent URL to look up. Canonicalized server-side (lowercased, trailing slashes trimmed). */
+                /** @description Agent URL to look up. Canonicalized server-side per AdCP URL canonicalization: the scheme and host fold, the path does not. */
                 agent_url: string;
                 /** @description `effective` (default) applies override layer; `raw` reads base table. */
                 include?: "raw" | "effective";

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-10-16T23:43:47.149Z"
+  "synced_at": "2026-10-19T00:55:30.097Z"
 }

package/dist/lib/server/decisioning/runtime/from-platform.js

@@ -309,7 +309,10 @@ function projectResponseCreativeIdentities(value, operation, legacyFormatConvert
   let projected = dataRecord;
   if ((0, import_types2.isProjectionProductInput)(projected)) {
     if (wireMode === "canonical") {
-      const canonical = (0, import_augment_response.toCanonicalOnlyResponse)({ products: [projected] }, { legacyFormatConverter });
+      const canonical = (0, import_augment_response.toCanonicalOnlyResponse)(
+        { products: [projected] },
+        { legacyFormatConverter, _inferDualEmissionLegacyRefs: false }
+      );
       if (canonical.diagnostics.length > 0 || canonical.response.products.length !== 1) {
         throw new import_creative_delivery.CreativeFormatProjectionError(
           operation,
@@ -548,7 +551,8 @@ function asCanonicalProductResponse(response, legacyFormatConverter) {
   assertSafeGetProductsResponse(response);
   validateDualProductFormatDeclarations(response, legacyFormatConverter);
   const projected = (0, import_augment_response.toCanonicalOnlyResponse)(response, {
-    legacyFormatConverter
+    legacyFormatConverter,
+    _inferDualEmissionLegacyRefs: false
   });
   const blockingDiagnostics = projected.diagnostics.filter(
     (diagnostic) => diagnostic.code !== "LEGACY_FORMAT_ID_DROPPED_UNMAPPED"

package/dist/lib/server/decisioning/runtime/from-platform.mjs

@@ -338,7 +338,10 @@ function projectResponseCreativeIdentities(value, operation, legacyFormatConvert
   let projected = dataRecord;
   if (isProjectionProductInput(projected)) {
     if (wireMode === "canonical") {
-      const canonical = toCanonicalOnlyResponse({ products: [projected] }, { legacyFormatConverter });
+      const canonical = toCanonicalOnlyResponse(
+        { products: [projected] },
+        { legacyFormatConverter, _inferDualEmissionLegacyRefs: false }
+      );
       if (canonical.diagnostics.length > 0 || canonical.response.products.length !== 1) {
         throw new CreativeFormatProjectionError(
           operation,
@@ -577,7 +580,8 @@ function asCanonicalProductResponse(response, legacyFormatConverter) {
   assertSafeGetProductsResponse(response);
   validateDualProductFormatDeclarations(response, legacyFormatConverter);
   const projected = toCanonicalOnlyResponse(response, {
-    legacyFormatConverter
+    legacyFormatConverter,
+    _inferDualEmissionLegacyRefs: false
   });
   const blockingDiagnostics = projected.diagnostics.filter(
     (diagnostic) => diagnostic.code !== "LEGACY_FORMAT_ID_DROPPED_UNMAPPED"

package/dist/lib/testing/client.js

@@ -414,12 +414,10 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
         step.error = versionUnsupported;
       } else if (caps?.data) {
         profile.raw_capabilities = caps.data;
-        const validation = (0, import_client_hooks.validateIncomingResponse)(
-          "get_adcp_capabilities",
+        const validation = (0, import_schema_loader.withServedValidationVersion)(
           caps.data,
-          "strict",
-          void 0,
-          (0, import_schema_loader.resolveServedValidationVersion)(caps.data, schemaAdcpVersion ?? client.getAdcpVersion())
+          schemaAdcpVersion ?? client.getAdcpVersion(),
+          (validationVersion) => (0, import_client_hooks.validateIncomingResponse)("get_adcp_capabilities", caps.data, "strict", void 0, validationVersion)
         );
         if (!validation.valid) {
           profile.capabilities_schema_issues = validation.issues.map((issue) => ({

package/dist/lib/testing/client.mjs

@@ -10,7 +10,7 @@ import { SsrfRefusedError } from "../net/ssrf-fetch.mjs";
 import { ADCP_VERSION, toReleasePrecisionVersion } from "../version.mjs";
 import { createHmac, hkdfSync, randomBytes } from "node:crypto";
 import { validateIncomingResponse } from "../validation/client-hooks.mjs";
-import { resolveServedValidationVersion } from "../validation/schema-loader.mjs";
+import { withServedValidationVersion } from "../validation/schema-loader.mjs";
 import { extractVersionUnsupportedDetails } from "../utils/error-extraction.mjs";
 import { buildAgentSigningContext } from "../signing/client.mjs";
 import { bindAgentStorage } from "../auth/oauth/storage-registry.mjs";
@@ -374,12 +374,10 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
         step.error = versionUnsupported;
       } else if (caps?.data) {
         profile.raw_capabilities = caps.data;
-        const validation = validateIncomingResponse(
-          "get_adcp_capabilities",
+        const validation = withServedValidationVersion(
           caps.data,
-          "strict",
-          void 0,
-          resolveServedValidationVersion(caps.data, schemaAdcpVersion ?? client.getAdcpVersion())
+          schemaAdcpVersion ?? client.getAdcpVersion(),
+          (validationVersion) => validateIncomingResponse("get_adcp_capabilities", caps.data, "strict", void 0, validationVersion)
         );
         if (!validation.valid) {
           profile.capabilities_schema_issues = validation.issues.map((issue) => ({

package/dist/lib/testing/compliance/comply.js

@@ -1344,7 +1344,12 @@ async function complyImpl(agentUrl, options) {
   }
   (0, import_test_kit.validateTestKit)(testOptions.test_kit);
   const signal = externalSignal;
-  return await (0, import_schema_loader.withExternalSchemaRoot)(complianceIndex.adcp_version, scopedSchemaRoot, async () => {
+  return await (0, import_schema_loader.withExternalSchemaRoot)(
+    complianceIndex.adcp_version,
+    scopedSchemaRoot,
+    () => (0, import_schema_loader.withServedReleaseSchemaRoots)(testOptions.servedReleaseSchemaRoots, () => complyInSchemaScope())
+  );
+  async function complyInSchemaScope() {
     let effectiveOptions = (0, import_runner.applyAdcpVersionRunOptions)(complianceIndex.adcp_version, {
       ...testOptions,
       // `comply()` has always defaulted an unset transport to MCP when it built
@@ -1648,7 +1653,7 @@ async function complyImpl(agentUrl, options) {
       total_duration_ms: Date.now() - start,
       notices: noticesDedup
     };
-  });
+  }
 }
 function hasComplyTimeoutBudgetExpired(start, timeout_ms, now = Date.now()) {
   return timeout_ms !== void 0 && now - start >= timeout_ms;

package/dist/lib/testing/compliance/comply.mjs

@@ -28,7 +28,7 @@ import { closeScopedConnections, withMCPConnectionScope } from "../../protocols/
 import { detectController, hasTestController } from "../test-controller.mjs";
 import { randomBytes } from "crypto";
 import { isPre31AdcpVersion } from "../../utils/adcp-version-config.mjs";
-import { withExternalSchemaRoot } from "../../validation/schema-loader.mjs";
+import { withExternalSchemaRoot, withServedReleaseSchemaRoots } from "../../validation/schema-loader.mjs";
 import { redactOAuthUrlForOutput, redactOAuthUrlsInText } from "../storyboard/oauth-metadata-graph/index.mjs";
 import { LIBRARY_VERSION } from "../../version.mjs";
 import { validationFailsStep } from "../storyboard/validations.mjs";
@@ -1327,7 +1327,12 @@ async function complyImpl(agentUrl, options) {
   }
   validateTestKit(testOptions.test_kit);
   const signal = externalSignal;
-  return await withExternalSchemaRoot(complianceIndex.adcp_version, scopedSchemaRoot, async () => {
+  return await withExternalSchemaRoot(
+    complianceIndex.adcp_version,
+    scopedSchemaRoot,
+    () => withServedReleaseSchemaRoots(testOptions.servedReleaseSchemaRoots, () => complyInSchemaScope())
+  );
+  async function complyInSchemaScope() {
     let effectiveOptions = applyAdcpVersionRunOptions(complianceIndex.adcp_version, {
       ...testOptions,
       // `comply()` has always defaulted an unset transport to MCP when it built
@@ -1631,7 +1636,7 @@ async function complyImpl(agentUrl, options) {
       total_duration_ms: Date.now() - start,
       notices: noticesDedup
     };
-  });
+  }
 }
 function hasComplyTimeoutBudgetExpired(start, timeout_ms, now = Date.now()) {
   return timeout_ms !== void 0 && now - start >= timeout_ms;

package/dist/lib/testing/index.d.mts

@@ -16,5 +16,5 @@ export { isSandboxRequest, mergeSeededProductsIntoResponse, filterValidSeededPro
 export type { TestControllerBridge, TestControllerBridgeContext, BridgeFromSessionStoreOptions, SeededCreative, SeededMediaBuy, SeededAccountFinancials, } from '../server/test-controller-bridge.mjs';
 export { runAgainstLocalAgent } from './local-agent-runner.mjs';
 export type { LocalAgentRunResult, PerStoryboardOverride, RunAgainstLocalAgentOptions } from './local-agent-runner.mjs';
-export { registerExternalSchemaRoot, unregisterExternalSchemaRoot, withExternalSchemaRoot } from '../validation/index.mjs';
+export { registerExternalSchemaRoot, unregisterExternalSchemaRoot, withExternalSchemaRoot, withServedReleaseSchemaRoots, } from '../validation/index.mjs';
 export { runStoryboard, runStoryboardStep, applyAdcpVersionRunOptions, applyStoryboardVersionOptions, getFirstStepPreview, parseStoryboard, loadStoryboardFile, normalizeValidationOnlyTasks, VALIDATION_ONLY_TASK, applyFixtureBindingsToRequest, buildFixtureResolutionSpecs, FixtureBindingRegistry, matchesFixtureRequirements, normalizeFixtureMatchExpression, validateFixtureResolutionDeclarations, getComplianceCacheDir, loadComplianceIndex, listBundles, loadBundleStoryboards, listAllComplianceStoryboards, getComplianceStoryboardById, findBundleById, resolveBundleOrStoryboard, resolveStoryboardsForCapabilities, isComplianceVersionSupported, CapabilityResolutionError, TASK_TO_METHOD, executeStoryboardTask, expandCreativeAssetDirectives, findUnresolvedCreativeAssetDirectives, extractContext, injectContext, runValidations, resolvePath, RateLimitTripObserver, RATE_LIMIT_TRIP_CONTRACT, RATE_LIMIT_TRIP_DEFAULT_REPLAY_MAX_WAIT_SECONDS, RATE_LIMIT_TRIP_MAX_ATTEMPTS_MAX, RATE_LIMIT_TRIP_MAX_ATTEMPTS_MIN, validateRateLimitTripSpec, getSandboxEntities, getSandboxBrands, getSandboxBrand, isSandboxDomain, clearSandboxCache, registerAssertion, getAssertion, listAssertions, listDefaultAssertions, clearAssertionRegistry, resolveAssertions, type AssertionSpec, type AssertionContext, type AssertionResult, type RegisterAssertionOptions, type Storyboard, type StoryboardFixtureResolution, type FixtureResolutionStrategy, type FixtureMatchOperator, type FixtureMatchClause, type FixtureResolutionDeclaration, type ProductFixtureResolutionDeclaration, type PricingOptionFixtureResolutionDeclaration, type FixtureResolutionStatus, type FixtureResolutionRecord, type FixtureResolutionAttempt, type FixtureResolutionEvidence, type FixtureResolutionCoverageGap, type StoryboardInvariants, type StoryboardInvariantsObject, type StepInvariantsObject, type StoryboardPhase, type StoryboardStep, type RateLimitTripSpec, type StoryboardValidation, type RateLimitTripClient, type RateLimitTripFailureCode, type RateLimitTripObservation, type RateLimitTripObserverOptions, type RateLimitTripResponseSnapshot, type RateLimitTripStructuredResult, type RateLimitTripTaskOptions, type StoryboardContext, type StoryboardRunOptions, type TrustedMatchContextProviderEndpoint, type TrustedMatchContextRegistrationContext, type TrustedMatchContextRouterRunnerOptions, type TrustedMatchPublisherAuthOperation, type TrustedMatchPublisherCredentialState, type TrustedMatchPublisherAuthTls, type TrustedMatchPublisherAuthProbeConfiguration, type TrustedMatchPublisherAuthRunner, type ValidationResult, type StoryboardStepPreview, type StoryboardStepResult, type StoryboardStepHint, type StoryboardStepHintBase, type ContextValueRejectedHint, type ShapeDriftHint, type MissingRequiredFieldHint, type FormatMismatchHint, type MonotonicViolationHint, type ContextProvenanceEntry, type StoryboardPhaseResult, type StoryboardResult, type RunnerNotice, type NoticeCode, type NoticeSeverity, type AgentCapabilities, type BundleKind, type BundleRef, type CapabilityResolutionCode, type ComplianceIndex, type ComplianceIndexProtocol, type ComplianceIndexSpecialism, type ResolveOptions, type ResolvedBundle, type ResolvedStoryboards, type SandboxBrand, type SandboxAgent, type SandboxEntities, type BrandJson, type AdagentsJson, gradeOAuthMetadataGraph, gradeOAuthMetadataGraphVector, loadOAuthMetadataGraphVectors, normalizeOAuthResourceForComparison, redactOAuthUrlForOutput, type GradeOAuthMetadataGraphOptions, type OAuthMetadataGraphErrorCode, type OAuthMetadataGraphFinding, type OAuthMetadataGraphGrade, type OAuthMetadataGraphObservation, type OAuthMetadataGraphVector, type OAuthMetadataGraphVectorCorpus, BrandJsonSchema, AdagentsJsonSchema, MCP_SESSION_PROBE_TASK, } from './storyboard/index.mjs';

package/dist/lib/testing/index.d.ts

@@ -16,5 +16,5 @@ export { isSandboxRequest, mergeSeededProductsIntoResponse, filterValidSeededPro
 export type { TestControllerBridge, TestControllerBridgeContext, BridgeFromSessionStoreOptions, SeededCreative, SeededMediaBuy, SeededAccountFinancials, } from '../server/test-controller-bridge';
 export { runAgainstLocalAgent } from './local-agent-runner';
 export type { LocalAgentRunResult, PerStoryboardOverride, RunAgainstLocalAgentOptions } from './local-agent-runner';
-export { registerExternalSchemaRoot, unregisterExternalSchemaRoot, withExternalSchemaRoot } from '../validation';
+export { registerExternalSchemaRoot, unregisterExternalSchemaRoot, withExternalSchemaRoot, withServedReleaseSchemaRoots, } from '../validation';
 export { runStoryboard, runStoryboardStep, applyAdcpVersionRunOptions, applyStoryboardVersionOptions, getFirstStepPreview, parseStoryboard, loadStoryboardFile, normalizeValidationOnlyTasks, VALIDATION_ONLY_TASK, applyFixtureBindingsToRequest, buildFixtureResolutionSpecs, FixtureBindingRegistry, matchesFixtureRequirements, normalizeFixtureMatchExpression, validateFixtureResolutionDeclarations, getComplianceCacheDir, loadComplianceIndex, listBundles, loadBundleStoryboards, listAllComplianceStoryboards, getComplianceStoryboardById, findBundleById, resolveBundleOrStoryboard, resolveStoryboardsForCapabilities, isComplianceVersionSupported, CapabilityResolutionError, TASK_TO_METHOD, executeStoryboardTask, expandCreativeAssetDirectives, findUnresolvedCreativeAssetDirectives, extractContext, injectContext, runValidations, resolvePath, RateLimitTripObserver, RATE_LIMIT_TRIP_CONTRACT, RATE_LIMIT_TRIP_DEFAULT_REPLAY_MAX_WAIT_SECONDS, RATE_LIMIT_TRIP_MAX_ATTEMPTS_MAX, RATE_LIMIT_TRIP_MAX_ATTEMPTS_MIN, validateRateLimitTripSpec, getSandboxEntities, getSandboxBrands, getSandboxBrand, isSandboxDomain, clearSandboxCache, registerAssertion, getAssertion, listAssertions, listDefaultAssertions, clearAssertionRegistry, resolveAssertions, type AssertionSpec, type AssertionContext, type AssertionResult, type RegisterAssertionOptions, type Storyboard, type StoryboardFixtureResolution, type FixtureResolutionStrategy, type FixtureMatchOperator, type FixtureMatchClause, type FixtureResolutionDeclaration, type ProductFixtureResolutionDeclaration, type PricingOptionFixtureResolutionDeclaration, type FixtureResolutionStatus, type FixtureResolutionRecord, type FixtureResolutionAttempt, type FixtureResolutionEvidence, type FixtureResolutionCoverageGap, type StoryboardInvariants, type StoryboardInvariantsObject, type StepInvariantsObject, type StoryboardPhase, type StoryboardStep, type RateLimitTripSpec, type StoryboardValidation, type RateLimitTripClient, type RateLimitTripFailureCode, type RateLimitTripObservation, type RateLimitTripObserverOptions, type RateLimitTripResponseSnapshot, type RateLimitTripStructuredResult, type RateLimitTripTaskOptions, type StoryboardContext, type StoryboardRunOptions, type TrustedMatchContextProviderEndpoint, type TrustedMatchContextRegistrationContext, type TrustedMatchContextRouterRunnerOptions, type TrustedMatchPublisherAuthOperation, type TrustedMatchPublisherCredentialState, type TrustedMatchPublisherAuthTls, type TrustedMatchPublisherAuthProbeConfiguration, type TrustedMatchPublisherAuthRunner, type ValidationResult, type StoryboardStepPreview, type StoryboardStepResult, type StoryboardStepHint, type StoryboardStepHintBase, type ContextValueRejectedHint, type ShapeDriftHint, type MissingRequiredFieldHint, type FormatMismatchHint, type MonotonicViolationHint, type ContextProvenanceEntry, type StoryboardPhaseResult, type StoryboardResult, type RunnerNotice, type NoticeCode, type NoticeSeverity, type AgentCapabilities, type BundleKind, type BundleRef, type CapabilityResolutionCode, type ComplianceIndex, type ComplianceIndexProtocol, type ComplianceIndexSpecialism, type ResolveOptions, type ResolvedBundle, type ResolvedStoryboards, type SandboxBrand, type SandboxAgent, type SandboxEntities, type BrandJson, type AdagentsJson, gradeOAuthMetadataGraph, gradeOAuthMetadataGraphVector, loadOAuthMetadataGraphVectors, normalizeOAuthResourceForComparison, redactOAuthUrlForOutput, type GradeOAuthMetadataGraphOptions, type OAuthMetadataGraphErrorCode, type OAuthMetadataGraphFinding, type OAuthMetadataGraphGrade, type OAuthMetadataGraphObservation, type OAuthMetadataGraphVector, type OAuthMetadataGraphVectorCorpus, BrandJsonSchema, AdagentsJsonSchema, MCP_SESSION_PROBE_TASK, } from './storyboard';

package/dist/lib/testing/index.js

@@ -192,7 +192,8 @@ __export(testing_exports, {
   unregisterExternalSchemaRoot: () => import_validation.unregisterExternalSchemaRoot,
   validateFixtureResolutionDeclarations: () => import_storyboard.validateFixtureResolutionDeclarations,
   validateRateLimitTripSpec: () => import_storyboard.validateRateLimitTripSpec,
-  withExternalSchemaRoot: () => import_validation.withExternalSchemaRoot
+  withExternalSchemaRoot: () => import_validation.withExternalSchemaRoot,
+  withServedReleaseSchemaRoots: () => import_validation.withServedReleaseSchemaRoots
 });
 module.exports = __toCommonJS(testing_exports);
 var import_pending_web_flow_store = require('./pending-web-flow-store.js');
@@ -384,5 +385,6 @@ var import_storyboard = require('./storyboard/index.js');
   unregisterExternalSchemaRoot,
   validateFixtureResolutionDeclarations,
   validateRateLimitTripSpec,
-  withExternalSchemaRoot
+  withExternalSchemaRoot,
+  withServedReleaseSchemaRoots
 });

package/dist/lib/testing/index.mjs

@@ -122,7 +122,12 @@ import {
   bridgeFromSessionStore
 } from "../server/test-controller-bridge.mjs";
 import { runAgainstLocalAgent } from "./local-agent-runner.mjs";
-import { registerExternalSchemaRoot, unregisterExternalSchemaRoot, withExternalSchemaRoot } from "../validation/index.mjs";
+import {
+  registerExternalSchemaRoot,
+  unregisterExternalSchemaRoot,
+  withExternalSchemaRoot,
+  withServedReleaseSchemaRoots
+} from "../validation/index.mjs";
 import {
   runStoryboard,
   runStoryboardStep,
@@ -359,5 +364,6 @@ export {
   unregisterExternalSchemaRoot,
   validateFixtureResolutionDeclarations,
   validateRateLimitTripSpec,
-  withExternalSchemaRoot
+  withExternalSchemaRoot,
+  withServedReleaseSchemaRoots
 };

package/dist/lib/testing/storyboard/runner.js

@@ -770,14 +770,14 @@ async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
       options = (0, import_test_kit.resolveDeclaredTestKit)(storyboard, options);
       options = (0, import_native_a2a_compliance.applyNativeA2AComplianceTransportOptions)(options);
       const schemaRoot = getRunSchemaRoot(options);
+      const runBody = () => (0, import_schema_loader.withServedReleaseSchemaRoots)(
+        options.servedReleaseSchemaRoots,
+        () => runStoryboardBody(agentUrlOrUrls, storyboard, options)
+      );
       if (schemaRoot) {
-        return await (0, import_schema_loader.withExternalSchemaRoot)(
-          schemaRoot.adcpVersion,
-          schemaRoot.schemaRoot,
-          () => runStoryboardBody(agentUrlOrUrls, storyboard, options)
-        );
+        return await (0, import_schema_loader.withExternalSchemaRoot)(schemaRoot.adcpVersion, schemaRoot.schemaRoot, runBody);
       }
-      return await runStoryboardBody(agentUrlOrUrls, storyboard, options);
+      return await runBody();
     },
     { isolate: true }
   );
@@ -3102,14 +3102,14 @@ async function runStoryboardStep(agentUrl, storyboard, stepId, options = {}) {
       options = (0, import_test_kit.resolveDeclaredTestKit)(storyboard, options);
       options = (0, import_native_a2a_compliance.applyNativeA2AComplianceTransportOptions)(options);
       const schemaRoot = getRunSchemaRoot(options);
+      const runBody = () => (0, import_schema_loader.withServedReleaseSchemaRoots)(
+        options.servedReleaseSchemaRoots,
+        () => runStoryboardStepBody(agentUrl, storyboard, stepId, options)
+      );
       if (schemaRoot) {
-        return await (0, import_schema_loader.withExternalSchemaRoot)(
-          schemaRoot.adcpVersion,
-          schemaRoot.schemaRoot,
-          () => runStoryboardStepBody(agentUrl, storyboard, stepId, options)
-        );
+        return await (0, import_schema_loader.withExternalSchemaRoot)(schemaRoot.adcpVersion, schemaRoot.schemaRoot, runBody);
       }
-      return await runStoryboardStepBody(agentUrl, storyboard, stepId, options);
+      return await runBody();
     },
     { isolate: true }
   );

package/dist/lib/testing/storyboard/runner.mjs

@@ -60,7 +60,8 @@ import {
   getSchemaValidatorByRef,
   resolveBundleKey,
   schemaAllowsTopLevelField,
-  withExternalSchemaRoot
+  withExternalSchemaRoot,
+  withServedReleaseSchemaRoots
 } from "../../validation/schema-loader.mjs";
 import { ADCP_VERSION, parseAdcpMajorVersion } from "../../version.mjs";
 import {
@@ -792,14 +793,14 @@ async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
       options = resolveDeclaredTestKit(storyboard, options);
       options = applyNativeA2AComplianceTransportOptions(options);
       const schemaRoot = getRunSchemaRoot(options);
+      const runBody = () => withServedReleaseSchemaRoots(
+        options.servedReleaseSchemaRoots,
+        () => runStoryboardBody(agentUrlOrUrls, storyboard, options)
+      );
       if (schemaRoot) {
-        return await withExternalSchemaRoot(
-          schemaRoot.adcpVersion,
-          schemaRoot.schemaRoot,
-          () => runStoryboardBody(agentUrlOrUrls, storyboard, options)
-        );
+        return await withExternalSchemaRoot(schemaRoot.adcpVersion, schemaRoot.schemaRoot, runBody);
       }
-      return await runStoryboardBody(agentUrlOrUrls, storyboard, options);
+      return await runBody();
     },
     { isolate: true }
   );
@@ -3124,14 +3125,14 @@ async function runStoryboardStep(agentUrl, storyboard, stepId, options = {}) {
       options = resolveDeclaredTestKit(storyboard, options);
       options = applyNativeA2AComplianceTransportOptions(options);
       const schemaRoot = getRunSchemaRoot(options);
+      const runBody = () => withServedReleaseSchemaRoots(
+        options.servedReleaseSchemaRoots,
+        () => runStoryboardStepBody(agentUrl, storyboard, stepId, options)
+      );
       if (schemaRoot) {
-        return await withExternalSchemaRoot(
-          schemaRoot.adcpVersion,
-          schemaRoot.schemaRoot,
-          () => runStoryboardStepBody(agentUrl, storyboard, stepId, options)
-        );
+        return await withExternalSchemaRoot(schemaRoot.adcpVersion, schemaRoot.schemaRoot, runBody);
       }
-      return await runStoryboardStepBody(agentUrl, storyboard, stepId, options);
+      return await runBody();
     },
     { isolate: true }
   );

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.9.4";
+export declare const RUNNER_CAPABILITY_VERSION = "15.9.6";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.9.4";
+export declare const RUNNER_CAPABILITY_VERSION = "15.9.6";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.js

@@ -259,6 +259,21 @@ function mapZodIssueToSchemaKeyword(issue) {
   }
 }
 function validateResponseSchema(validation, ctx, taskResult) {
+  const pinnedVersion = ctx.adcpVersion;
+  if (ctx.taskName === "get_adcp_capabilities" && pinnedVersion !== void 0) {
+    return (0, import_schema_loader.withServedValidationVersion)(
+      taskResult.data,
+      pinnedVersion,
+      (validationVersion) => validateResponseSchemaForVersion(
+        validation,
+        validationVersion === pinnedVersion ? ctx : { ...ctx, adcpVersion: validationVersion, responseAdcpVersion: validationVersion },
+        taskResult
+      )
+    );
+  }
+  return validateResponseSchemaForVersion(validation, ctx, taskResult);
+}
+function validateResponseSchemaForVersion(validation, ctx, taskResult) {
   const taskName = ctx.taskName;
   const schemaIdentityVersion = ctx.adcpVersion ?? ctx.responseAdcpVersion ?? import_version.ADCP_VERSION;
   const { schema_id, schema_url } = resolveSchemaIdentity(ctx.responseSchemaRef, schemaIdentityVersion);
@@ -356,7 +371,14 @@ function validateResponseSchema(validation, ctx, taskResult) {
 }
 function isExternalResponseSchemaAuthoritative(ctx) {
   const validationVersion = responseSchemaValidationVersion(ctx.adcpVersion, ctx.responseAdcpVersion);
-  return validationVersion !== void 0 && (0, import_schema_loader.isExternalSchemaRootActive)(validationVersion);
+  if (validationVersion !== void 0 && (0, import_schema_loader.isExternalSchemaRootActive)(validationVersion)) return true;
+  const pinnedVersion = ctx.adcpVersion;
+  if (ctx.taskName !== "get_adcp_capabilities" || pinnedVersion === void 0 || !ctx.taskResult) return false;
+  return (0, import_schema_loader.withServedValidationVersion)(
+    ctx.taskResult.data,
+    pinnedVersion,
+    (version) => version !== pinnedVersion && (0, import_schema_loader.isExternalSchemaRootActive)(version)
+  );
 }
 function responseSchemaValidationVersion(adcpVersion, responseAdcpVersion) {
   if (adcpVersion && (0, import_schema_loader.isExternalSchemaRootActive)(adcpVersion)) return adcpVersion;

package/dist/lib/testing/storyboard/validations.mjs

@@ -2,7 +2,11 @@ import { prepareResponseForSchemaValidation, TOOL_RESPONSE_SCHEMAS } from "../..
 import { injectLegacyEnvelopeStatus } from "../../utils/envelope-status-compat.mjs";
 import { TRANSPORT_SUFFIX_REGEX } from "../../utils/a2a-discovery.mjs";
 import { validateResponse } from "../../validation/schema-validator.mjs";
-import { hasSchemaBundle, isExternalSchemaRootActive } from "../../validation/schema-loader.mjs";
+import {
+  hasSchemaBundle,
+  isExternalSchemaRootActive,
+  withServedValidationVersion
+} from "../../validation/schema-loader.mjs";
 import { ADCP_VERSION, LIBRARY_VERSION } from "../../version.mjs";
 import { isPre31AdcpVersion } from "../../utils/adcp-version-config.mjs";
 import { gte as semverGte, valid as validSemver } from "semver";
@@ -234,6 +238,21 @@ function mapZodIssueToSchemaKeyword(issue) {
   }
 }
 function validateResponseSchema(validation, ctx, taskResult) {
+  const pinnedVersion = ctx.adcpVersion;
+  if (ctx.taskName === "get_adcp_capabilities" && pinnedVersion !== void 0) {
+    return withServedValidationVersion(
+      taskResult.data,
+      pinnedVersion,
+      (validationVersion) => validateResponseSchemaForVersion(
+        validation,
+        validationVersion === pinnedVersion ? ctx : { ...ctx, adcpVersion: validationVersion, responseAdcpVersion: validationVersion },
+        taskResult
+      )
+    );
+  }
+  return validateResponseSchemaForVersion(validation, ctx, taskResult);
+}
+function validateResponseSchemaForVersion(validation, ctx, taskResult) {
   const taskName = ctx.taskName;
   const schemaIdentityVersion = ctx.adcpVersion ?? ctx.responseAdcpVersion ?? ADCP_VERSION;
   const { schema_id, schema_url } = resolveSchemaIdentity(ctx.responseSchemaRef, schemaIdentityVersion);
@@ -331,7 +350,14 @@ function validateResponseSchema(validation, ctx, taskResult) {
 }
 function isExternalResponseSchemaAuthoritative(ctx) {
   const validationVersion = responseSchemaValidationVersion(ctx.adcpVersion, ctx.responseAdcpVersion);
-  return validationVersion !== void 0 && isExternalSchemaRootActive(validationVersion);
+  if (validationVersion !== void 0 && isExternalSchemaRootActive(validationVersion)) return true;
+  const pinnedVersion = ctx.adcpVersion;
+  if (ctx.taskName !== "get_adcp_capabilities" || pinnedVersion === void 0 || !ctx.taskResult) return false;
+  return withServedValidationVersion(
+    ctx.taskResult.data,
+    pinnedVersion,
+    (version) => version !== pinnedVersion && isExternalSchemaRootActive(version)
+  );
 }
 function responseSchemaValidationVersion(adcpVersion, responseAdcpVersion) {
   if (adcpVersion && isExternalSchemaRootActive(adcpVersion)) return adcpVersion;