@adcp/sdk 16.0.0-beta.2 → 16.0.0-beta.3

package/dist/lib/testing/client.mjs

@@ -12,6 +12,7 @@ import { normalizeTransportOptions } from "../protocols/index.mjs";
 import { createHmac, hkdfSync, randomBytes } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { validateIncomingResponse } from "../validation/client-hooks.mjs";
+import { resolveServedValidationVersion } from "../validation/schema-loader.mjs";
 import { extractVersionUnsupportedDetails } from "../utils/error-extraction.mjs";
 import { buildAgentSigningContext } from "../signing/client.mjs";
 import { bindAgentStorage } from "../auth/oauth/storage-registry.mjs";
@@ -491,7 +492,7 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
           caps.data,
           "strict",
           void 0,
-          schemaAdcpVersion ?? client.getAdcpVersion()
+          resolveServedValidationVersion(caps.data, schemaAdcpVersion ?? client.getAdcpVersion())
         );
         if (!validation.valid) {
           profile.capabilities_schema_issues = validation.issues.map((issue) => ({

package/dist/lib/testing/scenarios/capabilities.js

@@ -239,7 +239,7 @@ function crossValidateProtocolsAndTools(capabilities, tools) {
     creative: import_capabilities.CREATIVE_TOOLS,
     sponsored_intelligence: import_capabilities.SPONSORED_INTELLIGENCE_TOOLS,
     trusted_match: import_capabilities.TRUSTED_MATCH_TOOLS,
-    compliance: import_capabilities.COMPLIANCE_TOOLS
+    compliance_testing: import_capabilities.COMPLIANCE_TOOLS
   };
   const perProtocolDiffs = {};
   for (const protocol of capabilities.protocols) {

package/dist/lib/testing/scenarios/capabilities.mjs

@@ -225,7 +225,7 @@ function crossValidateProtocolsAndTools(capabilities, tools) {
     creative: CREATIVE_TOOLS,
     sponsored_intelligence: SPONSORED_INTELLIGENCE_TOOLS,
     trusted_match: TRUSTED_MATCH_TOOLS,
-    compliance: COMPLIANCE_TOOLS
+    compliance_testing: COMPLIANCE_TOOLS
   };
   const perProtocolDiffs = {};
   for (const protocol of capabilities.protocols) {

package/dist/lib/testing/storyboard/request-signing/builder.js

@@ -24,6 +24,7 @@ __export(builder_exports, {
 });
 module.exports = __toCommonJS(builder_exports);
 var import_crypto = require("crypto");
+var import_crypto2 = require('../../../signing/crypto.js');
 var import_signing = require('../../../signing/index.js');
 var import_vector_loader = require('./vector-loader.js');
 function buildPositiveRequest(vector, keys, options = {}) {
@@ -571,11 +572,7 @@ function formatParamsWithOmissions(components, params, override) {
   return `(${componentList});${pairs.join(";")}`;
 }
 function produceSignature(key, data) {
-  const privateKey = (0, import_crypto.createPrivateKey)({ key: key.privateKey, format: "jwk" });
-  if (key.alg === "ed25519") {
-    return new Uint8Array((0, import_crypto.sign)(null, data, privateKey));
-  }
-  return new Uint8Array((0, import_crypto.sign)("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+  return (0, import_crypto2.signWithPrivateJwk)(key.alg, key.privateKey, data);
 }
 function signerKeyFor(vector, keys) {
   const kid = vector.jwks_ref?.[0];

package/dist/lib/testing/storyboard/request-signing/builder.mjs

@@ -1,4 +1,5 @@
-import { createHash, createPrivateKey, randomBytes, randomUUID, sign as nodeSign } from "crypto";
+import { createHash, randomBytes, randomUUID } from "crypto";
+import { signWithPrivateJwk } from "../../../signing/crypto.mjs";
 import {
   buildSignatureBase,
   computeContentDigest,
@@ -554,11 +555,7 @@ function formatParamsWithOmissions(components, params, override) {
   return `(${componentList});${pairs.join(";")}`;
 }
 function produceSignature(key, data) {
-  const privateKey = createPrivateKey({ key: key.privateKey, format: "jwk" });
-  if (key.alg === "ed25519") {
-    return new Uint8Array(nodeSign(null, data, privateKey));
-  }
-  return new Uint8Array(nodeSign("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+  return signWithPrivateJwk(key.alg, key.privateKey, data);
 }
 function signerKeyFor(vector, keys) {
   const kid = vector.jwks_ref?.[0];

package/dist/lib/testing/storyboard/signer-grader/grader.js

@@ -22,7 +22,7 @@ __export(grader_exports, {
 });
 module.exports = __toCommonJS(grader_exports);
 var import_promises = require("node:fs/promises");
-var import_node_crypto = require("node:crypto");
+var import_crypto = require('../../../signing/crypto.js');
 var import_signing = require('../../../signing/index.js');
 var import_ssrf_fetch = require('../../../net/ssrf-fetch.js');
 var import_content_digest = require('../../../signing/content-digest.js');
@@ -175,12 +175,7 @@ async function keyFileProvider(filePath, kid, algorithm) {
     algorithm,
     fingerprint: `key-file:${kid}`,
     async sign(payload) {
-      const privateKey = (0, import_node_crypto.createPrivateKey)({ key: jwk, format: "jwk" });
-      const data = Buffer.from(payload);
-      if (algorithm === "ed25519") {
-        return new Uint8Array((0, import_node_crypto.sign)(null, data, privateKey));
-      }
-      return new Uint8Array((0, import_node_crypto.sign)("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+      return (0, import_crypto.signWithPrivateJwkAsync)(algorithm, jwk, payload);
     }
   };
 }

package/dist/lib/testing/storyboard/signer-grader/grader.mjs

@@ -1,5 +1,5 @@
 import { readFile } from "node:fs/promises";
-import { createPrivateKey, sign as nodeSign } from "node:crypto";
+import { signWithPrivateJwkAsync } from "../../../signing/crypto.mjs";
 import {
   HttpsJwksResolver,
   InMemoryReplayStore,
@@ -159,12 +159,7 @@ async function keyFileProvider(filePath, kid, algorithm) {
     algorithm,
     fingerprint: `key-file:${kid}`,
     async sign(payload) {
-      const privateKey = createPrivateKey({ key: jwk, format: "jwk" });
-      const data = Buffer.from(payload);
-      if (algorithm === "ed25519") {
-        return new Uint8Array(nodeSign(null, data, privateKey));
-      }
-      return new Uint8Array(nodeSign("sha256", data, { key: privateKey, dsaEncoding: "ieee-p1363" }));
+      return signWithPrivateJwkAsync(algorithm, jwk, payload);
     }
   };
 }

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.2";
+export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.3";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.2";
+export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.3";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/types/enums.generated.d.mts

@@ -98,6 +98,8 @@ export declare const FrequencyCapDurationUnitValues: readonly ["seconds", "minut
 export declare const FrequencyCapMutableFieldValues: readonly ["max_impressions", "per", "window", "suppress"];
 export declare const FrequencyCapScopeValues: readonly ["package"];
 export declare const GenreTaxonomyValues: readonly ["iab_content_3.0", "iab_content_2.2", "gracenote", "eidr", "apple_genres", "google_genres", "roku", "amazon_genres", "custom"];
+export declare const GeographicPlaceIdentifierSystemValues: readonly ["geonames", "google_ads", "microsoft_ads"];
+export declare const GeographicPlaceTypeValues: readonly ["airport", "borough", "city", "city_region", "commune", "county", "district", "municipality", "neighborhood", "post_town", "prefecture", "province", "quarter", "state", "territory", "ward"];
 export declare const GeographicTargetingLevelValues: readonly ["country", "region", "metro", "postal_area"];
 export declare const GOPTypeValues: readonly ["closed", "open"];
 export declare const GovernanceDecisionValues: readonly ["approved", "denied", "conditions"];
@@ -200,6 +202,7 @@ export declare const SortMetricValues: readonly ["impressions", "spend", "clicks
 export declare const SpecialCategoryValues: readonly ["awards", "championship", "concert", "conference", "election", "festival", "gala", "holiday", "premiere", "product_launch", "reunion", "tribute"];
 export declare const SponsoredPlacementTypeValues: readonly ["sponsored_search", "sponsored_display", "sponsored_native"];
 export declare const StandardScopeValues: readonly ["attestation_verifier"];
+export declare const StartTimingValues: readonly ["asap"];
 export declare const StoryboardStatusValues: readonly ["passing", "failing", "partial", "untested", "skipped", "not_selected", "unknown"];
 export declare const TalentRoleValues: readonly ["host", "guest", "creator", "cast", "narrator", "producer", "correspondent", "commentator", "analyst"];
 export declare const TaskStatusValues: readonly ["submitted", "working", "input-required", "completed", "canceled", "failed", "rejected", "auth-required", "unknown"];

package/dist/lib/types/enums.generated.d.ts

@@ -98,6 +98,8 @@ export declare const FrequencyCapDurationUnitValues: readonly ["seconds", "minut
 export declare const FrequencyCapMutableFieldValues: readonly ["max_impressions", "per", "window", "suppress"];
 export declare const FrequencyCapScopeValues: readonly ["package"];
 export declare const GenreTaxonomyValues: readonly ["iab_content_3.0", "iab_content_2.2", "gracenote", "eidr", "apple_genres", "google_genres", "roku", "amazon_genres", "custom"];
+export declare const GeographicPlaceIdentifierSystemValues: readonly ["geonames", "google_ads", "microsoft_ads"];
+export declare const GeographicPlaceTypeValues: readonly ["airport", "borough", "city", "city_region", "commune", "county", "district", "municipality", "neighborhood", "post_town", "prefecture", "province", "quarter", "state", "territory", "ward"];
 export declare const GeographicTargetingLevelValues: readonly ["country", "region", "metro", "postal_area"];
 export declare const GOPTypeValues: readonly ["closed", "open"];
 export declare const GovernanceDecisionValues: readonly ["approved", "denied", "conditions"];
@@ -200,6 +202,7 @@ export declare const SortMetricValues: readonly ["impressions", "spend", "clicks
 export declare const SpecialCategoryValues: readonly ["awards", "championship", "concert", "conference", "election", "festival", "gala", "holiday", "premiere", "product_launch", "reunion", "tribute"];
 export declare const SponsoredPlacementTypeValues: readonly ["sponsored_search", "sponsored_display", "sponsored_native"];
 export declare const StandardScopeValues: readonly ["attestation_verifier"];
+export declare const StartTimingValues: readonly ["asap"];
 export declare const StoryboardStatusValues: readonly ["passing", "failing", "partial", "untested", "skipped", "not_selected", "unknown"];
 export declare const TalentRoleValues: readonly ["host", "guest", "creator", "cast", "narrator", "producer", "correspondent", "commentator", "analyst"];
 export declare const TaskStatusValues: readonly ["submitted", "working", "input-required", "completed", "canceled", "failed", "rejected", "auth-required", "unknown"];

package/dist/lib/types/enums.generated.js

@@ -121,6 +121,8 @@ __export(enums_generated_exports, {
   FrequencyCapScopeValues: () => FrequencyCapScopeValues,
   GOPTypeValues: () => GOPTypeValues,
   GenreTaxonomyValues: () => GenreTaxonomyValues,
+  GeographicPlaceIdentifierSystemValues: () => GeographicPlaceIdentifierSystemValues,
+  GeographicPlaceTypeValues: () => GeographicPlaceTypeValues,
   GeographicTargetingLevelValues: () => GeographicTargetingLevelValues,
   GovernanceDecisionValues: () => GovernanceDecisionValues,
   GovernanceDomainValues: () => GovernanceDomainValues,
@@ -223,6 +225,7 @@ __export(enums_generated_exports, {
   SpecialCategoryValues: () => SpecialCategoryValues,
   SponsoredPlacementTypeValues: () => SponsoredPlacementTypeValues,
   StandardScopeValues: () => StandardScopeValues,
+  StartTimingValues: () => StartTimingValues,
   StoryboardStatusValues: () => StoryboardStatusValues,
   TMPResponseTypeValues: () => TMPResponseTypeValues,
   TalentRoleValues: () => TalentRoleValues,
@@ -354,6 +357,8 @@ const FrequencyCapDurationUnitValues = ["seconds", "minutes", "hours", "days", "
 const FrequencyCapMutableFieldValues = ["max_impressions", "per", "window", "suppress"];
 const FrequencyCapScopeValues = ["package"];
 const GenreTaxonomyValues = ["iab_content_3.0", "iab_content_2.2", "gracenote", "eidr", "apple_genres", "google_genres", "roku", "amazon_genres", "custom"];
+const GeographicPlaceIdentifierSystemValues = ["geonames", "google_ads", "microsoft_ads"];
+const GeographicPlaceTypeValues = ["airport", "borough", "city", "city_region", "commune", "county", "district", "municipality", "neighborhood", "post_town", "prefecture", "province", "quarter", "state", "territory", "ward"];
 const GeographicTargetingLevelValues = ["country", "region", "metro", "postal_area"];
 const GOPTypeValues = ["closed", "open"];
 const GovernanceDecisionValues = ["approved", "denied", "conditions"];
@@ -455,6 +460,7 @@ const SortMetricValues = ["impressions", "spend", "clicks", "ctr", "views", "com
 const SpecialCategoryValues = ["awards", "championship", "concert", "conference", "election", "festival", "gala", "holiday", "premiere", "product_launch", "reunion", "tribute"];
 const SponsoredPlacementTypeValues = ["sponsored_search", "sponsored_display", "sponsored_native"];
 const StandardScopeValues = ["attestation_verifier"];
+const StartTimingValues = ["asap"];
 const StoryboardStatusValues = ["passing", "failing", "partial", "untested", "skipped", "not_selected", "unknown"];
 const TalentRoleValues = ["host", "guest", "creator", "cast", "narrator", "producer", "correspondent", "commentator", "analyst"];
 const TaskStatusValues = ["submitted", "working", "input-required", "completed", "canceled", "failed", "rejected", "auth-required", "unknown"];
@@ -712,6 +718,8 @@ const RequestSigningErrorCodeMetadata = Object.freeze(requestSigningErrorCodeMet
   FrequencyCapScopeValues,
   GOPTypeValues,
   GenreTaxonomyValues,
+  GeographicPlaceIdentifierSystemValues,
+  GeographicPlaceTypeValues,
   GeographicTargetingLevelValues,
   GovernanceDecisionValues,
   GovernanceDomainValues,
@@ -814,6 +822,7 @@ const RequestSigningErrorCodeMetadata = Object.freeze(requestSigningErrorCodeMet
   SpecialCategoryValues,
   SponsoredPlacementTypeValues,
   StandardScopeValues,
+  StartTimingValues,
   StoryboardStatusValues,
   TMPResponseTypeValues,
   TalentRoleValues,

package/dist/lib/types/enums.generated.mjs

@@ -98,6 +98,8 @@ const FrequencyCapDurationUnitValues = ["seconds", "minutes", "hours", "days", "
 const FrequencyCapMutableFieldValues = ["max_impressions", "per", "window", "suppress"];
 const FrequencyCapScopeValues = ["package"];
 const GenreTaxonomyValues = ["iab_content_3.0", "iab_content_2.2", "gracenote", "eidr", "apple_genres", "google_genres", "roku", "amazon_genres", "custom"];
+const GeographicPlaceIdentifierSystemValues = ["geonames", "google_ads", "microsoft_ads"];
+const GeographicPlaceTypeValues = ["airport", "borough", "city", "city_region", "commune", "county", "district", "municipality", "neighborhood", "post_town", "prefecture", "province", "quarter", "state", "territory", "ward"];
 const GeographicTargetingLevelValues = ["country", "region", "metro", "postal_area"];
 const GOPTypeValues = ["closed", "open"];
 const GovernanceDecisionValues = ["approved", "denied", "conditions"];
@@ -199,6 +201,7 @@ const SortMetricValues = ["impressions", "spend", "clicks", "ctr", "views", "com
 const SpecialCategoryValues = ["awards", "championship", "concert", "conference", "election", "festival", "gala", "holiday", "premiere", "product_launch", "reunion", "tribute"];
 const SponsoredPlacementTypeValues = ["sponsored_search", "sponsored_display", "sponsored_native"];
 const StandardScopeValues = ["attestation_verifier"];
+const StartTimingValues = ["asap"];
 const StoryboardStatusValues = ["passing", "failing", "partial", "untested", "skipped", "not_selected", "unknown"];
 const TalentRoleValues = ["host", "guest", "creator", "cast", "narrator", "producer", "correspondent", "commentator", "analyst"];
 const TaskStatusValues = ["submitted", "working", "input-required", "completed", "canceled", "failed", "rejected", "auth-required", "unknown"];
@@ -455,6 +458,8 @@ export {
   FrequencyCapScopeValues,
   GOPTypeValues,
   GenreTaxonomyValues,
+  GeographicPlaceIdentifierSystemValues,
+  GeographicPlaceTypeValues,
   GeographicTargetingLevelValues,
   GovernanceDecisionValues,
   GovernanceDomainValues,
@@ -557,6 +562,7 @@ export {
   SpecialCategoryValues,
   SponsoredPlacementTypeValues,
   StandardScopeValues,
+  StartTimingValues,
   StoryboardStatusValues,
   TMPResponseTypeValues,
   TalentRoleValues,

package/dist/lib/validation/schema-loader.js

@@ -48,6 +48,7 @@ __export(schema_loader_exports, {
   listValidatorKeys: () => listValidatorKeys,
   registerExternalSchemaRoot: () => registerExternalSchemaRoot,
   resolveBundleKey: () => resolveBundleKey,
+  resolveServedValidationVersion: () => resolveServedValidationVersion,
   schemaAllowsTopLevelField: () => schemaAllowsTopLevelField,
   toReleasePrecisionWire: () => toReleasePrecisionWire,
   unregisterExternalSchemaRoot: () => unregisterExternalSchemaRoot,
@@ -754,6 +755,29 @@ function hasSchemaBundle(version) {
     return false;
   }
 }
+const SERVED_RELEASE_MAJOR = /^(\d+)\.\d+(?:-[a-zA-Z0-9.-]+)?$/;
+const NUMERIC_PIN_MAJOR = /^(\d+)\.\d+/;
+function resolveServedValidationVersion(response, pinnedVersion) {
+  const pinMajor = NUMERIC_PIN_MAJOR.exec(pinnedVersion)?.[1];
+  if (pinMajor === void 0) return pinnedVersion;
+  try {
+    if (isExternalSchemaRootActive(pinnedVersion)) return pinnedVersion;
+  } catch {
+    return pinnedVersion;
+  }
+  const echoed = response !== null && typeof response === "object" ? response.adcp_version : void 0;
+  if (typeof echoed !== "string") return pinnedVersion;
+  const echoMajor = SERVED_RELEASE_MAJOR.exec(echoed)?.[1];
+  if (echoMajor === void 0 || echoMajor !== pinMajor) return pinnedVersion;
+  let pinnedRelease;
+  try {
+    pinnedRelease = toReleasePrecisionWire(pinnedVersion);
+  } catch {
+    return pinnedVersion;
+  }
+  if (echoed === pinnedRelease) return pinnedVersion;
+  return hasSchemaBundle(echoed) ? echoed : pinnedVersion;
+}
 const mcpToolSchemaCache = /* @__PURE__ */ new Map();
 const mcpToolSummaryCache = /* @__PURE__ */ new Map();
 function boundedMcpToolSummary(value) {
@@ -1019,6 +1043,7 @@ function cloneJsonValue(value) {
   listValidatorKeys,
   registerExternalSchemaRoot,
   resolveBundleKey,
+  resolveServedValidationVersion,
   schemaAllowsTopLevelField,
   toReleasePrecisionWire,
   unregisterExternalSchemaRoot,

package/dist/lib/validation/schema-loader.mjs

@@ -701,6 +701,29 @@ function hasSchemaBundle(version) {
     return false;
   }
 }
+const SERVED_RELEASE_MAJOR = /^(\d+)\.\d+(?:-[a-zA-Z0-9.-]+)?$/;
+const NUMERIC_PIN_MAJOR = /^(\d+)\.\d+/;
+function resolveServedValidationVersion(response, pinnedVersion) {
+  const pinMajor = NUMERIC_PIN_MAJOR.exec(pinnedVersion)?.[1];
+  if (pinMajor === void 0) return pinnedVersion;
+  try {
+    if (isExternalSchemaRootActive(pinnedVersion)) return pinnedVersion;
+  } catch {
+    return pinnedVersion;
+  }
+  const echoed = response !== null && typeof response === "object" ? response.adcp_version : void 0;
+  if (typeof echoed !== "string") return pinnedVersion;
+  const echoMajor = SERVED_RELEASE_MAJOR.exec(echoed)?.[1];
+  if (echoMajor === void 0 || echoMajor !== pinMajor) return pinnedVersion;
+  let pinnedRelease;
+  try {
+    pinnedRelease = toReleasePrecisionWire(pinnedVersion);
+  } catch {
+    return pinnedVersion;
+  }
+  if (echoed === pinnedRelease) return pinnedVersion;
+  return hasSchemaBundle(echoed) ? echoed : pinnedVersion;
+}
 const mcpToolSchemaCache = /* @__PURE__ */ new Map();
 const mcpToolSummaryCache = /* @__PURE__ */ new Map();
 function boundedMcpToolSummary(value) {
@@ -965,6 +988,7 @@ export {
   listValidatorKeys,
   registerExternalSchemaRoot,
   resolveBundleKey,
+  resolveServedValidationVersion,
   schemaAllowsTopLevelField,
   toReleasePrecisionWire,
   unregisterExternalSchemaRoot,

package/dist/lib/version.d.mts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "16.0.0-beta.2";
+export declare const LIBRARY_VERSION = "16.0.0-beta.3";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "16.0.0-beta.2";
+    readonly library: "16.0.0-beta.3";
     readonly adcp: "3.2.4";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
-    readonly generatedAt: "2026-10-15T15:37:12.181Z";
+    readonly generatedAt: "2026-10-15T18:57:32.995Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.d.ts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "16.0.0-beta.2";
+export declare const LIBRARY_VERSION = "16.0.0-beta.3";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "16.0.0-beta.2";
+    readonly library: "16.0.0-beta.3";
     readonly adcp: "3.2.4";
     readonly compatibleVersions: readonly ["v2.5", "v2.6", "v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4"];
-    readonly generatedAt: "2026-10-15T15:37:12.181Z";
+    readonly generatedAt: "2026-10-15T18:57:32.995Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.js

@@ -31,7 +31,7 @@ __export(version_exports, {
   toReleasePrecisionVersion: () => toReleasePrecisionVersion
 });
 module.exports = __toCommonJS(version_exports);
-const LIBRARY_VERSION = "16.0.0-beta.2";
+const LIBRARY_VERSION = "16.0.0-beta.3";
 const ADCP_VERSION = "3.2.4";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -98,10 +98,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2.4"
 ];
 const VERSION_INFO = {
-  library: "16.0.0-beta.2",
+  library: "16.0.0-beta.3",
   adcp: "3.2.4",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-15T15:37:12.181Z"
+  generatedAt: "2026-10-15T18:57:32.995Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/dist/lib/version.mjs

@@ -1,4 +1,4 @@
-const LIBRARY_VERSION = "16.0.0-beta.2";
+const LIBRARY_VERSION = "16.0.0-beta.3";
 const ADCP_VERSION = "3.2.4";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -65,10 +65,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.2.4"
 ];
 const VERSION_INFO = {
-  library: "16.0.0-beta.2",
+  library: "16.0.0-beta.3",
   adcp: "3.2.4",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-15T15:37:12.181Z"
+  generatedAt: "2026-10-15T18:57:32.995Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/docs/TYPE-SUMMARY.md

@@ -1,7 +1,7 @@
 # AdCP Type Summary
 
 > Generated at: 2026-10-15
-> @adcp/sdk v16.0.0-beta.2
+> @adcp/sdk v16.0.0-beta.3
 
 Curated reference of the types that matter for using the AdCP client. For full generated types see `src/lib/types/tools.generated.ts` and `src/lib/types/core.generated.ts`.
 
@@ -49,6 +49,11 @@ interface A2ALegacyCompatOptions {
 }
 
 interface TransportOptions {
+  // Defaults to 4 MiB (DEFAULT_MAX_RESPONSE_BYTES); only 0 opts out
+  // (Infinity / negatives fall back to the default).
+  // SSE is bounded per event plus `maxResponseBytes * 2` cumulative per call.
+  // Over-cap responses throw ResponseTooLargeError; nothing is truncated.
+  // A per-call `transport` replaces this object; it does not merge.
   maxResponseBytes?: number;
   trustedFetchFn?: typeof fetch;
   allowPrivateIp?: boolean;

package/docs/guides/DISCOVERY-CACHE-AND-SESSION-REUSE.md

@@ -55,7 +55,7 @@ The key is a SHA-256 over:
 | configured `adcpVersion` / `wireAdcpVersion`         | negotiated version                                                                                                     |
 | every non-correlation, non-credential header         | unknown `x-*` tenant / routing / policy headers can select a different upstream view, so they fail closed into the key. This includes `baggage`, **ambient OpenTelemetry baggage included** |
 | request-signing identity and policy                  | `kind`, `kid`, `alg`, agent URL and signing policy; never the private key                                              |
-| effective `allowPrivateIp`, `maxResponseBytes`       | the transport policy the evidence was gathered under (per-call `transport` overrides included)                         |
+| configured `allowPrivateIp`, `maxResponseBytes`      | the transport policy the evidence was gathered under (per-call `transport` overrides included). These are the values the caller *configured*, not the effective ones: an unset `maxResponseBytes` keys as "unset" rather than as the 4 MiB default, so entries written before the default landed stay reusable. The MCP connection cache keys the *resolved* cap instead — see [Reusable MCP connections](#reusable-mcp-connections) |
 
 Not part of the key: correlation headers (`x-request-id`, `x-correlation-id`, `traceparent`, ...), and credential header values (`Authorization`, `x-adcp-auth`) — OAuth and `auth_token` credentials are also owned by `authIdentity`; a token rotation for the same authorization scope keeps the entry. **Choose `authIdentity` at least as narrow as the credential's authorization scope.** Change the identity or invalidate the cache when permissions change or access is revoked; use a distinct identity for anonymous access. Two principals must never share an identity. Keys are hashes and never contain the identity, token or header values.
 
@@ -101,7 +101,7 @@ Unlike [`primeCapabilities`](../TYPE-SUMMARY.md) — which stays client-bound an
 
 This behavior applies by default, including calls that pass a signal or timeout outside a connection scope. The process-wide legacy/OAuth session cache retains at most 20 connections per cache with LRU eviction and has no idle expiry. For request workflows with many distinct credentials, use a scope to bound session lifetime. At process shutdown, `closeConnections()` from `@adcp/sdk/advanced` closes the process-wide connections.
 
-A reusable session is keyed only by what changes the _connection_: endpoint, credential, tenant / routing headers, signing identity, `allowPrivateIp`, a caller-injected fetch, and the workflow scope. These no longer choose or split a session:
+A reusable session is keyed only by what changes the _connection_: endpoint, credential, tenant / routing headers, signing identity, `allowPrivateIp`, `maxResponseBytes`, a caller-injected fetch, and the workflow scope. These no longer choose or split a session:
 
 - **Correlation headers**: `traceparent`, `tracestate`, `x-request-id`, `x-correlation-id`, `x-trace-id`, `x-span-id`, `x-debug-id`, `x-client-request-id`, `x-b3-*`, `x-amzn-trace-id`, `x-cloud-trace-context`, `x-datadog-*`, `sentry-trace`, and vendor-prefixed `x-<vendor>-request-id` / `-correlation-id` / `-trace-id` / `-span-id` / `-debug-id`. Names suggesting credentials or tenant/routing identity (including `auth`, `token`, `tenant`, `account`, `workspace`, `seat`, `advertiser`, `publisher`, `buyer` and `seller`) are never treated as correlation. **`baggage` stays in the key**: it can carry tenant or routing members. Any header outside the list above also stays in the key (fail closed).
 - **`AbortSignal`** and **`requestTimeoutMs`**: they bound a call.
@@ -114,6 +114,7 @@ Isolation properties:
 - A caller that joins another caller's in-flight connect waits under its own signal and timeout. If the creator cancels the connect, the joiner retries for itself, with at most two retries after foreign aborts.
 - A caller-injected `fetchFn` (a per-call network trust boundary) keeps its own one-shot session outside a connection scope; inside a scope its identity is part of the key.
 - Connections are never shared across credentials, tenant headers, signing identities or `allowPrivateIp` settings.
+- Connections are never shared across different `maxResponseBytes` values either. The response cap is decided once per request, and a session's standalone `GET` event-stream listener issues exactly one request — at connect time — so it carries whatever policy opened the connection for the life of that connection. Sharing across policies would let one `maxResponseBytes: 0` call hand an uncapped listener to every later caller. The key uses the *resolved* cap, so an explicit `4 * 1024 * 1024` and an unset value are the same policy and share a session; `0` and any other number each get their own. Varying the cap per call therefore costs a session per distinct value against the same agent, against a 20-entry LRU — prefer a single client-level value where you can, or pin the session with `withMCPConnectionScope` where continuity matters.
 
 ### Public connection scope
 

package/docs/guides/UNIVERSAL-MACRO-COMPILATION.md

@@ -96,3 +96,41 @@ Do not create a global mapping based only on a token's spelling. A token such as
 cookie for another, and an account identifier for a third. Scope every mapping
 to its source dialect and keep the supporting vendor documentation with the
 registry entry.
+
+Vendor-scoped TCF mappings retain the complete receiving vendor ID: map
+`${GDPR_CONSENT_755}` to `{GDPR_CONSENT_755}`, never to unscoped
+`{GDPR_CONSENT}` or another vendor's token. The suffix must be a positive
+decimal integer without leading zeros. `{ADDTL_CONSENT}` is also supported,
+with the same source-dialect and documentation requirements. Its CMP-provided
+value is opaque; the helper does not generate consent or modify provider lists.
+
+For the return translation, supply exact native mappings:
+
+```typescript
+import { translateUniversalMacros } from '@adcp/sdk/substitution';
+
+const translated = translateUniversalMacros(
+  'https://pixel.vendor.example/i?gdpr={GDPR}&c={GDPR_CONSENT_755}&a={ADDTL_CONSENT}',
+  {
+    '{GDPR}': { native: '${GDPR}' },
+    '{GDPR_CONSENT_755}': { native: '${GDPR_CONSENT_755}' },
+    '{ADDTL_CONSENT}': { native: '${ADDTL_CONSENT}' },
+  }
+);
+```
+
+Existing native tokens pass through unchanged. The emitted URL may contain at
+most one scoped TCF token, including pre-existing tokens and native aliases
+identified by the supplied mappings. After dropping unsupported parameters,
+multiple occurrences throw `MultipleVendorConsentMacrosError` with code
+`multiple_vendor_consent_macros` and the second token in canonical AdCP form.
+Additional Consent does not count toward that limit. Concrete `value` mappings
+are encoded and reported in `frozen_consent_macros`; missing consent mappings
+appear in `dropped_consent_macros`. When an unscoped target requires an unknown
+vendor ID, use `'{GDPR_CONSENT}': { value: '' }` and translate `{GDPR}`
+independently rather than guessing an ID.
+
+These helpers implement the AdCP 3.3 translation contract. Generated protocol
+types and declaration/capability validation still follow the SDK's pinned schema
+release. Helper support alone does not establish a resolver's declared support
+for a scoped token or Additional Consent.

package/docs/guides/VALIDATE-YOUR-AGENT.md

@@ -668,6 +668,18 @@ try {
 
 These policies follow the language-neutral fixture ratified in [AdCP #6674](https://github.com/adcontextprotocol/adcp/issues/6674).
 
+The AdCP 3.3 fixture also covers vendor-scoped `{GDPR_CONSENT_<gvl_id>}` and
+`{ADDTL_CONSENT}`. Preserve the receiving vendor ID and treat Additional Consent
+as opaque CMP data. Both participate in dropped/frozen consent diagnostics.
+After unsupported parameters are dropped, a URL with multiple scoped TCF
+occurrences throws `MultipleVendorConsentMacrosError` (exported from both
+`@adcp/sdk` and `@adcp/sdk/substitution`), with code
+`multiple_vendor_consent_macros` and the canonical second token in `macro`.
+Existing native tokens and verified native aliases count; encoded concrete
+values and Additional Consent do not. See the
+[compilation guide](UNIVERSAL-MACRO-COMPILATION.md) for mapping and schema-version
+boundaries.
+
 ---
 
 ## The fork-matrix: canonical adapter → compliance

package/docs/llms.txt

@@ -1,7 +1,7 @@
 # Ad Context Protocol (AdCP)
 
 > Generated at: 2026-10-15
-> Library: @adcp/sdk v16.0.0-beta.2
+> Library: @adcp/sdk v16.0.0-beta.3
 > AdCP major version: 3
 > Canonical URL: https://adcontextprotocol.github.io/adcp-client/llms.txt
 > Note: the `Library` stamp reflects the package.json version at doc-generation time. The narrative below describes the surface that lands on the next-published minor — including any 6.7 helpers documented here ahead of the release tag.

package/docs/migration-14.x-rc-worksheet.md

@@ -11,8 +11,8 @@ below as the publication/deployment gate.
 
 | Fact | Value |
 | --- | --- |
-| Exact npm package | `@adcp/sdk@16.0.0-beta.2` |
-| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@16.0.0-beta.2 dist.integrity` |
+| Exact npm package | `@adcp/sdk@16.0.0-beta.3` |
+| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@16.0.0-beta.3 dist.integrity` |
 | Node.js runtime | `^20.19.0 || >=22.12.0` |
 | Default AdCP wire release | `3.2.4` |
 | Maintained wire releases | `v2.5`, `v2.6`, `v3`, `3.0.0`, `3.0`, `3.0.1`, `3.0.2`, `3.0.3`, `3.0.4`, `3.0.5`, `3.0.6`, `3.0.7`, `3.0.8`, `3.0.9`, `3.0.10`, `3.0.11`, `3.0.12`, `3.0.13`, `3.0.14`, `3.0.15`, `3.0.16`, `3.0.17`, `3.0.18`, `3.0.19`, `3.0.20`, `3.0.21`, `3.0.22`, `3.0.23`, `3.0.24`, `3.0.25`, `3.1.0`, `3.1`, `3.1.1`, `3.1.2`, `3.1.3`, `3.1.4`, `3.1.5`, `3.1.6`, `3.1.7`, `3.1.8`, `3.1.9`, `3.1.10`, `3.1.11`, `3.1.12`, `3.1.13`, `3.1.14`, `3.1.15`, `3.1.16`, `3.1.17`, `3.1.18`, `3.1.19`, `3.1.20`, `3.1.21`, `3.1.22`, `3.1.23`, `3.1.24`, `3.2.1`, `3.2`, `3.2.2`, `3.2.3`, `3.2.4` |
@@ -21,8 +21,8 @@ below as the publication/deployment gate.
 Install exact production inputs rather than a moving range or dist-tag:
 
 ```bash
-npm install --save-exact '@adcp/sdk@16.0.0-beta.2'
-npm view '@adcp/sdk@16.0.0-beta.2' dist.integrity
+npm install --save-exact '@adcp/sdk@16.0.0-beta.3'
+npm view '@adcp/sdk@16.0.0-beta.3' dist.integrity
 ```
 
 ### Required and optional peers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/sdk",
-  "version": "16.0.0-beta.2",
+  "version": "16.0.0-beta.3",
   "description": "AdCP SDK — client, server, and compliance harnesses for the AdContext Protocol (MCP + A2A)",
   "workspaces": [
     ".",
@@ -875,6 +875,7 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.68.0",
     "web-bot-auth": "0.2.0",
+    "workerd": "1.20260730.1",
     "zod": "^4.4.3",
     "zod-openapi": "^5.4.3"
   },