@adcp/sdk 16.0.0-beta.2 → 16.0.0-beta.4

package/dist/lib/index.mjs

@@ -295,7 +295,12 @@ export * from "./reporting/index.mjs";
 export * from "./types/index.mjs";
 import { BrandJsonSchema, AdagentsJsonSchema } from "./types/wellknown-schemas.generated.mjs";
 import { PlacementPresentationDocumentSchema, PlacementPresentationReferenceSchema } from "./types/schemas.generated.mjs";
-import { STANDARD_ERROR_CODES, isStandardErrorCode, getErrorRecovery } from "./types/error-codes.mjs";
+import {
+  STANDARD_ERROR_CODES,
+  isStandardErrorCode,
+  getErrorRecovery,
+  DEFAULT_UNKNOWN_ERROR_RECOVERY
+} from "./types/error-codes.mjs";
 import {
   adcpError,
   legacyCapabilitiesResponse,
@@ -465,7 +470,9 @@ import {
   BODY_SNIPPET_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS,
   sanitizeTransportHeaders,
-  sanitizeTransportUrl
+  sanitizeTransportUrl,
+  DEFAULT_MAX_RESPONSE_BYTES,
+  SSE_CUMULATIVE_BUDGET_MULTIPLIER
 } from "./protocols/index.mjs";
 import { toReleasePrecisionWire, validateAdcpVersionWire } from "./validation/schema-loader.mjs";
 import { bundleSupportsAdcpVersionField as _isSupported } from "./protocols/index.mjs";
@@ -785,6 +792,7 @@ import {
   divergenceOffset,
   translateUniversalMacros,
   UnsafeNativeMappingError,
+  MultipleVendorConsentMacrosError,
   compileUniversalMacroTemplate
 } from "./substitution/index.mjs";
 import {
@@ -879,9 +887,11 @@ export {
   CreativeFormatCapabilityError,
   CreativeFormatProjectionError,
   DEFAULT_MACRO_PROHIBITED_PATTERN,
+  DEFAULT_MAX_RESPONSE_BYTES,
   DEFAULT_MAX_SSE_FRAME_BYTES,
   DEFAULT_REPORTING_CAPABILITIES,
   DEFAULT_SSRF_POLICY,
+  DEFAULT_UNKNOWN_ERROR_RECOVERY,
   DISCOVERY_ARM_SCENARIOS,
   DeferredSettlementOwnershipError,
   DeferredTaskError,
@@ -945,6 +955,7 @@ export {
   MemoryStorage,
   MissingEnvSecretError,
   MissingInputHandlerError,
+  MultipleVendorConsentMacrosError,
   NeedsAuthorizationError,
   NetworkConsistencyChecker,
   OBSERVER_FLUSH_TIMEOUT_MS,
@@ -987,6 +998,7 @@ export {
   SIErrorCodes,
   SIGNALS_TOOLS,
   SISessionManager,
+  SSE_CUMULATIVE_BUDGET_MULTIPLIER,
   SSRF_TRANSIENT_CODES,
   STANDARD_CREATIVE_AGENTS,
   STANDARD_ERROR_CODES,

package/dist/lib/negotiation/types.d.mts

@@ -1,5 +1,5 @@
 /** Public AdCP proposal-negotiation types (introduced by the 3.2 contract). */
-import type { AcceptanceContext, CanonicalDeliveryForecast, CanonicalProposal as GeneratedCanonicalProposal, MediaBuyFrequencyCap, OutcomeTarget, ProductMediaBuySupportRequirements, ProductPurchase as GeneratedProductPurchase } from '../types/core.generated.mjs';
+import type { AcceptanceContext, CanonicalProposal as GeneratedCanonicalProposal, MediaBuyFrequencyCap, OutcomeTarget, ProductMediaBuySupportRequirements, ProductPurchase as GeneratedProductPurchase } from '../types/core.generated.mjs';
 export type { AcceptanceContext, CanonicalDeliveryForecast, CanonicalForecastPoint, MediaBuyFrequencyCap, OutcomeTarget, ProductMediaBuySupportRequirements, } from '../types/core.generated.mjs';
 export declare const PROPOSAL_REFINEMENT_DIMENSIONS: readonly ["total_budget", "cpm", "impressions", "flight", "product_changes", "alternatives", "criteria"];
 export type ProposalRefinementDimension = (typeof PROPOSAL_REFINEMENT_DIMENSIONS)[number];
@@ -109,31 +109,17 @@ export interface ProposalResolvedPricing {
     min_spend_per_package?: number;
     commission_rate?: number;
 }
-export interface ProposalPurchase {
-    product_id: string;
-    pricing_option_id: string;
+/**
+ * A purchase inside proposal commercial terms. Every field comes from the
+ * generated `ProductPurchase` wire type, so fields the pinned schemas add reach
+ * this type without edits here. Only `pricing` is widened.
+ */
+export interface ProposalPurchase extends Omit<GeneratedProductPurchase, ProposalPurchaseOverriddenKey> {
     /** Resolved pricing is required in accepted snapshots but optional on direct-purchase inputs. */
     pricing?: ProposalResolvedPricing | GeneratedProductPurchase['pricing'];
-    format_option_refs?: GeneratedProductPurchase['format_option_refs'];
-    catalog_ids?: GeneratedProductPurchase['catalog_ids'];
-    budget?: GeneratedProductPurchase['budget'];
-    daily_budget_cap?: GeneratedProductPurchase['daily_budget_cap'];
-    min_spend_target?: GeneratedProductPurchase['min_spend_target'];
-    impressions?: number;
-    start_time?: string;
-    end_time?: string;
-    pacing?: GeneratedProductPurchase['pacing'];
-    bidding?: GeneratedProductPurchase['bidding'];
-    targeting_overlay?: GeneratedProductPurchase['targeting_overlay'];
-    optimization_goals?: GeneratedProductPurchase['optimization_goals'];
-    audience_evidence_requirements?: GeneratedProductPurchase['audience_evidence_requirements'];
-    audience_evidence_pins?: GeneratedProductPurchase['audience_evidence_pins'];
-    agency_estimate_number?: GeneratedProductPurchase['agency_estimate_number'];
-    context?: GeneratedProductPurchase['context'];
-    ext?: GeneratedProductPurchase['ext'];
-    measurement_terms?: GeneratedProductPurchase['measurement_terms'];
-    performance_standards?: GeneratedProductPurchase['performance_standards'];
 }
+/** Generated `ProductPurchase` fields whose SDK type is intentionally wider. */
+type ProposalPurchaseOverriddenKey = 'pricing';
 export interface ProposalCommercialTerms<TPurchase extends ProposalPurchase = ProposalPurchase> {
     /** Keep the legacy open object while accepting the generated compact BrandKey. */
     brand: Record<string, unknown> | GeneratedCanonicalProposal['commercial_terms']['brand'];
@@ -145,25 +131,20 @@ export interface ProposalCommercialTerms<TPurchase extends ProposalPurchase = Pr
         currency: string;
     };
 }
-export interface CanonicalProposal<TTerms extends ProposalCommercialTerms = ProposalCommercialTerms> {
-    proposal_id: string;
-    proposal_kind: 'new_media_buy' | 'media_buy_update' | 'media_buy_cancellation';
-    parent_proposal_id?: string;
-    media_buy_id?: string;
-    base_media_buy_revision?: number;
-    opportunity_id?: string;
-    proposal_status: 'draft' | 'committed' | 'accepted';
-    accepted_at?: string;
-    expires_at?: string;
-    name: string;
-    description?: string;
-    brief_alignment?: string;
+/**
+ * A canonical proposal snapshot. Every field comes from the generated
+ * `CanonicalProposal` wire type (including fields such as `hold_policy` and
+ * `hold_placed_at` once the pinned schemas define them), so the SDK type tracks
+ * spec revisions without edits here. Only two fields are re-declared:
+ * `commercial_terms` is generic over the caller's terms type and `insertion_order` keeps the
+ * legacy open object.
+ */
+export interface CanonicalProposal<TTerms extends ProposalCommercialTerms = ProposalCommercialTerms> extends Omit<GeneratedCanonicalProposal, CanonicalProposalOverriddenKey> {
     commercial_terms: TTerms;
-    terms_digest: string;
     insertion_order?: Record<string, unknown> | GeneratedCanonicalProposal['insertion_order'];
-    total_budget_guidance?: GeneratedCanonicalProposal['total_budget_guidance'];
-    forecast?: CanonicalDeliveryForecast;
 }
+/** Generated `CanonicalProposal` fields whose SDK type is intentionally re-declared. */
+type CanonicalProposalOverriddenKey = 'commercial_terms' | 'insertion_order';
 export type ProposalRefinementReason = 'commercially_declined' | 'constraint_unsatisfiable' | 'unsupported_dimension' | 'uninterpreted' | 'alternatives_unavailable' | 'source_unavailable' | 'hold_unavailable' | 'batch_aborted';
 export interface RefinedProposalResult<TProposal extends CanonicalProposal = CanonicalProposal> {
     source_proposal_id: string;

package/dist/lib/negotiation/types.d.ts

@@ -1,5 +1,5 @@
 /** Public AdCP proposal-negotiation types (introduced by the 3.2 contract). */
-import type { AcceptanceContext, CanonicalDeliveryForecast, CanonicalProposal as GeneratedCanonicalProposal, MediaBuyFrequencyCap, OutcomeTarget, ProductMediaBuySupportRequirements, ProductPurchase as GeneratedProductPurchase } from '../types/core.generated';
+import type { AcceptanceContext, CanonicalProposal as GeneratedCanonicalProposal, MediaBuyFrequencyCap, OutcomeTarget, ProductMediaBuySupportRequirements, ProductPurchase as GeneratedProductPurchase } from '../types/core.generated';
 export type { AcceptanceContext, CanonicalDeliveryForecast, CanonicalForecastPoint, MediaBuyFrequencyCap, OutcomeTarget, ProductMediaBuySupportRequirements, } from '../types/core.generated';
 export declare const PROPOSAL_REFINEMENT_DIMENSIONS: readonly ["total_budget", "cpm", "impressions", "flight", "product_changes", "alternatives", "criteria"];
 export type ProposalRefinementDimension = (typeof PROPOSAL_REFINEMENT_DIMENSIONS)[number];
@@ -109,31 +109,17 @@ export interface ProposalResolvedPricing {
     min_spend_per_package?: number;
     commission_rate?: number;
 }
-export interface ProposalPurchase {
-    product_id: string;
-    pricing_option_id: string;
+/**
+ * A purchase inside proposal commercial terms. Every field comes from the
+ * generated `ProductPurchase` wire type, so fields the pinned schemas add reach
+ * this type without edits here. Only `pricing` is widened.
+ */
+export interface ProposalPurchase extends Omit<GeneratedProductPurchase, ProposalPurchaseOverriddenKey> {
     /** Resolved pricing is required in accepted snapshots but optional on direct-purchase inputs. */
     pricing?: ProposalResolvedPricing | GeneratedProductPurchase['pricing'];
-    format_option_refs?: GeneratedProductPurchase['format_option_refs'];
-    catalog_ids?: GeneratedProductPurchase['catalog_ids'];
-    budget?: GeneratedProductPurchase['budget'];
-    daily_budget_cap?: GeneratedProductPurchase['daily_budget_cap'];
-    min_spend_target?: GeneratedProductPurchase['min_spend_target'];
-    impressions?: number;
-    start_time?: string;
-    end_time?: string;
-    pacing?: GeneratedProductPurchase['pacing'];
-    bidding?: GeneratedProductPurchase['bidding'];
-    targeting_overlay?: GeneratedProductPurchase['targeting_overlay'];
-    optimization_goals?: GeneratedProductPurchase['optimization_goals'];
-    audience_evidence_requirements?: GeneratedProductPurchase['audience_evidence_requirements'];
-    audience_evidence_pins?: GeneratedProductPurchase['audience_evidence_pins'];
-    agency_estimate_number?: GeneratedProductPurchase['agency_estimate_number'];
-    context?: GeneratedProductPurchase['context'];
-    ext?: GeneratedProductPurchase['ext'];
-    measurement_terms?: GeneratedProductPurchase['measurement_terms'];
-    performance_standards?: GeneratedProductPurchase['performance_standards'];
 }
+/** Generated `ProductPurchase` fields whose SDK type is intentionally wider. */
+type ProposalPurchaseOverriddenKey = 'pricing';
 export interface ProposalCommercialTerms<TPurchase extends ProposalPurchase = ProposalPurchase> {
     /** Keep the legacy open object while accepting the generated compact BrandKey. */
     brand: Record<string, unknown> | GeneratedCanonicalProposal['commercial_terms']['brand'];
@@ -145,25 +131,20 @@ export interface ProposalCommercialTerms<TPurchase extends ProposalPurchase = Pr
         currency: string;
     };
 }
-export interface CanonicalProposal<TTerms extends ProposalCommercialTerms = ProposalCommercialTerms> {
-    proposal_id: string;
-    proposal_kind: 'new_media_buy' | 'media_buy_update' | 'media_buy_cancellation';
-    parent_proposal_id?: string;
-    media_buy_id?: string;
-    base_media_buy_revision?: number;
-    opportunity_id?: string;
-    proposal_status: 'draft' | 'committed' | 'accepted';
-    accepted_at?: string;
-    expires_at?: string;
-    name: string;
-    description?: string;
-    brief_alignment?: string;
+/**
+ * A canonical proposal snapshot. Every field comes from the generated
+ * `CanonicalProposal` wire type (including fields such as `hold_policy` and
+ * `hold_placed_at` once the pinned schemas define them), so the SDK type tracks
+ * spec revisions without edits here. Only two fields are re-declared:
+ * `commercial_terms` is generic over the caller's terms type and `insertion_order` keeps the
+ * legacy open object.
+ */
+export interface CanonicalProposal<TTerms extends ProposalCommercialTerms = ProposalCommercialTerms> extends Omit<GeneratedCanonicalProposal, CanonicalProposalOverriddenKey> {
     commercial_terms: TTerms;
-    terms_digest: string;
     insertion_order?: Record<string, unknown> | GeneratedCanonicalProposal['insertion_order'];
-    total_budget_guidance?: GeneratedCanonicalProposal['total_budget_guidance'];
-    forecast?: CanonicalDeliveryForecast;
 }
+/** Generated `CanonicalProposal` fields whose SDK type is intentionally re-declared. */
+type CanonicalProposalOverriddenKey = 'commercial_terms' | 'insertion_order';
 export type ProposalRefinementReason = 'commercially_declined' | 'constraint_unsatisfiable' | 'unsupported_dimension' | 'uninterpreted' | 'alternatives_unavailable' | 'source_unavailable' | 'hold_unavailable' | 'batch_aborted';
 export interface RefinedProposalResult<TProposal extends CanonicalProposal = CanonicalProposal> {
     source_proposal_id: string;

package/dist/lib/protocols/index.d.mts

@@ -11,6 +11,7 @@ export { withMCPConnectionScope };
 export type { MCPCallOptions, MCPConnectionResult } from './mcp.mjs';
 export { callA2ATool, createA2AClientFromCardUrl } from './a2a.mjs';
 export { DEFAULT_REQUEST_TIMEOUT_MS } from './abort.mjs';
+export { DEFAULT_MAX_RESPONSE_BYTES, SSE_CUMULATIVE_BUDGET_MULTIPLIER } from './responseSizeLimit.mjs';
 export { callMCPToolWithTasks, getMCPTaskStatus, getMCPTaskResult, listMCPTasks, cancelMCPTask, mapMCPTaskStatus, serverSupportsTasks, } from './mcp-tasks.mjs';
 import type { AgentConfig, DebugLogEntry } from '../types/index.mjs';
 import type { PushNotificationConfig } from '../types/tools.generated.mjs';
@@ -36,36 +37,71 @@ export declare function bundleSupportsAdcpVersionField(bundleKey: string): boole
 export interface TransportOptions {
     /**
      * Maximum response body size (in octets) the SDK will read before aborting
-     * with `ResponseTooLargeError`. When unset, the SDK does not impose a cap —
-     * matches the underlying MCP / A2A transport defaults.
+     * with `ResponseTooLargeError`.
      *
-     * Set this when crawling **untrusted** agents (registries, federated
-     * discovery layers, monitoring tools) to prevent a hostile vendor from
-     * buffering a large reply before any application-layer schema validation
-     * runs. Counted across response chunks; pre-cancels when `Content-Length`
-     * exceeds the cap. Applies to A2A agent-card discovery
-     * (`/.well-known/agent.json`) on the same call as well.
+     * **Defaults to 4 MiB** (`DEFAULT_MAX_RESPONSE_BYTES`). Agent responses are
+     * untrusted input, so the cap is on by default on every MCP and A2A call
+     * path — tool calls, endpoint discovery, `tools/list`, and A2A agent-card
+     * lookup (`/.well-known/agent.json`). Counted across response chunks as
+     * they arrive; pre-cancels when `Content-Length` already exceeds the cap.
      *
-     * Per-call override (`TaskOptions.transport.maxResponseBytes`) beats the
-     * value set on the client constructor (`SingleAgentClientConfig.transport`).
+     * Raise it for an agent that legitimately publishes a large catalog; lower
+     * it when crawling **untrusted** agents (registries, federated discovery
+     * layers, monitoring tools). Set it to exactly `0` to opt out of
+     * enforcement entirely — an explicit opt-out, never the default. `Infinity`
+     * and negative values are *not* opt-outs: they fall back to the 4 MiB
+     * default, because they almost always arrive from a misparsed env var or a
+     * budget subtraction rather than an intention. Use `0`.
+     *
+     * Per-call `transport` **replaces** the client constructor's `transport`
+     * object rather than merging field by field
+     * (`TaskOptions.transport` ?? `SingleAgentClientConfig.transport`), so a
+     * per-call object that omits `maxResponseBytes` gets the default back, not
+     * the constructor's value. Repeat the field when you override the object.
+     *
+     * Cached MCP connections are keyed on the cap, so varying it per call opens
+     * a separate connection (and MCP session) per distinct value against the
+     * same agent. That is deliberate — a connection established under one
+     * policy must not serve a call that configured another — but it means
+     * raising the cap for one tool is not free. Prefer a single client-level
+     * value where you can, or pin the session explicitly with
+     * `withMCPConnectionScope` when continuity matters.
      *
      * @remarks
-     * **Safe to set on all calls.** SSE responses (`text/event-stream`) are
-     * passed through unchanged — a single tool call legitimately emits N status
-     * frames + a final result, bounded by protocol-level framing rather than
-     * cumulative byte counts. The cap applies to one-shot JSON responses
-     * (`get_adcp_capabilities`, agent-card lookup, tool result payloads on
-     * non-streaming transports) where the body is bounded by definition.
+     * **SSE is covered too.** `text/event-stream` responses used to be exempt,
+     * which let any peer opt itself out of the cap by changing one response
+     * header. They now carry two bounds: no single event frame may exceed
+     * `maxResponseBytes` (the memory bound — an SSE consumer buffers one frame
+     * at a time), and the cumulative event-stream octets read during one call
+     * may not exceed `maxResponseBytes * 2`
+     * (`SSE_CUMULATIVE_BUDGET_MULTIPLIER`, the liveness bound that stops an
+     * endless drip of individually legal frames). Both failures raise the same
+     * `ResponseTooLargeError`; nothing is silently truncated.
+     *
+     * A long-lived `GET` event-stream — MCP's standalone notification listener,
+     * the legacy SSE transport — outlives the call that opened it, so it meters
+     * its cumulative allowance per *connection* instead of per call. That makes
+     * the cumulative number a memory bound there, not a liveness bound: a peer
+     * that keeps tripping it gets a reconnect cycle at a bounded cost per
+     * cycle. Cached connections are keyed on the cap in effect, so a listener
+     * is only ever reused by calls that configured the same policy as the call
+     * that opened it.
      *
      * @remarks
-     * **Hostile-peer note:** A peer can opt itself out of this cap by responding
-     * with `Content-Type: text/event-stream`. SSE is bypassed because cumulative
-     * event-frame bytes are unbounded by spec — MCP and A2A both stream tool
-     * responses this way. The MCP/A2A SDKs consume SSE incrementally and frame
-     * termination bounds memory in practice, so this is not a memory-bomb risk
-     * for well-formed transports. Adopters relying on `maxResponseBytes` as a
-     * hostile-server defense should treat it as best-effort for non-SSE
-     * responses only.
+     * **Compression and streaming failures.** The byte counter runs downstream
+     * of the runtime's content-decoder, so it measures decompressed octets: a
+     * small gzip blob that inflates to gigabytes still trips the cap after
+     * `maxResponseBytes` of output. The `Content-Length` pre-check, by
+     * contrast, sees the compressed length and is therefore only a fast path,
+     * not the guarantee.
+     *
+     * On a streaming transport the cap errors the response body. Some
+     * transports classify that as a stream disconnect and retry rather than
+     * propagating it, so the call would otherwise run out its deadline: the SDK
+     * records the violation and, if the call then fails, raises
+     * `ResponseTooLargeError` with the transport's own error as `cause` instead
+     * of the timeout. A buyer never gets a timeout for what is really an
+     * over-cap response.
      *
      * @remarks
      * Future hardening knobs (DNS-rebind defense, scheme allow-list, request

package/dist/lib/protocols/index.d.ts

@@ -11,6 +11,7 @@ export { withMCPConnectionScope };
 export type { MCPCallOptions, MCPConnectionResult } from './mcp';
 export { callA2ATool, createA2AClientFromCardUrl } from './a2a';
 export { DEFAULT_REQUEST_TIMEOUT_MS } from './abort';
+export { DEFAULT_MAX_RESPONSE_BYTES, SSE_CUMULATIVE_BUDGET_MULTIPLIER } from './responseSizeLimit';
 export { callMCPToolWithTasks, getMCPTaskStatus, getMCPTaskResult, listMCPTasks, cancelMCPTask, mapMCPTaskStatus, serverSupportsTasks, } from './mcp-tasks';
 import type { AgentConfig, DebugLogEntry } from '../types';
 import type { PushNotificationConfig } from '../types/tools.generated';
@@ -36,36 +37,71 @@ export declare function bundleSupportsAdcpVersionField(bundleKey: string): boole
 export interface TransportOptions {
     /**
      * Maximum response body size (in octets) the SDK will read before aborting
-     * with `ResponseTooLargeError`. When unset, the SDK does not impose a cap —
-     * matches the underlying MCP / A2A transport defaults.
+     * with `ResponseTooLargeError`.
      *
-     * Set this when crawling **untrusted** agents (registries, federated
-     * discovery layers, monitoring tools) to prevent a hostile vendor from
-     * buffering a large reply before any application-layer schema validation
-     * runs. Counted across response chunks; pre-cancels when `Content-Length`
-     * exceeds the cap. Applies to A2A agent-card discovery
-     * (`/.well-known/agent.json`) on the same call as well.
+     * **Defaults to 4 MiB** (`DEFAULT_MAX_RESPONSE_BYTES`). Agent responses are
+     * untrusted input, so the cap is on by default on every MCP and A2A call
+     * path — tool calls, endpoint discovery, `tools/list`, and A2A agent-card
+     * lookup (`/.well-known/agent.json`). Counted across response chunks as
+     * they arrive; pre-cancels when `Content-Length` already exceeds the cap.
      *
-     * Per-call override (`TaskOptions.transport.maxResponseBytes`) beats the
-     * value set on the client constructor (`SingleAgentClientConfig.transport`).
+     * Raise it for an agent that legitimately publishes a large catalog; lower
+     * it when crawling **untrusted** agents (registries, federated discovery
+     * layers, monitoring tools). Set it to exactly `0` to opt out of
+     * enforcement entirely — an explicit opt-out, never the default. `Infinity`
+     * and negative values are *not* opt-outs: they fall back to the 4 MiB
+     * default, because they almost always arrive from a misparsed env var or a
+     * budget subtraction rather than an intention. Use `0`.
+     *
+     * Per-call `transport` **replaces** the client constructor's `transport`
+     * object rather than merging field by field
+     * (`TaskOptions.transport` ?? `SingleAgentClientConfig.transport`), so a
+     * per-call object that omits `maxResponseBytes` gets the default back, not
+     * the constructor's value. Repeat the field when you override the object.
+     *
+     * Cached MCP connections are keyed on the cap, so varying it per call opens
+     * a separate connection (and MCP session) per distinct value against the
+     * same agent. That is deliberate — a connection established under one
+     * policy must not serve a call that configured another — but it means
+     * raising the cap for one tool is not free. Prefer a single client-level
+     * value where you can, or pin the session explicitly with
+     * `withMCPConnectionScope` when continuity matters.
      *
      * @remarks
-     * **Safe to set on all calls.** SSE responses (`text/event-stream`) are
-     * passed through unchanged — a single tool call legitimately emits N status
-     * frames + a final result, bounded by protocol-level framing rather than
-     * cumulative byte counts. The cap applies to one-shot JSON responses
-     * (`get_adcp_capabilities`, agent-card lookup, tool result payloads on
-     * non-streaming transports) where the body is bounded by definition.
+     * **SSE is covered too.** `text/event-stream` responses used to be exempt,
+     * which let any peer opt itself out of the cap by changing one response
+     * header. They now carry two bounds: no single event frame may exceed
+     * `maxResponseBytes` (the memory bound — an SSE consumer buffers one frame
+     * at a time), and the cumulative event-stream octets read during one call
+     * may not exceed `maxResponseBytes * 2`
+     * (`SSE_CUMULATIVE_BUDGET_MULTIPLIER`, the liveness bound that stops an
+     * endless drip of individually legal frames). Both failures raise the same
+     * `ResponseTooLargeError`; nothing is silently truncated.
+     *
+     * A long-lived `GET` event-stream — MCP's standalone notification listener,
+     * the legacy SSE transport — outlives the call that opened it, so it meters
+     * its cumulative allowance per *connection* instead of per call. That makes
+     * the cumulative number a memory bound there, not a liveness bound: a peer
+     * that keeps tripping it gets a reconnect cycle at a bounded cost per
+     * cycle. Cached connections are keyed on the cap in effect, so a listener
+     * is only ever reused by calls that configured the same policy as the call
+     * that opened it.
      *
      * @remarks
-     * **Hostile-peer note:** A peer can opt itself out of this cap by responding
-     * with `Content-Type: text/event-stream`. SSE is bypassed because cumulative
-     * event-frame bytes are unbounded by spec — MCP and A2A both stream tool
-     * responses this way. The MCP/A2A SDKs consume SSE incrementally and frame
-     * termination bounds memory in practice, so this is not a memory-bomb risk
-     * for well-formed transports. Adopters relying on `maxResponseBytes` as a
-     * hostile-server defense should treat it as best-effort for non-SSE
-     * responses only.
+     * **Compression and streaming failures.** The byte counter runs downstream
+     * of the runtime's content-decoder, so it measures decompressed octets: a
+     * small gzip blob that inflates to gigabytes still trips the cap after
+     * `maxResponseBytes` of output. The `Content-Length` pre-check, by
+     * contrast, sees the compressed length and is therefore only a fast path,
+     * not the guarantee.
+     *
+     * On a streaming transport the cap errors the response body. Some
+     * transports classify that as a stream disconnect and retry rather than
+     * propagating it, so the call would otherwise run out its deadline: the SDK
+     * records the violation and, if the call then fails, raises
+     * `ResponseTooLargeError` with the transport's own error as `cause` instead
+     * of the timeout. A buyer never gets a timeout for what is really an
+     * over-cap response.
      *
      * @remarks
      * Future hardening knobs (DNS-rebind defense, scheme allow-list, request

package/dist/lib/protocols/index.js

@@ -19,9 +19,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var protocols_exports = {};
 __export(protocols_exports, {
   BODY_SNIPPET_TIMEOUT_MS: () => import_transportDiagnostics2.BODY_SNIPPET_TIMEOUT_MS,
+  DEFAULT_MAX_RESPONSE_BYTES: () => import_responseSizeLimit.DEFAULT_MAX_RESPONSE_BYTES,
   DEFAULT_REQUEST_TIMEOUT_MS: () => import_abort.DEFAULT_REQUEST_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS: () => import_transportDiagnostics2.OBSERVER_FLUSH_TIMEOUT_MS,
   ProtocolClient: () => ProtocolClient,
+  SSE_CUMULATIVE_BUDGET_MULTIPLIER: () => import_responseSizeLimit.SSE_CUMULATIVE_BUDGET_MULTIPLIER,
   UnauthorizedError: () => import_mcp.UnauthorizedError,
   applyVersionEnvelope: () => applyVersionEnvelope,
   bundleSupportsAdcpVersionField: () => bundleSupportsAdcpVersionField,
@@ -59,6 +61,7 @@ var import_a2a = require('./a2a.js');
 var import_node_crypto = require("node:crypto");
 var import_a2a2 = require('./a2a.js');
 var import_abort = require('./abort.js');
+var import_responseSizeLimit = require('./responseSizeLimit.js');
 var import_mcp_tasks = require('./mcp-tasks.js');
 var import_mcp_tasks2 = require('./mcp-tasks.js');
 var import_mcp3 = require('./mcp.js');
@@ -76,7 +79,7 @@ var import_version = require('../version.js');
 var import_errors2 = require('../errors/index.js');
 var import_schema_loader = require('../validation/schema-loader.js');
 var import_client = require('../signing/client.js');
-var import_responseSizeLimit = require('./responseSizeLimit.js');
+var import_responseSizeLimit2 = require('./responseSizeLimit.js');
 var import_prepared_call_context = require('./prepared-call-context.js');
 var import_adcp_version_config = require('../utils/adcp-version-config.js');
 var import_transportDiagnostics = require('./transportDiagnostics.js');
@@ -259,7 +262,7 @@ class ProtocolClient {
       wireAdcpVersion,
       versionEnvelope: versionEnvelopeMode
     });
-    return (0, import_responseSizeLimit.withResponseSizeLimit)(
+    return (0, import_responseSizeLimit2.withResponseSizeLimit)(
       transport?.maxResponseBytes,
       () => (0, import_transportDiagnostics.withTransportDiagnostics)(
         {
@@ -523,7 +526,7 @@ const createMCPClient = (agentUrl, authToken, headers, serverVersion, adcpVersio
   transport = normalizeTransportOptions(transport);
   const versionEnvelope = buildVersionEnvelopeForMode(versionEnvelopeMode, adcpVersion, serverVersion);
   return {
-    callTool: (toolName, args, debugLogs) => (0, import_responseSizeLimit.withResponseSizeLimit)(
+    callTool: (toolName, args, debugLogs) => (0, import_responseSizeLimit2.withResponseSizeLimit)(
       transport?.maxResponseBytes,
       () => (0, import_mcp_tasks2.callMCPToolWithTasks)(
         agentUrl,
@@ -545,7 +548,7 @@ const createA2AClient = (agentUrl, authToken, headers, serverVersion, adcpVersio
   transport = normalizeTransportOptions(transport);
   const versionEnvelope = buildVersionEnvelopeForMode(versionEnvelopeMode, adcpVersion, serverVersion);
   return {
-    callTool: (toolName, parameters, debugLogs) => (0, import_responseSizeLimit.withResponseSizeLimit)(
+    callTool: (toolName, parameters, debugLogs) => (0, import_responseSizeLimit2.withResponseSizeLimit)(
       transport?.maxResponseBytes,
       () => (0, import_a2a3.callA2ATool)(
         agentUrl,
@@ -569,9 +572,11 @@ const createA2AClient = (agentUrl, authToken, headers, serverVersion, adcpVersio
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   BODY_SNIPPET_TIMEOUT_MS,
+  DEFAULT_MAX_RESPONSE_BYTES,
   DEFAULT_REQUEST_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS,
   ProtocolClient,
+  SSE_CUMULATIVE_BUDGET_MULTIPLIER,
   UnauthorizedError,
   applyVersionEnvelope,
   bundleSupportsAdcpVersionField,

package/dist/lib/protocols/index.mjs

@@ -31,6 +31,7 @@ async function closeScopedConnections(protocol = "mcp") {
 }
 import { callA2ATool, createA2AClientFromCardUrl } from "./a2a.mjs";
 import { DEFAULT_REQUEST_TIMEOUT_MS } from "./abort.mjs";
+import { DEFAULT_MAX_RESPONSE_BYTES, SSE_CUMULATIVE_BUDGET_MULTIPLIER } from "./responseSizeLimit.mjs";
 import {
   callMCPToolWithTasks,
   getMCPTaskStatus,
@@ -548,9 +549,11 @@ const createA2AClient = (agentUrl, authToken, headers, serverVersion, adcpVersio
 };
 export {
   BODY_SNIPPET_TIMEOUT_MS,
+  DEFAULT_MAX_RESPONSE_BYTES,
   DEFAULT_REQUEST_TIMEOUT_MS,
   OBSERVER_FLUSH_TIMEOUT_MS,
   ProtocolClient,
+  SSE_CUMULATIVE_BUDGET_MULTIPLIER,
   UnauthorizedError,
   applyVersionEnvelope,
   bundleSupportsAdcpVersionField,

package/dist/lib/protocols/mcp-modern.js

@@ -102,6 +102,7 @@ function connectionCacheKey(agentUrl, headers, signingCacheKey, authProvider, fe
   if (fetchKey) parts.push(fetchKey);
   if (handleLegacy !== void 0) parts.push(`handle-legacy:${handleLegacy}`);
   if (allowPrivateIp !== void 0) parts.push(`allow-private-ip:${allowPrivateIp}`);
+  parts.push((0, import_responseSizeLimit.responseSizeCapCacheKey)());
   const scopeKey = (0, import_mcp_scope.currentMCPConnectionScopeKey)();
   if (scopeKey) parts.push(scopeKey);
   return parts.join("::");

package/dist/lib/protocols/mcp-modern.mjs

@@ -43,7 +43,7 @@ import {
 } from "./abort.mjs";
 import { wrapFetchWithCapture } from "./rawResponseCapture.mjs";
 import { wrapFetchWithSignedRequestRejection } from "./signedRequestRejection.mjs";
-import { wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
+import { responseSizeCapCacheKey, wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
 import { wrapFetchWithTransportDiagnostics } from "./transportDiagnostics.mjs";
 import { createAgentTransportFetch } from "../net/agent-transport-fetch.mjs";
 const modernConnections = /* @__PURE__ */ new Map();
@@ -109,6 +109,7 @@ function connectionCacheKey(agentUrl, headers, signingCacheKey, authProvider, fe
   if (fetchKey) parts.push(fetchKey);
   if (handleLegacy !== void 0) parts.push(`handle-legacy:${handleLegacy}`);
   if (allowPrivateIp !== void 0) parts.push(`allow-private-ip:${allowPrivateIp}`);
+  parts.push(responseSizeCapCacheKey());
   const scopeKey = currentMCPConnectionScopeKey();
   if (scopeKey) parts.push(scopeKey);
   return parts.join("::");

package/dist/lib/protocols/mcp.js

@@ -89,6 +89,7 @@ function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, t
   if (signingCacheKey) parts.push(signingCacheKey);
   if (transportFetch) parts.push(`fetch:${getTransportFetchFnDisambiguator(transportFetch)}`);
   if (allowPrivateIp !== void 0) parts.push(`allow-private-ip:${allowPrivateIp}`);
+  parts.push((0, import_responseSizeLimit.responseSizeCapCacheKey)());
   const scopeKey = (0, import_mcp_scope.currentMCPConnectionScopeKey)();
   if (scopeKey) parts.push(scopeKey);
   return parts.join("::");

package/dist/lib/protocols/mcp.mjs

@@ -19,7 +19,7 @@ import { buildAgentSigningFetch, signingContextStorage } from "../signing/client
 import { redactArgsForLog } from "../utils/redact-args.mjs";
 import { wrapFetchWithCapture } from "./rawResponseCapture.mjs";
 import { getSignedRequestRejection, wrapFetchWithSignedRequestRejection } from "./signedRequestRejection.mjs";
-import { wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
+import { responseSizeCapCacheKey, wrapFetchWithSizeLimit } from "./responseSizeLimit.mjs";
 import { sanitizeTransportUrl, wrapFetchWithTransportDiagnostics } from "./transportDiagnostics.mjs";
 import {
   isAbortOrTimeoutError,
@@ -88,6 +88,7 @@ function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, t
   if (signingCacheKey) parts.push(signingCacheKey);
   if (transportFetch) parts.push(`fetch:${getTransportFetchFnDisambiguator(transportFetch)}`);
   if (allowPrivateIp !== void 0) parts.push(`allow-private-ip:${allowPrivateIp}`);
+  parts.push(responseSizeCapCacheKey());
   const scopeKey = currentMCPConnectionScopeKey();
   if (scopeKey) parts.push(scopeKey);
   return parts.join("::");