@adcp/sdk 16.3.0 → 16.5.0

package/dist/lib/core/SingleAgentClient.mjs

@@ -3,6 +3,8 @@ import { dirname as __adcpDirname } from "node:path";
 import { createRequire as __adcpCreateRequire } from "node:module";
 const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
 const require2 = __adcpCreateRequire(import.meta.url);
+import { withMCPConnectionPolicy } from "../protocols/mcp-connection-policy.mjs";
+import { hasUnsignedCapabilityBootstrap } from "../signing/protocol-methods.mjs";
 import { normalizeGetProductsResponse } from "../utils/pricing-adapter.mjs";
 import { normalizeMediaBuyResponse } from "../utils/creative-adapter.mjs";
 import { normalizeFormatsResponse } from "../utils/format-renders.mjs";
@@ -21,6 +23,7 @@ import {
 import { randomUUID, scryptSync } from "node:crypto";
 const SKIP_PRODUCT_CACHE = /* @__PURE__ */ Symbol("adcp.skipProductCache");
 const SKIP_ACCOUNT_REGISTRY_OBSERVATION = /* @__PURE__ */ Symbol("adcp.skipAccountRegistryObservation");
+import { accountKeySites, naturalAccountKey, reducedFields, valueAt, withReducedKeyAt } from "./account-reduction.mjs";
 import { ADCP_ENVELOPE_FIELDS } from "../types/adcp.mjs";
 import { parseAdcpMajorVersion, toReleasePrecisionVersion } from "../version.mjs";
 import {
@@ -31,8 +34,20 @@ import {
   resolveAdcpVersion
 } from "../utils/adcp-version-config.mjs";
 import { beta6ReportingRequestIssue } from "../media-buy/reporting-version.mjs";
-import { getVersionAdapter, resolveAdapterKey } from "../adapters/version/index.mjs";
-import { isExternalSchemaRootActive, schemaAllowsTopLevelField } from "../validation/schema-loader.mjs";
+import {
+  convertRequest,
+  convertResponse,
+  getVersionAdapter,
+  isNegotiationFailure,
+  negotiateAdcpRelease,
+  releaseDefinesTool,
+  resolveAdapterKey
+} from "../adapters/version/index.mjs";
+import {
+  isExternalSchemaRootActive,
+  schemaAllowsTopLevelField,
+  toReleasePrecisionWire
+} from "../validation/schema-loader.mjs";
 import { generateIdempotencyKey, requestUsesIdempotency } from "../utils/idempotency.mjs";
 import { createA2AClientFromCardUrl } from "../protocols/a2a.mjs";
 import {
@@ -372,8 +387,9 @@ function creativeMatchesProductOption(creative, declaration) {
 function isDeferredClientFinalizationContext(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const context = value;
-  return context.kind === "single-agent" && typeof context.taskType === "string" && typeof context.canonical === "boolean" && !!context.productPolicyRequest && typeof context.productPolicyRequest === "object" && !Array.isArray(context.productPolicyRequest) && (context.serverVersion === void 0 || context.serverVersion === "v2" || context.serverVersion === "v3") && (context.serverVersionSynthetic === void 0 || typeof context.serverVersionSynthetic === "boolean") && (context.projectionCatalogs === void 0 || Array.isArray(context.projectionCatalogs)) && (context.handlerName === void 0 || typeof context.handlerName === "string") && (context.skipStatusHandlers === void 0 || typeof context.skipStatusHandlers === "boolean");
+  return context.kind === "single-agent" && typeof context.taskType === "string" && typeof context.canonical === "boolean" && !!context.productPolicyRequest && typeof context.productPolicyRequest === "object" && !Array.isArray(context.productPolicyRequest) && (context.serverVersion === void 0 || context.serverVersion === "v2" || context.serverVersion === "v3") && (context.serverVersionSynthetic === void 0 || typeof context.serverVersionSynthetic === "boolean") && (context.negotiatedAdcpVersion === void 0 || typeof context.negotiatedAdcpVersion === "string") && (context.projectionCatalogs === void 0 || Array.isArray(context.projectionCatalogs)) && (context.handlerName === void 0 || typeof context.handlerName === "string") && (context.skipStatusHandlers === void 0 || typeof context.skipStatusHandlers === "boolean");
 }
+const MAX_REMEMBERED_NEGOTIATED_RELEASES = 1024;
 const CANONICAL_PACKAGE_ROUTE_TASKS = /* @__PURE__ */ new Set(["create_media_buy", "update_media_buy", "get_media_buys"]);
 const canonicalCreativeRoutingSnapshots = /* @__PURE__ */ new WeakSet();
 function canonicalAccountRoutingSnapshot(value) {
@@ -919,6 +935,12 @@ class SingleAgentClient {
     this.resolvedAdcpVersion = resolveAdcpVersion(
       config.adcpVersion ?? (config.experimentalIdentity33 ? "3.3" : void 0)
     );
+    if (config.accountIdentityDowngrade === "reduce" && typeof config.accountStorage?.compareAndSet !== "function") {
+      throw new ConfigurationError(
+        "accountIdentityDowngrade: 'reduce' requires accountStorage with compareAndSet. Reduced account keys are claimed in that storage so that no two buyer accounts reach one seller account, across instances and restarts. Configure durable accountStorage that implements compareAndSet, or use 'refuse'.",
+        "accountIdentityDowngrade"
+      );
+    }
     this.webhookRegistrationStore = config.webhookRegistrationStore ?? new InMemoryWebhookRegistrationStore();
     this.webhookReplayStore = config.webhookVerification?.replayStore ?? new InMemoryReplayStore();
     this.webhookRevocationStore = config.webhookVerification?.revocationStore ?? new InMemoryRevocationStore();
@@ -1239,6 +1261,8 @@ class SingleAgentClient {
   runAgentInfo;
   cachedToolSchemas;
   // inputSchema.properties per tool name
+  /** Release negotiated per operation, for converting webhook completions up. */
+  negotiatedReleaseByOperation = /* @__PURE__ */ new Map();
   primedCapabilitiesExpiresAt;
   // Freshness bound for application-owned evidence only
   capabilityEvidenceScopeKey = randomUUID();
@@ -2023,6 +2047,12 @@ class SingleAgentClient {
    * Also computes the canonical base URL by stripping /mcp suffix.
    */
   async ensureEndpointDiscovered(options) {
+    return withMCPConnectionPolicy(
+      normalizeTransportOptions(options?.transport ?? this.config.transport),
+      () => this.ensureEndpointDiscoveredWithConnectionPolicy(options)
+    );
+  }
+  async ensureEndpointDiscoveredWithConnectionPolicy(options) {
     throwIfAborted(options?.signal);
     if (this.config._reuseConfiguredDiscovery?.()) this.synchronizeCapabilityEvidenceAuthorizationScope();
     const needsDiscovery = this.normalizedAgent._needsDiscovery;
@@ -2277,6 +2307,12 @@ class SingleAgentClient {
    * Note: This is async and called lazily on first agent interaction
    */
   async discoverMCPEndpoint(providedUri, options) {
+    return withMCPConnectionPolicy(
+      normalizeTransportOptions(options?.transport ?? this.config.transport),
+      () => this.discoverMCPEndpointWithConnectionPolicy(providedUri, options)
+    );
+  }
+  async discoverMCPEndpointWithConnectionPolicy(providedUri, options) {
     throwIfAborted(options?.signal);
     const { connectMCPWithFallback } = await import("../protocols/mcp.mjs");
     const { probeModernMCPConnection } = await import("../protocols/mcp-modern.mjs");
@@ -3048,7 +3084,11 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     let externalStatus;
     let forgetPolicyState = false;
     try {
-      const canonicalResult = this.canonicalizeWebhookCreativeResult(metadata, parsed.result, canonicalCreativeTask);
+      const canonicalResult = this.canonicalizeWebhookCreativeResult(
+        metadata,
+        this.convertWebhookResultToClientRelease(parsed),
+        canonicalCreativeTask
+      );
       const dedupResult = canonicalResult;
       const dedupMetadata = { ...metadata };
       let webhookResult = dedupResult;
@@ -3629,32 +3669,47 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     };
     const serverVersion = await this.detectServerVersion(detectionOptions);
     throwIfAborted(options?.signal);
+    const negotiatedRelease = this.negotiateCallRelease(capabilityDiscoveryContext.capabilities, options);
+    this.assertToolAvailableAtRelease(taskType, negotiatedRelease, capabilityDiscoveryContext.toolSchemas);
     this.assertRequestSupportedByTargetVersion(
       taskType,
       normalizedParams,
       capabilityDiscoveryContext.capabilities,
       canonicalCreativeInvocation,
-      serverVersion
+      serverVersion,
+      negotiatedRelease
     );
-    const { options: effectiveOptions, driftLog: webhookDriftLog } = this.suppressPre31DiscoveryWebhook(
+    const { options: webhookOptions, driftLog: webhookDriftLog } = this.suppressPre31DiscoveryWebhook(
       taskType,
       options,
       capabilityDiscoveryContext.capabilities
     );
+    const effectiveOptions = this.withNegotiatedRelease(webhookOptions, negotiatedRelease);
     const inputSchemaStripLogs = [];
     if (options?.preserveGovernedPayload && serverVersion !== "v3") {
       throw new ConfigurationError(
         "Governed storyboard requests require a v3 seller to preserve the approved payload."
       );
     }
-    const { params: adaptedParams, driftLogs: adaptDriftLogs } = options?.preserveGovernedPayload ? { params: normalizedParams, driftLogs: [] } : this.adaptRequest(
+    const { params: convertedParams, driftLogs: adaptDriftLogs } = options?.preserveGovernedPayload ? { params: normalizedParams, driftLogs: [] } : this.adaptRequest(
       taskType,
       normalizedParams,
       serverVersion,
       inputSchemaStripLogs,
       capabilityDiscoveryContext.toolSchemas,
-      capabilityDiscoveryContext.capabilities
+      capabilityDiscoveryContext.capabilities,
+      negotiatedRelease
+    );
+    const adaptedParams = options?.preserveGovernedPayload ? convertedParams : await this.reconcileAccountKeyReductions(
+      taskType,
+      normalizedParams,
+      convertedParams,
+      negotiatedRelease,
+      adaptDriftLogs
     );
+    if (negotiatedRelease?.downgraded && !options?.skipIdempotencyAutoInject && !options?.skipAccountValidation && !options?.skipRequestValidation) {
+      this.executor.validateRequest(taskType, adaptedParams, inputSchemaStripLogs, negotiatedRelease.version);
+    }
     const adaptationLogs = [...adaptDriftLogs];
     if (webhookDriftLog) adaptationLogs.push(webhookDriftLog);
     const canonicalInputHandler = this.canonicalCreativeInputHandler(
@@ -3672,6 +3727,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       ...capabilityDiscoveryContext.capabilities?._synthetic !== void 0 && {
         serverVersionSynthetic: capabilityDiscoveryContext.capabilities._synthetic
       },
+      ...negotiatedRelease?.downgraded && { negotiatedAdcpVersion: negotiatedRelease.version },
       productPolicyRequest: productPolicyRequestSnapshot(normalizedParams),
       accountRegistry: this.accountRegistryContext(taskType, normalizedParams, effectiveOptions),
       ...projectionCatalogs !== void 0 && { projectionCatalogs },
@@ -3739,6 +3795,21 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         }
       };
     }
+    if (context.negotiatedAdcpVersion !== void 0) {
+      result.metadata = { ...result.metadata, negotiatedAdcpVersion: context.negotiatedAdcpVersion };
+      if (result.metadata.taskId) this.rememberNegotiatedRelease(result.metadata.taskId, context.negotiatedAdcpVersion);
+      if (result.success && result.data) {
+        const converted = this.convertResponseToClientRelease(
+          context.taskType,
+          result.data,
+          context.negotiatedAdcpVersion
+        );
+        result.data = converted.data;
+        if (converted.driftLogs.length > 0) {
+          result.debug_logs = [...result.debug_logs ?? [], ...converted.driftLogs];
+        }
+      }
+    }
     const completionHandlerAlreadyPublished = hasCompletionHandlerAlreadyPublished(result);
     const settlementAcknowledger = result[DEFERRED_SETTLEMENT_ACK];
     const taskType = context.taskType;
@@ -4723,6 +4794,228 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       suppressHandler: !policyResult.success
     };
   }
+  get accountIdentityDowngrade() {
+    return this.config.accountIdentityDowngrade ?? "refuse";
+  }
+  /**
+   * Negotiate the AdCP release to speak with this seller for one call: the
+   * highest release both sides support. Returns `undefined` when the call
+   * keeps its configured wire version: an explicit `wireAdcpVersion`
+   * override, a governed payload that must reach the seller byte-for-byte,
+   * the identity 3.3 experiment, or no authoritative seller release
+   * (synthetic capabilities, no release in common, or no release metadata at
+   * all: AdCP 3.1 does not require `supported_versions`, so its absence does
+   * not prove a 3.0 seller, and such sellers keep the 3.0 request adapters).
+   */
+  negotiateCallRelease(capabilities, options) {
+    if (this.config.wireAdcpVersion !== void 0 || options?.wireAdcpVersion !== void 0) return void 0;
+    if (options?.preserveGovernedPayload || this.config.experimentalIdentity33) return void 0;
+    const negotiated = negotiateAdcpRelease(this.resolvedAdcpVersion, capabilities);
+    if (!negotiated || isNegotiationFailure(negotiated) || negotiated.source === "legacy_v3") return void 0;
+    return negotiated;
+  }
+  /**
+   * Per-call options carrying the negotiated release to the executor, which
+   * stamps it on the version envelope and validates the response against it.
+   */
+  withNegotiatedRelease(options, negotiated) {
+    if (!negotiated?.downgraded) return options;
+    return { ...options ?? {}, wireAdcpVersion: negotiated.version, negotiatedAdcpVersion: negotiated.version };
+  }
+  /**
+   * Refuse a tool the negotiated release does not define (a 3.2-only task
+   * sent to a 3.1 seller) with a typed error instead of a seller-side schema
+   * or unknown-tool failure. Sellers that list the tool anyway are called.
+   */
+  assertToolAvailableAtRelease(taskType, negotiated, toolSchemas) {
+    if (!negotiated?.downgraded) return;
+    if (isExternalSchemaRootActive(negotiated.version)) return;
+    if (releaseDefinesTool(taskType, negotiated.version)) return;
+    if (!releaseDefinesTool(taskType, this.resolvedAdcpVersion)) return;
+    if ((toolSchemas ?? this.cachedToolSchemas)?.has(taskType)) return;
+    const suggestion = `Call a task AdCP ${negotiated.version} defines, or reach this seller once it supports AdCP ${toReleasePrecisionWire(this.resolvedAdcpVersion)}.`;
+    throw new ProtocolFeatureUnsupportedError([taskType], [], this.agent.agent_uri, {
+      message: `${taskType} is not defined in AdCP ${negotiated.version}, the newest release this seller supports. No request was sent. ${suggestion}`,
+      suggestion,
+      details: {
+        feature: taskType,
+        required_version: toReleasePrecisionWire(this.resolvedAdcpVersion),
+        capability_path: "adcp.supported_versions",
+        current_version: negotiated.version,
+        tool: taskType
+      }
+    });
+  }
+  /**
+   * Account-key bookkeeping for `accountIdentityDowngrade: 'reduce'`.
+   *
+   * Converting down to an older seller release: claim each reduced key for
+   * the buyer key it came from, and refuse the request when the reduced key
+   * (or an unreduced key the request sends as is) already belongs to a
+   * different buyer key. Without this, two buyer accounts would silently
+   * share one seller account, with merged settings, spend and reads.
+   *
+   * Seller on the client's release: a buyer key that earlier reached this
+   * seller reduced is still addressed by its reduced key, which is the key
+   * the seller's account has, until the caller moves the account to the full
+   * key and calls `client.accounts.clearReduction(key)`.
+   *
+   * Runs only once the account registry is in use or under `'reduce'`.
+   */
+  async reconcileAccountKeyReductions(taskType, original, adapted, negotiated, driftLogs) {
+    if (this.accountIdentityDowngrade !== "reduce" && !this._accounts) return adapted;
+    const sites = accountKeySites(original);
+    if (sites.length === 0) return adapted;
+    const registry = this.getAccountRegistry();
+    if (negotiated?.downgraded) {
+      if (this.accountIdentityDowngrade !== "reduce") return adapted;
+      const claims = sites.flatMap((site) => {
+        const reduced = naturalAccountKey(valueAt(adapted, site.path));
+        return reduced ? [{ site, account: site.key, reduced, adcpVersion: negotiated.version }] : [];
+      });
+      const conflict = await registry.claimReductions(claims);
+      if (conflict) {
+        this.throwAccountKeyCollision(taskType, claims[conflict.index].site.path, conflict.owner, negotiated.version);
+      }
+      return adapted;
+    }
+    let rewritten = adapted;
+    const pending = [];
+    for (const site of sites) {
+      const reduction = await registry.reductionFor(site.key);
+      if (!reduction) continue;
+      rewritten = withReducedKeyAt(rewritten, site.path, reduction.account);
+      pending.push({
+        path: site.path.join("."),
+        fields: reducedFields(site.key, reduction.account),
+        adcpVersion: reduction.adcpVersion
+      });
+    }
+    if (pending.length > 0) {
+      const inPlace = pending.every((entry) => entry.fields.every((field) => field === "operator_unit"));
+      driftLogs.push({
+        type: "account_identity_migration_pending",
+        message: `${taskType}: addressed ${pending.map((entry) => entry.path).join(", ")} by the reduced account key this seller has, without ${[...new Set(pending.flatMap((entry) => entry.fields))].join(", ")}. ` + (inPlace ? "Rekey the account in place with a sync_accounts settings update (account, operator_identity, revision), " : "currency, timezone and brand.countries cannot change on an existing account, so open a new account under the full key (and decide which key keeps the existing history), ") + "then call client.accounts.clearReduction(key).",
+        accounts: pending,
+        taskName: taskType,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+    return rewritten;
+  }
+  throwAccountKeyCollision(taskType, path, owner, negotiatedVersion) {
+    const field = path.join(".");
+    const suggestion = `Reach this seller with one of the two account keys, address the account by account_id, or wait until the seller supports the release that tells them apart.`;
+    throw new ProtocolFeatureUnsupportedError([`${taskType}.${field}`], [], this.agent.agent_uri, {
+      message: `${taskType} ${field} would reach the same seller account as another of this buyer's account keys: AdCP ${negotiatedVersion} cannot tell them apart. No request was sent. ${suggestion}`,
+      field,
+      suggestion,
+      details: {
+        feature: `${taskType}.${field}`,
+        reason: "account_identity_collision",
+        current_version: negotiatedVersion,
+        tool: taskType,
+        field,
+        conflicting_account: owner
+      }
+    });
+  }
+  throwFieldsUnsupportedAtRelease(taskType, fields, negotiatedVersion) {
+    const [first] = fields;
+    const paths = fields.map((field) => field.path);
+    const accountMove = paths.some((path) => /(?:^|\.)(?:operator_identity|revision)$/.test(path));
+    const suggestion = accountMove ? `AdCP ${negotiatedVersion} cannot rekey an account or hand it to another operator (operator_identity, revision). Make the move once the seller supports AdCP ${first.introducedIn}; until then the account keeps its current key and operator.` : `Remove ${paths.join(", ")} for this seller, or reach it once it supports AdCP ${first.introducedIn}. Sending the request without them would change what the seller does.`;
+    throw new ProtocolFeatureUnsupportedError(
+      paths.map((path) => `${taskType}.${path}`),
+      [],
+      this.agent.agent_uri,
+      {
+        message: `${taskType} ${paths.join(", ")} ${paths.length === 1 ? "requires" : "require"} AdCP ${first.introducedIn}; this seller supports AdCP ${negotiatedVersion}. No request was sent. ${suggestion}`,
+        field: first.path,
+        suggestion,
+        details: {
+          feature: `${taskType}.${first.path}`,
+          required_version: first.introducedIn,
+          capability_path: "adcp.supported_versions",
+          current_version: negotiatedVersion,
+          tool: taskType,
+          field: first.path,
+          fields: paths
+        }
+      }
+    );
+  }
+  throwAccountIdentityUnsupported(taskType, fields, negotiatedVersion) {
+    const [first] = fields;
+    const paths = fields.map((field) => field.path);
+    const suggestion = `Set accountIdentityDowngrade: 'reduce' to send the older account key (allowed while no other buyer key reaches the same seller account without ${paths.join(", ")}), or remove those fields for this seller.`;
+    throw new ProtocolFeatureUnsupportedError(
+      paths.map((path) => `${taskType}.${path}`),
+      [],
+      this.agent.agent_uri,
+      {
+        message: `${taskType} ${paths.join(", ")} ${paths.length === 1 ? "is" : "are"} part of the AdCP ${first.introducedIn} account key, which AdCP ${negotiatedVersion} cannot express. No request was sent. ${suggestion}`,
+        field: first.path,
+        suggestion,
+        details: {
+          feature: `${taskType}.${first.path}`,
+          required_version: first.introducedIn,
+          capability_path: "adcp.supported_versions",
+          current_version: negotiatedVersion,
+          tool: taskType,
+          field: first.path,
+          fields: paths
+        }
+      }
+    );
+  }
+  rememberNegotiatedRelease(operationId, version) {
+    this.negotiatedReleaseByOperation.delete(operationId);
+    this.negotiatedReleaseByOperation.set(operationId, version);
+    if (this.negotiatedReleaseByOperation.size > MAX_REMEMBERED_NEGOTIATED_RELEASES) {
+      const oldest = this.negotiatedReleaseByOperation.keys().next().value;
+      if (oldest !== void 0) this.negotiatedReleaseByOperation.delete(oldest);
+    }
+  }
+  /**
+   * Webhook completions bypass task finalization, so convert their result up
+   * here. The seller's own `adcp_version` names the release it served; an
+   * AdCP 3.0 seller sends none, so fall back to the release this client
+   * negotiated for the operation.
+   */
+  convertWebhookResultToClientRelease(parsed) {
+    const served = [parsed.result, parsed.envelope].map(
+      (value) => value && typeof value === "object" && typeof value.adcp_version === "string" ? value.adcp_version : void 0
+    ).find((version) => version !== void 0);
+    const release = served ?? this.negotiatedReleaseByOperation.get(parsed.metadata.operationId);
+    if (release === void 0 || parsed.result === void 0 || parsed.result === null) return parsed.result;
+    return convertResponse(parsed.metadata.taskType, parsed.result, {
+      fromVersion: release,
+      toVersion: this.resolvedAdcpVersion
+    }).data;
+  }
+  /**
+   * Convert a response served at the negotiated release up to the client's
+   * release. Returns drift entries for each conversion applied.
+   */
+  convertResponseToClientRelease(taskType, data, negotiatedVersion) {
+    if (negotiatedVersion === void 0 || data === void 0 || data === null) return { data, driftLogs: [] };
+    const translation = convertResponse(taskType, data, {
+      fromVersion: negotiatedVersion,
+      toVersion: this.resolvedAdcpVersion
+    });
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    return {
+      data: translation.data,
+      driftLogs: translation.drifts.map((drift) => ({
+        ...drift,
+        taskName: taskType,
+        clientVersion: this.resolvedAdcpVersion,
+        targetVersion: negotiatedVersion,
+        timestamp
+      }))
+    };
+  }
   /**
    * Adapt a request for the detected server wire version and the seller's
    * AdCP protocol version. Applies protocol-version adapters (e.g. stripping
@@ -4732,7 +5025,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    * Runs after `detectServerVersion` so capabilities are available and the
    * current call's tool schemas can be supplied without cross-tenant caching.
    */
-  adaptRequest(taskType, params, serverVersion, debugLogs, perCallToolSchemas, perCallCapabilities) {
+  adaptRequest(taskType, params, serverVersion, debugLogs, perCallToolSchemas, perCallCapabilities, negotiated) {
     if (serverVersion !== "v3") {
       throw new VersionUnsupportedError(taskType, "version", "v2", this.agent.agent_uri);
     }
@@ -4769,10 +5062,34 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       }
       adapted = filtered;
     }
+    if (negotiated?.downgraded) {
+      const translation = convertRequest(taskType, adapted, {
+        fromVersion: this.resolvedAdcpVersion,
+        toVersion: negotiated.version,
+        accountIdentity: this.accountIdentityDowngrade
+      });
+      if (translation.identityFields.length > 0 && this.accountIdentityDowngrade === "refuse") {
+        this.throwAccountIdentityUnsupported(taskType, translation.identityFields, negotiated.version);
+      }
+      if (translation.refusedFields.length > 0) {
+        this.throwFieldsUnsupportedAtRelease(taskType, translation.refusedFields, negotiated.version);
+      }
+      const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+      for (const drift of translation.drifts) {
+        driftLogs.push({
+          ...drift,
+          taskName: taskType,
+          clientVersion: this.resolvedAdcpVersion,
+          targetVersion: negotiated.version,
+          timestamp
+        });
+      }
+      return { params: translation.params, driftLogs };
+    }
     const adapterKey = resolveAdapterKey(this.resolvedAdcpVersion, perCallCapabilities ?? this.cachedCapabilities);
     if (adapterKey) {
       const versionAdapter = getVersionAdapter(adapterKey, taskType);
-      if (versionAdapter) {
+      if (versionAdapter?.adaptRequest) {
         const result = versionAdapter.adaptRequest(adapted);
         adapted = result.params;
         if (result.drift) {
@@ -4874,7 +5191,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         request = { ...request, buying_mode: "wholesale" };
       }
       const account = canonicalAccountRoutingSnapshot(accountReference);
-      const cache = !effectiveOptions.skipRequestValidation && !effectiveOptions.preserveGovernedPayload && !inputHandler && !request.push_notification_config && !this.config.webhookUrlTemplate && !this.config.handlers?.onGetProductsStatusChange ? this.config.productCache : void 0;
+      const cache = !effectiveOptions.skipRequestValidation && !this.usesScopedDiscoveryTransport(effectiveOptions) && !effectiveOptions.preserveGovernedPayload && !inputHandler && !request.push_notification_config && !this.config.webhookUrlTemplate && !this.config.handlers?.onGetProductsStatusChange ? this.config.productCache : void 0;
       const cacheScope = cache ? JSON.stringify([
         this.accountScope(),
         this.resolvedAdcpVersion,
@@ -6391,32 +6708,47 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       const serverVersion = await this.detectServerVersion(detectionOptions);
       detectedServerVersion = serverVersion;
       detectedServerVersionSynthetic = capabilityDiscoveryContext.capabilities?._synthetic;
+      const negotiatedRelease = this.negotiateCallRelease(capabilityDiscoveryContext.capabilities, options);
+      this.assertToolAvailableAtRelease(taskName, negotiatedRelease, capabilityDiscoveryContext.toolSchemas);
       this.assertRequestSupportedByTargetVersion(
         taskName,
         normalizedParams,
         capabilityDiscoveryContext.capabilities,
         false,
-        serverVersion
+        serverVersion,
+        negotiatedRelease
       );
-      const { options: effectiveOptions, driftLog: webhookDriftLog } = this.suppressPre31DiscoveryWebhook(
+      const { options: webhookOptions, driftLog: webhookDriftLog } = this.suppressPre31DiscoveryWebhook(
         taskName,
         options,
         capabilityDiscoveryContext.capabilities
       );
+      const effectiveOptions = this.withNegotiatedRelease(webhookOptions, negotiatedRelease);
       const inputSchemaStripLogs = [];
       if (options?.preserveGovernedPayload && serverVersion !== "v3") {
         throw new ConfigurationError(
           "Governed storyboard requests require a v3 seller to preserve the approved payload."
         );
       }
-      const { params: adaptedParams, driftLogs: adaptDriftLogs } = options?.preserveGovernedPayload ? { params: normalizedParams, driftLogs: [] } : this.adaptRequest(
+      const { params: convertedParams, driftLogs: adaptDriftLogs } = options?.preserveGovernedPayload ? { params: normalizedParams, driftLogs: [] } : this.adaptRequest(
         taskName,
         normalizedParams,
         serverVersion,
         inputSchemaStripLogs,
         capabilityDiscoveryContext.toolSchemas,
-        capabilityDiscoveryContext.capabilities
+        capabilityDiscoveryContext.capabilities,
+        negotiatedRelease
       );
+      const adaptedParams = options?.preserveGovernedPayload ? convertedParams : await this.reconcileAccountKeyReductions(
+        taskName,
+        normalizedParams,
+        convertedParams,
+        negotiatedRelease,
+        adaptDriftLogs
+      );
+      if (negotiatedRelease?.downgraded && !options?.skipIdempotencyAutoInject && !options?.skipAccountValidation && !options?.skipRequestValidation) {
+        this.executor.validateRequest(taskName, adaptedParams, inputSchemaStripLogs, negotiatedRelease.version);
+      }
       const adaptationLogs = [...adaptDriftLogs];
       if (webhookDriftLog) adaptationLogs.push(webhookDriftLog);
       const deferredClientContext = {
@@ -6428,6 +6760,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         ...capabilityDiscoveryContext.capabilities?._synthetic !== void 0 && {
           serverVersionSynthetic: capabilityDiscoveryContext.capabilities._synthetic
         },
+        ...negotiatedRelease?.downgraded && { negotiatedAdcpVersion: negotiatedRelease.version },
         productPolicyRequest: productPolicyRequestSnapshot(normalizedParams),
         accountRegistry: this.accountRegistryContext(taskName, normalizedParams, effectiveOptions),
         ...effectiveOptions?.taskId !== void 0 && { optionTaskId: effectiveOptions.taskId },
@@ -6912,6 +7245,12 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    * ```
    */
   async getAgentInfo(options) {
+    return withMCPConnectionPolicy(
+      normalizeTransportOptions(options?.transport ?? this.config.transport),
+      () => this.getAgentInfoWithConnectionPolicy(options)
+    );
+  }
+  async getAgentInfoWithConnectionPolicy(options) {
     throwIfAborted(options?.signal);
     const reuse = this.config._reuseConfiguredDiscovery?.() && !this.usesScopedDiscoveryTransport(options);
     if (!reuse) return this.getAgentInfoLive(options);
@@ -7008,7 +7347,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       } else if (readAuthToken) {
         connectOptions.authToken = readAuthToken;
       }
-      const modernTools = !transport?.trustedFetchFn && this.discoveredMcpEra === "legacy" && Date.now() - this.discoveredMcpEraAt < 5 * 60 * 1e3 ? { handled: false } : await withResponseSizeLimit(
+      const modernTools = !this.usesScopedDiscoveryTransport(options) && this.discoveredMcpEra === "legacy" && Date.now() - this.discoveredMcpEraAt < 5 * 60 * 1e3 ? { handled: false } : await withResponseSizeLimit(
         maxResponseBytes,
         () => tryListModernMCPTools(agent.agent_uri, readAuthToken, this.normalizedAgent.headers, {
           authProvider,
@@ -7160,6 +7499,12 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    * ```
    */
   async getCapabilities(options) {
+    return withMCPConnectionPolicy(
+      normalizeTransportOptions(options?.transport ?? this.config.transport),
+      () => this.getCapabilitiesWithConnectionPolicy(options)
+    );
+  }
+  async getCapabilitiesWithConnectionPolicy(options) {
     throwIfAborted(options?.signal);
     this.synchronizeCapabilityEvidenceAuthorizationScope();
     const discoveryContext = options?.[CAPABILITY_DISCOVERY_CONTEXT];
@@ -7414,6 +7759,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     const effectiveAgent = this.normalizedAgent;
     return canonicalizeJson({
       authToken: effectiveAgent.auth_token ?? null,
+      connectionPartition: this.config.transport?.connectionPartition ?? null,
       headers: effectiveAgent.headers ?? null,
       oauthTokens: effectiveAgent.oauth_tokens ?? null,
       oauthClient: effectiveAgent.oauth_client ?? null,
@@ -7446,8 +7792,9 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
   /** A comply() run owns its configured fetch; per-call transport changes still discover separately. */
   usesScopedDiscoveryTransport(options) {
     const transport = normalizeTransportOptions(options?.transport ?? this.config.transport);
-    if (!this.config._reuseConfiguredDiscovery?.()) return transport?.trustedFetchFn !== void 0;
     const configured = normalizeTransportOptions(this.config.transport);
+    if (transport?.connectionPartition !== configured?.connectionPartition) return true;
+    if (!this.config._reuseConfiguredDiscovery?.()) return transport?.trustedFetchFn !== void 0;
     return transport?.trustedFetchFn !== configured?.trustedFetchFn || transport?.allowPrivateIp !== configured?.allowPrivateIp || transport?.maxResponseBytes !== configured?.maxResponseBytes || transport?.requestTimeoutMs !== configured?.requestTimeoutMs || transport?.legacyCompat?.enabled !== configured?.legacyCompat?.enabled;
   }
   /**
@@ -7575,6 +7922,8 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       kid: (provider ? provider.keyid : signing.kid) ?? null,
       alg: (provider ? provider.algorithm : signing.alg) ?? null,
       alwaysSign: signing.always_sign ?? null,
+      alwaysSignProtocolMethods: signing.always_sign_protocol_methods ?? null,
+      unsignedCapabilityBootstrap: hasUnsignedCapabilityBootstrap(signing),
       signSupported: signing.sign_supported ?? null
     };
   }
@@ -7594,6 +7943,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       adcpVersion: this.resolvedAdcpVersion,
       wireAdcpVersion: this.config.wireAdcpVersion,
       authIdentity: config.authIdentity,
+      connectionPartition: transport?.connectionPartition,
       credentialKind: this.discoveryCredentialKind(),
       headers: withAmbientIdentityHeaders(this.normalizedAgent.headers),
       signing: this.discoverySigningFingerprint(),
@@ -8122,8 +8472,9 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    * first (cold-cache) call; the configured-version gate above still catches
    * an explicitly pre-3.1 client before validation or network I/O.
    */
-  assertRequestSupportedByTargetVersion(taskName, params, capabilities, canonicalCreativeInvocation = false, serverVersion) {
-    if (taskName === "sync_accounts") {
+  assertRequestSupportedByTargetVersion(taskName, params, capabilities, canonicalCreativeInvocation = false, serverVersion, negotiated) {
+    const reducesAccountIdentity = this.accountIdentityDowngrade === "reduce" && negotiated?.downgraded === true;
+    if (taskName === "sync_accounts" && !reducesAccountIdentity) {
       const advertisedVersions2 = capabilities?.supportedVersions ?? [];
       const servedVersion = capabilities?.servedVersion ?? capabilities?._raw?.adcp_version;
       const supports32 = serverVersion !== "v2" && (typeof servedVersion === "string" ? isAdcpVersionAtLeast(servedVersion, "3.2.0-0") : advertisedVersions2.some((version) => isAdcpVersionAtLeast(version, "3.2.0-0")));
@@ -8293,7 +8644,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     }
     const supportedVersions = capabilities.supportedVersions;
     if (supportedVersions !== void 0 && supportedVersions.length > 0) {
-      if (!isAdcpVersionSupported(this.resolvedAdcpVersion, supportedVersions)) {
+      if (!isAdcpVersionSupported(this.resolvedAdcpVersion, supportedVersions) && this.negotiateCallRelease(capabilities, options) === void 0) {
         throw new VersionUnsupportedError(taskType, "version", capabilities.version, this.agent.agent_uri);
       }
     } else {

package/dist/lib/core/TaskExecutor.d.mts

@@ -226,7 +226,7 @@ export declare class TaskExecutor {
      * adaptation runs, so the validator sees the same object the caller wrote.
      * Throws in strict, logs to `debugLogs` in warn, no-ops in off.
      */
-    validateRequest(taskName: string, params: unknown, debugLogs?: any[]): void;
+    validateRequest(taskName: string, params: unknown, debugLogs?: any[], adcpVersion?: string): void;
     /**
      * Generate webhook URL for protocol-level webhook support
      */

package/dist/lib/core/TaskExecutor.d.ts

@@ -226,7 +226,7 @@ export declare class TaskExecutor {
      * adaptation runs, so the validator sees the same object the caller wrote.
      * Throws in strict, logs to `debugLogs` in warn, no-ops in off.
      */
-    validateRequest(taskName: string, params: unknown, debugLogs?: any[]): void;
+    validateRequest(taskName: string, params: unknown, debugLogs?: any[], adcpVersion?: string): void;
     /**
      * Generate webhook URL for protocol-level webhook support
      */