@adcp/sdk 16.4.0 → 16.5.0

package/docs/llms.txt

@@ -1,7 +1,7 @@
 # Ad Context Protocol (AdCP)
 
-> Generated at: 2026-10-23
-> Library: @adcp/sdk v16.4.0
+> Generated at: 2026-10-25
+> Library: @adcp/sdk v16.5.0
 > AdCP major version: 3
 > Canonical URL: https://adcontextprotocol.github.io/adcp-client/llms.txt
 > Note: the `Library` stamp reflects the package.json version at doc-generation time. The narrative below describes the surface that lands on the next-published minor — including any 6.7 helpers documented here ahead of the release tag.
@@ -13,7 +13,7 @@ AdCP is an open protocol for AI agents to buy, manage, and optimize advertising
 
 ## Start here: AdCP 3.2
 
-The SDK requires Node.js `^20.19.0 || >=22.12.0`. Install this reference's release train with `npm install @adcp/sdk@16.4`; use the documentation from the exact published SDK version you install. For reproducible CLI runs, pin that exact SDK version. After installation, `node -p "require('@adcp/sdk').ADCP_VERSION"` reports its protocol pin; `ls node_modules/@adcp/sdk/compliance/cache` lists its packaged compliance versions. The legacy `adcp-3.2` npm tag selects SDK 14 and does not receive the refreshed compliance caches.
+The SDK requires Node.js `^20.19.0 || >=22.12.0`. Install this reference's release train with `npm install @adcp/sdk@16.5`; use the documentation from the exact published SDK version you install. For reproducible CLI runs, pin that exact SDK version. After installation, `node -p "require('@adcp/sdk').ADCP_VERSION"` reports its protocol pin; `ls node_modules/@adcp/sdk/compliance/cache` lists its packaged compliance versions. The legacy `adcp-3.2` npm tag selects SDK 14 and does not receive the refreshed compliance caches.
 
 The SDK is compact-lifecycle first: `list_products → buy_products → control_media_buy`, with `request_proposals → refine_proposals → accept_proposal` when terms need negotiation.
 
@@ -1529,7 +1529,7 @@ Flow: `get_products`
 **Product coverage is preserved across discovery surfaces** — Checks legacy and compact coverage predicates against independent negative controls without configuring delivery targeting.
 Flow: `get_products → list_products`
 
-**Seller applies deterministic product filters in every buying mode** — Verifies schema-valid get_products filters affect brief curation, wholesale feeds, and refinement instead of silently no-oping.
+**Seller applies deterministic product filters in supported buying modes** — Verifies schema-valid get_products filters affect brief curation, wholesale feeds, and refinement instead of silently no-oping.
 Flow: `get_products`
 
 **Seller exposes wholesale signal options and honors package-level signal_targeting_groups** — Verifies that a seller with wholesale products and wholesale get_signals can expose signal targeting eligibility, accept package-level signal_targeting_groups with pricing, reject unknown signals, and echo the applied grouped expression on readback.
@@ -1572,7 +1572,7 @@ Flow: `sync_accounts → get_products → create_media_buy → get_media_buys`
 Flow: `get_products → create_media_buy → update_media_buy → get_media_buys → update_media_buy → create_media_buy → get_products → create_media_buy → update_media_buy → get_media_buys → update_media_buy → get_media_buys`
 
 **Atomic media-buy total budget redistribution** — Verifies that a fixed media-buy total_budget update proportionally rescales active packages, returns auditable package state, and rejects competing package patches atomically.
-Flow: `sync_accounts → create_media_buy → update_media_buy → get_media_buys → update_media_buy`
+Flow: `sync_accounts → create_media_buy → get_media_buys → update_media_buy → get_media_buys → update_media_buy`
 
 **Seller handles typed proposal negotiation with constraints, product changes, and alternatives** — Verifies the AdCP 3.2 typed negotiation lifecycle: capability-gated constraint satisfaction, product changes, digest-verified alternatives, partial invariant, immutable lineage, finalize atomicity, and idempotent replay through refine_proposals.
 Flow: `get_adcp_capabilities → sync_accounts → request_proposals → refine_proposals → accept_proposal → refine_proposals`
@@ -1602,7 +1602,7 @@ Flow: `get_adcp_capabilities → get_products → create_media_buy → get_media
 Flow: `get_adcp_capabilities → sync_accounts → sync_catalogs → build_creative → expect_substitution_safe → get_products → create_media_buy → sync_event_sources → log_event → provide_performance_feedback → get_media_buy_delivery`
 
 **Digital out-of-home — non-guaranteed** — DOOH seller for non-guaranteed venue and screen inventory with canonical screen formats and substantive play reporting.
-Flow: `get_adcp_capabilities → list_products → create_media_buy → validate_input → sync_creatives → create_media_buy → comply_test_controller → get_media_buy_delivery`
+Flow: `get_adcp_capabilities → list_products → get_products → create_media_buy → validate_input → sync_creatives → create_media_buy → comply_test_controller → get_media_buy_delivery`
 
 **Programmatic exchange seller** — Programmatic exchange or SSP — multi-publisher auction inventory with floor prices, bid guidance, audience targeting, and auction-level delivery transparency.
 Flow: `get_adcp_capabilities → sync_accounts → sync_governance → get_products → create_media_buy → update_media_buy → get_media_buy_delivery`
@@ -1655,7 +1655,7 @@ Flow: `sync_accounts → get_products → create_media_buy → comply_test_contr
 Flow: `get_media_buys → comply_test_controller → get_media_buy_delivery`
 
 **End-to-end vendor-metric accountability: declaration → commitment → delivery audit** — Buyer commits vendor metrics on two packages, then verifies one clean package, one overdue gap, and one not-yet-measurable omission.
-Flow: `sync_accounts → get_products → create_media_buy → comply_test_controller → get_media_buy_delivery`
+Flow: `sync_accounts → get_products → create_media_buy → get_media_buys → comply_test_controller → get_media_buy_delivery`
 
 **Reliable Reporting: Managed Delivery** — Validates the Managed Delivery tier's explicit capability, atomic managed offering, resource retention, and authorization-revocation contract.
 Flow: `get_adcp_capabilities → comply_test_controller → get_reporting_status → comply_test_controller`
@@ -1838,6 +1838,8 @@ Flow: `get_adcp_capabilities → list_transformers → build_creative`
 
 **Runner output contract** — Required failure-detail shape that AdCP storyboard runners MUST emit so implementors can self-diagnose validation failures.
 
+**AdCP 4.0 compatibility checks**
+
 ### Error Handling
 
 **Billing contract and gate dispatch — sync_accounts capability vs per-buyer-agent gate** — Validates that account.supported_billing is declared and honored by sync_accounts, including out-of-set BILLING_NOT_SUPPORTED rejection, recovery-value consistency, and the distinct per-buyer-agent BILLING_NOT_PERMITTED_FOR_AGENT gate.
@@ -2045,6 +2047,8 @@ Run compliance tests with `adcp test <agent> <scenario>`. 24 built-in scenarios:
 
 ### Seeding fixtures for compliance (seller-side)
 
+Fresh fixture preparation can be gated with `prepareStoryboardFixtures(..., { prepared_fixtures_preparation_authorizer })`. It asks once before seller contact using a truthful proposed binding. The existing `prepared_fixtures_authorizer` remains reuse-only and is never called by preparation. The preparation-only option is rejected by run/step/comply; prepare explicitly before reusing state. See [collection fixture foundation](guides/COLLECTION-FIXTURE-FOUNDATION.md).
+
 Group A storyboards seed fixtures via `comply_test_controller.seed_product` (and the other `seed_*` scenarios) before calling the spec tool. Two SDK helpers bridge this:
 
 - **`mergeSeedProduct`** (plus the raw-wire `mergeSeedProductLegacy` migration counterpart, `mergeSeedPricingOption`, `mergeSeedCreative`, `mergeSeedPlan`, `mergeSeedMediaBuy`): permissive merge of a sparse storyboard fixture onto the seller's baseline defaults. `undefined`/`null` keep base; arrays replace by default; well-known id-keyed lists (`pricing_options`, `publisher_properties`, `packages`, `assets`, plan `findings`) overlay by id so seeding one entry doesn't drop the rest.

package/docs/migration-14.x-rc-worksheet.md

@@ -16,18 +16,18 @@ pin using `ADCP_VERSION` inside that tarball.
 
 | Fact | Value |
 | --- | --- |
-| Checkout `package.json` version | `@adcp/sdk@16.4.0` |
-| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@16.4.0 dist.integrity` |
+| Checkout `package.json` version | `@adcp/sdk@16.5.0` |
+| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@16.5.0 dist.integrity` |
 | Node.js runtime | `^20.19.0 || >=22.12.0` |
-| Default AdCP wire release | `3.2.5` |
-| Maintained wire releases | `v3`, `3.0.0`, `3.0`, `3.0.1`, `3.0.2`, `3.0.3`, `3.0.4`, `3.0.5`, `3.0.6`, `3.0.7`, `3.0.8`, `3.0.9`, `3.0.10`, `3.0.11`, `3.0.12`, `3.0.13`, `3.0.14`, `3.0.15`, `3.0.16`, `3.0.17`, `3.0.18`, `3.0.19`, `3.0.20`, `3.0.21`, `3.0.22`, `3.0.23`, `3.0.24`, `3.0.25`, `3.1.0`, `3.1`, `3.1.1`, `3.1.2`, `3.1.3`, `3.1.4`, `3.1.5`, `3.1.6`, `3.1.7`, `3.1.8`, `3.1.9`, `3.1.10`, `3.1.11`, `3.1.12`, `3.1.13`, `3.1.14`, `3.1.15`, `3.1.16`, `3.1.17`, `3.1.18`, `3.1.19`, `3.1.20`, `3.1.21`, `3.1.22`, `3.1.23`, `3.1.24`, `3.1.25`, `3.1.26`, `3.1.27`, `3.1.28`, `3.1.29`, `3.2.1`, `3.2`, `3.2.2`, `3.2.3`, `3.2.4`, `3.2.5` |
+| Default AdCP wire release | `3.2.7` |
+| Maintained wire releases | `v3`, `3.0.0`, `3.0`, `3.0.1`, `3.0.2`, `3.0.3`, `3.0.4`, `3.0.5`, `3.0.6`, `3.0.7`, `3.0.8`, `3.0.9`, `3.0.10`, `3.0.11`, `3.0.12`, `3.0.13`, `3.0.14`, `3.0.15`, `3.0.16`, `3.0.17`, `3.0.18`, `3.0.19`, `3.0.20`, `3.0.21`, `3.0.22`, `3.0.23`, `3.0.24`, `3.0.25`, `3.1.0`, `3.1`, `3.1.1`, `3.1.2`, `3.1.3`, `3.1.4`, `3.1.5`, `3.1.6`, `3.1.7`, `3.1.8`, `3.1.9`, `3.1.10`, `3.1.11`, `3.1.12`, `3.1.13`, `3.1.14`, `3.1.15`, `3.1.16`, `3.1.17`, `3.1.18`, `3.1.19`, `3.1.20`, `3.1.21`, `3.1.22`, `3.1.23`, `3.1.24`, `3.1.25`, `3.1.26`, `3.1.27`, `3.1.28`, `3.1.29`, `3.2.1`, `3.2`, `3.2.2`, `3.2.3`, `3.2.4`, `3.2.5`, `3.2.6`, `3.2.7` |
 | Canonical migration notes | [SDK 15 OAuth](./migration-oauth-issuer-bindings.md), [issuer-binding and storage](./guides/OAUTH-ISSUER-BINDING.md); historical [13.x → 14](./migration-13-to-14.md) |
 
 For a checkout at the published release commit, install the exact package version:
 
 ```bash
-npm install --save-exact '@adcp/sdk@16.4.0'
-npm view '@adcp/sdk@16.4.0' dist.integrity
+npm install --save-exact '@adcp/sdk@16.5.0'
+npm view '@adcp/sdk@16.5.0' dist.integrity
 ```
 
 ### Required and optional peers

package/docs/migration-agent-identity-3.3.md

@@ -354,8 +354,15 @@ resolver that throws: a transient (or uncoded) error is an outage answered
 that envelope and no challenge).
 
 Demand grants come from the verified brand or house record. Implicit authority
-requires brand, account operator, and signer operator to share a registrable
-domain. Otherwise only a direct grant with the account operator equal to the
+requires the account operator and signer operator to share a registrable domain
+with the brand or with its house (the house `resolveBrandHouse` returns, so the
+authorizing record and implicit authority never disagree). A house that the
+brand names but whose `brand_refs[]` does not list it back is unverified:
+`resolveBrandHouse` returns `undefined`, the brand is its own house, and the
+claimed house's operator needs a grant like any other. An uncoded throw from
+`resolveBrandHouse` is a `TrustRecordUnavailableError` (`SERVICE_UNAVAILABLE`),
+never `grant_absent`; an `IdentityAuthorizationError` or `AdcpError` it throws
+keeps its code. Otherwise only a direct grant with the account operator equal to the
 signer, a direct grant from a self-operated brand (the brand is its own account
 operator) to the signer's operator, or a two-link chain through the account
 operator, is accepted. The
@@ -461,10 +468,10 @@ released schemas:
 | [8169](https://github.com/adcontextprotocol/adcp/pull/8169) | `3ce6a14d7afaa71fa78ddf2223ed0421e01205ae` | Grants, trust schema, grant_absent; the registrable-domain `grantee` rule and its schema description from `eabe46048530c08a34e6eee6e4d15d7848e01c57` |
 | [8170](https://github.com/adcontextprotocol/adcp/pull/8170) | `8d3591e70e9a717c7fdfb513360a796fba24ca9a` | Onboarding additions only; its old trust key fields are excluded |
 | [8177](https://github.com/adcontextprotocol/adcp/pull/8177) | `b663f8e4235fe4276c73fb9bac6db491b2252bbf` | Reporting authentication omission |
-| [8298](https://github.com/adcontextprotocol/adcp/pull/8298) | `f44785a5b65db93988f30ad3d23ba5849f1a1d5e` | WBA interop harness, directory and request vectors |
+| [8298](https://github.com/adcontextprotocol/adcp/pull/8298) | `b3461a2ea279971b930b3d4d8d23ae56210a987b` | WBA interop harness, directory and request vectors (merge commit on `main`) |
 
 The vectors in `test/fixtures/wba-profile/` are byte-identical to #8298 at that
-head (see `PINNED.json`), which carries the #7894 profile and vectors. Every
+commit (see `PINNED.json`), which carries the #7894 profile and vectors. Every
 vendored request and directory vector is graded, and the interop harness
 (adcontextprotocol/adcp#8298) grades `scenarios.json`.
 

package/docs/migration-reporting-storage-package.md

@@ -22,6 +22,21 @@ Why: storage keeps its own release cadence, as Auth.js, LangGraph and OpenTeleme
 
 4. Re-run your own tests. No database migration is needed: every migration constant has the same SQL under its new import path.
 
+## BigQuery location discovery
+
+The BigQuery sink now discovers an omitted `location` from dataset metadata,
+including for US/EU datasets. Before upgrading the storage package:
+
+- Grant `bigquery.datasets.get` and expose `dataset.getMetadata()` in any client
+  wrapper, or set `location` explicitly to skip metadata access.
+- Replace empty location strings with an omitted option for discovery, or with
+  the actual dataset location. Empty strings now fail at construction.
+- Replace monitoring of `ADCP_BIGQUERY_SINK_LOCATION_UNSET` with monitoring of
+  rejected `runOnce()` calls. Discovery errors identify the permission and
+  explicit-location alternatives before warehouse state or loads are written.
+
+No database migration is required. See the [warehouse sink guide](guides/REPORTING-LEDGER.md#bigquery-warehouse-sink).
+
 ## Import mapping
 
 | Old import                                                                 | New import                                                                  |

package/examples/reliable-reporting-buyer/worker.mjs

@@ -126,7 +126,9 @@ export async function startBuyerReporting(bindings) {
               ? 429
               : error.code === 'webhook_signature_revocation_stale'
                 ? 503
-                : 401;
+                : error.code === 'webhook_body_malformed'
+                  ? 400
+                  : 401;
       } else {
         console.warn('[buyer reporting] verifier unavailable');
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/sdk",
-  "version": "16.4.0",
+  "version": "16.5.0",
   "description": "AdCP SDK — client, server, and compliance harnesses for the AdContext Protocol (MCP + A2A)",
   "workspaces": [
     ".",
@@ -558,7 +558,7 @@
     ".claude-plugin/**/*",
     "compliance/cache/3.0.25/**/*",
     "compliance/cache/3.1.29/**/*",
-    "compliance/cache/3.2.5/**/*",
+    "compliance/cache/3.2.7/**/*",
     "ADCP_VERSION",
     "docs/README.md",
     "docs/TYPE-SUMMARY.md",
@@ -796,7 +796,7 @@
     "typescript-eslint": "^8.68.0",
     "web-bot-auth": "0.2.0",
     "workerd": "1.20260730.1",
-    "zod": "^4.4.3",
+    "zod": "^4.6.6",
     "zod-openapi": "^5.4.3"
   },
   "engines": {
@@ -818,7 +818,7 @@
     "launch-editor": "^2.14.2",
     "markdown-it": "^14.3.3"
   },
-  "adcp_version": "3.2.5",
+  "adcp_version": "3.2.7",
   "sideEffects": [
     "**/default-invariants.*"
   ]