@adcp/sdk 16.5.0 → 16.6.0

package/dist/lib/server/media-buy-store.mjs

@@ -1,6 +1,25 @@
 import { applyTargetingInput, resolveTargetingInput } from "../media-buy/targeting-input.mjs";
 import { scopedStore } from "./state-store.mjs";
 const DEFAULT_MEDIA_BUY_STORE_COLLECTION = "media_buys_targeting";
+const PACKAGE_IDENTITY_FIELDS = ["package_id", "product_id", "buyer_ref"];
+function compatibleIdentity(left, right) {
+  if (!left || !right) return false;
+  return PACKAGE_IDENTITY_FIELDS.every((key) => !left[key] || !right[key] || left[key] === right[key]);
+}
+function sharesIdentity(left, right) {
+  if (!left || !right) return false;
+  return compatibleIdentity(left, right) && PACKAGE_IDENTITY_FIELDS.some((key) => left[key] && left[key] === right[key]);
+}
+function matchContextPackage(requests, responses, index) {
+  const matches = requests.filter((request) => sharesIdentity(request, responses[index]));
+  if (matches.length === 1 && responses.filter((response) => sharesIdentity(matches[0], response)).length === 1) {
+    return matches[0];
+  }
+  if (requests.length === responses.length && requests.every((request, i) => compatibleIdentity(request, responses[i]))) {
+    return requests[index];
+  }
+  return void 0;
+}
 function createMediaBuyStore(options) {
   const collection = options.collection ?? DEFAULT_MEDIA_BUY_STORE_COLLECTION;
   function viewFor(accountId) {
@@ -18,8 +37,9 @@ function createMediaBuyStore(options) {
     async persistFromCreate(accountId, request, result) {
       const requestPackages = request.packages ?? [];
       const responsePackages = result.packages ?? [];
-      if (requestPackages.length === 0 || !result.media_buy_id) return;
-      const persistedPackages = [];
+      if (!result.media_buy_id) return;
+      const prior = await loadRecord(accountId, result.media_buy_id);
+      const byId = new Map((prior?.packages ?? []).map((pkg) => [pkg.package_id, { ...pkg }]));
       for (let i = 0; i < requestPackages.length; i++) {
         const reqPkg = requestPackages[i];
         if (!reqPkg?.targeting_overlay) continue;
@@ -30,12 +50,26 @@ function createMediaBuyStore(options) {
         if (!packageId) continue;
         const persistedOverlay = respPkg?.targeting_overlay ?? resolveTargetingInput(reqPkg.targeting_overlay);
         if (!persistedOverlay) continue;
-        persistedPackages.push({ package_id: packageId, targeting_overlay: persistedOverlay });
+        byId.set(packageId, { ...byId.get(packageId), package_id: packageId, targeting_overlay: persistedOverlay });
       }
-      if (persistedPackages.length === 0) return;
+      for (const [index, response] of responsePackages.entries()) {
+        if (!response.package_id) continue;
+        const context2 = matchContextPackage(requestPackages, responsePackages, index)?.context ?? response.context;
+        const stored = byId.get(response.package_id);
+        if (context2 !== void 0 && stored?.context === void 0) {
+          byId.set(response.package_id, {
+            ...stored,
+            package_id: response.package_id,
+            context: structuredClone(context2)
+          });
+        }
+      }
+      const context = prior?.context ?? request.context ?? result.context;
+      if (byId.size === 0 && context === void 0) return;
       await writeRecord(accountId, {
         media_buy_id: result.media_buy_id,
-        packages: persistedPackages
+        ...context !== void 0 ? { context: structuredClone(context) } : {},
+        packages: Array.from(byId.values())
       });
     },
     async mergeFromUpdate(accountId, mediaBuyId, patch) {
@@ -43,42 +77,56 @@ function createMediaBuyStore(options) {
         media_buy_id: mediaBuyId,
         packages: []
       };
-      const byId = new Map(prior.packages.map((p) => [p.package_id, p.targeting_overlay]));
+      const byId = new Map(prior.packages.map((p) => [p.package_id, { ...p }]));
       for (const pkg of patch.packages ?? []) {
         const packageId = pkg?.package_id;
         if (!packageId) continue;
         if (!("targeting_overlay" in pkg)) continue;
         const incoming = pkg.targeting_overlay;
         if (incoming === void 0) continue;
-        const merged = applyTargetingInput(byId.get(packageId), incoming);
-        if (merged) byId.set(packageId, merged);
-        else byId.delete(packageId);
+        const stored = byId.get(packageId);
+        const merged = applyTargetingInput(stored?.targeting_overlay, incoming);
+        if (merged) byId.set(packageId, { ...stored, package_id: packageId, targeting_overlay: merged });
+        else if (stored?.context !== void 0) {
+          byId.set(packageId, { package_id: packageId, context: stored.context });
+        } else byId.delete(packageId);
       }
       for (const pkg of patch.new_packages ?? []) {
         if (!pkg?.targeting_overlay || !pkg.package_id) continue;
         const resolved = resolveTargetingInput(pkg.targeting_overlay);
-        if (resolved) byId.set(pkg.package_id, resolved);
+        if (resolved)
+          byId.set(pkg.package_id, {
+            ...byId.get(pkg.package_id),
+            package_id: pkg.package_id,
+            targeting_overlay: resolved
+          });
       }
       await writeRecord(accountId, {
-        media_buy_id: mediaBuyId,
-        packages: Array.from(byId.entries()).map(([package_id, targeting_overlay]) => ({
-          package_id,
-          targeting_overlay
-        }))
+        ...prior,
+        packages: Array.from(byId.values())
       });
     },
     async backfill(accountId, result) {
       const buys = result.media_buys;
       if (!buys || buys.length === 0) return result;
       for (const buy of buys) {
-        if (!buy?.media_buy_id || !buy.packages) continue;
+        if (!buy?.media_buy_id) continue;
         const record = await loadRecord(accountId, buy.media_buy_id);
         if (!record) continue;
-        const overlayById = new Map(record.packages.map((p) => [p.package_id, p.targeting_overlay]));
-        for (const pkg of buy.packages) {
-          if (!pkg?.package_id || pkg.targeting_overlay !== void 0) continue;
-          const persisted = overlayById.get(pkg.package_id);
-          if (persisted) pkg.targeting_overlay = persisted;
+        if (buy.context === void 0 && record.context !== void 0) {
+          buy.context = structuredClone(record.context);
+        }
+        const byId = new Map(record.packages.map((p) => [p.package_id, p]));
+        for (const pkg of buy.packages ?? []) {
+          if (!pkg?.package_id) continue;
+          const persisted = byId.get(pkg.package_id);
+          if (!persisted) continue;
+          if (pkg.targeting_overlay === void 0 && persisted.targeting_overlay !== void 0) {
+            pkg.targeting_overlay = persisted.targeting_overlay;
+          }
+          if (pkg.context === void 0 && persisted.context !== void 0) {
+            pkg.context = structuredClone(persisted.context);
+          }
         }
       }
       return result;

package/dist/lib/server/responses.js

@@ -60,6 +60,7 @@ __export(responses_exports, {
 module.exports = __toCommonJS(responses_exports);
 var import_media_buy_helpers = require('./media-buy-helpers.js');
 var import_reporting_delivery_config = require('./reporting-delivery-config.js');
+var import_account_response_identity = require('./account-response-identity.js');
 const explicitResponseSummaries = /* @__PURE__ */ new WeakMap();
 function _getExplicitResponseSummary(response) {
   return explicitResponseSummaries.get(response);
@@ -124,7 +125,14 @@ function stripBusinessEntityBank(row, key) {
   return stripped;
 }
 function stripAccountWriteOnlyFields(account) {
-  const stripped = stripBusinessEntityBank(stripNotificationConfigSecrets(account), "billing_entity");
+  const {
+    destination_billing_entity: _destination,
+    authInfo: _authInfo,
+    ctx_metadata: _metadata,
+    ...responseFields
+  } = account;
+  const response = stripBusinessEntityBank(stripNotificationConfigSecrets(responseFields), "billing_entity");
+  const stripped = { ...response, ...(0, import_account_response_identity.projectAccountResponseIdentityFields)(response) };
   const reportingDeliveryConfigs = stripped.reporting_delivery_configs;
   if (reportingDeliveryConfigs === void 0) return stripped;
   return {

package/dist/lib/server/responses.mjs

@@ -1,5 +1,6 @@
 import { validActionsForStatus } from "./media-buy-helpers.mjs";
 import { projectReportingDeliveryConfigStates } from "./reporting-delivery-config.mjs";
+import { projectAccountResponseIdentityFields } from "./account-response-identity.mjs";
 const explicitResponseSummaries = /* @__PURE__ */ new WeakMap();
 function _getExplicitResponseSummary(response) {
   return explicitResponseSummaries.get(response);
@@ -64,7 +65,14 @@ function stripBusinessEntityBank(row, key) {
   return stripped;
 }
 function stripAccountWriteOnlyFields(account) {
-  const stripped = stripBusinessEntityBank(stripNotificationConfigSecrets(account), "billing_entity");
+  const {
+    destination_billing_entity: _destination,
+    authInfo: _authInfo,
+    ctx_metadata: _metadata,
+    ...responseFields
+  } = account;
+  const response = stripBusinessEntityBank(stripNotificationConfigSecrets(responseFields), "billing_entity");
+  const stripped = { ...response, ...projectAccountResponseIdentityFields(response) };
   const reportingDeliveryConfigs = stripped.reporting_delivery_configs;
   if (reportingDeliveryConfigs === void 0) return stripped;
   return {

package/dist/lib/server/state-machine.d.mts

@@ -20,21 +20,20 @@
  *     Production seller code that handles the wire protocol directly
  *     should use this — the framework projects `AdcpError` onto the
  *     wire `adcp_error` envelope automatically.
+ * Media-buy helpers accept the served AdCP version as a third argument;
+ * `getMediaBuyTransitions(version)` selects the same graph for custom consumers.
  *
  * @public
  */
 import type { CreativeStatus, MediaBuyStatus } from '../types/core.generated.mjs';
 /**
- * Legal `MediaBuyStatus` transitions per `media-buy-status.json`.
- *
- * `active ↔ paused` is reversible (buyer pauses, seller resumes).
- * `completed | rejected | canceled` are terminal — no outbound edges.
- *
- * `pending_start → rejected` is supported because the schema's prose
- * (`"declined by the seller after creation"`) does not exclude post-start
- * rejection. Storyboards do not exercise that edge today; sellers MAY
- * narrow it in their own enforcement if their upstream forbids it.
+ * Lifecycle graph for the served AdCP release. In 3.3, a seller review rejection
+ * can introduce buyer work before activation: `pending_start → pending_creatives`.
+ * Older releases keep their published graph. Active/paused buys cannot rewind.
+ * Accepts full-semver or release-precision versions, including 3.3 candidates.
  */
+export declare function getMediaBuyTransitions(adcpVersion?: string): ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>>;
+/** Lifecycle graph for the SDK's default AdCP release. */
 export declare const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>>;
 /**
  * Legal `CreativeStatus` transitions per `creative-status.json`.
@@ -47,7 +46,7 @@ export declare const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, Readonly
  */
 export declare const CREATIVE_ASSET_TRANSITIONS: ReadonlyMap<CreativeStatus, ReadonlySet<CreativeStatus>>;
 /** Boolean predicate for `MediaBuyStatus` transitions. Self-edges are illegal. */
-export declare function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): boolean;
+export declare function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus, adcpVersion?: string): boolean;
 /** Boolean predicate for `CreativeStatus` transitions. Self-edges are illegal. */
 export declare function isLegalCreativeTransition(from: CreativeStatus, to: CreativeStatus): boolean;
 /**
@@ -70,7 +69,7 @@ export declare function isLegalCreativeTransition(from: CreativeStatus, to: Crea
  * `STANDARD_ERROR_CODES` — the buyer can adjust their request (re-fetch
  * current state, choose a different action) rather than escalating.
  */
-export declare function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): void;
+export declare function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus, adcpVersion?: string): void;
 /**
  * Throws an `AdcpError('INVALID_STATE')` for an illegal `CreativeStatus`
  * transition. Creatives have no terminals — every state can recover via

package/dist/lib/server/state-machine.d.ts

@@ -20,21 +20,20 @@
  *     Production seller code that handles the wire protocol directly
  *     should use this — the framework projects `AdcpError` onto the
  *     wire `adcp_error` envelope automatically.
+ * Media-buy helpers accept the served AdCP version as a third argument;
+ * `getMediaBuyTransitions(version)` selects the same graph for custom consumers.
  *
  * @public
  */
 import type { CreativeStatus, MediaBuyStatus } from '../types/core.generated';
 /**
- * Legal `MediaBuyStatus` transitions per `media-buy-status.json`.
- *
- * `active ↔ paused` is reversible (buyer pauses, seller resumes).
- * `completed | rejected | canceled` are terminal — no outbound edges.
- *
- * `pending_start → rejected` is supported because the schema's prose
- * (`"declined by the seller after creation"`) does not exclude post-start
- * rejection. Storyboards do not exercise that edge today; sellers MAY
- * narrow it in their own enforcement if their upstream forbids it.
+ * Lifecycle graph for the served AdCP release. In 3.3, a seller review rejection
+ * can introduce buyer work before activation: `pending_start → pending_creatives`.
+ * Older releases keep their published graph. Active/paused buys cannot rewind.
+ * Accepts full-semver or release-precision versions, including 3.3 candidates.
  */
+export declare function getMediaBuyTransitions(adcpVersion?: string): ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>>;
+/** Lifecycle graph for the SDK's default AdCP release. */
 export declare const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, ReadonlySet<MediaBuyStatus>>;
 /**
  * Legal `CreativeStatus` transitions per `creative-status.json`.
@@ -47,7 +46,7 @@ export declare const MEDIA_BUY_TRANSITIONS: ReadonlyMap<MediaBuyStatus, Readonly
  */
 export declare const CREATIVE_ASSET_TRANSITIONS: ReadonlyMap<CreativeStatus, ReadonlySet<CreativeStatus>>;
 /** Boolean predicate for `MediaBuyStatus` transitions. Self-edges are illegal. */
-export declare function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): boolean;
+export declare function isLegalMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus, adcpVersion?: string): boolean;
 /** Boolean predicate for `CreativeStatus` transitions. Self-edges are illegal. */
 export declare function isLegalCreativeTransition(from: CreativeStatus, to: CreativeStatus): boolean;
 /**
@@ -70,7 +69,7 @@ export declare function isLegalCreativeTransition(from: CreativeStatus, to: Crea
  * `STANDARD_ERROR_CODES` — the buyer can adjust their request (re-fetch
  * current state, choose a different action) rather than escalating.
  */
-export declare function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus): void;
+export declare function assertMediaBuyTransition(from: MediaBuyStatus, to: MediaBuyStatus, adcpVersion?: string): void;
 /**
  * Throws an `AdcpError('INVALID_STATE')` for an illegal `CreativeStatus`
  * transition. Creatives have no terminals — every state can recover via

package/dist/lib/server/state-machine.js

@@ -22,12 +22,15 @@ __export(state_machine_exports, {
   MEDIA_BUY_TRANSITIONS: () => MEDIA_BUY_TRANSITIONS,
   assertCreativeTransition: () => assertCreativeTransition,
   assertMediaBuyTransition: () => assertMediaBuyTransition,
+  getMediaBuyTransitions: () => getMediaBuyTransitions,
   isLegalCreativeTransition: () => isLegalCreativeTransition,
   isLegalMediaBuyTransition: () => isLegalMediaBuyTransition
 });
 module.exports = __toCommonJS(state_machine_exports);
+var import_version = require('../version.js');
+var import_adcp_version_config = require('../utils/adcp-version-config.js');
 var import_async_outcome = require('./decisioning/async-outcome.js');
-const MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
+const LEGACY_MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
   ["pending_creatives", /* @__PURE__ */ new Set(["pending_start", "active", "paused", "canceled", "rejected"])],
   ["pending_start", /* @__PURE__ */ new Set(["active", "paused", "canceled", "rejected"])],
   ["active", /* @__PURE__ */ new Set(["paused", "completed", "canceled"])],
@@ -36,6 +39,17 @@ const MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
   ["rejected", /* @__PURE__ */ new Set()],
   ["canceled", /* @__PURE__ */ new Set()]
 ]);
+const CREATIVE_REVIEW_MEDIA_BUY_TRANSITIONS = new Map([
+  ...LEGACY_MEDIA_BUY_TRANSITIONS,
+  [
+    "pending_start",
+    /* @__PURE__ */ new Set(["pending_creatives", ...LEGACY_MEDIA_BUY_TRANSITIONS.get("pending_start")])
+  ]
+]);
+function getMediaBuyTransitions(adcpVersion = import_version.ADCP_VERSION) {
+  return (0, import_adcp_version_config.isAdcpVersionAtLeast)(adcpVersion, "3.3-beta") ? CREATIVE_REVIEW_MEDIA_BUY_TRANSITIONS : LEGACY_MEDIA_BUY_TRANSITIONS;
+}
+const MEDIA_BUY_TRANSITIONS = getMediaBuyTransitions();
 const CREATIVE_ASSET_TRANSITIONS = /* @__PURE__ */ new Map([
   ["processing", /* @__PURE__ */ new Set(["pending_review", "rejected"])],
   ["pending_review", /* @__PURE__ */ new Set(["approved", "rejected"])],
@@ -43,14 +57,14 @@ const CREATIVE_ASSET_TRANSITIONS = /* @__PURE__ */ new Map([
   ["archived", /* @__PURE__ */ new Set(["approved"])],
   ["rejected", /* @__PURE__ */ new Set(["processing", "pending_review"])]
 ]);
-function isLegalMediaBuyTransition(from, to) {
-  return MEDIA_BUY_TRANSITIONS.get(from)?.has(to) ?? false;
+function isLegalMediaBuyTransition(from, to, adcpVersion = import_version.ADCP_VERSION) {
+  return getMediaBuyTransitions(adcpVersion).get(from)?.has(to) ?? false;
 }
 function isLegalCreativeTransition(from, to) {
   return CREATIVE_ASSET_TRANSITIONS.get(from)?.has(to) ?? false;
 }
-function assertMediaBuyTransition(from, to) {
-  if (isLegalMediaBuyTransition(from, to)) return;
+function assertMediaBuyTransition(from, to, adcpVersion = import_version.ADCP_VERSION) {
+  if (isLegalMediaBuyTransition(from, to, adcpVersion)) return;
   if (to === "canceled") {
     throw new import_async_outcome.AdcpError("NOT_CANCELLABLE", {
       message: `Media buy in ${from} state cannot be canceled.`,
@@ -75,6 +89,7 @@ function assertCreativeTransition(from, to) {
   MEDIA_BUY_TRANSITIONS,
   assertCreativeTransition,
   assertMediaBuyTransition,
+  getMediaBuyTransitions,
   isLegalCreativeTransition,
   isLegalMediaBuyTransition
 });

package/dist/lib/server/state-machine.mjs

@@ -1,5 +1,7 @@
+import { ADCP_VERSION } from "../version.mjs";
+import { isAdcpVersionAtLeast } from "../utils/adcp-version-config.mjs";
 import { AdcpError } from "./decisioning/async-outcome.mjs";
-const MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
+const LEGACY_MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
   ["pending_creatives", /* @__PURE__ */ new Set(["pending_start", "active", "paused", "canceled", "rejected"])],
   ["pending_start", /* @__PURE__ */ new Set(["active", "paused", "canceled", "rejected"])],
   ["active", /* @__PURE__ */ new Set(["paused", "completed", "canceled"])],
@@ -8,6 +10,17 @@ const MEDIA_BUY_TRANSITIONS = /* @__PURE__ */ new Map([
   ["rejected", /* @__PURE__ */ new Set()],
   ["canceled", /* @__PURE__ */ new Set()]
 ]);
+const CREATIVE_REVIEW_MEDIA_BUY_TRANSITIONS = new Map([
+  ...LEGACY_MEDIA_BUY_TRANSITIONS,
+  [
+    "pending_start",
+    /* @__PURE__ */ new Set(["pending_creatives", ...LEGACY_MEDIA_BUY_TRANSITIONS.get("pending_start")])
+  ]
+]);
+function getMediaBuyTransitions(adcpVersion = ADCP_VERSION) {
+  return isAdcpVersionAtLeast(adcpVersion, "3.3-beta") ? CREATIVE_REVIEW_MEDIA_BUY_TRANSITIONS : LEGACY_MEDIA_BUY_TRANSITIONS;
+}
+const MEDIA_BUY_TRANSITIONS = getMediaBuyTransitions();
 const CREATIVE_ASSET_TRANSITIONS = /* @__PURE__ */ new Map([
   ["processing", /* @__PURE__ */ new Set(["pending_review", "rejected"])],
   ["pending_review", /* @__PURE__ */ new Set(["approved", "rejected"])],
@@ -15,14 +28,14 @@ const CREATIVE_ASSET_TRANSITIONS = /* @__PURE__ */ new Map([
   ["archived", /* @__PURE__ */ new Set(["approved"])],
   ["rejected", /* @__PURE__ */ new Set(["processing", "pending_review"])]
 ]);
-function isLegalMediaBuyTransition(from, to) {
-  return MEDIA_BUY_TRANSITIONS.get(from)?.has(to) ?? false;
+function isLegalMediaBuyTransition(from, to, adcpVersion = ADCP_VERSION) {
+  return getMediaBuyTransitions(adcpVersion).get(from)?.has(to) ?? false;
 }
 function isLegalCreativeTransition(from, to) {
   return CREATIVE_ASSET_TRANSITIONS.get(from)?.has(to) ?? false;
 }
-function assertMediaBuyTransition(from, to) {
-  if (isLegalMediaBuyTransition(from, to)) return;
+function assertMediaBuyTransition(from, to, adcpVersion = ADCP_VERSION) {
+  if (isLegalMediaBuyTransition(from, to, adcpVersion)) return;
   if (to === "canceled") {
     throw new AdcpError("NOT_CANCELLABLE", {
       message: `Media buy in ${from} state cannot be canceled.`,
@@ -46,6 +59,7 @@ export {
   MEDIA_BUY_TRANSITIONS,
   assertCreativeTransition,
   assertMediaBuyTransition,
+  getMediaBuyTransitions,
   isLegalCreativeTransition,
   isLegalMediaBuyTransition
 };

package/dist/lib/signing/agent-fetch.d.mts

@@ -80,7 +80,7 @@ export interface BuildAgentSigningFetchOptions {
  *   1. Sign immediately when the payload carries webhook authentication.
  *   2. Resolve the AdCP operation and exact JSON-RPC protocol method.
  *   3. Consult each capability namespace independently; either can request
- *      signing. Legacy SDK task polls sign when the seller supports signing.
+ *      signing. SDK AdCP task polls sign when the seller supports signing.
  *   4. Resolve the seller's content-digest policy into a per-request toggle.
  *   5. Delegate to `createSigningFetch` with the decision baked in.
  */

package/dist/lib/signing/agent-fetch.d.ts

@@ -80,7 +80,7 @@ export interface BuildAgentSigningFetchOptions {
  *   1. Sign immediately when the payload carries webhook authentication.
  *   2. Resolve the AdCP operation and exact JSON-RPC protocol method.
  *   3. Consult each capability namespace independently; either can request
- *      signing. Legacy SDK task polls sign when the seller supports signing.
+ *      signing. SDK AdCP task polls sign when the seller supports signing.
  *   4. Resolve the seller's content-digest policy into a per-request toggle.
  *   5. Delegate to `createSigningFetch` with the decision baked in.
  */

package/dist/lib/signing/agent-fetch.js

@@ -157,13 +157,13 @@ function buildAgentSigningFetch(options) {
     }
     const operation = extractAdcpOperation(init?.body);
     if (operation === "get_adcp_capabilities" && (0, import_protocol_methods.hasUnsignedCapabilityBootstrap)(signing)) return false;
-    const isPollOperation = operation === "tasks_get" || operation === "tasks/get";
+    const isPollOperation = operation === "get_task_status" || operation === "tasks_get" || operation === "tasks/get";
     const methods = policyMethods ?? (isPollOperation ? jsonRpcMethodsForSigning(init?.body) : []);
     const profileCompatible = signing.profile === "web-bot-auth" ? (0, import_protocol_methods.signingListIncludes)(capability?.profiles, "web-bot-auth") : capability?.profiles === void 0 || (0, import_protocol_methods.signingListIncludes)(capability.profiles, "adcp/request-signing/v1");
-    const legacyPoll = profileCompatible && capability?.supported === true && (operation === "tasks_get" && methods.includes("tools/call") || operation === "tasks/get" && methods.some(
+    const signedPoll = profileCompatible && capability?.supported === true && ((operation === "tasks_get" || operation === "get_task_status") && methods.includes("tools/call") || (operation === "tasks/get" || operation === "get_task_status") && methods.some(
       (method) => ["message/send", "message/stream", "SendMessage", "SendStreamingMessage"].includes(method)
     ));
-    const sign = signing.profile === "web-bot-auth" && !!operation && (0, import_protocol_methods.signingListIncludes)(capability?.profiles, "web-bot-auth") || shouldSignOperation(operation, capability, signing) || methods.some((method) => shouldSignProtocolMethod(method, capability, signing)) || legacyPoll;
+    const sign = signing.profile === "web-bot-auth" && !!operation && (0, import_protocol_methods.signingListIncludes)(capability?.profiles, "web-bot-auth") || shouldSignOperation(operation, capability, signing) || methods.some((method) => shouldSignProtocolMethod(method, capability, signing)) || signedPoll;
     if (sign && signing.profile === "web-bot-auth" && !(0, import_protocol_methods.signingListIncludes)(capability?.profiles, "web-bot-auth"))
       throw new TypeError("Seller did not advertise the Web Bot Auth request signing profile");
     return sign;

package/dist/lib/signing/agent-fetch.mjs

@@ -139,13 +139,13 @@ function buildAgentSigningFetch(options) {
     }
     const operation = extractAdcpOperation(init?.body);
     if (operation === "get_adcp_capabilities" && hasUnsignedCapabilityBootstrap(signing)) return false;
-    const isPollOperation = operation === "tasks_get" || operation === "tasks/get";
+    const isPollOperation = operation === "get_task_status" || operation === "tasks_get" || operation === "tasks/get";
     const methods = policyMethods ?? (isPollOperation ? jsonRpcMethodsForSigning(init?.body) : []);
     const profileCompatible = signing.profile === "web-bot-auth" ? signingListIncludes(capability?.profiles, "web-bot-auth") : capability?.profiles === void 0 || signingListIncludes(capability.profiles, "adcp/request-signing/v1");
-    const legacyPoll = profileCompatible && capability?.supported === true && (operation === "tasks_get" && methods.includes("tools/call") || operation === "tasks/get" && methods.some(
+    const signedPoll = profileCompatible && capability?.supported === true && ((operation === "tasks_get" || operation === "get_task_status") && methods.includes("tools/call") || (operation === "tasks/get" || operation === "get_task_status") && methods.some(
       (method) => ["message/send", "message/stream", "SendMessage", "SendStreamingMessage"].includes(method)
     ));
-    const sign = signing.profile === "web-bot-auth" && !!operation && signingListIncludes(capability?.profiles, "web-bot-auth") || shouldSignOperation(operation, capability, signing) || methods.some((method) => shouldSignProtocolMethod(method, capability, signing)) || legacyPoll;
+    const sign = signing.profile === "web-bot-auth" && !!operation && signingListIncludes(capability?.profiles, "web-bot-auth") || shouldSignOperation(operation, capability, signing) || methods.some((method) => shouldSignProtocolMethod(method, capability, signing)) || signedPoll;
     if (sign && signing.profile === "web-bot-auth" && !signingListIncludes(capability?.profiles, "web-bot-auth"))
       throw new TypeError("Seller did not advertise the Web Bot Auth request signing profile");
     return sign;

package/dist/lib/testing/client.d.mts

@@ -89,6 +89,7 @@ schemaAdcpVersion?: string): Promise<{
     profile: AgentProfile;
     step: TestStepResult;
     caughtError?: unknown;
+    evidence?: TestStepResult;
 }>;
 /**
  * Discover what channels, pricing models, formats the agent supports

package/dist/lib/testing/client.d.ts

@@ -89,6 +89,7 @@ schemaAdcpVersion?: string): Promise<{
     profile: AgentProfile;
     step: TestStepResult;
     caughtError?: unknown;
+    evidence?: TestStepResult;
 }>;
 /**
  * Discover what channels, pricing models, formats the agent supports

package/dist/lib/testing/client.js

@@ -641,23 +641,24 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
   }
   const failure = describeProfileDiscoveryFailure(profile);
   if (!step.passed || failure) {
-    const evidence = { ...step, ...failure ?? {}, passed: false, duration_ms: step.duration_ms };
-    evidence.error = (0, import_redact_credential_patterns.redactCredentialPatterns)(evidence.error ?? "Agent discovery failed", false).slice(
+    const evidence2 = { ...step, ...failure ?? {}, passed: false, duration_ms: step.duration_ms };
+    evidence2.error = (0, import_redact_credential_patterns.redactCredentialPatterns)(evidence2.error ?? "Agent discovery failed", false).slice(
       0,
       4096
     );
-    profile.capabilities_failure = evidence;
+    profile.capabilities_failure = evidence2;
   }
   if (!step.passed) step.error = (0, import_redact_credential_patterns.redactCredentialPatterns)(step.error ?? "Agent discovery failed", false);
   if (!failure && step.passed && (scopeKey === void 0 || scopeKey === client.getCapabilityEvidenceScope().scopeKey)) {
     seedTestClientSigningCapability(client, profile, schemaAdcpVersion);
   }
+  const evidence = step.passed && !failure ? { ...step } : void 0;
   if (step.passed && !failure) {
     delete step.request;
     delete step.response_record;
     delete step.adcp_error;
   }
-  return { profile, step, ...caughtError !== void 0 && { caughtError } };
+  return { profile, step, ...caughtError !== void 0 && { caughtError }, ...evidence && { evidence } };
 }
 async function discoverAgentCapabilities(client, profile, options) {
   const steps = [];
@@ -876,7 +877,7 @@ function validateResponseSchema(toolName, data, responseAdcpVersion) {
       warnings: [`No Zod schema registered for "${toolName}" \u2014 validation skipped`]
     };
   }
-  const compatData = data && typeof data === "object" && !Array.isArray(data) ? (0, import_envelope_status_compat.injectLegacyEnvelopeStatus)(data, { toolName }) : data;
+  const compatData = data && typeof data === "object" && !Array.isArray(data) ? (0, import_envelope_status_compat.injectLegacyEnvelopeStatus)(data, { toolName, adcpVersion: responseAdcpVersion }) : data;
   const result = schema.safeParse((0, import_response_schemas.prepareResponseForSchemaValidation)(toolName, compatData, responseAdcpVersion));
   if (result.success) {
     return {

package/dist/lib/testing/client.mjs

@@ -599,23 +599,24 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
   }
   const failure = describeProfileDiscoveryFailure(profile);
   if (!step.passed || failure) {
-    const evidence = { ...step, ...failure ?? {}, passed: false, duration_ms: step.duration_ms };
-    evidence.error = redactCredentialPatterns(evidence.error ?? "Agent discovery failed", false).slice(
+    const evidence2 = { ...step, ...failure ?? {}, passed: false, duration_ms: step.duration_ms };
+    evidence2.error = redactCredentialPatterns(evidence2.error ?? "Agent discovery failed", false).slice(
       0,
       4096
     );
-    profile.capabilities_failure = evidence;
+    profile.capabilities_failure = evidence2;
   }
   if (!step.passed) step.error = redactCredentialPatterns(step.error ?? "Agent discovery failed", false);
   if (!failure && step.passed && (scopeKey === void 0 || scopeKey === client.getCapabilityEvidenceScope().scopeKey)) {
     seedTestClientSigningCapability(client, profile, schemaAdcpVersion);
   }
+  const evidence = step.passed && !failure ? { ...step } : void 0;
   if (step.passed && !failure) {
     delete step.request;
     delete step.response_record;
     delete step.adcp_error;
   }
-  return { profile, step, ...caughtError !== void 0 && { caughtError } };
+  return { profile, step, ...caughtError !== void 0 && { caughtError }, ...evidence && { evidence } };
 }
 async function discoverAgentCapabilities(client, profile, options) {
   const steps = [];
@@ -834,7 +835,7 @@ function validateResponseSchema(toolName, data, responseAdcpVersion) {
       warnings: [`No Zod schema registered for "${toolName}" \u2014 validation skipped`]
     };
   }
-  const compatData = data && typeof data === "object" && !Array.isArray(data) ? injectLegacyEnvelopeStatus(data, { toolName }) : data;
+  const compatData = data && typeof data === "object" && !Array.isArray(data) ? injectLegacyEnvelopeStatus(data, { toolName, adcpVersion: responseAdcpVersion }) : data;
   const result = schema.safeParse(prepareResponseForSchemaValidation(toolName, compatData, responseAdcpVersion));
   if (result.success) {
     return {