@adcp/sdk 16.5.0 → 16.6.1

package/docs/guides/DELIVERY-WEBHOOK-PARSING.md

@@ -0,0 +1,135 @@
+# Parsing media-buy delivery webhooks
+
+Use `parseMediaBuyDeliveryWebhook` from `@adcp/sdk/webhooks` after your receiver
+has authenticated the original HTTP body and enforced replay protection. It
+validates delivery content without requiring an `AgentClient`, an SDK callback
+registry, or a signature-verification strategy. It performs no authentication
+itself; `ok: true` means the payload is valid, not that its sender is trusted.
+
+```typescript
+import { parseMediaBuyDeliveryWebhook } from '@adcp/sdk/webhooks';
+
+// Call only after signature verification. Load the version from the registered
+// seller/buy record, rather than trusting a version claim in the request body.
+function parseAuthenticatedDelivery(verifiedRawBody: Uint8Array, negotiatedVersion: string) {
+  const parsed = parseMediaBuyDeliveryWebhook(verifiedRawBody, {
+    adcpVersion: negotiatedVersion,
+  });
+  if (!parsed.ok) {
+    // Suitable for a 400 response: paths are readable and omit report values (map key names can appear in paths).
+    // e.g. result.media_buy_deliveries[0].by_package is required
+    return { status: 400, error: parsed.message, errors: parsed.errors };
+  }
+  return { status: 200, report: parsed.result };
+}
+```
+
+Pass the exact bytes you authenticated to avoid parsing a different body from
+JSON middleware. The parser also accepts a parsed JSON object or a JSON string. It returns
+a detached copy of validated data and preserves the seller's fields. It does
+not add a task status, operation ID, currency, package breakdown, or other
+missing data. Bodies are limited to 16 MiB and 64 nesting levels before schema
+validation. Schema diagnostics use fail-fast validation and readable paths.
+Invalid bodies return one of:
+
+| Code | Meaning |
+| --- | --- |
+| `webhook_envelope_invalid` | Malformed JSON, invalid envelope metadata, or a missing result. |
+| `webhook_result_invalid` | The nested delivery report fails the selected release's schema. |
+| `webhook_unsupported_payload` | Another task type, or an unenveloped report without explicit opt-in. |
+
+An invalid or unbundled `adcpVersion` is a caller configuration error and throws
+`ConfigurationError`. Omission selects the SDK's protocol pin. The body does not
+select its own validation release.
+
+## Select the release used for the buy
+
+A reporting webhook does not provide a trustworthy negotiated-version field.
+Keep that release with the callback/buy registration and supply it for every
+report. Stable patch pins select their bundled minor contract; preview pins
+remain exact.
+
+| Release | Report validation | Envelope details |
+| --- | --- | --- |
+| 3.0 | `get-media-buy-delivery-response.json`; report-wide currency is required. | `operation_id` is optional and remains absent when omitted. The parser accepts the documented `media_buy_delivery` discriminator even though the old task enum omits it. |
+| 3.1 | `media-buy-delivery-webhook-result.json`; report-wide currency is required. | `operation_id` is required. |
+| 3.2 | Dedicated webhook-result schema; report-wide currency is optional. | `operation_id` is required. |
+
+All releases require `by_package` on each delivery row. The SDK's schema loader
+handles both relative and absolute schema IDs. No external `$ref` traversal or
+network fetch is needed.
+
+On SDK 16, the standalone parser is additive. Existing `verifyAndParseWebhook`
+contracts remain unchanged; receivers needing per-buy release selection can pass
+already-authenticated bytes to this parser.
+
+## Bare-report compatibility is explicit
+
+The default rejects a body with top-level `media_buy_deliveries` and no MCP
+envelope. For a temporary migration, opt in explicitly:
+
+```typescript
+const parsed = parseMediaBuyDeliveryWebhook(verifiedRawBody, {
+  adcpVersion: savedBuy.adcpVersion,
+  acceptBareDeliveryReport: true,
+});
+if (parsed.ok && parsed.wireFormat === 'bare_delivery_report') {
+  // Record the seller's protocol violation and repair its callback format.
+  // parsed.envelope is undefined; no transport identity has been invented.
+}
+```
+
+The report still undergoes release-specific validation. A poll-shaped report
+with only a task `status` and no envelope identity is also bare; any such field
+is preserved when the selected report schema permits it. An incomplete or invalid
+envelope never falls back to bare-report acceptance. A normal envelope returns
+`wireFormat: 'mcp_envelope'` and the validated `envelope`. Authentication and
+sender, account, media-buy authorization, and deduplication remain the receiver's
+responsibility in either format.
+
+## A shared delivery body for polling and pushing
+
+`MediaBuyDeliveryReport` imports from `@adcp/sdk/types` or `@adcp/sdk/webhooks`.
+`MediaBuyDeliveryReportSchema` imports from `@adcp/sdk/schemas` and
+`@adcp/sdk/schemas/browser`. This payload-only shape accepts a polled report or a
+webhook result without requiring a task-level `status`. The shared TypeScript type and these Zod schemas describe
+the SDK's current pin; use the parser above for older release-specific checks.
+
+`GetMediaBuyDeliveryResponseSchema` still requires task status through its
+referenced `core/protocol-envelope.json`. The absence of `status` from the
+response document's own `required` list does not remove that inherited
+requirement. Use the shared body schema for ingestion, and the full response
+schema for a poll's protocol envelope. `MediaBuyDeliveryWebhookResultSchema`
+now retains the canonical required row fields, including `by_package`.
+
+## Envelope status and notification type are independent
+
+The parser accepts the selected release's task-status enum; it does not require
+`completed` for all reporting messages. For example, `notification_type:
+'delayed'` may accompany `status: 'working'` when a valid report is present.
+`delayed` itself is not a task status. A progress-only message without a report
+is not a delivery-data webhook.
+
+`notification_type: 'final'` concerns report scheduling; envelope `completed`
+does not mean the media buy has finished. Per-buy state remains in
+`media_buy_deliveries[].status`. This follows the protocol's
+[envelope/result distinction](https://github.com/adcontextprotocol/adcp/blob/v3.3.0-beta.0/docs/building/by-layer/L3/webhooks.mdx#payload-anatomy-envelope-vs-result).
+
+The protocol also requires receivers to ignore `aggregated_totals` in pushed
+reports as an authority source. The parser preserves that field for auditing
+when supplied; reconcile authoritative totals through a poll or per-delivery
+rows instead.
+
+For offline tooling that needs all raw JSON Schema diagnostics,
+`@adcp/sdk/schemas` also exports `getSchemaValidatorByRef`. Its default is
+fail-fast; complete diagnostics are an explicit option:
+
+```typescript
+import { getSchemaValidatorByRef } from '@adcp/sdk/schemas';
+const validate = getSchemaValidatorByRef(
+  'media-buy/media-buy-delivery-webhook-result.json',
+  '3.1',
+  undefined,
+  { allErrors: true },
+);
+```

package/docs/guides/DISCOVERY-CACHE-AND-SESSION-REUSE.md

@@ -162,6 +162,21 @@ Await every operation before the scope callback returns; the callback owns the s
 
 Inside a scope the endpoint probe, capability discovery, `tools/list` and tool calls share one negotiated session per identity. `closeScopedConnections()` closes the current MCP scope's sessions early and does nothing when no MCP scope is active (A2A connections are not scoped). Nested `withMCPConnectionScope` calls join the outer scope unless you pass `{ isolate: true }`.
 
+An implicit high-level task scope closes local transports without sending session
+`DELETE` when its final result is accepted `submitted`, `working`, `input-required`,
+`auth-required`, or `deferred` work. (`deferred` is a task/HITL result, not an MCP
+wire status.) The owning task's final result decides; an earlier nested result
+cannot change a completed owner's cleanup. Completed tasks keep normal session
+termination.
+
+An explicit `withMCPConnectionScope` workflow remains caller-owned: its final
+cleanup terminates its sessions even if a call inside returned `submitted` or
+`working`. End that callback only when you intend to relinquish those sessions.
+Implicit preservation means avoiding termination, not retaining a connection for
+resumption: local clients are closed and evicted, later calls open fresh sessions,
+and the seller owns expiration of its retained sessions. A preserved implicit
+scope can include discovery sessions as well as the dispatch session.
+
 ### One exception: the first legacy handoff
 
 For a seller on the pre-2026 MCP protocol era, the SDK negotiates with the v2 client first and then hands the call to the v1 client so 2025 Tasks keep working. That handoff is a cold cost the SDK cannot avoid: the first scope against such a seller opens one classification handshake plus one shared v1 session. Within the scope everything after that (probe aside) shares the v1 session, including `tools/list`, and the classification is remembered across scopes for five minutes, so a later scope opens only its own session. Modern-era sellers need a single negotiation per scope.

package/docs/guides/TYPED-CLIENT-TOOLS.md

@@ -0,0 +1,49 @@
+# Typed client tools
+
+`SingleAgentClient` and `AgentClient` expose a camelCase method for every tool
+in the bundled AdCP manifest. Each method uses the normal request validation,
+idempotency-key generation, and per-client version negotiation. `executeTask`
+also has typed request and response mappings for every tool.
+
+```ts
+const result = await client.getTaskStatus({ task_id: sellerTaskId, include_result: true });
+if (result.success) console.log(result.data.status, result.data.result);
+
+const tasks = await client.listTasks({}); // Queries the seller's list_tasks tool.
+```
+
+`getTaskStatus({ task_id })` returns the protocol response inside `TaskResult`.
+The observed task's `status` and `error` remain data: querying a failed or working
+task completes the query without resubmitting or following that task.
+
+For compatibility, `getTaskStatus(taskId)` still returns mapped `TaskInfo`, and
+`listTasks()` with no arguments still lists locally tracked tasks. Use
+`trackTask()` or a submitted result's `waitForCompletion()` to observe completion.
+The object overload calls `get_task_status` directly and requires a seller that
+supports that tool. Use the string overload or task tracking for negotiated
+compatibility with older sellers.
+The typed response preserves the seller's `task_id`; callers should compare it
+with the requested ID. The string overload and completion tracking enforce that
+identity check automatically. Discovery and authorization failures are surfaced
+rather than treated as evidence that only the legacy tool is supported.
+
+SDK polling chooses `get_task_status` when advertised by the seller, falling back
+to `tasks_get` for MCP or `tasks/get` for A2A otherwise.
+
+The supported tools `listCreativeFormats`, `buildCreative`, `listTransformers`,
+`getContentStandards`, `listContentStandards`, `calibrateContent`, and
+`validateContentDelivery` have ordinary typed methods. Their existing `*Legacy`
+aliases remain available. These tool methods return their protocol wire shapes;
+the SDK's canonical creative discovery and delivery helpers remain available too.
+On the SDK 16 line these are the AdCP 3.2 wire shapes, including any legacy
+`format_id` fields the protocol still supports. Generic `preview_creative`
+execution uses the canonical preview helper; use `previewCreativeLegacy` for
+raw named-format requests.
+
+Direct `SingleAgentClient.syncPlans` and `getPlanAuditLogs` calls use the
+configured governance agent when present. Without one, the client requires its
+own agent to advertise the governance tool before sending the request.
+
+`complyTestController` is typed for conformance testing against a seller that
+advertises it. Its availability does not imply that a production seller enables
+test controls.

package/docs/llms.txt

@@ -1,7 +1,7 @@
 # Ad Context Protocol (AdCP)
 
-> Generated at: 2026-10-25
-> Library: @adcp/sdk v16.5.0
+> Generated at: 2026-10-28
+> Library: @adcp/sdk v16.6.1
 > AdCP major version: 3
 > Canonical URL: https://adcontextprotocol.github.io/adcp-client/llms.txt
 > Note: the `Library` stamp reflects the package.json version at doc-generation time. The narrative below describes the surface that lands on the next-published minor — including any 6.7 helpers documented here ahead of the release tag.
@@ -13,7 +13,7 @@ AdCP is an open protocol for AI agents to buy, manage, and optimize advertising
 
 ## Start here: AdCP 3.2
 
-The SDK requires Node.js `^20.19.0 || >=22.12.0`. Install this reference's release train with `npm install @adcp/sdk@16.5`; use the documentation from the exact published SDK version you install. For reproducible CLI runs, pin that exact SDK version. After installation, `node -p "require('@adcp/sdk').ADCP_VERSION"` reports its protocol pin; `ls node_modules/@adcp/sdk/compliance/cache` lists its packaged compliance versions. The legacy `adcp-3.2` npm tag selects SDK 14 and does not receive the refreshed compliance caches.
+The SDK requires Node.js `^20.19.0 || >=22.12.0`. Install this reference's release train with `npm install @adcp/sdk@16.6`; use the documentation from the exact published SDK version you install. For reproducible CLI runs, pin that exact SDK version. After installation, `node -p "require('@adcp/sdk').ADCP_VERSION"` reports its protocol pin; `ls node_modules/@adcp/sdk/compliance/cache` lists its packaged compliance versions. The legacy `adcp-3.2` npm tag selects SDK 14 and does not receive the refreshed compliance caches.
 
 The SDK is compact-lifecycle first: `list_products → buy_products → control_media_buy`, with `request_proposals → refine_proposals → accept_proposal` when terms need negotiation.
 
@@ -1852,7 +1852,7 @@ Flow: `get_adcp_capabilities → activate_signal → get_signals → activate_si
 Flow: `get_adcp_capabilities → create_media_buy → get_products → create_media_buy → get_products → create_media_buy`
 
 **STALE_RESPONSE advisory-success wire placement** — Validates that STALE_RESPONSE rides in errors[] on a populated success response with transport success preserved, and that STALE_RESPONSE is absent on healthy upstream responses.
-Flow: `get_adcp_capabilities → comply_test_controller → get_products`
+Flow: `get_adcp_capabilities → get_products → comply_test_controller → get_products`
 
 ### Security
 

package/docs/migration-14.x-rc-worksheet.md

@@ -16,18 +16,18 @@ pin using `ADCP_VERSION` inside that tarball.
 
 | Fact | Value |
 | --- | --- |
-| Checkout `package.json` version | `@adcp/sdk@16.5.0` |
-| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@16.5.0 dist.integrity` |
+| Checkout `package.json` version | `@adcp/sdk@16.6.1` |
+| npm integrity | registry-derived after publication; run `npm view @adcp/sdk@16.6.1 dist.integrity` |
 | Node.js runtime | `^20.19.0 || >=22.12.0` |
-| Default AdCP wire release | `3.2.7` |
-| Maintained wire releases | `v3`, `3.0.0`, `3.0`, `3.0.1`, `3.0.2`, `3.0.3`, `3.0.4`, `3.0.5`, `3.0.6`, `3.0.7`, `3.0.8`, `3.0.9`, `3.0.10`, `3.0.11`, `3.0.12`, `3.0.13`, `3.0.14`, `3.0.15`, `3.0.16`, `3.0.17`, `3.0.18`, `3.0.19`, `3.0.20`, `3.0.21`, `3.0.22`, `3.0.23`, `3.0.24`, `3.0.25`, `3.1.0`, `3.1`, `3.1.1`, `3.1.2`, `3.1.3`, `3.1.4`, `3.1.5`, `3.1.6`, `3.1.7`, `3.1.8`, `3.1.9`, `3.1.10`, `3.1.11`, `3.1.12`, `3.1.13`, `3.1.14`, `3.1.15`, `3.1.16`, `3.1.17`, `3.1.18`, `3.1.19`, `3.1.20`, `3.1.21`, `3.1.22`, `3.1.23`, `3.1.24`, `3.1.25`, `3.1.26`, `3.1.27`, `3.1.28`, `3.1.29`, `3.2.1`, `3.2`, `3.2.2`, `3.2.3`, `3.2.4`, `3.2.5`, `3.2.6`, `3.2.7` |
+| Default AdCP wire release | `3.2.8` |
+| Maintained wire releases | `v3`, `3.0.0`, `3.0`, `3.0.1`, `3.0.2`, `3.0.3`, `3.0.4`, `3.0.5`, `3.0.6`, `3.0.7`, `3.0.8`, `3.0.9`, `3.0.10`, `3.0.11`, `3.0.12`, `3.0.13`, `3.0.14`, `3.0.15`, `3.0.16`, `3.0.17`, `3.0.18`, `3.0.19`, `3.0.20`, `3.0.21`, `3.0.22`, `3.0.23`, `3.0.24`, `3.0.25`, `3.1.0`, `3.1`, `3.1.1`, `3.1.2`, `3.1.3`, `3.1.4`, `3.1.5`, `3.1.6`, `3.1.7`, `3.1.8`, `3.1.9`, `3.1.10`, `3.1.11`, `3.1.12`, `3.1.13`, `3.1.14`, `3.1.15`, `3.1.16`, `3.1.17`, `3.1.18`, `3.1.19`, `3.1.20`, `3.1.21`, `3.1.22`, `3.1.23`, `3.1.24`, `3.1.25`, `3.1.26`, `3.1.27`, `3.1.28`, `3.1.29`, `3.1.30`, `3.2.1`, `3.2`, `3.2.2`, `3.2.3`, `3.2.4`, `3.2.5`, `3.2.6`, `3.2.7`, `3.2.8` |
 | Canonical migration notes | [SDK 15 OAuth](./migration-oauth-issuer-bindings.md), [issuer-binding and storage](./guides/OAUTH-ISSUER-BINDING.md); historical [13.x → 14](./migration-13-to-14.md) |
 
 For a checkout at the published release commit, install the exact package version:
 
 ```bash
-npm install --save-exact '@adcp/sdk@16.5.0'
-npm view '@adcp/sdk@16.5.0' dist.integrity
+npm install --save-exact '@adcp/sdk@16.6.1'
+npm view '@adcp/sdk@16.6.1' dist.integrity
 ```
 
 ### Required and optional peers

package/docs/migration-6.6-to-6.7.md

@@ -1061,6 +1061,20 @@ paths produce a value. The store fills the gap for adopters who
 hadn't wired echo yet (the canonical silent-storyboard-failure for
 `media_buy_seller/inventory_list_targeting/get_after_create`).
 
+The current store also persists buy-level and package-level `context` from
+`create_media_buy`, including empty objects and null-valued keys. It fills
+missing resource context on `get_media_buys`; seller-provided echoes and the
+read request's top-level context take precedence. Targeting updates retain
+creation context. Context for packages added by `update_media_buy` remains
+adapter-owned.
+
+Package context follows unambiguous echoed identities (`product_id`,
+`package_id`, or legacy `buyer_ref`). Positional matching requires equal
+package counts and no contradictory identities. If pairing is ambiguous,
+only context echoed on the create response is retained for that package.
+Existing targeting-only records need no migration; creation context cannot
+be recovered retroactively from those records.
+
 ### 16. **breaking** — drop `customTools["update_rights"]`; wire `BrandRightsPlatform.updateRights`
 
 `update_rights` is now a framework-registered first-class tool (PR

package/docs/migration-account-change-feed.md

@@ -262,3 +262,22 @@ status-change record and webhook, so the subsequent authoritative
 creative library needed by the scenario's applicability check. Those training
 seller changes belong upstream; they do not introduce buyer durable storage or
 a persistent subscription runtime into the SDK.
+
+### Validating older feed releases
+
+`streamAccountChanges` uses negotiated response metadata, the served-version echo,
+or the client's configured AdCP version to select the page schema. For a custom
+reader without SDK metadata, pass `adcpVersion: '3.2.7'` in the stream options and
+send the same release in your reader's requests. AdCP 3.3 requires nonempty
+`changed_paths` on seller-originated changes; AdCP 3.2 does not.
+
+SDK 16.6 also provides the signature-agnostic delivery receiver parser described
+in [Parsing media-buy delivery webhooks](./guides/DELIVERY-WEBHOOK-PARSING.md).
+The stable parser accepts the bundled AdCP 3.0, 3.1, and 3.2 reporting contracts.
+
+When available, `metadata.wireAdcpVersion` records the trusted SDK-selected wire
+release, independently of the seller echo. Drains prefer negotiated/wire
+metadata, then a custom reader's explicit `adcpVersion`, then the echo and
+configured client pin. An older echo cannot weaken a known wire contract.
+Sellers without authoritative release metadata keep the echo/client fallback;
+use an explicit validation pin for a custom reader when its release is known.

package/docs/releases/sdk-16.6-adoption-fixes.md

@@ -0,0 +1,33 @@
+# SDK 16 stable adoption fixes
+
+The SDK keeps its AdCP 3.2.7 pin and existing legacy HTML mapping. New APIs are
+additive: `parseMediaBuyDeliveryWebhook`, the shared delivery report body/schema,
+canonical `AssetVariant` exports, and targeting overlay key arrays. The standalone
+parser accepts authenticated bytes and validates the trusted caller-selected
+release; existing `verifyAndParseWebhook` return contracts are unchanged.
+
+Account-sync results retain `account`, `operator_unit`, `revision`,
+`identity_change`, `identity_change_preview`, `currency`, and `timezone`.
+`SyncAccountsResultRow` remains an interface with required legacy
+`brand`/`operator`/`status` fields, so existing extending interfaces and read-side
+wrappers keep compiling. A 3.2 `account` reference takes precedence over the flat
+wire anchor; 3.0 and 3.1 retain the flat fields. The modern account-only result
+union is an SDK 17 migration. Adopters serving multiple releases should select
+result identity using `ctx.servedAdcpVersion`.
+
+The entire `destination_billing_entity` is request-only. Its name and tax data
+are stripped along with bank details and framework auth/context metadata before
+responses or replay caching. Nested account and operator identity objects use
+closed protocol schemas and are emitted as detached validated snapshots.
+
+Global daypart-union and nonempty Zod output tightening stays on SDK 17.
+AssetVariant alone restores reachable protocol minItems and shallow output
+typing, fixing the published TypeScript repro while preserving union options. The
+shared stable report body reflects the existing tolerant poll Zod output;
+version-aware delivery parsing uses strict authoritative JSON schemas.
+
+Asset bounds also apply when the shared catalog, provenance, inline-markup,
+tag/redirect and tracker schemas are used outside AssetVariant. Direct Zod
+consumers now reject those protocol-invalid empty arrays consistently with the
+existing authoritative wire schemas. Typed input and per-branch union helpers
+remain available.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adcp/sdk",
-  "version": "16.5.0",
+  "version": "16.6.1",
   "description": "AdCP SDK — client, server, and compliance harnesses for the AdContext Protocol (MCP + A2A)",
   "workspaces": [
     ".",
@@ -557,8 +557,8 @@
     "!skills/*.previous/**/*",
     ".claude-plugin/**/*",
     "compliance/cache/3.0.25/**/*",
-    "compliance/cache/3.1.29/**/*",
-    "compliance/cache/3.2.7/**/*",
+    "compliance/cache/3.1.30/**/*",
+    "compliance/cache/3.2.8/**/*",
     "ADCP_VERSION",
     "docs/README.md",
     "docs/TYPE-SUMMARY.md",
@@ -639,13 +639,13 @@
     "test:protocol-comparison": "node test/utils/comprehensive-protocol-comparison.js",
     "test:status-report": "node test/utils/final-status-report.js",
     "sync-schemas": "tsx scripts/sync-schemas.ts",
-    "sync-schemas:all": "npm run sync-schemas && npm run sync-schemas -- 3.1.29 && npm run sync-schemas -- 3.0.25",
+    "sync-schemas:all": "npm run sync-schemas && npm run sync-schemas -- 3.1.30 && npm run sync-schemas -- 3.0.25",
     "sync:canonical-storyboard-fixtures": "tsx scripts/sync-canonical-storyboard-fixtures.ts --update",
     "check:canonical-storyboard-fixtures": "tsx scripts/sync-canonical-storyboard-fixtures.ts --check",
     "sync-registry-schemas": "tsx scripts/generate-registry-types.ts --sync",
     "schemas:ensure": "tsx scripts/schemas-ensure.ts",
     "schema-diff": "tsx scripts/schema-diff.ts",
-    "generate-types": "tsx scripts/generate-types.ts && tsx scripts/generate-enum-arrays.ts && tsx scripts/generate-inline-enum-arrays.ts && tsx scripts/generate-manifest-derived.ts && tsx scripts/generate-entity-hydration.ts && tsx scripts/generate-media-buy-update-fields.ts && tsx scripts/generate-media-buy-action-metadata.ts",
+    "generate-types": "tsx scripts/generate-types.ts && tsx scripts/generate-enum-arrays.ts && tsx scripts/generate-targeting-keys.ts && tsx scripts/generate-inline-enum-arrays.ts && tsx scripts/generate-manifest-derived.ts && tsx scripts/generate-entity-hydration.ts && tsx scripts/generate-media-buy-update-fields.ts && tsx scripts/generate-media-buy-action-metadata.ts",
     "generate-manifest-derived": "tsx scripts/generate-manifest-derived.ts",
     "generate-entity-hydration": "tsx scripts/generate-entity-hydration.ts",
     "generate-types:all": "npm run generate-types",
@@ -731,7 +731,7 @@
   "dependencies": {
     "@modelcontextprotocol/client": "2.3.1",
     "@modelcontextprotocol/ext-apps": "2.0.0",
-    "@modelcontextprotocol/node": "2.0.0",
+    "@modelcontextprotocol/node": "2.1.1",
     "@modelcontextprotocol/server": "2.3.1",
     "@types/ws": "^8.18.1",
     "ajv": "^8.20.0",
@@ -818,7 +818,7 @@
     "launch-editor": "^2.14.2",
     "markdown-it": "^14.3.3"
   },
-  "adcp_version": "3.2.7",
+  "adcp_version": "3.2.8",
   "sideEffects": [
     "**/default-invariants.*"
   ]