chore: release package

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@adcp/sdk@7.4.0

Minor Changes

• 22f5cd4: feat(testing): getSeededMediaBuyDelivery bridge callback + nit-test coverage on existing bridges (closes feat(testing): next-phase TestControllerBridge seeded callbacks for proxy sellers #1755 phase 1)

  Adds a sixth opt-in callback to TestControllerBridge<TAccount> for the get_media_buy_delivery read path so platform-proxy sellers can seed delivery-snapshot fixtures into conformance storyboards without driving real measurement through the upstream adapter:

  • getSeededMediaBuyDelivery(ctx) → merged into get_media_buy_delivery response (dedup by media_buy_id, seeded wins on collision — follows the established collision precedent set by mergeSeededMediaBuys / mergeSeededCreatives / mergeSeededAccounts: storyboards seed deliberately, so a seeded fixture for an existing media_buy_id is an explicit author override). Same sandbox + resolved-account + controller-present gating as the other bridges. BridgeFromSessionStoreOptions gains a matching selectSeededMediaBuyDelivery selector.

  After the merge, aggregated_totals is recomputed from the merged per-delivery totals so media_buy_count / impressions / spend reflect the merged set (otherwise the response would be wire-incorrect). Policy:

  • Required sums (impressions, spend, media_buy_count) always recompute.
  • Optional sums (clicks, completed_views, views, conversions, conversion_value) recompute only when every merged delivery populates the field; partial population falls back to the handler's value (no silent under-counting).
  • Derived ratios (roas, completion_rate, cost_per_acquisition) recompute only when both inputs recomputed AND divisor is non-zero (no Infinity / NaN).
  • Pass-through (reach, reach_unit, frequency, new_to_brand_rate) keep the handler's value verbatim — not derivable from per-delivery totals.

  Also adds regression coverage on the bridges that landed in 7.3.0:

  • getSeededAccountFinancials now has an explicit assertion that the resolved ctx.account.account_id wins over the request's account.account_id when both are present (so fixtures are interchangeable across AccountReference variants).
  • list_creatives mixed-collision math has explicit coverage: when handler and bridge overlap partially, query_summary.total_matching grows only by the non-colliding subset (+= newCount, not += seededCount).

• 12e4a7f: feat(testing): per-tool seeded callbacks on TestControllerBridge for platform-proxy sellers (closes feat(testing): extend TestControllerBridge with per-tool seeded callbacks (creatives, media-buys, accounts, financials, formats) #1002)

  TestControllerBridge previously exposed only getSeededProducts, leaving platform-proxy sellers (DSPs, walled gardens, retail-media networks) without a way to feed seeded fixtures into the read path of every other read tool — storyboard seeds against seed_creative / seed_media_buy were dead writes when the adapter proxied to upstream APIs.

  Extends TestControllerBridge<TAccount> with five opt-in callbacks mirroring getSeededProducts (post-handler merge, sandbox + resolved-account + controller-present gating, warn-and-drop validation, never throws):

  • getSeededCreatives(ctx) → merged into list_creatives (dedup by creative_id)
  • getSeededMediaBuys(ctx) → merged into get_media_buys (dedup by media_buy_id)
  • getSeededAccounts(ctx) → merged into list_accounts (dedup by account_id)
  • getSeededAccountFinancials(ctx) → replaces get_account_financials envelope when seeded account.account_id matches the request (singleton response, replace semantics)
  • getSeededCreativeFormats(ctx) → merged into list_creative_formats (dedup by canonical format_id.agent_url|format_id.id)

  BridgeFromSessionStoreOptions gains matching selectSeeded* selectors so adopters wiring storyboards via the session-store pattern get all bridges in one helper. Per-tool callbacks are omitted from the returned bridge when no selector is provided.

  Production traffic is unchanged: bridges run only on sandbox-flagged requests against a registered controller.

Patch Changes

• 8f3511d: Add a server-side guard that fails fast when forked adapter examples still contain .example tenant domains outside test or development.

• ba56164: fix(client): pass text/event-stream responses through enforceSizeLimit (fix(client): enforceSizeLimit should bypass text/event-stream responses #1176)

  The response-body byte cap was designed for one-shot JSON discovery responses
  (get_adcp_capabilities, agent-card lookup). SSE responses legitimately stream
  N status frames + a final result frame whose cumulative bytes can exceed any
  reasonable cap, but each frame is bounded by protocol-level framing. Bypass the
  cap for text/event-stream (case-insensitive prefix match, covers ; charset=utf-8
  variants). Adopters can now safely set maxResponseBytes on long-lived buyer
  sessions without tearing down legitimate streams.

@adcp/eslint-plugin@0.1.0

Minor Changes

• 4d54139: feat(eslint-plugin): ship @adcp/eslint-plugin with no-credential-read-from-args rule (feat(eslint-plugin): phase 1 — no-credential-read-from-args rule in new @adcp/eslint-plugin workspace #1541)

  New workspace shipping the first build-time guard against the SDK's AdCP Testing Framework with Authentication, Hierarchical Logging & Security Features #1 adopter
  footgun: reading credential-shaped keys off the buyer-supplied args bag inside
  extractContext / synthesizeFromArgs platform method implementations. Build-time
  sibling to the SDK's credentialPolicy: 'authInfo-only' runtime guard — same
  regex set (imported from @adcp/sdk/server's DEFAULT_CREDENTIAL_PATTERNS),
  caught earlier. Detection is method-name keyed, not interface-type keyed, so
  duck-typed definePlatform shapes and class methods that don't implements
  the interface explicitly are both covered. Phase 2 (adcp doctor subcommand
  and suggestion-level prefer-authinfo-credential-channel rule) tracked in feat(eslint-plugin): phase 1 — no-credential-read-from-args rule in new @adcp/eslint-plugin workspace #1541.

Patch Changes

• Updated dependencies [8f3511d]
• Updated dependencies [22f5cd4]
• Updated dependencies [ba56164]
• Updated dependencies [12e4a7f]
  • @adcp/sdk@7.4.0