What changed

• @silverprotocol/core requires zod 4.4.0 or later. With an older zod, AgEvent.parse() could give a received ext.* event a prototype taken from its own __proto__ member. Three side effects:
  • An application that pins an older zod for itself gets a second copy of zod for core.
  • An application that combines core’s exported schemas with its own zod should move its own zod to 4.4.0 or later.
  • overrides or resolutions that force zod below 4.4.0 defeat the requirement. Remove them, or decode with ingestAgEvent().
• Claude Agent SDK: a model name in the native modelUsage no longer sets the prototype of usage.byModel or of modelUsage in ext.anthropic.result-meta, and a supersedes list is copied like the other carries.
• Vercel AI SDK: an emitted value never holds a member named __proto__, at any depth, and a step’s stop details in message.metadata no longer take their prototype from one; the members beside it are carried as before.
• Google ADK: a member named __proto__ in a native is dropped at every depth, and the unparsed-native carry no longer takes its prototype from one.
• OpenAI Agents SDK: a host error’s usage reaches turn.error copied, without an own __proto__ key; a well-formed usage is unchanged. A host usage that isn’t a valid usage once that key is dropped is no longer put on turn.error; it rides ext.openai.unparsed instead.

What to do

1. Upgrade every @silverprotocol/* package to 0.12.3, including where another package pins one (check your lockfile).
2. If your application decodes received events with AgEvent.parse() or ingestAgEvent(), upgrade core now. Versions of core before 0.6.4 are being deprecated on npm.
3. Review the advisory for what to check in application code that copies values taken from events.

What changed

• A remote agent’s repeat of the forwarded message is no longer mapped. Some remote A2A agents repeat the forwarded message back in their first reply. ADK-Python’s A2A executor on a2a-sdk 0.3.x sends it back as a new task’s submitted status, in the "user" role, and the relay yields it as the remote agent’s own output: model text on @google/adk, reasoning on ADK-Python’s relay. Before 0.12.2 the normalizer mapped that output like any other content, so the forwarded conversation reached the emitted events. It can hold the user’s text, other agents’ replies, tool-call arguments and tool results, and, on @google/adk before 2.1.0, an adk_request_credential call’s OAuth client secret.
• 0.12.2 recognizes the repeat in a relayed event whose recorded reply is a submitted status with its message in the "user" role, and maps the event as if the repeated message’s parts were absent. Every other part of the event, including a task’s artifact parts, is mapped as before. In their place it emits one ext.google.relay-echo-omitted event inside the turn the relayed event belongs to. That event carries only the number of parts omitted, and none of their content.
• A user-role message relayed in any other state, such as a remote workflow’s tool result while it’s working, is mapped as before.

Who is affected

An application on @silverprotocol/google-adk 0.3.0 to 0.12.1 that runs an agent tree containing a RemoteA2AAgent, or feeds the normalizer ADK events serialized from ADK-Python’s relay, when the remote agent repeats the forwarded message. An application that doesn’t relay to a remote A2A agent, or whose remote agents don’t repeat it, isn’t affected.

What to do

1. Upgrade every @silverprotocol/* package to 0.12.2, including where another package pins one (check your lockfile), and rebuild any image that bundles the normalizer.
2. Rotate any secret that could have ridden in the repeat, as the advisory lists.
3. Purge those relay turns’ stored output, as the advisory describes.

Until you can upgrade, the advisory describes a workaround for each relay. What 0.12.2 doesn’t cover is listed there too.

What changed

• Google ADK no longer carries an A2A relay’s bookkeeping. When a run relays a conversation through @google/adk’s RemoteA2AAgent, ADK records its exchange with the remote agent in the customMetadata of the events it relays, under a2a:request, a2a:response, a2a:task_id and a2a:context_id. The forwarded request can hold the host’s A2A push-notification token and credentials, request metadata, local ids and the conversation it forwards. Before 0.12.1, the normalizer copied customMetadata unchanged into provider-raw blocks, and a relayed event it couldn’t map reached an ext.google.unparsed event with its native copy intact.
• 0.12.1 drops those four entries from each event’s customMetadata, and from the native copy in an ext.google.unparsed event under either spelling of the field (customMetadata or custom_metadata). Every other entry still rides, and no customMetadata member is emitted when none remains. The package’s README documents this exception to draft.8’s carry of unmapped ADK event fields.
• No recorded stream carries these entries, so none changes.

Who is affected

An application on @silverprotocol/google-adk 0.3.0 to 0.12.0 (the versions before 0.12.1 that declare @google/adk as a peer) that either runs an agent tree containing a RemoteA2AAgent, or feeds the normalizer ADK events serialized from ADK-Python’s relay. An application that doesn’t relay to a remote A2A agent isn’t affected.

What to do

1. Upgrade every @silverprotocol/* package to 0.12.1, including where another package pins one (check your lockfile), and rebuild any image that bundles the normalizer.
2. If AgJSON events from an affected version were forwarded or persisted while your application relayed through a RemoteA2AAgent, rotate the credentials the advisory lists, starting with the A2A push-notification token and credentials.
3. Purge stored provider-raw blocks, and ext.google.unparsed events whose native carries a2a:* entries in customMetadata or custom_metadata.

Not covered

These are unchanged in every version, 0.12.1 included:

• other customMetadata entries, which 0.12.1 still carries;
• copies of ADK’s native events that your application reads, stores or forwards itself;
• copies ADK keeps or forwards itself;
• a remote agent that repeats the forwarded message in its reply, which @google/adk yields as the relay’s own output. Upgrading doesn’t stop this. The advisory describes a RemoteA2AAgent afterRequestCallbacks entry that removes the repeated message from a response in the submitted state, and what to rotate and purge for it. ADK’s own copies and the repeated message have been reported to Google. For the repeated message in the events this package emits, 0.12.2 addresses it; see its release note.

Upgrading from 0.11.x

• Node.js 22.12 or later. Every package now declares "engines": {"node": ">=22.12.0"}. The packages are ES modules and use no Node API; the floor is 22.12 because that’s the first 22.x whose require() loads ES modules from CommonJS. CI now runs on Node 22 and 24. On an older Node, npm warns (EBADENGINE); nothing is removed.
• The 1.x promise, and what @beta means. A symbol marked @beta in the type declarations is outside the 1.x promise: it may change in a minor release. This release marks as @beta the types that restate an upstream SDK’s native shapes: the OpenAI Agents SDK package’s 31 native-mirror types, and the Google ADK package’s AdkEvent, AdkContent and AdkPart. These follow the package’s peer range. Core’s producer helpers were already @beta. Each package’s own API (its createXNormalizer(), the options it takes and its helpers) carries the 1.x promise. It’s a marking, not a removal: nothing stops compiling. The rule is stated in core’s README, under “API stability”.

Google ADK

• An error close carries the turn’s usage. When ADK ends a turn with an error in the stream (errorCode and errorMessage), the turn’s turn.error now carries the turn’s usage, as a host-reported error close already did. No recorded stream reaches this path, so none changes. This is a producer fix: the in-band close now carries the usage the spec defines for turn.error, and no field’s meaning changes.
• An empty artifactDelta no longer rides a provider-raw block. ADK gives every event an empty artifactDelta, and the normalizer carried it each time as a provider-raw block in the message content. It now skips artifactDelta only when it’s an empty object. A non-empty one still rides exactly as before, alone or beside another unmapped action. Recorded ADK streams change by design: those blocks leave, a block that also carried another action keeps it without the empty key, and seq renumbers. The fold keeps every message, and every turn record is unchanged.

OpenAI Agents SDK

• A handoff at the start of a resumed run gets a real parent turn. A resumed run can stream a handoff before any turn of the invoke has opened. The normalizer now opens the invoke’s own turn (turn_resume_<callId>) at the handoff’s handoff_requested, instead of at handoff_occurred, and makes it the parent of the handoff’s nested turn, so the nested turn carries the host’s thread. Before, the nested turn’s parentTurnId was a placeholder that named no turn. In a stored fold, the nested turn’s parentTurnId changes, and the resumed turn now comes before it in turns[]. Messages and artifacts are unchanged, and no recorded stream has this shape. This is a defect fix: the nested turn now gets the parent the spec already prescribes (§1.1: a nested turn’s parentTurnId points at the enclosing turn), and no field’s meaning changes.

@silverprotocol/core

• The MCP App display-mode request lists its modes in AgDisplayMode’s order (inline, pip, fullscreen). The values are the same, so validation is unchanged; the type unions print in the new order.
• The README gains the “API stability” section described above.

Spec: an erratum to draft.8

The first erratum to draft.8, applied in place under §15’s errata policy, with no version change. §12’s closed-set paragraph now notes, in an informative parenthetical, that the reference SDK checks its schema against the table: its spec-drift check reads the table and compares its sets. §3’s mcp-app mode union is listed in AgDisplayMode’s order. Neither edit changes a set, a meaning, the wire, a fold or a golden.

Wire version

1.0.0-draft.8, unchanged. Replaying every recorded stream through the 0.11.0 and 0.12.0 packages, the Claude Agent SDK (30), OpenAI Agents SDK (15) and Vercel AI SDK (8) streams are byte-identical, in their events and in the fold. Of the 116 Google ADK runs (the recorded streams, the same streams with and without the host-completion event, and the pause fixtures in both modes), 6 are identical, and 110 differ only by the removed empty artifactDelta blocks, the empty key taken off the blocks that also carry another action, and the seq numbering that follows. Every fold matches once the same changes are applied.

The v0.12.0 release is tagged at typescript-sdk commit ef24ebd4, the commit npm’s provenance for all six 0.12.0 packages attests.

What the reference producers emit for now

Until every deployed consumer runs a draft.4 or later reader, the reference producers emit no event type, closed-set value or block type beyond draft.3’s vocabulary except ext.<vendor>.*. A reader from before draft.4 drops an event type it doesn’t know and parks on the gap, while a draft.4 or later reader stubs it in place and keeps its seq slot (§12).

Upgrading from 0.10.x

• AgReasoningConfig.effort is an open string. "minimal", "low", "medium" and "high" stay documented, and any other string now passes. A receiver on an earlier core still rejects an undocumented value as unknown-value, so upgrade the receiving side before you send one. A non-string effort is still malformed, and mode stays a closed set.
• A memory record keeps the write’s _meta. AgMemoryRecord gains an optional _meta, copied from memory.write._meta. A stream whose memory.write carried _meta re-folds with it, where 0.10.0 dropped it. A reader that stores a strict parse’s output drops the field; the reference reader keeps unknown fields (§0.2).

Spec: AgJSON 1.0.0-draft.8

• Closed sets for major 1. §12’s table is the normative list of closed sets, each with its class. Within major 1, a set classed FROZEN gains no value; new vocabulary for it lands only as an optional open-string companion where the table names one, as turn.done.finishReasonRaw does for the finish reason. AgBlock has 16 kinds.
• New block types. A later minor may define a new AgBlock type together with an additive AgClientCapabilities field that declares support for it. A producer must not emit that block type to a client whose declared capabilities omit it.
• Version acceptance. A consumer rejects a different major and should accept any same-major version, including any prerelease tag of that major (-draft.*, -rc.*). The per-client version gate and its 1.0.0-draft.3 default are withdrawn. No producer implemented them, and a receiver already rejects an absent version as malformed, so nothing changes in practice.
• After 1.0, a change to what an existing field or fold means is a major.
• ext.<vendor>.<key>: §12 states the grammar the schema enforces. The vendor is one dot-free token that the emitter owns, and the key may carry dots. The reversed-domain recommendation is retired.
• Built records. A record the fold builds carries only the members its type declares (§5). The reference reducer already does.
• Fold changes, both additive record fields (§12): AgMemoryRecord._meta (above), and prompt.blocked.reasonRaw carried onto AgTurnRecord.promptBlocked (below). 0.10.0 dropped both.
• prompt.blocked.reasonRaw, an optional open-string companion that carries a native block reason the mapping reports as "other" (§4, §10 item 23).
• Recalled memory has no AgJSON event. The Claude Agent SDK’s memory_recall frame rides ext.anthropic.frame, byte-preserved, and a host-executed memory-tool read reports on that call’s tool.done (§13.11). This draft neither adds nor reserves a memory.read event.
• Housekeeping, text only:
  • §10 now reads as a conformance definition: each framework-specific item states whom it binds.
  • §11 is resolved.
  • §13.11 no longer offers ADK user:/app: keys as a memory.write example; they ride state.delta for all of 1.x (§8.0 item 30).
  • The draft notes move to a new §15, Revision history, with an errata policy. An erratum corrects the text of a published revision, never what a field, event or fold means. It’s applied in place and doesn’t move the version.
• No golden changes. draft.7 envelopes remain accepted (same major, §12).

@silverprotocol/core

• prompt.blocked.reasonRaw, folded onto AgTurnRecord.promptBlocked, as turn.done.finishReasonRaw is carried. An event without it lands a record without it.
• AgMemoryRecord._meta. A value write replaces the record whole, _meta included, so a write without one lands a record without one. A patch replaces _meta only when the write carries one, as it does reason and durable. A messages.snapshot’s memory elements declare the same field, and toPersistable() keeps it.
• AgReasoningConfig.effort is typed string, so checkAgInput() no longer reports an undocumented effort as unknown-value.
• AGJSON_VERSION is 1.0.0-draft.8.

Google ADK

• An unmapped prompt block reason rides prompt.blocked.reasonRaw. SAFETY, BLOCKLIST and PROHIBITED_CONTENT map to their reasons and carry no reasonRaw. Any other promptFeedback.blockReason maps to "other" and now rides reasonRaw verbatim. On @google/adk 2.1.0, no ADK-built event carries promptFeedback, because ADK turns a prompt block into an error code and message. So this serves events built elsewhere.

Wire version

1.0.0-draft.8, with optional fields only. Replaying the 77 recorded streams through the 0.10.0 and 0.11.0 packages, output is byte-identical for every one: Claude Agent SDK 30 of 30, Google ADK 24 of 24 (with and without the host-completion event), OpenAI Agents SDK 15 of 15 and Vercel AI SDK 8 of 8. The new optional fields appear in no recorded stream. The other framework packages change only their READMEs’ wire-version line, and @silverprotocol/richtext is unchanged apart from its version.

The v0.11.0 release is tagged at typescript-sdk commit d24faaaf, the commit npm’s provenance for all six 0.11.0 packages attests.

Google ADK

• A paused turn closes at the invocation’s end, on every host. A credential or input request doesn’t have to end an ADK invocation. More of that invocation can follow the pause: the model runs again after a usage-only report (including through ADK’s SSE streaming path), an after-agent callback adds content, or a SequentialAgent root moves to its next sub-agent. That output belongs to the paused turn. The paused close is now the turn’s last event: from push() on the host-completion event when you use hostCompletion, otherwise from flush(). Before, a host without hostCompletion got the paused close at the pause, the later output landed after it, and the fold parked. The 0.9.0 note listed this as a known limit.
• What a host sees differs from 0.9.0 in three ways:
  • Without hostCompletion, the paused turn.done now arrives from flush(), after the invocation’s other events, instead of at the pause. Only the terminal moves: each hitl.ask arrives where it did. A host may act on a live hitl.ask before the terminal; the paused record in turn.done stays the durable declaration.
  • The paused turn’s usage covers the invocation’s later rounds.
  • A turn that holds an ask when the stream ends, with no pause signal seen, still closes as turn.abort (stream-truncated), never as paused.
• Correction to the 0.9.0 note. It said ADK ends the invocation at a tool confirmation. That holds for the pausing agent’s own run, but a confirmation in a SequentialAgent sub-agent that isn’t the last one is still followed by the next sub-agent’s output in the same invocation. So the rule above covers every pause kind, confirmations included.
• Still host-completion-only: two shapes of a completed, not paused, run. Without hostCompletion, a SequentialAgent root outside ADK’s Workflow plane, or an after-agent callback that appends content after a success close, lands after the in-band terminal and parks the reducer.
• Every recorded stream serializes byte-identically. Only the engine fixtures whose invocation outlives the pause change: they now fold clean without the completion event.
• Known limit, unchanged: under ADK’s SSE streaming mode, ADK’s closing usage report repeats the call’s usage, so a turn’s summed usage can count that call twice. Because a paused turn now sums the invocation’s later rounds on every host, this can show on a paused turn too.

Spec: AgJSON 1.0.0-draft.7

• The ADK paused close moves to the invocation’s end (§8.0 item 26): from push() on the host-completion event, otherwise from flush(). INV-FLUSH (2) now releases a turn whose pause was signalled as paused at flush, and a turn with no pause signal still closes as a truncation. INV-TURN, §8.0 “Ids across invokes”, item 12 and §10 items 25 and 40 read accordingly. §7 says a host may act on a live hitl.ask before the turn’s terminal.
• Every recorded cassette serializes byte-identically. Six engine fixtures that parked on hosts without the completion event now fold, and a paused turn’s usage covers the invocation’s later rounds.
• This is a defect fix: a fold that parked now closes, and no field’s meaning changes.

draft.6 envelopes remain accepted (same major, §12).

@silverprotocol/core

• AGJSON_VERSION is 1.0.0-draft.7.
• The producer API is marked @beta in the type declarations. That covers StreamAssembler and its field types, AssemblerCheckpoint, withAtomicPush with its options and error constants, and the JSON-safety helpers. The wire vocabulary and the consumer API stay unmarked, including Normalizer and ToolOutcome. Nothing changes at runtime.

Wire version

1.0.0-draft.7. Replaying the 77 recorded streams through the 0.9.0 and 0.10.0 packages, output is byte-identical for every one: Claude Agent SDK 30 of 30, Google ADK 24 of 24 (with and without the host-completion event), OpenAI Agents SDK 15 of 15 and Vercel AI SDK 8 of 8. No recorded stream has a pause its invocation outlives. The other framework packages change only their READMEs’ wire-version line, and @silverprotocol/richtext is unchanged apart from its version.

npm’s provenance for the 0.10.0 packages names typescript-sdk commit 4fd5a02a, one commit after the v0.10.0 tag, which changes only a repository check script outside every package; the package contents are identical.

Fixes: streams that parked the fold

• Claude Agent SDK, parallel tool calls with partial messages on. The Claude normalizer no longer seals a streamed assistant message when a tool result arrives mid-stream, so parallel tool calls with partial messages on no longer start a call twice (a fold park since core 0.7.0). On streamed tool rounds, message.end now follows the round’s tool.done. Five existing goldens reorder only, and in one the message’s streamed usage now lands on message.end instead of a raw carry (a recovery, not a meaning change).
• Google ADK, a paused turn followed by more output from the same invocation. ADK ends the invocation at a tool confirmation, but not at a credential request or an input request, so more of the same invocation can follow the pause. For example, the model runs again after a stream that ends with a usage-only chunk, an after-agent callback runs, or a SequentialAgent root moves to its next sub-agent. The normalizer closed the turn paused at the pause, so that later output landed after the terminal and the fold parked. With hostCompletion, the paused close now waits for the host-completion event (SPEC §8.0 item 26). A paused run that ends without that event closes at flush() as turn.abort (stream-truncated), or as turn.error for an error the host feeds.
  • Known limit, for hosts without hostCompletion: a paused ADK turn whose invocation keeps emitting (a credential or input request on a backend whose stream ends with a usage-only chunk, an after-agent callback, or a SequentialAgent root) still parks on a host that doesn’t feed the completion marker. Opt in to hostCompletion to fold it clean today; the bare-host fix, the paused close deferred to the invocation’s end, lands in the next minor.
• Google ADK Live, a tool call followed by the model’s reply. On the Live path, for a model whose name doesn’t contain -flash-live, ADK yields the call generation’s turnComplete between the function response and the model’s reply. The normalizer closed the turn there, so without the host-completion marker the reply landed on the closed turn and the fold parked (a park since core 0.7.0), losing the reply and its usage. A turn now waits for the model’s reply after each function response; a turnComplete with no finish reason or error code in that window doesn’t close it, and an error still closes it at once. A live tool-call capture now folds as one turn, closed on the reply’s turnComplete, with or without the marker.

Changed: toPersistable()

• toPersistable(result) now also omits memory records whose scope isn’t thread, unless you declare that scope in { memoryScopes }. A bare call keeps thread memory only. This corrects the 0.8.0 note, which said the projection removed displayRequired “and nothing else changed”: from 0.9.0 it also drops agent, user and skill memory you haven’t declared. A host that keeps those scopes passes them, for example toPersistable(result, { memoryScopes: ["user"] }).

Spec: AgJSON 1.0.0-draft.6

• Memory scopes. A non-thread memory scope (agent, user, skill) records a write to the producer’s own cross-thread store, never a claim about the host (§2, §4, §5, §13.11). A host’s storage projection may omit the non-thread scopes it hasn’t declared it persists (§5.0, §8.0 host obligation 7). The declaration rides the additive AgCapabilities.memoryScopes (§3), and the reference projection takes it (§10 item 51). A stored fold written before draft.6 keeps every scope its host kept, and its durable flag reads as the producer’s statement about its own store.
• URLs (§13.4). A consumer’s scheme validation now covers any URL it navigates to or renders as a hyperlink, whatever carried it. The former list of carriers becomes examples, and a kind: "auth" ask’s authorization URL is covered on either carrier. A fetch made to render or resolve a wire URL follows the host care that the section sets out.
• The draft.6 text itself changes no producer’s bytes and no golden. The release as a whole does move goldens: the Claude fix above reorders five and recovers usage in one, and the release adds four recorded streams (three Claude parallel-call captures and a Gemini Live tool call).

draft.5 envelopes remain accepted (same major, §12).

@silverprotocol/core

• AgCapabilities.memoryScopes, an optional list of the non-thread scopes the host persists. Absent declares none.
• toPersistable(result, { memoryScopes }) keeps thread memory and each declared scope (see Changed).
• toPersistableWithReport(result, { memoryScopes }) returns { result, omitted }: the same projection, plus each omitted record by scope and key in the fold’s order, for a host that reports what it didn’t store.

Wire version

1.0.0-draft.6. Replaying the 77 recorded streams through the 0.8.0 and 0.9.0 packages, output is byte-identical for every OpenAI Agents SDK stream (15 of 15), every Vercel AI SDK stream (8 of 8) and every Google ADK stream (24 of 24). The recorded ADK streams feed the host-completion marker, and on them this release’s ADK changes move nothing. 22 of 30 Claude streams are byte-identical. The eight that change are the six goldens above and two new parallel-call captures with partial messages on. @silverprotocol/richtext is unchanged apart from its version.

Upgrading from 0.7.x

• Claude inputTokens is cache-inclusive. In draft.5, inputTokens counts every input token the provider processed, cache reads and writes included, with cacheReadTokens and cacheWriteTokens as its breakdown, never an addition. Anthropic reports input without the cache, so a Claude inputTokens (on the turn, on each message and in each byModel entry) now includes its cache reads and writes, and rises on cached calls. One with no cache counters is unchanged. In the echo capture, the turn’s inputTokens goes from 4 to 4,056: 4 uncached tokens, plus 1,966 cache reads and 2,086 cache writes. A Claude turn terminal’s counters cover that turn, so its usage now reads cumulative: false; 0.7.x marked it true. Its costUsd is the SDK’s running estimate over the whole query() call, so it carries the new costScope: "query". Without partial messages, an assistant message’s outputTokens is a placeholder, so message.end.usage now omits it. Usage from the OpenAI Agents SDK, the Vercel AI SDK and Google ADK’s generateContent route is unchanged; Gemini Live changes (see Google ADK).
  • Repairing stored Claude rows. A stored Claude turn record is from before 0.8.0 exactly when its top-level usage carries a costUsd key (a 0 included) and no costScope; a record without usage has nothing to repair. To repair one, add cacheReadTokens + cacheWriteTokens to its inputTokens and, for each byModel entry, that entry’s own cacheReadTokens + cacheWriteTokens to the entry’s inputTokens. Read its top-level cumulative as false and its costUsd as carrying costScope: "query", and leave each entry’s cumulative as stored. The record’s token counters and cost then read as a 0.8.0 record’s. A host that rewrites the row stores the repaired counters and costScope: "query" together, which ends the marker, so the row is never repaired twice. A stored Claude message record has no exact marker: inputTokens < cacheReadTokens + cacheWriteTokens identifies some older rows, not all.
• A snapshot no longer reopens a closed turn. A turn is closed while the fold holds a turn record for it that carries an outcome. A messages.snapshot changes closure only through the turn records it leaves: one that carries a turn with an outcome keeps that turn closed, and one that omits turns keeps every closure. After such a snapshot, a message.start, a tool.done adopting a message, or a terminal for that turn parks the reducer, where 0.7.x folded it. To reopen a turn, carry its record without an outcome (a snapshot with turns: [] drops every record, and so every closure). No framework package’s output changes.
  • This reverses part of what draft.4 and 0.7.0 said. The draft.4 spec note and AgJSON#1 (section 4) said a turn stays closed “until a messages.snapshot”, and the 0.7.0 note advised: when needsResync is set, resume from a snapshot. A snapshot still clears a message’s seal, since it replaces the messages. It no longer clears a turn’s closure. Resuming from a snapshot of the fold still recovers from a gap or a re-delivery. It doesn’t license new content for a turn the snapshot records as closed: a finished invoke re-sent from seq 0 after a snapshot of its own fold parks, and the fold stays the snapshot’s.
• A second terminal for a closed turn parks. A turn.done, turn.error or turn.abort for a closed turn now sets needsResync and leaves the fold unchanged, whatever its outcome and whether or not it repeats the recorded one. In 0.7.x each terminal overwrote the record, so an error followed by a success read as a success. The one exception is a host’s paused refresh: a re-sent turn.start, then a turn.done with a paused outcome and refreshed asks, for a turn closed as paused. It replaces the outcome and asks, keeps the recorded usage, and the turn stays closed. The refresh still works when a messages.snapshot falls between the turn.start and the turn.done. The one-terminal rule binds a host’s own appended events as well as a normalizer’s. Every committed golden folds as before.
• Record events for a turn whose thread isn’t known are held. A source, handoff, prompt.blocked, guardrail.result, agent.capabilities or display.required event lands on a record carrying the turn’s thread. The thread comes from a turn.start, subagent.start, message.start or messages.snapshot of that turn. Until the reducer knows it, the landing is held and result() omits the record.
  • Before (0.7.x): a record event for a turn not yet opened created a stub record whose threadId was the turnId, or an unknown-turn record.
  • After (0.8.0): no turn record carries a threadId that no event carried. A later opener sets a held record’s thread, and a subagent.start also sets its parentTurnId.
  • In the fold: a terminal or record event with no turnId resolves to the sole open turn, never a closed one. With no open turn, or several, its owner is unresolvable and the reducer parks. The reference reducer holds up to 64 turns and 1,024 landings; past either, it parks.
  • Reducer.ensureTurn(), which minted those stubs, is removed.
• Ids change: Google ADK. Turn and message ids now carry a per-invoke stem, random by default, or the invokeId option: turn_<invocationId> becomes turn_adk_<16 hex>_<invocationId>, and message ids follow. invokeId: "adk" doesn’t reproduce 0.7.x’s ids. The host-error sentinel’s invocationId no longer names the turn. This keeps ids unique when an invoke reuses an invocationId, as a resumed ADK-Python run does; in 0.7.x two such invokes folded into one Reducer parked it.
• Claude host-only fields moved. These are breaking if you read them:
  • The CLI wrapper keys context_usage, usage_report, user_message_uuid, user_message_uuids, resume_reason, aborted and supersedes move from providerMetadata to host-only _meta, on the first block’s start event, or on a message.metadata event when no block anchors them. On a frame whose first block is a tool call, they now always arrive on message.metadata. This retracts the providerMetadata channel described for aborted in 0.3.7, for context_usage in 0.4.4, and for the user_message_uuid family, resume_reason and usage_report in 0.6.1–0.6.3.
  • A tool result’s resourceLinks moves from tool.done.providerMetadata (0.5.4) to tool.done._meta["anthropic/resourceLinks"], the SDK’s list, verbatim. The result’s content stays the rendered text.
  • A permission denial’s context (decisionReasonType, decisionReasonCode, decisionReason, agentId) now rides one record, tool.done._meta["anthropic/permissionDenied"], on the denial and on the closing tool result alike. That includes decisionReasonCode, added in 0.6.3.
  • A notice’s level, preventContinuation and toolUseId ride the notice text block’s _meta.
  • Host records carry no durability promise (SPEC §2.1). A host may drop _meta when it persists a conversation, so a record read from the live stream can be absent after a reload.
• Pass threadId if you persist. A host that persists, routes or folds across invokes by threadId must give the normalizer the thread it assigned the invoke to (SPEC §8.0 host obligation 6). Without the option, each package stamps a facet-local placeholder that is not a thread identity: "openai", "google" or "vercel", or the Claude session id. Output without the option is unchanged.

Spec: AgJSON 1.0.0-draft.5

• Turn closure follows the fold’s turn records across a messages.snapshot (§5.0 INV-MSG, §5, §10 item 27).
• A second terminal for a closed turn is a reduce() error and a snapshot resync, except the paused refresh (§5.0 INV-MSG and INV-TURN, §8.0 host obligation 5, §10 item 27).
• Record events on unopened turns land on the turn’s known thread, never a placeholder, and a normalizer opens a turn before any event of it, record events included (§5.0 INV-OWNER and INV-TURN, §10 items 48 and 49). Erratum to draft.4: its note said a terminal for a turn seen only in a snapshot’s messages folds onto a record carrying that message’s threadId; the 0.7.x reducer did so only when no record event had reached that turn first.
• The input side of AgUsage (§4; §8.0 items 4, 19, 24 and 29; §10 items 8, 21 and 50): inputTokens is cache-inclusive, the revision draft.3 deferred; cumulative binds the object it sits on; the optional costScope names a cost whose scope differs from its object’s counters. Over the Gemini Live API, thoughtsTokenCount always folds into outputTokens, totalTokens is inputTokens + outputTokens + (toolUseInputTokens ?? 0), and a differing provider total rides the new optional totalTokensRaw.
• display.required is recorded for the live render, not for replay (§5, §5.0 INV-FOLD, §13.3, §10 item 51). A host’s persistence and re-display of a turn’s grounding records follow the grounding provider’s terms, and the render duty is conditioned on them. A host’s storage projection may omit turns[].displayRequired, which toPersistable() does in one call. Nothing changes on the wire or in the fold.
• MCP resource links in tool results (§8.0 item 31, §10 item 44): a normalizer emits an MCP resource_link part as one resource-link block, never a provider-raw block. The block gains MCP’s optional name, title, description and size. A member that doesn’t fit the block rides one provider-raw right after it, and a part without a string uri stays one provider-raw. §13.4’s scheme validation now covers resource-link uris and links a consumer takes from a tool result. A resource-link uri is carried byte for byte, so a signed or credential-bearing link is the host’s to handle: under §13.4 for its scheme, and with its own care when it fetches or persists it.
• Host records are side metadata (§2.1, §8.0 items 19, 21 and 29, §10 item 45): values that never round-trip to the provider ride _meta, not providerMetadata.
• The OpenAI handoff round release (§8.0 item 14, §10 item 46): when a handoff resolves a round, a call of that round with no result and no run-item stops being pending at handoff_occurred, and the round’s deferred close is released.
• A cross-invoke tool result lands in the later invoke’s own turn, as its own role: "tool" message (§5.0 INV-XINV), and a Claude deferred tool closes the turn paused with one approval ask (§8.0 item 32; §10 item 47).
• Remedy-shaped vendor data is advisory and never executed automatically, and a provider credit token is never emitted (§13.10, §10 item 52). A fix the framework waits on is a hitl.ask; a fix it only reports rides, less what §13.10 forbids, in a carrier that folds (§8.0 item 33, §10 item 53). §13.6 names messageMetadata. No carry moved: the homes are the ones the 0.7.0 and 0.7.1 notes describe.
• retriable on the error outcome (§10 item 54): AgOutcome’s error variant gains an optional retriable, copied from turn.error as the producer set it.
• Whose value threadId is (§1.2; §8.0 Partition root and host obligation 6; §10 item 55): the host’s. No schema change.
• Editorial: a key-replace state.delta patch never removes a member; handoff‘s transfer and escalate are defined from the producers’ semantics; turn.done.messageMetadata replaces the named message’s bag whole; §13.4 and §13.6 gain host-care sentences.

draft.4 envelopes remain accepted (same major, §12).

@silverprotocol/core

• toPersistable(result) returns a deep copy of a fold with displayRequired removed from every turn record, and nothing else changed. Persist its result unless the grounding provider’s terms permit storing displayRequired.
• outcome.retriable. The error outcome records turn.error’s retriable when the producer set it; an absent one stays absent. The non-terminal error event’s retriable never folds. Two committed Claude golden folds, an API authentication failure and a deferred tool no longer available, now carry retriable: false. A reader that validates a stored AgTurnRecord with an older core’s schema drops the field.
• AgUsage gains the optional costScope and totalTokensRaw. A core from 0.6.5 on passes them through as unknown fields; a core up to 0.6.4 drops them at ingest.
• The resource-link block gains the optional name, title, description and size (an integer), and its schema is exported as AgResourceLinkBlock, so a normalizer can check each native member against it.
• StreamAssembler never reopens a closed turn, so a late merging turn.start or a second subagentStart for a closed id no longer makes flush() emit a second terminal. openTurn() on a turn already seen now keeps a trigger passed to it. No shipped framework package reaches either path.
• Reducer.ensureTurn() is removed (see Upgrading).

Claude Agent SDK

• Usage accounting follows draft.5 (see Upgrading).
• A deferred tool pauses the turn. When a PreToolUse hook answers defer, the result closes the turn from push() with one hitl.ask (kind: "approval", askId approval_<call id>) and turn.done with a paused outcome naming it. The resumed invoke opens its own turn, and the call’s result lands there as a role: "tool" message. In 0.7.x the turn closed as a success with finishReason: "unknown", finishReasonRaw: "tool_deferred" and no ask. The ext.anthropic.result-meta carry is unchanged.
• Host-only fields moved to _meta (see Upgrading).
• turn.start.trigger. A top-level turn’s turn.start carries trigger: {kind: "user", ref} from the CLI’s user_message_uuid, taken from the frame that opens the turn. kind: "user" means a user-role send the host submitted with that uuid, not human authorship. It’s never set from an error result, a nested frame, a notice or a later frame of the turn.
• Hardens the tool_result_meta carry: a provider credit token at any depth is removed before the entry is emitted, as for the other CLI wrapper carries.
• The README documents the existing threadId option as the thread root.

OpenAI Agents SDK

• A parallel handoff no longer leaves its source turn open. When the model requests several transfers in one response, @openai/agents from 0.8.1 runs the first and streams nothing for the others. At handoff_occurred, each call of the source round that has no result and that no run-item named now stops being pending. It’s carried as ext.openai.dropped-call inside the source turn and gets no tool.done. Once nothing of the round is pending, the round’s deferred close is released in the same push(): message.end, then the deferred turn.done, with its outcome, finish reason and usage. In 0.7.x the source turn ended with turn.abort (stream-truncated) at flush, its usage on the round’s message.end. A result that arrives later for a released call rides the same ext.openai.dropped-call key after the turn’s terminal, never as a tool.done. This replaces the parallel-handoff limit described in the 0.7.1 and 0.7.2 notes for @openai/agents 0.8.1 and later.
  • Still deferred: when a filter removes handoff_occurred or tool results; an approval pending beside the transfer on @openai/agents 0.8.x, which closes paused at flush; and pending program, hosted-shell or tool-search calls.
• createOpenaiNormalizer() takes an optional { threadId }, stamped on every turn and message, nested handoff turns included. A handoff that streams before any turn of the invoke opened gets the parent id turn_<stem>_handoff_parent.

Vercel AI SDK

• An MCP tool error folds as an error. @ai-sdk/mcp returns an MCP result with isError: true as ordinary tool output; it now folds as outcome: "error" with isError: true, where 0.7.x folded it as a success. The facet reads MCP members only from a result @ai-sdk/mcp stamped, so an ordinary tool that returns an MCP-shaped object is unaffected.
• An MCP Apps view locator rides tool.done._meta. An MCP result’s _meta.ui is now carried unchanged on tool.done._meta, so it survives a later snapshot.
• A result for a call made in a previous call (a tool result, tool error or denied approval that streamText delivers before its first step) now names its own message, <toolCallId>:result, in this invoke’s turn, and folds as a role: "tool" message. In 0.7.x it had no messageId and parked the fold.
• Anthropic stop details. A refusal’s providerMetadata.anthropic.stopDetails on the finish step now rides the step’s message.metadata, verbatim, with any provider credit token removed at any depth. In 0.7.x it was dropped.
• createVercelNormalizer() takes an optional { threadId }, stamped on every entity. ext.vercel.* never follows it.

Google ADK

• Ids change to a per-invoke stem (see Upgrading).
• Live sessions get a turn per generation. On a barge-in, ADK sends interrupted: true first, then the interrupted generation’s usage and turnComplete, then the reply. The interrupted generation now closes as turn.abort (interrupted) on its own turnComplete, with its usage on its message.end, and the reply opens the next turn, turn_<invokeId>_<invocationId>_g1. A live barge-in closes the interrupted generation and folds clean, as two live captures show, one of them with two barge-ins. This closes the known limit in the 0.7.1 note, where a real barge-in parked the reducer.
  • Still limited: a generation that follows a completed reply with no barge-in lands in the closed turn, and parks, unless you opt into hostCompletion, which defers that close. When text is buffered at the interrupt, ADK yields only the text aggregate, without the flag, so the turn closes at flush() as stream-truncated.
  • A transcription reads once. ADK’s finished transcription is no longer re-emitted when it repeats the chunks already streamed.
• Gemini Live usage. Over the Live API, outputTokens now counts the response and the thoughts; 0.7.x counted the thoughts alone. totalTokens is derived as inputTokens + outputTokens + (toolUseInputTokens ?? 0), the total Gemini’s generateContent surface reports for the same counts, not a billing figure. Google’s own total rides totalTokensRaw where it differs, and neither is emitted when Google reports no total. Each report’s per-modality breakdown rides message.metadata as usageDetails, one verbatim entry per report. Live usage stored before 0.8.0 is unreliable. Usage on the generateContent route is unchanged.
• MCP resource links. An MCP resource_link part of a tool result becomes one resource-link block, with a provider-raw right after it only for members that don’t fit. Image, audio and embedded-resource parts stay provider-raw.
• createAdkNormalizer() takes an optional { threadId }, stamped on every turn and message it opens, the host-error turn included.

Wire version

1.0.0-draft.5. Replaying the 73 recorded streams through the 0.7.2 and 0.8.0 packages, output is byte-identical for 14 of 15 OpenAI Agents SDK streams and 6 of 8 Vercel AI SDK streams. Every Claude stream changes (usage accounting), and so does every Google ADK stream (ids). @silverprotocol/richtext is unchanged apart from its version.

OpenAI Agents SDK

• An ignored handoff closes its nested turn at its result. When the model requests several handoffs in one response, the SDK runs only the first. On @openai/agents 0.8.0 and earlier it streams a result for each ignored call (“Multiple handoffs detected, ignoring this one.”). The ignored handoff’s nested turn, opened at its handoff_requested, now closes at that result, with turn.abort and then subagent.done, before the call’s tool.done. In 0.7.1 it stayed open until flush aborted it. This turn.abort carries no reason.
• With several handoffs open, each is matched to its own call, and the handoff event belongs to the source turn. Before, it could attach to the first handoff’s nested turn, which had already closed. A stream with a single handoff is unchanged.
• From 0.8.1 the SDK doesn’t stream the ignored calls at all, so the parallel-handoff limit described in 0.7.1 still applies there: the source turn ends with turn.abort (stream-truncated) at flush.

Spec

• 1.0.0-draft.4 gains a clarification, with no version change: a state patch or snapshot that is itself a credential object is omitted whole and emitted as {} (§8.0 item 28(b)). The reference Google ADK package already behaved this way, so nothing changes on the wire.

The compatibility tables on each npm page are unchanged.

Claude Agent SDK

• A subagent’s run report reaches you. When an Agent (or legacy Task) call finishes, the subagent’s run report now rides that call’s tool.done, verbatim, in host-only _meta["anthropic/agentOutput"]. The report covers status, agent id and type, the model it resolved to, totals, usage and tool statistics; for a background launch, it’s the launch acknowledgement instead. content and prompt are left out, since the event already carries them. The report’s usage is the subagent’s own, so it stays out of AgUsage, whose parent total already includes it. 0.7.0 didn’t carry the report.
• A turn woken by a background subagent says so. A result’s origin, for example {kind: "task-notification"} on the turn a background subagent’s completion woke, rides ext.anthropic.result-meta.origin. 0.7.0 dropped it.
• The CLI’s stamp on a tool result rides its tool.done. A tool_result_meta entry (for example, for a call a hook blocked or the user cancelled) now rides tool.done._meta["anthropic/toolResultMeta"], verbatim, beside any MCP _meta. 0.7.0 used it to decide the outcome but didn’t carry it.
• The API’s own tool input. When the CLI rewrote a tool call’s input, the input exactly as the API produced it rides tool.args.assembled.providerMetadata.wireInput and folds onto the tool-call block. That’s the input a replayed history must send back. It appears only when it differs from the event’s input.
• Hardens how the harness writes its facts on a tool result: the anthropic/ keys on a tool.done’s _meta are reserved for them, so a tool’s own keys under that prefix aren’t carried. Every other _meta key the tool returned is kept, verbatim.

Google ADK

• A Live barge-in’s turn closes in order. Only hosts on ADK’s runLive path see this change, since runAsync never sets interrupted. In 0.7.0 a barge-in (interrupted: true) emitted turn.abort in the middle of its event, so that event’s own content, ADK’s full-text aggregate and the message’s message.end all arrived after the terminal. Now the message closes first, and turn.abort with reason: "interrupted" follows the event’s own content. The turn has one terminal, and the event’s own content precedes it. Ids are unchanged.
• Known limit: a real Live barge-in still parks the reducer, as it did in 0.7.0. On the live wire, ADK sends the interrupt flag first, and then that generation’s own usage and completion events and the model’s reply, all in the same invoke. Those land after the turn’s terminal, so the reducer parks and the reply isn’t in the fold. A clean fold of a barge-in needs each generation to get its own turn.

@silverprotocol/core

• StreamAssembler.toolArgsAssembled() takes an optional providerMetadata, for normalizer authors. Without it, the event is unchanged from 0.7.0.

Known limit, unchanged

• Parallel handoffs (OpenAI Agents SDK). When the model requests several handoffs in one response, the SDK runs only the first, and what happens to the ignored calls depends on the @openai/agents version.

  • From 0.8.1, nothing about them reaches the stream. The SDK drops them from the run’s history; only in a server-managed conversation (conversationId or previousResponseId) does it send the model a synthetic result for each. With no tool.done for them, the source turn ends with turn.abort (stream-truncated) at flush.
  • Up to 0.8.0, the SDK streams a result for each ignored call, which lands as that call’s tool.done, and the source turn closes normally. The ignored handoff’s nested turn is closed at flush with turn.abort (stream-truncated).

  The limit was disclosed in 0.7.0 and has now been measured on a live response at @openai/agents 0.18.0; the behaviour is unchanged in 0.7.1. The 0.7.0 note said the ignored calls’ results go to the model only, which holds only in a server-managed conversation from 0.8.1. This corrects it.

The compatibility tables on each npm page are unchanged.

Upgrading from 0.6.x

• Upgrade the framework packages no later than @silverprotocol/core. If you fold several invokes into one Reducer, a 0.7.0 core stops and asks for a resync on a message.start for a turn that has already closed, and a closed turn stays closed across invokes. The framework packages up to 0.6.7 reuse turn ids from one invoke to the next, so a 0.7.0 core folding their output parks on the second invoke. Upgrade them together with core, or before it.
• Honour needsResync. The reference reducer now parks on a re-delivered event, and on a block id or a final tool.done repeated within one invoke; 0.6.7 folded these silently. It also extends the closure rule. 0.6.7 already resynced on a new block or a delta into a sealed message, and on a new block into a closed turn. 0.7.0 adds block-finalizing events (text.end, reasoning.end, reasoning.opaque, tool.args.assembled), a delta into a still-open message of a closed turn and a message.start for a closed turn, and it keeps a turn closed across the invokes of one fold. When needsResync is set, resume from a snapshot.
• Ids change. If you store or compare them:
  • Claude: every turn id changes. A turn is now turn_<first assistant message id> (or the id of the notice or result frame that opens it), and each subagent run gets its own id. In 0.6.7 every turn in an invoke was turn_<session_id>, so a multi-turn invoke folded into a single turn record.
  • OpenAI Agents SDK and Vercel AI SDK: turn and message ids they mint now carry a per-invoke stem, random by default, or the new invokeId option. invokeId: "vercel" reproduces 0.6.7’s Vercel ids exactly. invokeId: "openai" reproduces OpenAI’s turn ids, but handoff turns become turn_openai_handoff_<n>.
  • Google ADK: streaming block ids count per invoke, so a second turn continues at text:1 instead of reopening text:0. The id-less fallback turn is turn_adk_<random> instead of turn_adk.
  • Google ADK asks: approval and authentication asks are now keyed by the reserved call ADK creates for the pause. Their askId is approval_<reservedId> / auth_<reservedId>, toolCallId is the reserved id, and the original call id moves to metadata.originalFunctionCallId. A host that answers asks by askId must use the new ids.
• Handle paused. An OpenAI Agents SDK approval pause now closes its turn as paused, naming its ask. In 0.6.7 it folded as a success.
• ADK tool failures now fold as failures. An ADK tool result carrying an error member now folds as outcome: "error" with isError: true, and a declined approval as "denied"; in 0.6.7 both folded as "ok". A tool of yours that returns {error: …} as ordinary data now reads as a failure.
• Two things moved. These are breaking if you read them:
  • OpenAI misalignment. Since 0.6.1, @silverprotocol/openai-agents has emitted OpenAI’s error.misalignment as a turn-scoped ext.openai.misalignment event. From 0.7.0 it arrives as an adapter notice, just before the turn.error it explains. The notice is one text block carrying detailed_explanation (or error.message when there is none), and the whole misalignment object is on that block’s _meta["openai/misalignment"]. The notice is part of the transcript, so it’s persisted with it. ext.openai.misalignment is no longer emitted.
  • Claude CLI wrapper fields. narration_block_indexes, api_error, api_error_params and api_error_code move from providerMetadata to host-only _meta, on the first block’s start event (folded onto that block), or on message.metadata when the first block isn’t text or thinking. estimated_tokens moves to reasoning.delta’s _meta and is now live-only. providerMetadata is kept for values that must round-trip to the provider.

Spec: AgJSON 1.0.0-draft.4

• Forward-compatible ingest. A well-formed event (an object with a string type and a numeric seq) that this version can’t validate (an unknown event type, an unknown value, an unknown block type) is no longer dropped. ingestAgEvent(s) returns it in place as ext.agjson.ignored {seq, ignoredType, raw}. That event never folds but keeps its seq slot, so the reducer doesn’t see a false gap. raw is live-only; don’t persist it. Input that isn’t a well-formed event is still dropped, and is now reported through the optional onReject callback. Ingest never throws.
• Closed value sets are frozen for 1.x. New values go to open companions instead. The first is turn.done.finishReasonRaw: the framework’s native finish value, set when the mapped finishReason loses it. It’s recorded on the turn record. All four framework packages set it; Google ADK also keeps message.metadata.rawFinishReason for one more release.
• phase on text and reasoning blocks. A new optional open string; "interim" marks narration between tool calls. It’s set on *.start and may be replaced on *.end. The OpenAI Agents SDK sets it for commentary, the Vercel AI SDK for an OpenAI commentary text part, and the Claude Agent SDK for narration blocks the CLI marks (which the current CLI doesn’t yet do).
• Stored records and inputs follow the forward-compatibility rule too. readStoredAgMessage, readStoredAgMessages and readStoredAgMemoryRecords read what you persisted. An element they can’t read, such as a content block of a type this version doesn’t define, is left out and reported with its position and its stored value, and a stored record that isn’t a message at all is reported whole; everything else reads normally, unknown fields included. Don’t persist the view they return. checkAgInput checks an input before you act on any of it. A value outside a closed set, or any other schema failure, rejects the whole input with a typed result (malformed, unknown-value or major-mismatch); an unknown object field never does. It checks protocol, then version, then the rest: an input whose protocol is "agjson" but whose major version differs is major-mismatch, whatever else it carries. Otherwise a malformed value in any part it checks makes the result malformed, even if the input also carries an unknown value. Members that only an unknown kind would select, and the fields of a block of an unknown type, aren’t checked.
• New: uiResources.viewMessageTurns. An optional client capability. A client sets it on AgClientCapabilities to say it delivers a message sent from a view (an MCP Apps ui/message or an OpenAI Apps sendFollowUpMessage) as the user message of a later kind: "start" input: at once when no turn is in progress, otherwise after that turn ends. Such a client never cancels a turn in progress to deliver it, and it answers the view with an error, never a success, for a message it doesn’t deliver (for example, one the user declines). The flag applies only to the input that carries it, so an agent host shouldn’t rely on this delivery for an input without it. Cores before 0.7.0 ignore it. Discussion: AgJSON#2.
• Erratum to draft.2: “additive” there meant an absent field or role is byte-identical to draft.1. Under draft.4’s rules a new AgRole value is not additive for consumers, and a consumer from before draft.2 can’t fold notice messages.

Fold changes (@silverprotocol/core)

These change what reduce() builds from a stream. They are tracked, with their spec text, in AgJSON#1, along with the ignored-event slot above and the nested-turn terminals below.

• Tool results kept open are snapshots. A later tool.done for a result kept open with more: true replaces the result’s payload as a unit: content, outcome, isError, structuredContent, uiData, sideData, errorText, errorCode and pendingInput. A payload field the later event omits is cleared, including when the final tool.done reports an error. _meta, toolMetadata and dynamic are kept unless re-sent, providerMetadata merges by key, and an explicit uiData: null is stored as a value. A producer must carry an MCP Apps result’s _meta.ui unchanged on tool.done._meta, so a view keyed on _meta.ui.resourceUri survives. The Vercel AI SDK is the one framework package that keeps results open: a generator tool that yields and then throws now folds to the error alone.
• state.delta object patches replace each top-level key whole, the way ADK applies a state delta: {cfg:{a:1,b:2}} then {cfg:{a:5}} now folds to {cfg:{a:5}}, not {cfg:{a:5,b:2}}. null is stored as a value, a scalar patch does nothing, and JSON Patch arrays are unchanged. On core 0.6.x the one-level merge stays; from 0.7.0, anything the old merge left behind in a key clears the next time that key is written.
• A re-delivered event never folds twice, and the other delivery faults listed under Upgrading now park the fold instead of corrupting it.
• A terminal (turn.done, turn.error or turn.abort) for a turn the reducer never saw opened folds onto no turn record and doesn’t park. In 0.6.7 such a terminal minted a turn record of its own. A turn counts as seen opened once a turn.start or subagent.start opens it, or once a folded messages.snapshot carries it; a snapshot that carries turns replaces that set. A terminal for a turn that was seen opened but has no record gets one only when the latest snapshot carrying that turn gives it a threadId.

@silverprotocol/core: new APIs and fixes

• withAtomicPush(createInner, opts?) wraps a normalizer so each push() is atomic. If handling one native event throws, that event’s partial output is discarded (no seq is used) and one error {message: "normalizer error", code} takes its place. The OpenAI, Claude and Google packages now use it. StreamAssembler.checkpoint() / rollback() give the same guarantee to a normalizer that can’t journal; the Vercel package uses them.
• toJsonValueSafe(v) turns any live value into JSON without throwing: cycles become "[Circular]", a value past the depth cap becomes "[MaxDepth]", and an Error becomes {name, message} plus its own enumerable fields. toJsonValueSafeWithIssues(v) also reports what it replaced, and isJsonValue(v) is a type guard.
• Reducer.push() keeps its own copy. It now folds a copy of each event, so a host that reuses or changes an event object after pushing it no longer changes the fold. result() already returned a copy, so reading was never affected.
• validateHitlAnswer now rejects an answer whose status isn’t defined (unknown-status) before dispatch. 0.6.7 could read it as a grant.
• reduce() no longer leaves an explicit providerMetadata: undefined key on a block.

Claude Agent SDK

• One turn id per turn, unique across invokes (see Upgrading). A multi-turn invoke now folds into one turn record per turn, keeping each turn’s outcome and usage. New option: invokeId.
• Subagent runs close on their own. A run opens once and closes once with its own turn.done, turn.error or turn.abort (with no usage) right before subagent.done, as draft.4 requires. It closes on the spawning task’s result, on a task_notification, or at flush. A background sub-run stays open until its task_notification arrives; the parent’s result no longer closes it. A nested API error no longer closes the parent turn. In 0.6.7 every nested message opened and closed its own bracket.
• Every turn opens with turn.start, including one that starts with a result (a startup failure, a local command, a result-only API error) and a resumed invoke that starts with a tool result.
• A denied tool call closes once, as denied. A harness-denied call used to close as error and then get a second denied close from the result’s denials. An error-subtype result now emits its denials too.
• More CLI facts reach you. diagnostics, error_details, advisor_model and attribution_agent now ride host-only _meta beside the fields that moved there (see Upgrading). A non-null stop_details, for example a refusal’s category and its fallbacks, folds onto its message through turn.done.messageMetadata. Wrapper fields on a first block that isn’t text (a compaction, a content block, an MCP tool result) now ride message.metadata; 0.6.7 dropped them. Unknown top-level frame types (for example command_lifecycle) and the CLI’s synthetic user frames ride ext.anthropic.frame. deferred_tool_use rides ext.anthropic.result-meta.deferredToolUse, and an error close adds apiErrorStatus and stopReason there.
• A result-only error close says why. Its code is the API error code, else the CLI’s terminal_reason, else "api_error", and its message is the result text, else the code. 0.6.7 could close with an empty message.
• finishReasonRaw carries the native stop_reason when finishReason falls back to "unknown".
• A stream that ends early closes cleanly. When a stream is cut short, flush() closes the blocks still open without inventing content: no tool input assembled from partial JSON, no reasoning signature and no compaction block.
• push() never throws. Each frame is read as plain JSON first. A frame that still can’t be handled is rolled back and replaced by one core error event, and emitted values never share objects with the frame you pushed.
• Hardens how verbatim vendor carries (ext.anthropic.* frames, provider-raw blocks and CLI wrapper fields) are copied.

OpenAI Agents SDK

• An approval pause stays paused. When a stream ends while the facet is still holding a round open, it releases that round, in order and before the live response closes. While a call still waits for approval, the round comes out as paused, naming its approval ask (askId approval_<callId>, kind: "approval"). When the round’s own terminal isn’t a success, it comes out as that terminal. Otherwise its usage goes on message.end, followed by turn.abort (stream-truncated). An Agents SDK approval pause, which used to fold as a success, now folds as paused with its ask.
• Handoffs close cleanly. A handoff now closes both its transfer call (the transfer_to_<agent> call gets its tool.done from the SDK’s handoff_occurred) and its nested turn (turn.done with success and finishReason: "unknown", then subagent.done), and the source agent’s turn closes as a success at the handoff, before the target agent’s rounds. In 0.6.7 the transfer call never got a result, the nested turn had no outcome, and the source agent’s turn stayed open until the end of the stream, closing after the target agent’s rounds. One limit: when the model requests several handoffs in one response, the SDK sends the results of the ignored calls only to the model, so the source turn still ends with turn.abort (stream-truncated) at flush.
• An approval resume opens its own turn. A resumed run’s leading tool results now open turn.start, each as its own tool message, followed by the resumed response in the same turn. In 0.6.7 they arrived with no turn open, and the fold parked.
• Commentary is marked phase: "interim" on its text block. providerMetadata.phase still carries OpenAI’s value, and a null or empty phase is no longer emitted.
• finishReasonRaw carries the native finish reason when the mapping falls back to "other" or "unknown".
• push() never throws. The normalizer is wrapped in withAtomicPush, and each native event is read as plain JSON once. In 0.6.7, pushing live Agents SDK objects threw for six of nine live shapes. ext.openai.unparsed now carries a copy, not your object.
• createOpenaiNormalizer() takes an optional { invokeId }.

Vercel AI SDK

• Ids are unique across invokes, with a per-invoke stem, or invokeId (see Upgrading). Step ids still repeat; they’re live-only and never folded.
• finishReasonRaw carries the finish part’s rawFinishReason when the mapping falls back to "other" or "unknown".
• An OpenAI commentary text part opens with phase: "interim".
• A cycle or BigInt in a live value degrades only its own node ("[Circular]", or the number’s decimal string); 0.6.7 turned the whole value into "[object Object]".
• Each stream part is a transaction. A part that throws midway is rolled back (no seq is used) and replaced by one core error event.
• createVercelNormalizer() takes an optional { invokeId }.

Google ADK

• Tool failures fold as failures (see Upgrading), in this order: an MCP result with isError is an error; ADK’s pause placeholder stays "ok"; a declined approval is "denied"; any other result with a truthy error member is an error, with errorText and errorCode; everything else is "ok".
• Pauses: each pause is keyed by its reserved call: an approval request becomes an approval ask, an authentication request an auth ask, and an input request a text or form ask. A Workflow function node’s authentication request now closes its turn as paused; in 0.6.7 it aborted at flush.
• Opt-in host completion. Create the normalizer with { hostCompletion: true } and push { type: "__host_complete__" } after runAsync() returns normally, and a completed Workflow closes its turn as a success from push(). Without the option, a completed Workflow still aborts at flush, as before. Turn it on only if you push the sentinel: with the option on and no sentinel, even a plain agent’s turn aborts at flush.
• Host-error sentinel. Push { type: "__host_error__", code, message } (or the caught Error) and every open turn closes as turn.error, innermost first. With no turn open, a new turn is opened to carry the error. In 0.6.7 a caught throw could only ride ext.google.unparsed, and the turn aborted at flush.
• finishReasonRaw is set on the lossy mappings, and message.metadata.rawFinishReason / rawErrorCode stay for one more release.
• Block ids count per invoke, and the fallback turn id is unique (see Upgrading).
• push() now runs inside withAtomicPush, with the same guarantees as 0.6.7’s guard. A native event with nothing serializable now rides ext.google.unparsed with native: null; 0.6.7 sent {reason: "not-serializable"}.
• Security advisory GHSA-w78f-8q9f-jwpg. Versions before 0.7.0 could carry credential material from ADK events into the events they emit, and 0.7.0 completes the fix, including how ADK shared state is carried. If you ran an affected version, the advisory lists which versions are affected and what to do.

Wire version

AGJSON_VERSION is 1.0.0-draft.4. draft.3 envelopes remain accepted (same major). The compatibility tables on each npm page are unchanged.

Google ADK

• push() no longer throws on live or malformed ADK events (SPEC.md §8.0). A host that pushes the Event objects ADK yields, as the README shows, can hand the normalizer members that are not JSON: undefined, a Date, a BigInt, a cycle. Each event is now read once as plain JSON before anything maps it: a Date becomes its ISO string, a BigInt its decimal string, a repeated ancestor "[Circular]", and members JSON would drop are dropped.
• An event that still cannot be mapped (for example, one whose parts are not a list) is dropped whole and reported once as a non-fatal core error event (message: "normalizer error", code: the error’s constructor name, no payload). Apart from that report, the stream is the same as if the event had never arrived. If flush() itself fails, it is reported the same way and still ends the open message and turn. An event with nothing serializable at all is reported once as ext.google.unparsed, with a reason in place of its content.
• A live Error inside an event now rides as {name, message} plus its own enumerable fields (without its stack). An app tool that returns an Error as its value now folds that message into tool.done; before this release, pushing that live event threw.
• Hardens how ADK workflow node data is carried.

The compatibility tables on each npm page are unchanged.

Core: two reducer conformance fixes

• A late delta for a message the Reducer has already sealed no longer attaches to it. A text, reasoning, opaque-reasoning or tool-argument delta whose block belongs to a sealed message now sets needsResync, as block-creating events already did (SPEC.md INV-MSG). A delta for a block the reducer has never seen behaves as before. If your stream delivers deltas after message.end, you will now see a resync instead of a message that grew after it closed.
• A final tool.done that follows a preliminary one (more: true) now keeps toolMetadata and dynamic. Until now only the first delivery carried them into the folded result.

OpenAI Agents SDK: reasoning as a first-class block

• Reasoning now folds as a first-class reasoning block. The Agents SDK reports a reasoning item only after the response completes, so until now it reached AgJSON only as ext.openai.late-reasoning. The block now opens where the item appears on the wire, ahead of the function call it precedes, and is filled from the completed response: OpenAI re-encrypts a reasoning item at each stage, and only the final copy is valid to send back when you replay the conversation.
• message.start.model is filled from response.created, so the folded message records the model that answered.
• A built-in tool call that OpenAI runs itself now carries providerExecuted: true on tool.start, so a client that relays tool calls knows not to run it again.
• An assistant message’s phase (for example, commentary versus the final answer) now also rides text.start in providerMetadata, so it is known before the first delta. text.end carries it as before.

Google ADK

• Streaming block ids no longer repeat within a turn. Each id is now a per-turn count for its kind, not the part’s position in its event, so two thinking events in one invoke no longer both open reasoning:0. The first block of each kind keeps its old id.
• A workflow’s pause closes its turn as paused. A nested model node’s final answer no longer closes the whole invocation turn, so a later request for input lands on an open turn instead of making the Reducer resync.
• hitl.ask for an authentication pause fills the spec’s authConfig field: the scheme, and the authorization URL, token URL and scopes where ADK provides them.
• displayName on inline data and file data is carried: as the filename of a file block, in providerMetadata on image and audio blocks, and alongside a resource link.
• Events that carry JSON null where the genai types say a field is optional (for example, session payloads serialized from Python) no longer throw or produce output the schema rejects.
• Hardens how authentication objects from ADK are carried.

The compatibility tables on each npm page are unchanged.

Unknown fields now pass through ingest at every depth

SPEC.md §0.2 asks a consumer to pass unknown fields through untouched, so a stream from a newer producer survives an older reader. Through 0.6.4, ingestAgEvent / ingestAgEvents honoured that only at the top level of an event: an unknown key one level down — a new counter inside turn.done.usage, a new property on a block sent by content.block — was silently removed during validation. From 0.6.5 it is kept, at every depth. Where the Reducer folds a sub-object whole (usage on turns and messages, a block delivered by content.block), the unknown key reaches its result too.

Ordinary events keep every field and value they had in 0.6.4. One difference is visible: nested objects now keep the producer’s key order, where 0.6.4 re-ordered them to the schema’s. You will see it in usage (for example, totalTokens now sits where the producer put it). Deep-equality checks are unaffected, but anything that compares serialized JSON, such as a snapshot, a hash or a byte baseline, can change once.

One thing to check if you persist or strictly validate the reduced result: records built from a newer producer’s stream can now carry keys your schema does not know. That is the point of the change, but a closed schema on your side will see them.

The compatibility tables on each npm page are unchanged.

Fixed: an ingest issue in @silverprotocol/core

0.6.4 fixes an issue in ingestAgEvent / ingestAgEvents. Upgrading is recommended for every consumer that calls either function. Ordinary events are unaffected: their output is byte-identical to 0.6.3’s.

Claude: a carry and a fix

• Refusal fallback, whole. When Claude Code falls back to another model after a refusal, the facet used to read only the retracted message ids (→ message.remove) and drop the rest of the frame. The whole frame now also rides ext.anthropic.frame{kind: "model_refusal_fallback", frame}, after the removes, so its trigger, direction, original and fallback model, refusal category and explanation reach you. They reach you on the event stream only; the folded transcript does not show them. The retraction path is unchanged.
• Replayed user frames emit nothing. A user frame the Agent SDK marks isReplay: true (prompt acknowledgements, queued-prompt merges, history re-sends) is now a no-op. Nothing the facet emitted before is lost: replays carry content it never mapped. Before, a replay acknowledgement arriving mid-stream could split the message being streamed in two. A replayed tool result would also have re-emitted its tool.done, though no current Agent SDK version sends one.

OpenAI Agents SDK: MCP tool-result _meta

When your customDataExtractor returns the MCP result’s _meta (as ctx.resultMeta), @silverprotocol/openai-agents now puts it on the tool result’s _meta, verbatim. When that _meta includes ui (MCP Apps), the structured content is also placed on uiData, the same routing the Claude facet already applies. structuredContent itself is unchanged. With no _meta, output is byte-identical to 0.6.3. The package README gains an “MCP tool results” section on what your extractor should return.

Vercel AI SDK: OpenAI’s phase reaches you

With @ai-sdk/openai, text parts from GPT-5.5 and later carry providerMetadata.openai.phase: "commentary" for text between tool calls, "final_answer" for the answer. The facet used to drop it. text.start and text.end now carry the part’s providerMetadata verbatim, so the phase is known before the first delta. OpenAI asks that phase be sent back on follow-up requests, and a UI that ignores it merges commentary into the answer. Text parts without metadata are byte-identical to 0.6.3.

The compatibility tables on each npm page are unchanged.

Fixed: a Claude API error folded as a successful turn

When a Claude turn ends on an API error, the Agent SDK ends it with two frames (after any api_retry notices): an assistant message carrying error (for example authentication_failed), then a result with subtype: "success" and is_error: true. Through 0.6.2 the facet closed the turn on the first frame and then closed it again on the second — turn.error followed by turn.done{outcome: success} on the same turnId — which breaks the rule that every turn closes exactly once. The reducer kept the last close, so the folded turn read as a success whose result was the error text.

We confirmed the sequence on the live wire with a deliberately invalid API key, and folded the same frames through both versions:

0.6.2   turn.error, turn.done{success}   →  folded: success, result "Failed to authenticate. API Error: 401 API key is invalid."
0.6.3   turn.error{authentication_failed, retriable: false}   →  folded: error

From 0.6.3 the assistant error frame no longer closes the turn; the result frame emits the single turn.error, and it now carries the result’s usage, so a long agentic turn that fails on its last round keeps the cost of the rounds before it. The same change removes a second double close: an assistant error followed by an error-subtype result used to emit turn.error twice. If a stream ends before its result frame, the turn still closes as turn.error at flush.

The same release also changes a second, rarer shape. A result that reports is_error: true with no assistant error frame before it was folded by 0.6.2 as a plain success; it now closes as turn.error too, with code api_error_code (or "api_error" when absent), retriable only for HTTP status 429 or 5xx.

Apart from these and the startup-failure change below, turns that do not end on an API error are byte-identical to 0.6.2.

Two consequences to check. The error close for these turns now arrives at the result frame, after ext.anthropic.result-meta, rather than at the assistant frame. And if you persist AgJSON streams: a stored 0.6.2-or-earlier stream in which one turnId has a turn.error followed by a turn.done is the two-frame case, its folded success is wrong, and the turn.error before it carries the real code. The rarer result-only case cannot be recovered from the AgJSON alone — it is a lone turn.done{success} whose result is the API error’s text.

Vercel AI SDK: denied tool calls reach their home, and one upstream shape changed

• ai 7.0.102 emits tool-output-denied inside the step when a tool approval is denied automatically. The facet used to pass it through as a raw frame; it now becomes tool.done{outcome: "denied"}, the event the spec defines for it.
• ai 7.0.108 changed what happens when a model violates toolChoice by calling a different tool: that tool is no longer executed, and the run ends as turn.error, now carrying its usage. The facet follows the new behaviour.

Neither path is reachable unless you use tool approvals or a forced toolChoice.

New models, live-verified

• Claude Opus 5.5 (claude-opus-5-5, GA 2026-09-22) needs @anthropic-ai/claude-agent-sdk 0.3.280 or later. Older versions still send the id to the API, but price it, set its default effort and report its model as Opus 5. Claude Opus 5 (claude-opus-5), GA since July, had no seed until now; it is also the model Claude Code falls back to after certain refusals, so its frames can appear in sessions that never asked for it.
• GPT-6 Sol and GPT-6 Luna (GA 2026-09-22) on both the OpenAI Agents SDK and the Vercel AI SDK. The Agents SDK has no model-specific settings for either, so both run at the API’s default reasoning effort, medium.

Thinking on Claude: set the display mode if you want summaries

With thinking.display unset, Claude Code (2.1.272 and 2.1.280 alike, on the first-party API) asks the API for between-tool narration only. No thinking summary reaches the stream: at most an empty reasoning.* block that carries only its signature, whichever model you use. That is upstream behaviour, not a facet change, but it explains an empty reasoning panel. To stream summaries, pass thinking: { type: "adaptive", display: "summarized" } to the Agent SDK. The corpus now carries a seed that does exactly that.

Signals that no longer fall on the floor

Additive — absent, every stream is byte-identical to 0.6.2 — except that a present startupFailureReason now also changes retriable, as described:

• Claude: api_error, api_error_params (whose remedy names the fix a host should offer) and api_error_code on the API-error frame; usage_report on /usage results; startupFailureReason in ext.anthropic.result-meta, which also marks the turn non-retriable unless the reason is one upstream calls retriable, so an auto-retry loop no longer spins on a failure that cannot clear; and decisionReasonCode on permission denials.
• Google ADK: Part.speechMetadata (new in @google/genai 2.24.0). Parts missing a field the genai types mark optional — inlineData without mimeType, code without code, a file without fileUri — now pass through verbatim instead of throwing or producing an invalid block.

@google/adk 2.1.0

The event and response types we normalize are unchanged, but the package’s dependencies grew. It adds dockerode as an optional dependency, which brings in ssh2 and cpu-features, both of which run install scripts: with pnpm’s strict build approval you will need to allow or deny them explicitly. Its @types/dockerode dependency also adds a second @types/node (18.x) to your type program, which matters only if you compile with skipLibCheck: false.

One ADK change we have not mapped yet: when a model calls a tool name that is not registered, ADK 2.1.0 now answers with a {error: "Function … is not found in the toolsDict."} function response instead of throwing, and the facet reports that tool call as outcome: "ok".

Known gap: OpenAI reasoning items

GPT-6 Sol is the first model in our OpenAI Agents SDK corpus that actually reasons on a simple prompt (the Agents SDK pins GPT-5.6 Sol to effort none and GPT-6 Astra to low, but runs Sol at the API default, medium), and it shows a limitation of @silverprotocol/openai-agents: reasoning items reach you as ext.openai.late-reasoning { itemId, encryptedContent } rather than as first-class reasoning.* blocks, because the Agents SDK announces them only after the response has closed. The encrypted content is the correct one to send back for stateless replay — OpenAI re-encrypts at each stage, and the facet carries the final blob.

Peers and security

• @anthropic-ai/claude-agent-sdk 0.3.280, @google/adk 2.1.0 with @google/genai 2.24.0, ai 7.0.111 with @ai-sdk/openai 4.0.72, and the openai client 7.22.0 under an unchanged @openai/agents 0.18.0.
• The @opentelemetry/core override is retired: @google/adk 2.1.0 moved to exporters that already require a patched version. The adm-zip 0.6.1 floor stays, because @google/adk 2.1.0 still asks for 0.5.x; 0.6.1 also fixes a third advisory published since 0.6.2. Neither package is a runtime dependency of any @silverprotocol package.

The compatibility tables on each npm page carry the dated evidence.

Fixed: a failed OpenAI response could close as a successful turn

@silverprotocol/openai-agents declared the response.completed event’s status as "completed" | "incomplete". The wire is wider than that: openai-node types ResponseStatus as completed, failed, in_progress, cancelled, queued or incomplete, and a response.completed event carries a whole Response object, status included. A response that reported status: "failed" or "cancelled" therefore fell past every error branch and closed the turn as turn.done with outcome: {type: "success"}.

From 0.6.2 an unsuccessful terminal status closes as turn.error, carrying the status as the error code. The branch sits last, so refusal, content_filter and response.incomplete keep their exact prior precedence and output; a response.completed with an absent or "completed" status is byte-identical to 0.6.1. One refinement beyond the literal fix: if a producer sends the self-contradictory combination of status: "incomplete" and an incomplete_details.reason, the sharper reason wins, so code reads the same as it would have from a correctly-labelled response.incomplete.

This is worth an explicit check if you persist turn outcomes. @openai/agents 0.17.1 began rejecting unsuccessful terminal states upstream, but it forwards the raw event to normalizers before it throws — so on 0.6.1 and earlier the success close was already emitted by the time the run aborted. Rows written by an older version cannot be repaired from the AgJSON alone; the status only survives in the provider-raw payload.

Four upstream signals that no longer fall on the floor

• narration_block_indexes (Claude Agent SDK 0.3.272) names which of a frame’s content blocks are user-facing narration rather than private reasoning — the progress updates Anthropic’s thinking.display: "updates" mode returns between tool calls. Without it a client cannot tell a thinking block meant to be shown from one usually hidden, so it rides the block’s providerMetadata verbatim. It appears in no SDK type declaration; only a live capture surfaced it.
• resume_reason (0.3.268) says why a turn is the automatic re-run of one a worker restart interrupted. On such a re-run user_message_uuid names the interrupted turn’s prompt, so without this a consumer cannot distinguish the re-run’s first reply from the original attempt’s. It joins user_message_uuid and user_message_uuids as the third leg of one turn-binding family, on the same channels under the same once-per-message rule.
• resultIndex (from result_index, 0.3.268) is the delivery sequence of a result within a run. A result whose write fails still consumes its number, so a gap in the sequence is how you detect a result that was lost in transit. It rides ext.anthropic.result-meta beside queuedTurnCount.
• localCommand (from local_command, 0.3.268) marks a turn that ran a slash command without entering the model loop. Its presence is the signal — it is the only thing separating that from an empty turn. Note the value is coarse by design upstream: every user, project or third-party command reports custom, and every MCP command reports mcp.

@openai/agents 0.18.0’s new toolSearchAgentName is carried on the tool lifecycle alongside the existing executionStatus. All five are additive: absent, every stream is byte-identical to 0.6.1.

Errored Vercel turns now report the tokens they burned

ai 7.0.94 made streamText enforce toolChoice, closing a violating run as finish{finishReason: "error"} with totalUsage populated. The facet’s error close discarded that usage even though AgTurnError has a usage slot the OpenAI facet already fills. It now forwards it through the same mapper the success close uses. Absent usage stays absent.

@openai/agents 0.18.0 is in range

The declared peer range moves from >=0.2.0 <0.18 to >=0.2.0 <0.19, so installing the current @openai/agents beside this facet no longer produces an npm peer warning. The typed streaming surface is unchanged across the whole 0.17.0 → 0.18.0 span: identical event and result declarations, identical stream-event and protocol-item inventories. 0.18.0’s headline changes — Docker file APIs moving inside the container, sandbox file-I/O protection, image-generation actions — are all off the path this facet normalizes.

Peer sweep and security

• @anthropic-ai/claude-agent-sdk 0.3.261 → 0.3.272 (nine published versions). The SDKAssistantMessageError union widened to include verification_required and cloud_credential_error; both are non-retriable, which is what the facet already reported, now recorded deliberately rather than by omission. All six Claude seeds were re-captured.
• ai 7.0.100 with @ai-sdk/openai 4.0.66 and @ai-sdk/mcp 2.0.49; @google/genai 2.22.0 with @google/adk unchanged at 2.0.0. Both Vercel and both OpenAI seeds re-captured.
• adm-zip 0.6.1. A medium-severity advisory (CVE-2026-76845) covers every published version through 0.6.0: archive extraction followed symlinks in the destination, allowing writes outside it. 0.6.1 adds the guard and fixes six further issues. It reaches this workspace only as a transitive of @google/adk’s skills loader and is not a runtime dependency of any published @silverprotocol package, so no consumer was exposed through us — but the floor is now pinned so it cannot regress.

Also

The site’s spec badge had been serving 1.0.0-draft.1 since 0.5.0 — two revisions stale — because the shields URL escapes the hyphen and no search for the plain string ever matched it. The version is now generated from the SDK’s AGJSON_VERSION and checked by the same gate that guards the compatibility tables, as is the machine-readable peer list in llms.txt.

The compatibility tables on each npm page carry the dated evidence.

Gemini 3.8 Flash — verified, and now the ADK capture default

gemini-3.8-flash went GA on 2026-09-02 with the same thinking knob and the same price as 3.7. The corpus carries a live trio for it (echo, MCP Apps card, thinking with thought summaries and signatures), captured through the unchanged @silverprotocol/google-adk facet on the unchanged @google/adk 2.0.0 peer, with @google/genai 2.21.0, whose only change is the new model id. The census found nothing new on the wire, and the token identity from draft.3 holds on every event. The e2e capture default for ADK moves to 3.8; consumers do not need to change anything.

GPT-6 Astra — captured on both OpenAI paths

gpt-6-astra (2026-09-03) reasons on every request, rejects temperature/top_p, and offers no dated snapshot. It is now a standing seed on both @silverprotocol/openai-agents (via @openai/agents 0.17.0 with the openai client at 7.10.0) and @silverprotocol/vercel-ai (ai 7.0.93). Neither facet needed a code change, and neither capture path sends the rejected parameters: the Vercel provider strips temperature/top_p for reasoning models, while the Agents SDK forwards whatever you set, so do not set them for Astra. What the captures showed:

• The Vercel path streams a reasoning item with no text, normalized to reasoning.start/reasoning.end, and 13 reasoning tokens (the raw wire also echoes reasoningContext: "all_turns"); the Agents SDK path chose not to reason for the echo.
• OpenAI stamps a new response-level attribute, access_programs.cyber, on every Astra response. It is program-tier metadata, not turn content, and is treated like service_tier.
• The capture default for the OpenAI family stays gpt-5.6-sol for now (Astra lists at $10/$50 per MTok against Sol’s $4/$20 and cannot stop reasoning; the choice is with the founder).

One new lossless carry: misalignment errors

openai-node 7.10.0 adds error.misalignment (error_type, detailed_explanation, and a steer.message continuation instruction) beside the misalignment_policy_violation code on response.failed. The openai-agents facet now emits it verbatim as a turn-scoped ext.openai.misalignment event immediately before the turn.error it annotates — a safety classification a host should be able to show. Absent, nothing changes. The documented auto-stop only fires on persisted-reasoning, WebSocket, or compaction requests, so this is synthetic-tested.

Peer sweep

• @anthropic-ai/claude-agent-sdk 0.3.261: user_message_uuids (every client uuid a merged or queued turn answered) now rides the same three channels as user_message_uuid; a few remote-session latency fields are recognised as router-plane. All six Claude seeds were refreshed at 0.3.261 with a clean census.
• ai 7.0.93 trio: typed surface byte-identical; usage.raw now carries the provider’s complete usage object.
• Toolchain: Vitest 5 (note for contributors: runs from packages/e2e must pass --config ../../vitest.config.ts; pnpm e2e:capture does), astro 7.3.1 on the site.

The compatibility tables on each npm page carry the dated evidence.

Breaking for Gemini / ADK consumers: usage.outputTokens includes reasoning

Spec 1.0.0-draft.3 defines AgUsage.outputTokens as every token the provider generated, including reasoning, with reasoningTokens a breakdown of it. That is the convention Anthropic and OpenAI already document (“billed as output tokens”), the one the OpenTelemetry GenAI conventions prescribe, and the one the Vercel AI SDK, LangChain, Pydantic AI and LiteLLM all normalize Gemini to. Until now @silverprotocol/google-adk copied Gemini’s candidatesTokenCount, which excludes thoughts — so outputTokens meant “billable output” on three frameworks and “visible text” on the fourth, and no consumer could tell which.

From 0.6.0 the adk facet folds thoughtsTokenCount into outputTokens, guarded by Gemini’s own total so an endpoint that already reports candidates inclusively is never double-added. On a thinking turn turn.done.usage.outputTokens rises by exactly reasoningTokens:

echo-gemini35     31 → 156   (394 + 156 == 550)
thinking-gemini37 29 → 152
tool-error        35 → 212

inputTokens, reasoningTokens and totalTokens are unchanged, and inputTokens + outputTokens + (toolUseInputTokens ?? 0) == totalTokens now holds on Gemini as it already did on OpenAI and Vercel. Claude, OpenAI and Vercel usage is byte-identical. Two correct ways to read the fields, everywhere:

• All generated tokens, what you are billed for at the output rate: outputTokens.
• Visible text only: outputTokens − reasoningTokens (approximate on Anthropic, whose thinking_tokens is a re-tokenization estimate).

Repairing persisted rows produced by earlier versions: a Gemini row is pre-0.6.0 exactly when totalTokens − inputTokens − outputTokens − (toolUseInputTokens ?? 0) == reasoningTokens > 0; add reasoningTokens to outputTokens for those rows. Claude, OpenAI and Vercel rows need no change.

Correction to the 0.5.4 claude facet documentation: its source comments stated that the adk facet already followed the subset convention. It did not; 0.6.0 makes the statement true. (The 0.5.4 release note itself spoke only about Claude and was accurate.)

Known gap: @google/adk’s Interactions-API route (useInteractionsApi) synthesizes usage without thoughts upstream, so on that route reasoningTokens is absent and outputTokens stays exclusive. An upstream issue is being filed against google/adk-js.

Wire version

AGJSON_VERSION is now 1.0.0-draft.3. Draft.2 inputs remain accepted (same major). Unlike draft.2, draft.3 is not byte-identical for Gemini/ADK producers, as described above; no field shapes changed, and the spec is explicit that the input side (inputTokens versus cache counters) is out of scope for this revision. A conformance identity joins §10 and the replay suite now asserts it on every golden that reports a total.

The compatibility tables on each npm page carry the dated evidence.

Claude Fable 5.1 captured — thinking you can count but not read

claude-fable-5-1 went GA on 2026-09-01 and the corpus now carries a live seed trio for it (echo, streamed partials, two ordered tool calls), captured through @anthropic-ai/claude-agent-sdk 0.3.258 — the first SDK build whose Claude Code knows the model id. Fable thinks on every turn but, by default, does not show its reasoning text. Three things change for a consumer as a result:

• usage.reasoningTokens is now populated for Claude, per turn and per model (usage.byModel[model].reasoningTokens). It is a subset of outputTokens — do not add the two. This closes a gap where the facet had been discarding the Agent SDK’s thinking-token telemetry as a constant zero.
• reasoning.delta may arrive with an empty delta and providerMetadata.estimated_tokens (a number, or null before the first estimate). That is the whole payload when reasoning text is withheld; render it as progress. @silverprotocol/core’s StreamAssembler.reasoningDelta gained the optional providerMetadata slot to make this possible (additive).
• ext.anthropic.frame now carries kind: "thinking_tokens" frames — Claude Code’s running estimate while the model thinks, the only live signal a host gets before the first visible token.

The result-frame extension also grows: ext.anthropic.result-meta gains per-model costBasis (list / managed / unknown — which price table costUsd was computed from, now that Claude Code applies managed rates and a US-only-inference multiplier), userMessageUuid, queuedTurnCount, and the CLI’s subagentStats tally. MCP tools that return resource_link blocks land those on tool.done providerMetadata.resourceLinks.

// A Fable 5.1 reasoning stream with display omitted:
{ type: "reasoning.start", id: "msg_…:reasoning:0" }
{ type: "reasoning.delta", id: "…", delta: "", providerMetadata: { estimated_tokens: 50 } }
{ type: "reasoning.end",   id: "…" }
{ type: "reasoning.opaque", id: "…", kind: "signature", value: "CAQS…" }

The default capture model stays claude-sonnet-5; Fable is a named seed family, not the default.

Google ADK 2.x supported

@google/adk 2.0.0 landed outside the declared range (typescript-sdk#22). The major rewrites the agent-graph plane (workflow engine, BaseAgent extends BaseNode, LLMAgentWrapper removed) and leaves the event wire additive-only: four optional workflow-plane fields on Event and an object-valued actions.agentState, all carried in the event-level provider-raw ledger and never present on a plain LlmAgent run. @google/genai 2.20.0 adds one Part field (mediaProcessing), carried beside mediaResolution. The peer range widens to >=1.0.0 <3; the gemini-3.7-flash trio was re-captured live at 2.0.0 with a clean census.

One thing to know if you use MCPToolset: ADK 2.0 made @modelcontextprotocol/sdk an optional peer loaded lazily at connect time. Install it yourself alongside @google/adk.

Vercel AI SDK 7.0.90 — errors carry their code

The ai 7.0.90 trio (@ai-sdk/openai 4.0.56, @ai-sdk/mcp 2.0.43) leaves the typed stream surface byte-identical. Since 7.0.80 the SDK wraps provider mid-stream errors in a StreamProviderError; the facet now populates error.code and error.retriable (and the same fields on turn.error) from it. retriable may be inferred by the SDK from the HTTP status rather than asserted by the provider.

Dependency sweep

Development-only Dependabot alerts across both lockfiles were cleared: ADK 2.0’s optional peers dropped the mikro-orm / sqlite3 / tar subtree, the test runner moved to Vitest 4, and three transitive pins that upstream still holds below the patched release are overridden (adm-zip, @opentelemetry/core, uuid). None of these were reachable from the published packages, which depend only on zod. The workspace also moved to pnpm 11.25.0, which restores README metadata on pnpm publish — from this cohort on, the npm package pages render their READMEs.

The compatibility tables on each npm page carry the dated evidence.

@silverprotocol/richtext learns tables

Agents fall back to markdown pipe tables whenever a result is tabular, and until now the rich-text AST deliberately parsed them as literal text — the honest fail-safe, but a chat bubble full of | # | Task | is not what anyone wanted (typescript-sdk#23, from a docs capture pass on a downstream chat kit). The block vocabulary gains a table node covering the GFM pipe-table subset: a header row, a delimiter row that supplies per-column alignment, and body rows of inline content.

parseRichText("| # | Task |\n|:-:|------|\n| 1 | **Ship** it |");
// [{ type: "table", align: ["center", undefined], header: { cells: […] }, rows: [{ cells: […] }] }]

The header fixes the column count and every row has exactly that many cells — short rows are padded with empty cells, long rows drop the excess, which is GFM’s rule and what every renderer the model was trained against already does. Outer pipes are optional, \| is the cell-pipe escape (it works inside code spans), and cells carry inline content only, through the same parser and the same safety policy: raw HTML stays literal text, unsafe link targets get no href. The streaming contract holds: the delimiter row has to complete before the table forms, so a renderer sees a paragraph flip once into a table and never flap back; body rows then grow in place.

This is an additive union member. A host that switches exhaustively on block.type should add a table arm in the same change that bumps the package — TypeScript will not force the issue when the switch returns ReactNode, and a missing arm renders a table as nothing.

OpenAI Agents 0.17 supported

@openai/agents 0.17.0 landed outside the declared peer range (typescript-sdk#24). All seven agents-core wire files the facet consumes are byte-identical to 0.16.0, and the provider package’s only change is websocket replay-safety bookkeeping — a wire no-op. The range widens to >=0.2.0 <0.18.

The live capture that accompanies the widening earned its keep: the census caught a wrapper-level field the type inventory cannot see. Since agents-core 0.15.0, RunToolCallOutputItem.executionStatus is "executed" when the runner actually invoked a function tool and absent when the result was synthesized instead — an input-guardrail rejection, a cancellation, a refused approval. The facet now carries it verbatim on tool.done providerMetadata, beside the existing caller carry, so a consumer can tell a tool’s own result from a runner substitute.

The compatibility tables on each npm page carry the dated evidence.

createClaudeNormalizer({ threadId })

The Claude Agent SDK wire has no thread concept — only session_id — so the claude facet has always relabeled that id as the AgJSON threadId, a placeholder in the same spirit as the openai/vercel facets’ fixed labels. That placeholder is fine for self-contained streams, but it leaks: a consumer that persists events verbatim under its own thread identity ends up with mid-stream rows keyed by the SDK’s session id while its session records carry the real thread id (guuey#415, where the mismatch confounded an identity investigation).

The factory now accepts an options object with threadId: the runtime that owns the real partition root stamps it at construction, and every emitted entity — messages, synthesized turn.starts, notice rows, denial records — carries one id everywhere. Per SPEC §3, threadId is the partition root a key-value persistence layer writes by; the layer that owns that identity is the caller, not the wire.

Absent the option, the legacy session_id relabeling stands unchanged — recorded cassettes and existing consumers are byte-identical. Synthesized turn ids continue to embed the session id as opaque identifiers; that is deliberate and not part of this change.

Corpus: the gemini-3.7-flash validation trio

Three new live cassettes, captured at @google/adk 1.6.0 and enrolled as CI replay seeds in the same change: echo-gemini37 (tool loop), app-spec-gemini37 (re-attesting the MCP-Apps structuredContent/_meta.ui carry that only a live capture caught last generation), and thinking-gemini37 — the corpus’s first real Gemini thought: true capture. Until now the adapter’s reasoning path was attested only by synthetic frames: 3.7 returns no thought summaries by default, so the harness grew a per-scenario thinkingLevel knob (low/medium/high, 3.7’s set) that maps to thinkingConfig { includeThoughts, thinkingLevel } on the ADK agent. The capture yields real thought parts with signatures, normalized to reasoning.start/delta/end plus the signature’s reasoning.opaque carry. Census came back clean — no unknown 3.7 wire fields; the one new triage is the thought boolean itself, a structurally-consumed flag under the same rule as partial.

Finish reasons: the genai 2.16 tool-call pair, mapped and lossless

The SDK generation 3.7 launched with declares two finish reasons the adapter didn’t map: UNEXPECTED_TOOL_CALL now lands on its exact AgJSON home (unexpected_tool_call, in the superset since draft.1), and TOO_MANY_TOOL_CALLS maps to other pending a spec-process decision on first-class standing. More importantly, lossy mappings no longer discard the wire string: any finish reason that maps inexactly (the unknown arm included) is carried in message.metadata before the message seals — rawFinishReason, the same channel and key the vercel-ai facet already uses, or rawErrorCode when the wire field was actually a block reason. Exact mappings emit nothing, so existing streams are byte-identical.

Defaults and evidence

DEFAULT_MODEL for adk captures bumps to gemini-3.7-flash per the corpus-verified policy; the google-adk evidence log and the generated compatibility tables record the day-6 validation. No dependency changes were needed — @google/adk 1.6.0 with @google/genai 2.17.x already covers the model.

Grant modes — scope-qualified consent (§7)

Real permission systems answer “yes” with a scope: always, this chat only, just once. hitl.ask (and its persisted AgPausedAsk record) can now declare grantModes — the accept variants the asker offers — and the answer echoes exactly one as AgHitlAnswer.grantModeId. The design is strictly asker-declared: ids are opaque, AgJSON hard-codes nobody’s mode set, and declining stays the universal affordance outside the declaration (a renderer can always show refusal without consulting it). Anchored on the Claude Agent SDK’s PermissionUpdate.destination scopes and the OpenAI Agents alwaysApprove/alwaysReject options; frameworks with binary confirmation (ADK) simply don’t declare, which is the valid absent case.

Enforcement ships with the shape: grantModeId on a non-resolved answer rejects at parse, and the new validateHitlAnswer(ask, answer) checks the cross-object contract (required-iff-declared, echo-must-be-declared, plus the pre-existing requestState byte-echo rule) against the fold’s own paused-ask record. Clients advertise support via the hitl.grantModes capability flag.

The notice role — a first-class home for transcript annotations (§3)

AgRole gains "notice": a persisted, non-conversational transcript row for host banners, adapter annotations, and framework notices — with noticeSource: host | adapter | framework naming the layer that injected it. A notice is never replayed to the model, never merges into assistant content, and never renders as agent-authored. The admission test is deliberately narrow (persisted + user-facing + non-conversational); ephemeral status chatter stays in vendor carries.

The Claude normalizer ships the first producer: SDKInformationalMessage frames (transcript notices, halt explanations) are promoted from their vendor-extension carry to full notice messages — and now carry tool_use_id, which the old route dropped.

Wire version

AGJSON_VERSION is now 1.0.0-draft.2. Draft.1 inputs remain accepted (same major); consumers pinning 0.4.x should bump to parse streams that use the new vocabulary.

OpenAI Agents 0.16 supported

@openai/agents 0.16.0 landed four days after 0.15.0, again outside our declared peer range. The study came back as clean as it gets: both consumed wire files are byte-identical to 0.15.0 (run-item event names, protocol items, and the full literal inventory all zero-delta) — the minor is internal to agent/handoff/runner plumbing. The range widens to >=0.2.0 <0.17 and the npm peer warning disappears.

Verification refresh

• Claude Agent SDK 0.3.233 — SDKMessage union unchanged (39 members); the only stream-wire addition is the context_usage sibling carried above.
• genai 2.17.1 (under ADK 1.6.0) — the Part surface is byte-identical.
• Vercel AI 7.0.66 with the aligned @ai-sdk/mcp 2.0.32 / @ai-sdk/openai 4.0.42 trio — provider-utils pin unchanged at 5.0.27, both patches crossed the nightly’s family-forced leg silently.

The compatibility tables on each npm page carry the dated evidence.

Verification refresh

The whole peer matrix moved and re-verified as wire no-ops:

• Claude Agent SDK 0.3.229 — SDKMessage union unchanged across three patches.
• genai 2.17.0 (under ADK 1.6.0) — the Part surface is zero-delta; the minor is elsewhere.
• Vercel AI 7.0.64 with the aligned @ai-sdk/mcp 2.0.31 / @ai-sdk/openai 4.0.41 trio — six upstream patches absorbed with zero compatibility incidents, courtesy of the nightly’s lockstep-aware verification.

No behavior changes; the compatibility tables on each npm page carry the dated evidence.

• The replay-load-bearing encrypted_content blob rides the block’s ciphertext opaque (provider: "openai"), mirroring the Claude mapping exactly.
• Previously these items fell through to the lossless ext.openai.unparsed channel — nothing was dropped, but nothing converged either.

Verification refresh

Every facet’s compatibility table on npm now carries the week’s evidence: Claude Agent SDK 0.3.226 (five patches, wire-no-op — SDKMessage union verified unchanged), OpenAI Agents 0.14.3, Google ADK 1.6.0 + genai 2.16.0 (full d.ts inventory diff: Part/Event/LlmResponse all zero-delta), and the Vercel AI 7.0.58 provider-utils-aligned trio.

_meta-only payloads are exactly the generative-UI bootstraps (canonical MCP-Apps _meta.ui, A2UI render descriptors). Before this release the facet stamped them onto tool.done events and the fold silently discarded them, so a folded consumer couldn’t mount cards from AgReduceResult without a repair wrapper. Now:

• CREATE spreads _meta onto the new tool-result block, mirroring the text.start/reasoning.start precedent.
• MERGE assigns it guarded, so a preliminary (more: true) result’s bootstrap survives a final replace that omits its own — and a final carrying its own overwrites.

If you carried a sidecar to re-attach _meta after folding, it collapses to new Reducer().

Agents emit markdown in chat (**bold**, lists, headings); every host needs the same answer to “what does this text mean to a renderer”. This package owns that seam and nothing more:

• Typed AST for the conversational subset — paragraphs (explicit break nodes; chat prose stays line-broken), headings, fenced code, flat lists, strong/em/inline code/links, backslash escapes.
• The safety policy lives here, once. No HTML node type exists — markup in model output can only ever be literal text. Link href populates only for http/https/mailto; everything else parses as a link with href: undefined.
• Streaming-tolerant by design. Every prefix parses; **bol yields {type: "strong", closed: false} that completes in place; completed constructs never reshape on re-parse. Built for token deltas (see 0.3.11).
• Zero dependencies, zero components — you map the AST onto your own renderers.

The 0.x minor signals the feature moment: token streaming (0.3.11) plus the new package. Rendering stays host business; the AST is the contract.

const response = query({ prompt, options: { includePartialMessages: true } });

No other change needed:

• The complete assistant message the SDK still emits after partials is deduplicated automatically — reducer state after partials + suppressed-complete is provably identical to the complete-only fold (pinned by test).
• Streams without partials produce byte-identical output to previous releases.
• Time-to-first-token rides message.metadata as ttft_ms.
• Census-caught bonus: the SDK’s system/status frames ("requesting", …) are now carried via ext.anthropic.frame — wire-level input for agent-status UI.

Verified live, not just synthetically: a new corpus seed (partials-sonnet5) captured the real interleaving — complete frames landing mid-stream, tool results binding before message_stop — and the mapping handles all of it.

• Google ADK 1.5.0 + genai 2.15.0: the new Part.audioTranscription field is carried whole via provider-raw (nothing silently dropped when native-audio models transcribe), and CompactedEvent gains a projection + event-level provider-raw ledger for session-replay tolerance.
• Vercel AI 7.0.51: empty text-deltas carrying a providerMetadata bag now emit text.delta with the first-class metadata slot — the Reducer merges it onto the sealed block. Scoped to empty deltas so existing output stays byte-identical.
• The ai/@ai-sdk/mcp lockstep repair: both pin @ai-sdk/provider-utils exactly; mismatched pairs install duplicate copies whose unique-symbol-branded Schema breaks typecheck. This cohort aligned the pairing and documented the ladder — the compatibility tables now record which combinations are verified.
• Claude Agent SDK 0.3.221 and OpenAI Agents 0.14.2 verified as wire no-ops.

Now the message lifecycle is keyed on the SDK’s own message.id with a deferred seal: one message.start/message.end pair per id, block indices continuing across frames, the close riding the next fold-binding frame. A defensive path handles the pathological orderings (:cont: derived carriers — sealed ids are never re-opened, ever).

And so this class of bug can’t return: corpus-wide INV-MSG fold gates now run in CI — every cassette, every facet, folded through the normative Reducer, asserting no re-opens and no parking.

• Claude result-frame enrichment: fast_mode_disabled_reason and per-model canonicalModel/provider identity (billing rate-table selection) now ride a structured ext.anthropic.result-meta event before the turn close.
• OpenAI programmatic tool calling: the 0.14.0 program/program_output arms map to the builtin-tool lifecycle, and the live capture revealed final-round message_output_created arriving after response_done — the phase annotation now rides a dedicated ext.openai.late-phase event on that path.
• Registry/transforms grew accordingly, including the first production use of {*} dynamic-key wildcards for per-model usage paths.

• resumed_from_incomplete_thinking — replay-load-bearing per the SDK’s own docs: this turn continued a truncated prior turn inside its trailing signed thinking block. A replayed history must carry the flag back; it now rides the first-block providerMetadata carrier.
• aborted — the interrupt-truncation signal (no stop_reason ever arrives; content may end mid-word). Without it a truncated frame folds indistinguishably from a complete one. Block-less aborted frames fall back to message.metadata.

• 0.1.0 (2026-07-06): first publish — @silverprotocol/core (the typed AgEvent schema, Normalizer interface, and normative reduce()) plus the Claude Agent SDK, OpenAI Agents, and Google ADK facets.
• 0.2.x (2026-07-07): packaging polish — self-contained READMEs on npm, install docs.
• 0.3.0 (2026-07-07): the Google ADK facet retargeted from the community @iqai/adk to the official @google/adk — shipped as a minor, with the hand-typed projection discipline that still guards that facet today.
• 0.3.3 (2026-07-13): first release shipped through the public mirror’s OIDC trusted-publishing pipeline — provenance attestations on every package since.