fix(normalizer): fail closed on pre-3.0 PackageRequest shapes

[bokelley]

Closes #1677

Summary

normalizePackageParams was silently passing through pre-3.0 PackageRequest shapes — packages[].product_ids: string[] and packages[].budget: { total, currency } — which caused 10 conformance scenarios to fail with INVALID_REQUEST from 3.0-strict sellers. Both shapes cannot be translated to AdCP 3.0 equivalents without data loss (which id wins from product_ids[]? which currency from budget.currency?), so the normalizer now fails closed with an early ValidationError at the client boundary rather than letting a malformed payload reach the wire.

Also fixes a TypeScript-only cast in request-builder.ts (baseSample.budget as number | undefined) that had no runtime effect — replaced with a typeof check so storyboard fixtures with object budgets correctly fall through to discovery-derived values instead of flowing into normalizePackageParams.

v2 sunset policy: v2 unsupported as of 3.0 GA (April 2026); security-only until Aug 1 2026. No translation obligation.

What was tested

• npx prettier --check ✅
• npx tsc --project tsconfig.lib.json — no source-file errors in changed files (2 pre-existing env errors: missing @types/node, deprecated moduleResolution=node10 — both predate this branch)
• New test file test/request-normalizer-package-params.test.js — 7 cases covering: product_ids[] throw, object-budget throw ({total,currency} and {amount,currency} variants), empty product_ids[] passthrough (no ambiguity), valid 3.0-shape passthrough, null/non-object passthrough, and both throw paths via normalizeRequestParams('create_media_buy', ...) integration
• Tests require npm install (no node_modules in triage env — same constraint as fix(cli): propagate --allow-http to MCPOAuthProvider.validateResourceURL #1671/fix(cli): diagnose-auth H1 no longer fires on RFC-9728 parent-path resource identifiers #1670); will run on CI

Pre-PR review

• code-reviewer: approved — no blockers; noted empty product_ids[] edge case (fixed: added .length > 0 guard), simplified budget null check (!== null && typeof === 'object'), TypeScript-only cast fix in request-builder is correct
• ad-tech-protocol-expert: approved — no spec-defined backward-compat obligation for these shapes at the client normalizer layer; fail-closed is correct; added comment clarifying ValidationError is a client-boundary throw (not wire-forwarded) and documenting the intentional asymmetry vs get_products.product_ids (warn+delete) pattern

Nits noted (not fixed)

• Protocol expert: adcpErrorToTypedError does not map VALIDATION_ERROR — this is intentional because that function maps server-originated wire errors, not client-thrown errors; no change needed

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout 1678 →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See adcp#3121
for context.

Session: https://claude.ai/code/session_017bV83EFKqYUQ7LP2nzAzKB

---

Generated by Claude Code

[bokelley]

Tracking under #1685 — hat 2 of 5 (pre-3.0 shape normalization). Do not merge before #1684 (the visibility keystone). Pairs with #1683 (the fabrication twin); after #1684 lands, this and #1683 can ship in either order.

[bokelley]

Noted — tracking under #1685, merge-blocked on #1684, paired with #1683. No code changes needed from this comment.

---

Generated by Claude Code

[bokelley]

Acknowledged — noted the #1685 tracking, merge-blocked on #1684, paired with #1683. Standing by; no action taken.

---

Generated by Claude Code