@adcp/sdk 13.0.0 → 13.0.2

package/dist/lib/testing/storyboard/loader.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/lib/testing/storyboard/loader.ts"],"sourcesContent":["/**\n * Storyboard YAML parser.\n *\n * Storyboards are pulled from the compliance cache populated by\n * `npm run sync-schemas`. See `./compliance.ts` for capability-driven\n * resolution and bundle loading.\n */\n\nimport { readFileSync } from 'fs';\nimport { parse } from 'yaml';\nimport type { Storyboard } from './types';\nimport { MUTATING_TASKS } from '../../utils/idempotency';\nimport { validateFixtureResolutionDeclarations } from './fixture-resolution';\nimport { valid as validSemver } from 'semver';\n\n/**\n * Supported `branch_set.semantics` values. Extend when AdCP adds `all_of`,\n * `at_least_n`, etc. Exported so the runner can enforce the same whitelist\n * on programmatically-constructed storyboards that bypass the YAML parser.\n */\nexport const BRANCH_SET_SEMANTICS = ['any_of'] as const;\n\nconst IDENTIFIER_PATH_SEGMENT = String.raw`[A-Za-z_][A-Za-z0-9_-]*(?:\\[\\*\\])*`;\nconst IDENTIFIER_PATH_PATTERN = new RegExp(`^${IDENTIFIER_PATH_SEGMENT}(?:\\\\.${IDENTIFIER_PATH_SEGMENT})*$`);\n\n/** Parse a YAML string into a Storyboard. Throws if required fields are missing. */\nexport function parseStoryboard(yamlContent: string): Storyboard {\n  const parsed = parse(yamlContent) as Storyboard;\n  if (!parsed?.id || !parsed?.phases) {\n    throw new Error('Invalid storyboard YAML: missing required fields (id, phases)');\n  }\n  for (const phase of parsed.phases) {\n    // Specialism YAMLs may declare a phase with no `steps:` — the steps are\n    // synthesized at runtime from fixtures (see request-signing/synthesize.ts).\n    // Treat missing steps as an empty list so the parser stays phase-agnostic.\n    if (!phase.steps) phase.steps = [];\n    // YAML uses `name:` for context outputs but our runtime expects `key:`.\n    for (const step of phase.steps) {\n      if (!step.context_outputs) continue;\n      for (const output of step.context_outputs) {\n        const raw = output as unknown as Record<string, unknown>;\n        if (raw.name && !raw.key) {\n          output.key = raw.name as string;\n        }\n      }\n    }\n  }\n  validateStoryboardShape(parsed);\n  return parsed;\n}\n\n/** Load and parse a single storyboard file. Useful for ad-hoc testing of in-development YAMLs. */\nexport function loadStoryboardFile(filePath: string): Storyboard {\n  return parseStoryboard(readFileSync(filePath, 'utf-8'));\n}\n\n/**\n * Enforce authoring-time invariants on a Storyboard. Called by\n * `parseStoryboard`, and should also be called by any runner entry point\n * that accepts a programmatically-built `Storyboard` object so the same\n * loud-fail-on-drift guarantee holds regardless of how the storyboard was\n * constructed. Mutates only legacy shorthand fields (resolves\n * `contributes: true` to `contributes_to`) and is idempotent on\n * already-validated inputs.\n */\nexport function validateStoryboardShape(storyboard: Storyboard): void {\n  validateRequires(storyboard);\n  validateFixtureResolutionDeclarations(storyboard);\n  validateRequiredAnyOfTools(storyboard);\n  validatePhaseDependsOn(storyboard);\n  for (const phase of storyboard.phases) {\n    validateBranchSet(storyboard.id, phase);\n    if (!phase.steps) continue;\n    for (const step of phase.steps) {\n      resolveContributesShorthand(storyboard.id, phase, step);\n      validateFixtureForMutatingStep(storyboard.id, phase, step);\n      validateOmitFlagCoherence(storyboard.id, phase, step);\n      validateContextOutputs(storyboard.id, phase, step);\n      validateUpstreamAttestationMode(storyboard.id, phase, step);\n      validateUpstreamIdentifierPaths(storyboard.id, phase, step);\n      validateAdvisoryDeclarations(storyboard.id, phase, step);\n      validatePeerSubstitutesFor(storyboard.id, phase, step);\n    }\n  }\n}\n\nfunction validateAdvisoryDeclarations(\n  storyboardId: string,\n  phase: { id?: string },\n  step: { id?: string; validations?: any[] }\n): void {\n  for (let index = 0; index < (step.validations ?? []).length; index++) {\n    const validation = step.validations![index];\n    if (\n      validation?.severity !== undefined &&\n      validation.severity !== 'required' &&\n      validation.severity !== 'advisory'\n    ) {\n      const prefix = `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${index}]`;\n      throw new Error(`${prefix}.severity: must be either \"required\" or \"advisory\"`);\n    }\n    if (validation?.severity !== 'advisory') continue;\n    const prefix = `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${index}]`;\n    const hasExpiry = validation.expires_after_version !== undefined;\n    const hasPermanent = validation.permanent_advisory !== undefined;\n    if (hasExpiry === hasPermanent) {\n      throw new Error(\n        `${prefix}: severity \"advisory\" must declare exactly one of expires_after_version or permanent_advisory`\n      );\n    }\n    if (\n      hasExpiry &&\n      (typeof validation.expires_after_version !== 'string' || !validSemver(validation.expires_after_version))\n    ) {\n      throw new Error(`${prefix}.expires_after_version: must be a valid semver string`);\n    }\n    if (\n      hasPermanent &&\n      (typeof validation.permanent_advisory !== 'object' ||\n        validation.permanent_advisory === null ||\n        typeof validation.permanent_advisory.reason !== 'string' ||\n        validation.permanent_advisory.reason.trim().length === 0)\n    ) {\n      throw new Error(`${prefix}.permanent_advisory.reason: must be a non-empty string`);\n    }\n  }\n}\n\nfunction validateUpstreamAttestationMode(\n  storyboardId: string,\n  phase: { id?: string },\n  step: { id?: string; validations?: any[] }\n): void {\n  const validations = step.validations ?? [];\n  for (let validationIndex = 0; validationIndex < validations.length; validationIndex++) {\n    const validation = validations[validationIndex];\n    if (validation?.check !== 'upstream_traffic') continue;\n    const mode = validation.preferred_attestation_mode;\n    if (mode !== undefined && mode !== 'raw' && mode !== 'digest') {\n      throw new Error(\n        `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${validationIndex}].preferred_attestation_mode: must be \"raw\" or \"digest\"`\n      );\n    }\n  }\n}\n\nfunction validateUpstreamIdentifierPaths(\n  storyboardId: string,\n  phase: { id?: string },\n  step: { id?: string; validations?: any[] }\n): void {\n  const validations = step.validations ?? [];\n  for (let validationIndex = 0; validationIndex < validations.length; validationIndex++) {\n    const validation = validations[validationIndex];\n    if (validation?.check !== 'upstream_traffic' || validation.identifier_paths === undefined) continue;\n    if (!Array.isArray(validation.identifier_paths)) {\n      throw new Error(\n        `[${storyboardId}] ${phase.id ?? '?'}.${\n          step.id ?? '?'\n        }.validations[${validationIndex}].identifier_paths: must be an array of request-payload paths`\n      );\n    }\n    for (let pathIndex = 0; pathIndex < validation.identifier_paths.length; pathIndex++) {\n      const path = validation.identifier_paths[pathIndex];\n      if (typeof path !== 'string' || path.length === 0) {\n        throw new Error(\n          `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${validationIndex}].identifier_paths[${pathIndex}]: must be a non-empty string`\n        );\n      }\n      const pathErrorPrefix = `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${validationIndex}].identifier_paths[${pathIndex}]`;\n      let firstSegment: string;\n      try {\n        const validated = validateIdentifierPathSyntax(path);\n        firstSegment = validated.firstSegment;\n      } catch {\n        throw new Error(\n          `${pathErrorPrefix}: \"${path}\" is unsupported; identifier_paths resolve only against the request payload or sample_request using dotted paths with [*] array selectors`\n        );\n      }\n      const root = firstSegment.toLowerCase();\n      if (root === 'request' || root === 'response' || root === 'context') {\n        throw new Error(\n          `${pathErrorPrefix}: \"${path}\" is unsupported; identifier_paths resolve only against the request payload or sample_request`\n        );\n      }\n    }\n  }\n}\n\nfunction validateIdentifierPathSyntax(path: string): { normalized: string; firstSegment: string } {\n  const trimmed = path.trim();\n  const normalized = trimmed.startsWith('$.') ? trimmed.slice(2) : trimmed;\n  if (!IDENTIFIER_PATH_PATTERN.test(normalized)) {\n    throw new Error('unsupported identifier path syntax');\n  }\n  return { normalized, firstSegment: normalized.split(/[.[\\]]/, 1)[0] ?? '' };\n}\n\nfunction validateRequiredAnyOfTools(storyboard: Storyboard): void {\n  if (storyboard.required_any_of_tools === undefined) return;\n  if (!Array.isArray(storyboard.required_any_of_tools)) {\n    throw new Error(`[${storyboard.id}] required_any_of_tools: must be an array of tool-family objects`);\n  }\n  if (storyboard.required_any_of_tools.length === 0) {\n    throw new Error(`[${storyboard.id}] required_any_of_tools: [] is not allowed — omit the field to use no gate`);\n  }\n  for (let i = 0; i < storyboard.required_any_of_tools.length; i++) {\n    const family = storyboard.required_any_of_tools[i] as unknown;\n    if (family === null || typeof family !== 'object' || Array.isArray(family)) {\n      throw new Error(`[${storyboard.id}] required_any_of_tools[${i}]: must be an object`);\n    }\n    const { tools, rationale } = family as { tools?: unknown; rationale?: unknown };\n    if (!Array.isArray(tools) || tools.length < 2) {\n      throw new Error(`[${storyboard.id}] required_any_of_tools[${i}].tools: must list at least two tool names`);\n    }\n    for (const tool of tools) {\n      if (typeof tool !== 'string' || tool.length === 0) {\n        throw new Error(`[${storyboard.id}] required_any_of_tools[${i}].tools: entries must be non-empty strings`);\n      }\n    }\n    if (rationale !== undefined && typeof rationale !== 'string') {\n      throw new Error(`[${storyboard.id}] required_any_of_tools[${i}].rationale: must be a string`);\n    }\n  }\n}\n\n/**\n * Authoring-time validation for `phase.depends_on` (#1161). Each entry\n * must reference a phase declared earlier in the storyboard. Forward\n * references and self-references fail loud at parse time so authoring\n * mistakes (typos, reorderings) don't degrade silently into \"phase\n * always runs\" / \"phase always cascades.\"\n *\n * Rules:\n *   - Empty list (`depends_on: []`) is legal — it declares an\n *     independent phase. No further validation needed.\n *   - Each non-empty entry must be a non-empty string.\n *   - Each entry must reference a phase that appears EARLIER in the\n *     `storyboard.phases[]` array (forward references are rejected).\n *   - A phase cannot depend on itself.\n */\nfunction validatePhaseDependsOn(storyboard: Storyboard): void {\n  const phaseIdsSeen = new Set<string>();\n  for (const phase of storyboard.phases) {\n    if (phase.depends_on !== undefined) {\n      if (!Array.isArray(phase.depends_on)) {\n        throw new Error(`[${storyboard.id}] phase '${phase.id}': depends_on must be an array of phase ids`);\n      }\n      for (const dep of phase.depends_on) {\n        if (typeof dep !== 'string' || dep.length === 0) {\n          throw new Error(`[${storyboard.id}] phase '${phase.id}': depends_on entries must be non-empty strings`);\n        }\n        if (dep === phase.id) {\n          throw new Error(`[${storyboard.id}] phase '${phase.id}': depends_on cannot reference itself`);\n        }\n        if (!phaseIdsSeen.has(dep)) {\n          throw new Error(\n            `[${storyboard.id}] phase '${phase.id}': depends_on '${dep}' is not a phase declared earlier in this storyboard (forward and unknown references are rejected)`\n          );\n        }\n      }\n    }\n    phaseIdsSeen.add(phase.id);\n  }\n}\n\n/**\n * Authoring-time validation for `Storyboard.requires` (#1626). The field is\n * an array of non-empty requirement names:\n *\n *   - `requires: []` is rejected — an empty array reads as \"no\n *     requirements,\" which is the same as omitting the field; failing\n *     load forces the author to omit it explicitly.\n *   - Each entry must be a non-empty string.\n *\n * Unknown string values are allowed for forward compatibility. Runners that\n * don't know how to satisfy a future requirement skip at runtime with\n * `skip_reason: 'requirement_unmet'` and the authored value in\n * `skip.requirement`.\n */\nfunction validateRequires(storyboard: Storyboard): void {\n  if (storyboard.requires === undefined) return;\n  if (!Array.isArray(storyboard.requires)) {\n    throw new Error(\n      `[${storyboard.id}] requires: must be an array of requirement names (got ${typeof storyboard.requires})`\n    );\n  }\n  if (storyboard.requires.length === 0) {\n    throw new Error(`[${storyboard.id}] requires: [] is not allowed — omit the field to use the default ([real_wire])`);\n  }\n  for (let i = 0; i < storyboard.requires.length; i++) {\n    const name = storyboard.requires[i];\n    if (typeof name !== 'string' || name.length === 0) {\n      throw new Error(`[${storyboard.id}] requires[${i}]: entries must be non-empty strings`);\n    }\n  }\n}\n\n/**\n * Issue #820: mutating tasks (per {@link MUTATING_TASKS}) must have a\n * `sample_request` authored. The fixture is authoritative at run time —\n * there's no sane default payload for a write, and silently fabricating\n * one was the bug factory that produced #780 / #792 / #793 / #802 / #805.\n *\n * Error messages point at the task name, the step id, the storyboard, and\n * suggest the concrete author action.\n *\n * Opt-out: steps with `expect_error: true` that deliberately exercise\n * missing-fixture / malformed-payload seller behavior skip this check —\n * the author is signaling the payload is the test condition.\n *\n * Synthesized phases (`request-signing/synthesize.ts`, controller seeding)\n * start with `phase.steps = []` in YAML and the loader doesn't see the\n * runtime-generated steps, so those paths are not affected.\n */\nfunction validateFixtureForMutatingStep(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  if (!MUTATING_TASKS.has(step.task)) return;\n  if (step.sample_request !== undefined) return;\n  if (step.expect_error === true) return;\n  throw new Error(\n    `[${storyboardId}] phase '${phase.id}' step '${step.id}' (task=${step.task}): ` +\n      `mutating tasks require a sample_request fixture — the runner no longer fabricates ` +\n      `write payloads. Author sample_request in the step or, for intentionally malformed ` +\n      `payloads, set expect_error: true.`\n  );\n}\n\n/**\n * `omit_account: true` must be paired with `expect_error: true`.\n *\n * An accountless `create_media_buy` will always be rejected by a spec-compliant\n * seller; a step that sets `omit_account` without `expect_error` will be graded\n * as a failure (not a controlled negative test), producing a misleading\n * compliance result. Fail loud at parse time so the author sees the problem\n * during storyboard load, not at run time.\n */\nfunction validateOmitFlagCoherence(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  if (step.omit_account && step.expect_error !== true) {\n    throw new Error(\n      `[${storyboardId}] phase '${phase.id}' step '${step.id}': ` +\n        `omit_account: true requires expect_error: true — an accountless ` +\n        `create_media_buy will always be rejected by a spec-compliant seller.`\n    );\n  }\n}\n\n/**\n * Each `context_outputs` entry must declare exactly one source: either\n * `path` (extract from response) or `generate` (mint at run time). An entry\n * with neither is a silent no-op; one with both would silently pick `generate`\n * and ignore `path`. Both are authoring foot-guns that should fail loud.\n */\nfunction validateContextOutputs(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  if (!step.context_outputs?.length) return;\n  for (const output of step.context_outputs) {\n    const hasPath = output.path !== undefined;\n    const hasGenerate = output.generate !== undefined;\n    if (!hasPath && !hasGenerate) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': context_outputs entry ` +\n          `'${output.key}' must set exactly one of 'path' or 'generate'.`\n      );\n    }\n    if (hasPath && hasGenerate) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': context_outputs entry ` +\n          `'${output.key}' sets both 'path' and 'generate' — they are mutually exclusive.`\n      );\n    }\n    // Validate generator name. The runtime resolver also checks but the loader\n    // catches typos at storyboard-load time so authors see the failure on\n    // build, not on the first run.\n    if (hasGenerate && output.generate !== 'uuid_v4' && output.generate !== 'opaque_id') {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': context_outputs entry ` +\n          `'${output.key}' has unknown generate value '${output.generate}'. ` +\n          `Supported: 'uuid_v4', 'opaque_id'.`\n      );\n    }\n  }\n}\n\n/**\n * Authoring-time validation for `provides_state_for` (the AdCP 3.0.3 spec\n * field — adcp#3734) and the legacy `peer_substitutes_for` synonym. The\n * runner treats the field as same-phase-only and substitution-only-when-\n * stateful; surface those constraints at parse time so storyboard authors\n * see typos and cross-phase references on build, not as a silent no-rescue\n * at run time.\n *\n * Both field names parse to the same canonical normalized form on the step\n * object (the spec name `provides_state_for` is preferred when both are\n * declared). The deprecation alias is documented in `types.ts`.\n *\n * Rules:\n *   - Each target must reference a step that exists in the same phase.\n *   - A step cannot substitute for itself.\n *   - The substitute step itself must be `stateful: true` — non-stateful\n *     passes don't establish state per the cascade contract.\n *   - The target step must be `stateful: true` — non-stateful targets\n *     don't participate in cascade gating, so a substitution declaration\n *     would be a no-op.\n *   - When both fields are declared on the same step, they must match\n *     element-for-element (the deprecation contract is \"synonym for\", not\n *     \"additive with\").\n */\nfunction validatePeerSubstitutesFor(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  const newField = step.provides_state_for;\n  const legacyField = step.peer_substitutes_for;\n  if (newField === undefined && legacyField === undefined) return;\n\n  if (newField !== undefined && legacyField !== undefined) {\n    // Order-sensitive equality: `[A, B]` vs `[B, A]` would throw despite being\n    // semantically equivalent. Authors mid-migration should write the same list\n    // in both fields; the deprecation alias is a literal synonym, not a\n    // same-set restatement.\n    const a = JSON.stringify(Array.isArray(newField) ? newField : [newField]);\n    const b = JSON.stringify(Array.isArray(legacyField) ? legacyField : [legacyField]);\n    if (a !== b) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': both provides_state_for and ` +\n          `peer_substitutes_for declared with different values — pick one (provides_state_for is the ` +\n          `spec field; peer_substitutes_for is a deprecated synonym)`\n      );\n    }\n  }\n\n  // Normalize onto provides_state_for so the runner can read a single field.\n  // peer_substitutes_for stays for back-compat with any consumer code that\n  // already reads it.\n  if (newField === undefined && legacyField !== undefined) {\n    step.provides_state_for = legacyField;\n  } else if (newField !== undefined && legacyField === undefined) {\n    step.peer_substitutes_for = newField;\n  }\n\n  const sourceFieldName = newField !== undefined ? 'provides_state_for' : 'peer_substitutes_for';\n  const declared = step.provides_state_for!;\n  const targets = Array.isArray(declared) ? declared : [declared];\n  if (!step.stateful) {\n    throw new Error(\n      `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} is only legal on stateful steps`\n    );\n  }\n  const phaseStepIds = new Map(phase.steps.map(s => [s.id, s]));\n  for (const target of targets) {\n    if (typeof target !== 'string' || target.length === 0) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} entries must be non-empty strings`\n      );\n    }\n    if (target === step.id) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} cannot reference itself`\n      );\n    }\n    const targetStep = phaseStepIds.get(target);\n    if (!targetStep) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} target '${target}' is not a step in this phase (same-phase only)`\n      );\n    }\n    if (!targetStep.stateful) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} target '${target}' must be stateful`\n      );\n    }\n  }\n}\n\nfunction validateBranchSet(storyboardId: string, phase: Storyboard['phases'][number]): void {\n  if (phase.branch_set === undefined) return;\n  const bs = phase.branch_set as unknown;\n  if (!bs || typeof bs !== 'object') {\n    throw new Error(`[${storyboardId}] phase '${phase.id}': branch_set must be an object with { id, semantics }`);\n  }\n  const { id, semantics } = bs as Record<string, unknown>;\n  if (typeof id !== 'string' || id.length === 0) {\n    throw new Error(`[${storyboardId}] phase '${phase.id}': branch_set.id must be a non-empty string`);\n  }\n  if (typeof semantics !== 'string' || semantics.length === 0) {\n    throw new Error(`[${storyboardId}] phase '${phase.id}': branch_set.semantics must be a non-empty string`);\n  }\n  // Only `any_of` is defined in AdCP today (adcp#2646 lint rule 2 —\n  // `at_least_n` and `all_of` are reserved but not defined). Reject unknown\n  // values at parse rather than silently skipping grading at runtime, so\n  // spec-drift typos fail loud instead of degrading to raw `failed` peers.\n  if (!(BRANCH_SET_SEMANTICS as readonly string[]).includes(semantics)) {\n    throw new Error(\n      `[${storyboardId}] phase '${phase.id}': branch_set.semantics='${semantics}' is not supported (valid: ${BRANCH_SET_SEMANTICS.join(', ')})`\n    );\n  }\n  // Schema constraint: every phase in a branch set MUST be optional. A\n  // non-optional branch-set phase would fail the storyboard on any step\n  // failure regardless of peer contribution, defeating the any_of gate.\n  if (phase.optional !== true) {\n    throw new Error(`[${storyboardId}] phase '${phase.id}': phases declaring branch_set must set 'optional: true'`);\n  }\n}\n\n/**\n * Resolve the `contributes: true` boolean shorthand introduced alongside the\n * first-class `branch_set:` phase field (adcp-client#693, adcp#2646).\n *\n * Rules:\n *   - `contributes: true` is legal only inside a phase that declares `branch_set:`.\n *   - A step MUST NOT set both `contributes` and `contributes_to` (ambiguous).\n *   - A string `contributes_to` inside a branch_set phase MUST equal `branch_set.id`\n *     (otherwise the aggregation target drifts — same invariant the spec lint enforces).\n *\n * After resolution, `step.contributes_to` carries the flag name and `step.contributes`\n * is cleared, so the runner reads a single field regardless of authoring form.\n */\nfunction resolveContributesShorthand(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  const hasBoolean = step.contributes !== undefined;\n  const hasString = step.contributes_to !== undefined;\n\n  if (hasBoolean && hasString) {\n    throw new Error(`[${storyboardId}] step '${step.id}' declares both 'contributes' and 'contributes_to' — pick one`);\n  }\n\n  if (hasBoolean) {\n    if (step.contributes === true) {\n      if (!phase.branch_set) {\n        throw new Error(\n          `[${storyboardId}] step '${step.id}': 'contributes: true' is only legal inside a phase that declares branch_set`\n        );\n      }\n      step.contributes_to = phase.branch_set.id;\n    }\n    delete step.contributes;\n    return;\n  }\n\n  if (hasString && phase.branch_set && step.contributes_to !== phase.branch_set.id) {\n    throw new Error(\n      `[${storyboardId}] step '${step.id}': contributes_to='${step.contributes_to}' must equal enclosing phase's branch_set.id='${phase.branch_set.id}'`\n    );\n  }\n}\n"],"mappings":"AAQA,SAAS,oBAAoB;AAC7B,SAAS,aAAa;AAEtB,SAAS,sBAAsB;AAC/B,SAAS,6CAA6C;AACtD,SAAS,SAAS,mBAAmB;AAO9B,MAAM,uBAAuB,CAAC,QAAQ;AAE7C,MAAM,0BAA0B,OAAO;AACvC,MAAM,0BAA0B,IAAI,OAAO,IAAI,uBAAuB,SAAS,uBAAuB,KAAK;AAGpG,SAAS,gBAAgB,aAAiC;AAC/D,QAAM,SAAS,MAAM,WAAW;AAChC,MAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,QAAQ;AAClC,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,aAAW,SAAS,OAAO,QAAQ;AAIjC,QAAI,CAAC,MAAM,MAAO,OAAM,QAAQ,CAAC;AAEjC,eAAW,QAAQ,MAAM,OAAO;AAC9B,UAAI,CAAC,KAAK,gBAAiB;AAC3B,iBAAW,UAAU,KAAK,iBAAiB;AACzC,cAAM,MAAM;AACZ,YAAI,IAAI,QAAQ,CAAC,IAAI,KAAK;AACxB,iBAAO,MAAM,IAAI;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,0BAAwB,MAAM;AAC9B,SAAO;AACT;AAGO,SAAS,mBAAmB,UAA8B;AAC/D,SAAO,gBAAgB,aAAa,UAAU,OAAO,CAAC;AACxD;AAWO,SAAS,wBAAwB,YAA8B;AACpE,mBAAiB,UAAU;AAC3B,wCAAsC,UAAU;AAChD,6BAA2B,UAAU;AACrC,yBAAuB,UAAU;AACjC,aAAW,SAAS,WAAW,QAAQ;AACrC,sBAAkB,WAAW,IAAI,KAAK;AACtC,QAAI,CAAC,MAAM,MAAO;AAClB,eAAW,QAAQ,MAAM,OAAO;AAC9B,kCAA4B,WAAW,IAAI,OAAO,IAAI;AACtD,qCAA+B,WAAW,IAAI,OAAO,IAAI;AACzD,gCAA0B,WAAW,IAAI,OAAO,IAAI;AACpD,6BAAuB,WAAW,IAAI,OAAO,IAAI;AACjD,sCAAgC,WAAW,IAAI,OAAO,IAAI;AAC1D,sCAAgC,WAAW,IAAI,OAAO,IAAI;AAC1D,mCAA6B,WAAW,IAAI,OAAO,IAAI;AACvD,iCAA2B,WAAW,IAAI,OAAO,IAAI;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,6BACP,cACA,OACA,MACM;AACN,WAAS,QAAQ,GAAG,SAAS,KAAK,eAAe,CAAC,GAAG,QAAQ,SAAS;AACpE,UAAM,aAAa,KAAK,YAAa,KAAK;AAC1C,QACE,YAAY,aAAa,UACzB,WAAW,aAAa,cACxB,WAAW,aAAa,YACxB;AACA,YAAMA,UAAS,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,KAAK;AAC1F,YAAM,IAAI,MAAM,GAAGA,OAAM,oDAAoD;AAAA,IAC/E;AACA,QAAI,YAAY,aAAa,WAAY;AACzC,UAAM,SAAS,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,KAAK;AAC1F,UAAM,YAAY,WAAW,0BAA0B;AACvD,UAAM,eAAe,WAAW,uBAAuB;AACvD,QAAI,cAAc,cAAc;AAC9B,YAAM,IAAI;AAAA,QACR,GAAG,MAAM;AAAA,MACX;AAAA,IACF;AACA,QACE,cACC,OAAO,WAAW,0BAA0B,YAAY,CAAC,YAAY,WAAW,qBAAqB,IACtG;AACA,YAAM,IAAI,MAAM,GAAG,MAAM,uDAAuD;AAAA,IAClF;AACA,QACE,iBACC,OAAO,WAAW,uBAAuB,YACxC,WAAW,uBAAuB,QAClC,OAAO,WAAW,mBAAmB,WAAW,YAChD,WAAW,mBAAmB,OAAO,KAAK,EAAE,WAAW,IACzD;AACA,YAAM,IAAI,MAAM,GAAG,MAAM,wDAAwD;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,gCACP,cACA,OACA,MACM;AACN,QAAM,cAAc,KAAK,eAAe,CAAC;AACzC,WAAS,kBAAkB,GAAG,kBAAkB,YAAY,QAAQ,mBAAmB;AACrF,UAAM,aAAa,YAAY,eAAe;AAC9C,QAAI,YAAY,UAAU,mBAAoB;AAC9C,UAAM,OAAO,WAAW;AACxB,QAAI,SAAS,UAAa,SAAS,SAAS,SAAS,UAAU;AAC7D,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,eAAe;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gCACP,cACA,OACA,MACM;AACN,QAAM,cAAc,KAAK,eAAe,CAAC;AACzC,WAAS,kBAAkB,GAAG,kBAAkB,YAAY,QAAQ,mBAAmB;AACrF,UAAM,aAAa,YAAY,eAAe;AAC9C,QAAI,YAAY,UAAU,sBAAsB,WAAW,qBAAqB,OAAW;AAC3F,QAAI,CAAC,MAAM,QAAQ,WAAW,gBAAgB,GAAG;AAC/C,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAClC,KAAK,MAAM,GACb,gBAAgB,eAAe;AAAA,MACjC;AAAA,IACF;AACA,aAAS,YAAY,GAAG,YAAY,WAAW,iBAAiB,QAAQ,aAAa;AACnF,YAAM,OAAO,WAAW,iBAAiB,SAAS;AAClD,UAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,cAAM,IAAI;AAAA,UACR,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,eAAe,sBAAsB,SAAS;AAAA,QACtH;AAAA,MACF;AACA,YAAM,kBAAkB,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,eAAe,sBAAsB,SAAS;AAC5I,UAAI;AACJ,UAAI;AACF,cAAM,YAAY,6BAA6B,IAAI;AACnD,uBAAe,UAAU;AAAA,MAC3B,QAAQ;AACN,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,MAAM,IAAI;AAAA,QAC9B;AAAA,MACF;AACA,YAAM,OAAO,aAAa,YAAY;AACtC,UAAI,SAAS,aAAa,SAAS,cAAc,SAAS,WAAW;AACnE,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,MAAM,IAAI;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,6BAA6B,MAA4D;AAChG,QAAM,UAAU,KAAK,KAAK;AAC1B,QAAM,aAAa,QAAQ,WAAW,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI;AACjE,MAAI,CAAC,wBAAwB,KAAK,UAAU,GAAG;AAC7C,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,SAAO,EAAE,YAAY,cAAc,WAAW,MAAM,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG;AAC5E;AAEA,SAAS,2BAA2B,YAA8B;AAChE,MAAI,WAAW,0BAA0B,OAAW;AACpD,MAAI,CAAC,MAAM,QAAQ,WAAW,qBAAqB,GAAG;AACpD,UAAM,IAAI,MAAM,IAAI,WAAW,EAAE,kEAAkE;AAAA,EACrG;AACA,MAAI,WAAW,sBAAsB,WAAW,GAAG;AACjD,UAAM,IAAI,MAAM,IAAI,WAAW,EAAE,iFAA4E;AAAA,EAC/G;AACA,WAAS,IAAI,GAAG,IAAI,WAAW,sBAAsB,QAAQ,KAAK;AAChE,UAAM,SAAS,WAAW,sBAAsB,CAAC;AACjD,QAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,YAAM,IAAI,MAAM,IAAI,WAAW,EAAE,2BAA2B,CAAC,sBAAsB;AAAA,IACrF;AACA,UAAM,EAAE,OAAO,UAAU,IAAI;AAC7B,QAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,GAAG;AAC7C,YAAM,IAAI,MAAM,IAAI,WAAW,EAAE,2BAA2B,CAAC,4CAA4C;AAAA,IAC3G;AACA,eAAW,QAAQ,OAAO;AACxB,UAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,cAAM,IAAI,MAAM,IAAI,WAAW,EAAE,2BAA2B,CAAC,4CAA4C;AAAA,MAC3G;AAAA,IACF;AACA,QAAI,cAAc,UAAa,OAAO,cAAc,UAAU;AAC5D,YAAM,IAAI,MAAM,IAAI,WAAW,EAAE,2BAA2B,CAAC,+BAA+B;AAAA,IAC9F;AAAA,EACF;AACF;AAiBA,SAAS,uBAAuB,YAA8B;AAC5D,QAAM,eAAe,oBAAI,IAAY;AACrC,aAAW,SAAS,WAAW,QAAQ;AACrC,QAAI,MAAM,eAAe,QAAW;AAClC,UAAI,CAAC,MAAM,QAAQ,MAAM,UAAU,GAAG;AACpC,cAAM,IAAI,MAAM,IAAI,WAAW,EAAE,YAAY,MAAM,EAAE,6CAA6C;AAAA,MACpG;AACA,iBAAW,OAAO,MAAM,YAAY;AAClC,YAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAAG;AAC/C,gBAAM,IAAI,MAAM,IAAI,WAAW,EAAE,YAAY,MAAM,EAAE,iDAAiD;AAAA,QACxG;AACA,YAAI,QAAQ,MAAM,IAAI;AACpB,gBAAM,IAAI,MAAM,IAAI,WAAW,EAAE,YAAY,MAAM,EAAE,uCAAuC;AAAA,QAC9F;AACA,YAAI,CAAC,aAAa,IAAI,GAAG,GAAG;AAC1B,gBAAM,IAAI;AAAA,YACR,IAAI,WAAW,EAAE,YAAY,MAAM,EAAE,kBAAkB,GAAG;AAAA,UAC5D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,iBAAa,IAAI,MAAM,EAAE;AAAA,EAC3B;AACF;AAgBA,SAAS,iBAAiB,YAA8B;AACtD,MAAI,WAAW,aAAa,OAAW;AACvC,MAAI,CAAC,MAAM,QAAQ,WAAW,QAAQ,GAAG;AACvC,UAAM,IAAI;AAAA,MACR,IAAI,WAAW,EAAE,0DAA0D,OAAO,WAAW,QAAQ;AAAA,IACvG;AAAA,EACF;AACA,MAAI,WAAW,SAAS,WAAW,GAAG;AACpC,UAAM,IAAI,MAAM,IAAI,WAAW,EAAE,sFAAiF;AAAA,EACpH;AACA,WAAS,IAAI,GAAG,IAAI,WAAW,SAAS,QAAQ,KAAK;AACnD,UAAM,OAAO,WAAW,SAAS,CAAC;AAClC,QAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,YAAM,IAAI,MAAM,IAAI,WAAW,EAAE,cAAc,CAAC,sCAAsC;AAAA,IACxF;AAAA,EACF;AACF;AAmBA,SAAS,+BACP,cACA,OACA,MACM;AACN,MAAI,CAAC,eAAe,IAAI,KAAK,IAAI,EAAG;AACpC,MAAI,KAAK,mBAAmB,OAAW;AACvC,MAAI,KAAK,iBAAiB,KAAM;AAChC,QAAM,IAAI;AAAA,IACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,WAAW,KAAK,IAAI;AAAA,EAI5E;AACF;AAWA,SAAS,0BACP,cACA,OACA,MACM;AACN,MAAI,KAAK,gBAAgB,KAAK,iBAAiB,MAAM;AACnD,UAAM,IAAI;AAAA,MACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE;AAAA,IAGxD;AAAA,EACF;AACF;AAQA,SAAS,uBACP,cACA,OACA,MACM;AACN,MAAI,CAAC,KAAK,iBAAiB,OAAQ;AACnC,aAAW,UAAU,KAAK,iBAAiB;AACzC,UAAM,UAAU,OAAO,SAAS;AAChC,UAAM,cAAc,OAAO,aAAa;AACxC,QAAI,CAAC,WAAW,CAAC,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,6BAChD,OAAO,GAAG;AAAA,MAClB;AAAA,IACF;AACA,QAAI,WAAW,aAAa;AAC1B,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,6BAChD,OAAO,GAAG;AAAA,MAClB;AAAA,IACF;AAIA,QAAI,eAAe,OAAO,aAAa,aAAa,OAAO,aAAa,aAAa;AACnF,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,6BAChD,OAAO,GAAG,iCAAiC,OAAO,QAAQ;AAAA,MAElE;AAAA,IACF;AAAA,EACF;AACF;AA0BA,SAAS,2BACP,cACA,OACA,MACM;AACN,QAAM,WAAW,KAAK;AACtB,QAAM,cAAc,KAAK;AACzB,MAAI,aAAa,UAAa,gBAAgB,OAAW;AAEzD,MAAI,aAAa,UAAa,gBAAgB,QAAW;AAKvD,UAAM,IAAI,KAAK,UAAU,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC;AACxE,UAAM,IAAI,KAAK,UAAU,MAAM,QAAQ,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;AACjF,QAAI,MAAM,GAAG;AACX,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE;AAAA,MAGxD;AAAA,IACF;AAAA,EACF;AAKA,MAAI,aAAa,UAAa,gBAAgB,QAAW;AACvD,SAAK,qBAAqB;AAAA,EAC5B,WAAW,aAAa,UAAa,gBAAgB,QAAW;AAC9D,SAAK,uBAAuB;AAAA,EAC9B;AAEA,QAAM,kBAAkB,aAAa,SAAY,uBAAuB;AACxE,QAAM,WAAW,KAAK;AACtB,QAAM,UAAU,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAC9D,MAAI,CAAC,KAAK,UAAU;AAClB,UAAM,IAAI;AAAA,MACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe;AAAA,IAC7E;AAAA,EACF;AACA,QAAM,eAAe,IAAI,IAAI,MAAM,MAAM,IAAI,OAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe;AAAA,MAC7E;AAAA,IACF;AACA,QAAI,WAAW,KAAK,IAAI;AACtB,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe;AAAA,MAC7E;AAAA,IACF;AACA,UAAM,aAAa,aAAa,IAAI,MAAM;AAC1C,QAAI,CAAC,YAAY;AACf,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe,YAAY,MAAM;AAAA,MAC/F;AAAA,IACF;AACA,QAAI,CAAC,WAAW,UAAU;AACxB,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe,YAAY,MAAM;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,cAAsB,OAA2C;AAC1F,MAAI,MAAM,eAAe,OAAW;AACpC,QAAM,KAAK,MAAM;AACjB,MAAI,CAAC,MAAM,OAAO,OAAO,UAAU;AACjC,UAAM,IAAI,MAAM,IAAI,YAAY,YAAY,MAAM,EAAE,wDAAwD;AAAA,EAC9G;AACA,QAAM,EAAE,IAAI,UAAU,IAAI;AAC1B,MAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG;AAC7C,UAAM,IAAI,MAAM,IAAI,YAAY,YAAY,MAAM,EAAE,6CAA6C;AAAA,EACnG;AACA,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,MAAM,IAAI,YAAY,YAAY,MAAM,EAAE,oDAAoD;AAAA,EAC1G;AAKA,MAAI,CAAE,qBAA2C,SAAS,SAAS,GAAG;AACpE,UAAM,IAAI;AAAA,MACR,IAAI,YAAY,YAAY,MAAM,EAAE,4BAA4B,SAAS,8BAA8B,qBAAqB,KAAK,IAAI,CAAC;AAAA,IACxI;AAAA,EACF;AAIA,MAAI,MAAM,aAAa,MAAM;AAC3B,UAAM,IAAI,MAAM,IAAI,YAAY,YAAY,MAAM,EAAE,0DAA0D;AAAA,EAChH;AACF;AAeA,SAAS,4BACP,cACA,OACA,MACM;AACN,QAAM,aAAa,KAAK,gBAAgB;AACxC,QAAM,YAAY,KAAK,mBAAmB;AAE1C,MAAI,cAAc,WAAW;AAC3B,UAAM,IAAI,MAAM,IAAI,YAAY,WAAW,KAAK,EAAE,oEAA+D;AAAA,EACnH;AAEA,MAAI,YAAY;AACd,QAAI,KAAK,gBAAgB,MAAM;AAC7B,UAAI,CAAC,MAAM,YAAY;AACrB,cAAM,IAAI;AAAA,UACR,IAAI,YAAY,WAAW,KAAK,EAAE;AAAA,QACpC;AAAA,MACF;AACA,WAAK,iBAAiB,MAAM,WAAW;AAAA,IACzC;AACA,WAAO,KAAK;AACZ;AAAA,EACF;AAEA,MAAI,aAAa,MAAM,cAAc,KAAK,mBAAmB,MAAM,WAAW,IAAI;AAChF,UAAM,IAAI;AAAA,MACR,IAAI,YAAY,WAAW,KAAK,EAAE,sBAAsB,KAAK,cAAc,iDAAiD,MAAM,WAAW,EAAE;AAAA,IACjJ;AAAA,EACF;AACF;","names":["prefix"]}
+{"version":3,"sources":["../../../../src/lib/testing/storyboard/loader.ts"],"sourcesContent":["/**\n * Storyboard YAML parser.\n *\n * Storyboards are pulled from the compliance cache populated by\n * `npm run sync-schemas`. See `./compliance.ts` for capability-driven\n * resolution and bundle loading.\n */\n\nimport { readFileSync } from 'fs';\nimport { parse } from 'yaml';\nimport type { Storyboard } from './types';\nimport { MUTATING_TASKS } from '../../utils/idempotency';\nimport { validateFixtureResolutionDeclarations } from './fixture-resolution';\nimport { valid as validSemver } from 'semver';\n\n/**\n * Supported `branch_set.semantics` values. Extend when AdCP adds `all_of`,\n * `at_least_n`, etc. Exported so the runner can enforce the same whitelist\n * on programmatically-constructed storyboards that bypass the YAML parser.\n */\nexport const BRANCH_SET_SEMANTICS = ['any_of'] as const;\n\nconst IDENTIFIER_PATH_SEGMENT = String.raw`[A-Za-z_][A-Za-z0-9_-]*(?:\\[\\*\\])*`;\nconst IDENTIFIER_PATH_PATTERN = new RegExp(`^${IDENTIFIER_PATH_SEGMENT}(?:\\\\.${IDENTIFIER_PATH_SEGMENT})*$`);\n\n/** Parse a YAML string into a Storyboard. Throws if required fields are missing. */\nexport function parseStoryboard(yamlContent: string): Storyboard {\n  const parsed = parse(yamlContent) as Storyboard;\n  if (!parsed?.id || !parsed?.phases) {\n    throw new Error('Invalid storyboard YAML: missing required fields (id, phases)');\n  }\n  if (Object.prototype.hasOwnProperty.call(parsed, 'compliance_dir')) {\n    throw new Error(\n      'Invalid storyboard YAML: compliance_dir is loader-owned runtime provenance; select an external cache with runner options instead.'\n    );\n  }\n  for (const phase of parsed.phases) {\n    // Specialism YAMLs may declare a phase with no `steps:` — the steps are\n    // synthesized at runtime from fixtures (see request-signing/synthesize.ts).\n    // Treat missing steps as an empty list so the parser stays phase-agnostic.\n    if (!phase.steps) phase.steps = [];\n    // YAML uses `name:` for context outputs but our runtime expects `key:`.\n    for (const step of phase.steps) {\n      if (!step.context_outputs) continue;\n      for (const output of step.context_outputs) {\n        const raw = output as unknown as Record<string, unknown>;\n        if (raw.name && !raw.key) {\n          output.key = raw.name as string;\n        }\n      }\n    }\n  }\n  validateStoryboardShape(parsed);\n  return parsed;\n}\n\n/** Load and parse a single storyboard file. Useful for ad-hoc testing of in-development YAMLs. */\nexport function loadStoryboardFile(filePath: string): Storyboard {\n  return parseStoryboard(readFileSync(filePath, 'utf-8'));\n}\n\n/**\n * Enforce authoring-time invariants on a Storyboard. Called by\n * `parseStoryboard`, and should also be called by any runner entry point\n * that accepts a programmatically-built `Storyboard` object so the same\n * loud-fail-on-drift guarantee holds regardless of how the storyboard was\n * constructed. Mutates only legacy shorthand fields (resolves\n * `contributes: true` to `contributes_to`) and is idempotent on\n * already-validated inputs.\n */\nexport function validateStoryboardShape(storyboard: Storyboard): void {\n  validateRequires(storyboard);\n  validateFixtureResolutionDeclarations(storyboard);\n  validateRequiredAnyOfTools(storyboard);\n  validatePhaseDependsOn(storyboard);\n  for (const phase of storyboard.phases) {\n    validateBranchSet(storyboard.id, phase);\n    if (!phase.steps) continue;\n    for (const step of phase.steps) {\n      resolveContributesShorthand(storyboard.id, phase, step);\n      validateFixtureForMutatingStep(storyboard.id, phase, step);\n      validateOmitFlagCoherence(storyboard.id, phase, step);\n      validateContextOutputs(storyboard.id, phase, step);\n      validateUpstreamAttestationMode(storyboard.id, phase, step);\n      validateUpstreamIdentifierPaths(storyboard.id, phase, step);\n      validateAdvisoryDeclarations(storyboard.id, phase, step);\n      validatePeerSubstitutesFor(storyboard.id, phase, step);\n    }\n  }\n}\n\nfunction validateAdvisoryDeclarations(\n  storyboardId: string,\n  phase: { id?: string },\n  step: { id?: string; validations?: any[] }\n): void {\n  for (let index = 0; index < (step.validations ?? []).length; index++) {\n    const validation = step.validations![index];\n    if (\n      validation?.severity !== undefined &&\n      validation.severity !== 'required' &&\n      validation.severity !== 'advisory'\n    ) {\n      const prefix = `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${index}]`;\n      throw new Error(`${prefix}.severity: must be either \"required\" or \"advisory\"`);\n    }\n    if (validation?.severity !== 'advisory') continue;\n    const prefix = `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${index}]`;\n    const hasExpiry = validation.expires_after_version !== undefined;\n    const hasPermanent = validation.permanent_advisory !== undefined;\n    if (hasExpiry === hasPermanent) {\n      throw new Error(\n        `${prefix}: severity \"advisory\" must declare exactly one of expires_after_version or permanent_advisory`\n      );\n    }\n    if (\n      hasExpiry &&\n      (typeof validation.expires_after_version !== 'string' || !validSemver(validation.expires_after_version))\n    ) {\n      throw new Error(`${prefix}.expires_after_version: must be a valid semver string`);\n    }\n    if (\n      hasPermanent &&\n      (typeof validation.permanent_advisory !== 'object' ||\n        validation.permanent_advisory === null ||\n        typeof validation.permanent_advisory.reason !== 'string' ||\n        validation.permanent_advisory.reason.trim().length === 0)\n    ) {\n      throw new Error(`${prefix}.permanent_advisory.reason: must be a non-empty string`);\n    }\n  }\n}\n\nfunction validateUpstreamAttestationMode(\n  storyboardId: string,\n  phase: { id?: string },\n  step: { id?: string; validations?: any[] }\n): void {\n  const validations = step.validations ?? [];\n  for (let validationIndex = 0; validationIndex < validations.length; validationIndex++) {\n    const validation = validations[validationIndex];\n    if (validation?.check !== 'upstream_traffic') continue;\n    const mode = validation.preferred_attestation_mode;\n    if (mode !== undefined && mode !== 'raw' && mode !== 'digest') {\n      throw new Error(\n        `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${validationIndex}].preferred_attestation_mode: must be \"raw\" or \"digest\"`\n      );\n    }\n  }\n}\n\nfunction validateUpstreamIdentifierPaths(\n  storyboardId: string,\n  phase: { id?: string },\n  step: { id?: string; validations?: any[] }\n): void {\n  const validations = step.validations ?? [];\n  for (let validationIndex = 0; validationIndex < validations.length; validationIndex++) {\n    const validation = validations[validationIndex];\n    if (validation?.check !== 'upstream_traffic' || validation.identifier_paths === undefined) continue;\n    if (!Array.isArray(validation.identifier_paths)) {\n      throw new Error(\n        `[${storyboardId}] ${phase.id ?? '?'}.${\n          step.id ?? '?'\n        }.validations[${validationIndex}].identifier_paths: must be an array of request-payload paths`\n      );\n    }\n    for (let pathIndex = 0; pathIndex < validation.identifier_paths.length; pathIndex++) {\n      const path = validation.identifier_paths[pathIndex];\n      if (typeof path !== 'string' || path.length === 0) {\n        throw new Error(\n          `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${validationIndex}].identifier_paths[${pathIndex}]: must be a non-empty string`\n        );\n      }\n      const pathErrorPrefix = `[${storyboardId}] ${phase.id ?? '?'}.${step.id ?? '?'}.validations[${validationIndex}].identifier_paths[${pathIndex}]`;\n      let firstSegment: string;\n      try {\n        const validated = validateIdentifierPathSyntax(path);\n        firstSegment = validated.firstSegment;\n      } catch {\n        throw new Error(\n          `${pathErrorPrefix}: \"${path}\" is unsupported; identifier_paths resolve only against the request payload or sample_request using dotted paths with [*] array selectors`\n        );\n      }\n      const root = firstSegment.toLowerCase();\n      if (root === 'request' || root === 'response' || root === 'context') {\n        throw new Error(\n          `${pathErrorPrefix}: \"${path}\" is unsupported; identifier_paths resolve only against the request payload or sample_request`\n        );\n      }\n    }\n  }\n}\n\nfunction validateIdentifierPathSyntax(path: string): { normalized: string; firstSegment: string } {\n  const trimmed = path.trim();\n  const normalized = trimmed.startsWith('$.') ? trimmed.slice(2) : trimmed;\n  if (!IDENTIFIER_PATH_PATTERN.test(normalized)) {\n    throw new Error('unsupported identifier path syntax');\n  }\n  return { normalized, firstSegment: normalized.split(/[.[\\]]/, 1)[0] ?? '' };\n}\n\nfunction validateRequiredAnyOfTools(storyboard: Storyboard): void {\n  if (storyboard.required_any_of_tools === undefined) return;\n  if (!Array.isArray(storyboard.required_any_of_tools)) {\n    throw new Error(`[${storyboard.id}] required_any_of_tools: must be an array of tool-family objects`);\n  }\n  if (storyboard.required_any_of_tools.length === 0) {\n    throw new Error(`[${storyboard.id}] required_any_of_tools: [] is not allowed — omit the field to use no gate`);\n  }\n  for (let i = 0; i < storyboard.required_any_of_tools.length; i++) {\n    const family = storyboard.required_any_of_tools[i] as unknown;\n    if (family === null || typeof family !== 'object' || Array.isArray(family)) {\n      throw new Error(`[${storyboard.id}] required_any_of_tools[${i}]: must be an object`);\n    }\n    const { tools, rationale } = family as { tools?: unknown; rationale?: unknown };\n    if (!Array.isArray(tools) || tools.length < 2) {\n      throw new Error(`[${storyboard.id}] required_any_of_tools[${i}].tools: must list at least two tool names`);\n    }\n    for (const tool of tools) {\n      if (typeof tool !== 'string' || tool.length === 0) {\n        throw new Error(`[${storyboard.id}] required_any_of_tools[${i}].tools: entries must be non-empty strings`);\n      }\n    }\n    if (rationale !== undefined && typeof rationale !== 'string') {\n      throw new Error(`[${storyboard.id}] required_any_of_tools[${i}].rationale: must be a string`);\n    }\n  }\n}\n\n/**\n * Authoring-time validation for `phase.depends_on` (#1161). Each entry\n * must reference a phase declared earlier in the storyboard. Forward\n * references and self-references fail loud at parse time so authoring\n * mistakes (typos, reorderings) don't degrade silently into \"phase\n * always runs\" / \"phase always cascades.\"\n *\n * Rules:\n *   - Empty list (`depends_on: []`) is legal — it declares an\n *     independent phase. No further validation needed.\n *   - Each non-empty entry must be a non-empty string.\n *   - Each entry must reference a phase that appears EARLIER in the\n *     `storyboard.phases[]` array (forward references are rejected).\n *   - A phase cannot depend on itself.\n */\nfunction validatePhaseDependsOn(storyboard: Storyboard): void {\n  const phaseIdsSeen = new Set<string>();\n  for (const phase of storyboard.phases) {\n    if (phase.depends_on !== undefined) {\n      if (!Array.isArray(phase.depends_on)) {\n        throw new Error(`[${storyboard.id}] phase '${phase.id}': depends_on must be an array of phase ids`);\n      }\n      for (const dep of phase.depends_on) {\n        if (typeof dep !== 'string' || dep.length === 0) {\n          throw new Error(`[${storyboard.id}] phase '${phase.id}': depends_on entries must be non-empty strings`);\n        }\n        if (dep === phase.id) {\n          throw new Error(`[${storyboard.id}] phase '${phase.id}': depends_on cannot reference itself`);\n        }\n        if (!phaseIdsSeen.has(dep)) {\n          throw new Error(\n            `[${storyboard.id}] phase '${phase.id}': depends_on '${dep}' is not a phase declared earlier in this storyboard (forward and unknown references are rejected)`\n          );\n        }\n      }\n    }\n    phaseIdsSeen.add(phase.id);\n  }\n}\n\n/**\n * Authoring-time validation for `Storyboard.requires` (#1626). The field is\n * an array of non-empty requirement names:\n *\n *   - `requires: []` is rejected — an empty array reads as \"no\n *     requirements,\" which is the same as omitting the field; failing\n *     load forces the author to omit it explicitly.\n *   - Each entry must be a non-empty string.\n *\n * Unknown string values are allowed for forward compatibility. Runners that\n * don't know how to satisfy a future requirement skip at runtime with\n * `skip_reason: 'requirement_unmet'` and the authored value in\n * `skip.requirement`.\n */\nfunction validateRequires(storyboard: Storyboard): void {\n  if (storyboard.requires === undefined) return;\n  if (!Array.isArray(storyboard.requires)) {\n    throw new Error(\n      `[${storyboard.id}] requires: must be an array of requirement names (got ${typeof storyboard.requires})`\n    );\n  }\n  if (storyboard.requires.length === 0) {\n    throw new Error(`[${storyboard.id}] requires: [] is not allowed — omit the field to use the default ([real_wire])`);\n  }\n  for (let i = 0; i < storyboard.requires.length; i++) {\n    const name = storyboard.requires[i];\n    if (typeof name !== 'string' || name.length === 0) {\n      throw new Error(`[${storyboard.id}] requires[${i}]: entries must be non-empty strings`);\n    }\n  }\n}\n\n/**\n * Issue #820: mutating tasks (per {@link MUTATING_TASKS}) must have a\n * `sample_request` authored. The fixture is authoritative at run time —\n * there's no sane default payload for a write, and silently fabricating\n * one was the bug factory that produced #780 / #792 / #793 / #802 / #805.\n *\n * Error messages point at the task name, the step id, the storyboard, and\n * suggest the concrete author action.\n *\n * Opt-out: steps with `expect_error: true` that deliberately exercise\n * missing-fixture / malformed-payload seller behavior skip this check —\n * the author is signaling the payload is the test condition.\n *\n * Synthesized phases (`request-signing/synthesize.ts`, controller seeding)\n * start with `phase.steps = []` in YAML and the loader doesn't see the\n * runtime-generated steps, so those paths are not affected.\n */\nfunction validateFixtureForMutatingStep(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  if (!MUTATING_TASKS.has(step.task)) return;\n  if (step.sample_request !== undefined) return;\n  if (step.expect_error === true) return;\n  throw new Error(\n    `[${storyboardId}] phase '${phase.id}' step '${step.id}' (task=${step.task}): ` +\n      `mutating tasks require a sample_request fixture — the runner no longer fabricates ` +\n      `write payloads. Author sample_request in the step or, for intentionally malformed ` +\n      `payloads, set expect_error: true.`\n  );\n}\n\n/**\n * `omit_account: true` must be paired with `expect_error: true`.\n *\n * An accountless `create_media_buy` will always be rejected by a spec-compliant\n * seller; a step that sets `omit_account` without `expect_error` will be graded\n * as a failure (not a controlled negative test), producing a misleading\n * compliance result. Fail loud at parse time so the author sees the problem\n * during storyboard load, not at run time.\n */\nfunction validateOmitFlagCoherence(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  if (step.omit_account && step.expect_error !== true) {\n    throw new Error(\n      `[${storyboardId}] phase '${phase.id}' step '${step.id}': ` +\n        `omit_account: true requires expect_error: true — an accountless ` +\n        `create_media_buy will always be rejected by a spec-compliant seller.`\n    );\n  }\n}\n\n/**\n * Each `context_outputs` entry must declare exactly one source: either\n * `path` (extract from response) or `generate` (mint at run time). An entry\n * with neither is a silent no-op; one with both would silently pick `generate`\n * and ignore `path`. Both are authoring foot-guns that should fail loud.\n */\nfunction validateContextOutputs(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  if (!step.context_outputs?.length) return;\n  for (const output of step.context_outputs) {\n    const hasPath = output.path !== undefined;\n    const hasGenerate = output.generate !== undefined;\n    if (!hasPath && !hasGenerate) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': context_outputs entry ` +\n          `'${output.key}' must set exactly one of 'path' or 'generate'.`\n      );\n    }\n    if (hasPath && hasGenerate) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': context_outputs entry ` +\n          `'${output.key}' sets both 'path' and 'generate' — they are mutually exclusive.`\n      );\n    }\n    // Validate generator name. The runtime resolver also checks but the loader\n    // catches typos at storyboard-load time so authors see the failure on\n    // build, not on the first run.\n    if (hasGenerate && output.generate !== 'uuid_v4' && output.generate !== 'opaque_id') {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': context_outputs entry ` +\n          `'${output.key}' has unknown generate value '${output.generate}'. ` +\n          `Supported: 'uuid_v4', 'opaque_id'.`\n      );\n    }\n  }\n}\n\n/**\n * Authoring-time validation for `provides_state_for` (the AdCP 3.0.3 spec\n * field — adcp#3734) and the legacy `peer_substitutes_for` synonym. The\n * runner treats the field as same-phase-only and substitution-only-when-\n * stateful; surface those constraints at parse time so storyboard authors\n * see typos and cross-phase references on build, not as a silent no-rescue\n * at run time.\n *\n * Both field names parse to the same canonical normalized form on the step\n * object (the spec name `provides_state_for` is preferred when both are\n * declared). The deprecation alias is documented in `types.ts`.\n *\n * Rules:\n *   - Each target must reference a step that exists in the same phase.\n *   - A step cannot substitute for itself.\n *   - The substitute step itself must be `stateful: true` — non-stateful\n *     passes don't establish state per the cascade contract.\n *   - The target step must be `stateful: true` — non-stateful targets\n *     don't participate in cascade gating, so a substitution declaration\n *     would be a no-op.\n *   - When both fields are declared on the same step, they must match\n *     element-for-element (the deprecation contract is \"synonym for\", not\n *     \"additive with\").\n */\nfunction validatePeerSubstitutesFor(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  const newField = step.provides_state_for;\n  const legacyField = step.peer_substitutes_for;\n  if (newField === undefined && legacyField === undefined) return;\n\n  if (newField !== undefined && legacyField !== undefined) {\n    // Order-sensitive equality: `[A, B]` vs `[B, A]` would throw despite being\n    // semantically equivalent. Authors mid-migration should write the same list\n    // in both fields; the deprecation alias is a literal synonym, not a\n    // same-set restatement.\n    const a = JSON.stringify(Array.isArray(newField) ? newField : [newField]);\n    const b = JSON.stringify(Array.isArray(legacyField) ? legacyField : [legacyField]);\n    if (a !== b) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': both provides_state_for and ` +\n          `peer_substitutes_for declared with different values — pick one (provides_state_for is the ` +\n          `spec field; peer_substitutes_for is a deprecated synonym)`\n      );\n    }\n  }\n\n  // Normalize onto provides_state_for so the runner can read a single field.\n  // peer_substitutes_for stays for back-compat with any consumer code that\n  // already reads it.\n  if (newField === undefined && legacyField !== undefined) {\n    step.provides_state_for = legacyField;\n  } else if (newField !== undefined && legacyField === undefined) {\n    step.peer_substitutes_for = newField;\n  }\n\n  const sourceFieldName = newField !== undefined ? 'provides_state_for' : 'peer_substitutes_for';\n  const declared = step.provides_state_for!;\n  const targets = Array.isArray(declared) ? declared : [declared];\n  if (!step.stateful) {\n    throw new Error(\n      `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} is only legal on stateful steps`\n    );\n  }\n  const phaseStepIds = new Map(phase.steps.map(s => [s.id, s]));\n  for (const target of targets) {\n    if (typeof target !== 'string' || target.length === 0) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} entries must be non-empty strings`\n      );\n    }\n    if (target === step.id) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} cannot reference itself`\n      );\n    }\n    const targetStep = phaseStepIds.get(target);\n    if (!targetStep) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} target '${target}' is not a step in this phase (same-phase only)`\n      );\n    }\n    if (!targetStep.stateful) {\n      throw new Error(\n        `[${storyboardId}] phase '${phase.id}' step '${step.id}': ${sourceFieldName} target '${target}' must be stateful`\n      );\n    }\n  }\n}\n\nfunction validateBranchSet(storyboardId: string, phase: Storyboard['phases'][number]): void {\n  if (phase.branch_set === undefined) return;\n  const bs = phase.branch_set as unknown;\n  if (!bs || typeof bs !== 'object') {\n    throw new Error(`[${storyboardId}] phase '${phase.id}': branch_set must be an object with { id, semantics }`);\n  }\n  const { id, semantics } = bs as Record<string, unknown>;\n  if (typeof id !== 'string' || id.length === 0) {\n    throw new Error(`[${storyboardId}] phase '${phase.id}': branch_set.id must be a non-empty string`);\n  }\n  if (typeof semantics !== 'string' || semantics.length === 0) {\n    throw new Error(`[${storyboardId}] phase '${phase.id}': branch_set.semantics must be a non-empty string`);\n  }\n  // Only `any_of` is defined in AdCP today (adcp#2646 lint rule 2 —\n  // `at_least_n` and `all_of` are reserved but not defined). Reject unknown\n  // values at parse rather than silently skipping grading at runtime, so\n  // spec-drift typos fail loud instead of degrading to raw `failed` peers.\n  if (!(BRANCH_SET_SEMANTICS as readonly string[]).includes(semantics)) {\n    throw new Error(\n      `[${storyboardId}] phase '${phase.id}': branch_set.semantics='${semantics}' is not supported (valid: ${BRANCH_SET_SEMANTICS.join(', ')})`\n    );\n  }\n  // Schema constraint: every phase in a branch set MUST be optional. A\n  // non-optional branch-set phase would fail the storyboard on any step\n  // failure regardless of peer contribution, defeating the any_of gate.\n  if (phase.optional !== true) {\n    throw new Error(`[${storyboardId}] phase '${phase.id}': phases declaring branch_set must set 'optional: true'`);\n  }\n}\n\n/**\n * Resolve the `contributes: true` boolean shorthand introduced alongside the\n * first-class `branch_set:` phase field (adcp-client#693, adcp#2646).\n *\n * Rules:\n *   - `contributes: true` is legal only inside a phase that declares `branch_set:`.\n *   - A step MUST NOT set both `contributes` and `contributes_to` (ambiguous).\n *   - A string `contributes_to` inside a branch_set phase MUST equal `branch_set.id`\n *     (otherwise the aggregation target drifts — same invariant the spec lint enforces).\n *\n * After resolution, `step.contributes_to` carries the flag name and `step.contributes`\n * is cleared, so the runner reads a single field regardless of authoring form.\n */\nfunction resolveContributesShorthand(\n  storyboardId: string,\n  phase: Storyboard['phases'][number],\n  step: Storyboard['phases'][number]['steps'][number]\n): void {\n  const hasBoolean = step.contributes !== undefined;\n  const hasString = step.contributes_to !== undefined;\n\n  if (hasBoolean && hasString) {\n    throw new Error(`[${storyboardId}] step '${step.id}' declares both 'contributes' and 'contributes_to' — pick one`);\n  }\n\n  if (hasBoolean) {\n    if (step.contributes === true) {\n      if (!phase.branch_set) {\n        throw new Error(\n          `[${storyboardId}] step '${step.id}': 'contributes: true' is only legal inside a phase that declares branch_set`\n        );\n      }\n      step.contributes_to = phase.branch_set.id;\n    }\n    delete step.contributes;\n    return;\n  }\n\n  if (hasString && phase.branch_set && step.contributes_to !== phase.branch_set.id) {\n    throw new Error(\n      `[${storyboardId}] step '${step.id}': contributes_to='${step.contributes_to}' must equal enclosing phase's branch_set.id='${phase.branch_set.id}'`\n    );\n  }\n}\n"],"mappings":"AAQA,SAAS,oBAAoB;AAC7B,SAAS,aAAa;AAEtB,SAAS,sBAAsB;AAC/B,SAAS,6CAA6C;AACtD,SAAS,SAAS,mBAAmB;AAO9B,MAAM,uBAAuB,CAAC,QAAQ;AAE7C,MAAM,0BAA0B,OAAO;AACvC,MAAM,0BAA0B,IAAI,OAAO,IAAI,uBAAuB,SAAS,uBAAuB,KAAK;AAGpG,SAAS,gBAAgB,aAAiC;AAC/D,QAAM,SAAS,MAAM,WAAW;AAChC,MAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,QAAQ;AAClC,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,MAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,gBAAgB,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,aAAW,SAAS,OAAO,QAAQ;AAIjC,QAAI,CAAC,MAAM,MAAO,OAAM,QAAQ,CAAC;AAEjC,eAAW,QAAQ,MAAM,OAAO;AAC9B,UAAI,CAAC,KAAK,gBAAiB;AAC3B,iBAAW,UAAU,KAAK,iBAAiB;AACzC,cAAM,MAAM;AACZ,YAAI,IAAI,QAAQ,CAAC,IAAI,KAAK;AACxB,iBAAO,MAAM,IAAI;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,0BAAwB,MAAM;AAC9B,SAAO;AACT;AAGO,SAAS,mBAAmB,UAA8B;AAC/D,SAAO,gBAAgB,aAAa,UAAU,OAAO,CAAC;AACxD;AAWO,SAAS,wBAAwB,YAA8B;AACpE,mBAAiB,UAAU;AAC3B,wCAAsC,UAAU;AAChD,6BAA2B,UAAU;AACrC,yBAAuB,UAAU;AACjC,aAAW,SAAS,WAAW,QAAQ;AACrC,sBAAkB,WAAW,IAAI,KAAK;AACtC,QAAI,CAAC,MAAM,MAAO;AAClB,eAAW,QAAQ,MAAM,OAAO;AAC9B,kCAA4B,WAAW,IAAI,OAAO,IAAI;AACtD,qCAA+B,WAAW,IAAI,OAAO,IAAI;AACzD,gCAA0B,WAAW,IAAI,OAAO,IAAI;AACpD,6BAAuB,WAAW,IAAI,OAAO,IAAI;AACjD,sCAAgC,WAAW,IAAI,OAAO,IAAI;AAC1D,sCAAgC,WAAW,IAAI,OAAO,IAAI;AAC1D,mCAA6B,WAAW,IAAI,OAAO,IAAI;AACvD,iCAA2B,WAAW,IAAI,OAAO,IAAI;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,6BACP,cACA,OACA,MACM;AACN,WAAS,QAAQ,GAAG,SAAS,KAAK,eAAe,CAAC,GAAG,QAAQ,SAAS;AACpE,UAAM,aAAa,KAAK,YAAa,KAAK;AAC1C,QACE,YAAY,aAAa,UACzB,WAAW,aAAa,cACxB,WAAW,aAAa,YACxB;AACA,YAAMA,UAAS,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,KAAK;AAC1F,YAAM,IAAI,MAAM,GAAGA,OAAM,oDAAoD;AAAA,IAC/E;AACA,QAAI,YAAY,aAAa,WAAY;AACzC,UAAM,SAAS,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,KAAK;AAC1F,UAAM,YAAY,WAAW,0BAA0B;AACvD,UAAM,eAAe,WAAW,uBAAuB;AACvD,QAAI,cAAc,cAAc;AAC9B,YAAM,IAAI;AAAA,QACR,GAAG,MAAM;AAAA,MACX;AAAA,IACF;AACA,QACE,cACC,OAAO,WAAW,0BAA0B,YAAY,CAAC,YAAY,WAAW,qBAAqB,IACtG;AACA,YAAM,IAAI,MAAM,GAAG,MAAM,uDAAuD;AAAA,IAClF;AACA,QACE,iBACC,OAAO,WAAW,uBAAuB,YACxC,WAAW,uBAAuB,QAClC,OAAO,WAAW,mBAAmB,WAAW,YAChD,WAAW,mBAAmB,OAAO,KAAK,EAAE,WAAW,IACzD;AACA,YAAM,IAAI,MAAM,GAAG,MAAM,wDAAwD;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,gCACP,cACA,OACA,MACM;AACN,QAAM,cAAc,KAAK,eAAe,CAAC;AACzC,WAAS,kBAAkB,GAAG,kBAAkB,YAAY,QAAQ,mBAAmB;AACrF,UAAM,aAAa,YAAY,eAAe;AAC9C,QAAI,YAAY,UAAU,mBAAoB;AAC9C,UAAM,OAAO,WAAW;AACxB,QAAI,SAAS,UAAa,SAAS,SAAS,SAAS,UAAU;AAC7D,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,eAAe;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gCACP,cACA,OACA,MACM;AACN,QAAM,cAAc,KAAK,eAAe,CAAC;AACzC,WAAS,kBAAkB,GAAG,kBAAkB,YAAY,QAAQ,mBAAmB;AACrF,UAAM,aAAa,YAAY,eAAe;AAC9C,QAAI,YAAY,UAAU,sBAAsB,WAAW,qBAAqB,OAAW;AAC3F,QAAI,CAAC,MAAM,QAAQ,WAAW,gBAAgB,GAAG;AAC/C,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAClC,KAAK,MAAM,GACb,gBAAgB,eAAe;AAAA,MACjC;AAAA,IACF;AACA,aAAS,YAAY,GAAG,YAAY,WAAW,iBAAiB,QAAQ,aAAa;AACnF,YAAM,OAAO,WAAW,iBAAiB,SAAS;AAClD,UAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,cAAM,IAAI;AAAA,UACR,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,eAAe,sBAAsB,SAAS;AAAA,QACtH;AAAA,MACF;AACA,YAAM,kBAAkB,IAAI,YAAY,KAAK,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,gBAAgB,eAAe,sBAAsB,SAAS;AAC5I,UAAI;AACJ,UAAI;AACF,cAAM,YAAY,6BAA6B,IAAI;AACnD,uBAAe,UAAU;AAAA,MAC3B,QAAQ;AACN,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,MAAM,IAAI;AAAA,QAC9B;AAAA,MACF;AACA,YAAM,OAAO,aAAa,YAAY;AACtC,UAAI,SAAS,aAAa,SAAS,cAAc,SAAS,WAAW;AACnE,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,MAAM,IAAI;AAAA,QAC9B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,6BAA6B,MAA4D;AAChG,QAAM,UAAU,KAAK,KAAK;AAC1B,QAAM,aAAa,QAAQ,WAAW,IAAI,IAAI,QAAQ,MAAM,CAAC,IAAI;AACjE,MAAI,CAAC,wBAAwB,KAAK,UAAU,GAAG;AAC7C,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,SAAO,EAAE,YAAY,cAAc,WAAW,MAAM,UAAU,CAAC,EAAE,CAAC,KAAK,GAAG;AAC5E;AAEA,SAAS,2BAA2B,YAA8B;AAChE,MAAI,WAAW,0BAA0B,OAAW;AACpD,MAAI,CAAC,MAAM,QAAQ,WAAW,qBAAqB,GAAG;AACpD,UAAM,IAAI,MAAM,IAAI,WAAW,EAAE,kEAAkE;AAAA,EACrG;AACA,MAAI,WAAW,sBAAsB,WAAW,GAAG;AACjD,UAAM,IAAI,MAAM,IAAI,WAAW,EAAE,iFAA4E;AAAA,EAC/G;AACA,WAAS,IAAI,GAAG,IAAI,WAAW,sBAAsB,QAAQ,KAAK;AAChE,UAAM,SAAS,WAAW,sBAAsB,CAAC;AACjD,QAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAC1E,YAAM,IAAI,MAAM,IAAI,WAAW,EAAE,2BAA2B,CAAC,sBAAsB;AAAA,IACrF;AACA,UAAM,EAAE,OAAO,UAAU,IAAI;AAC7B,QAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,SAAS,GAAG;AAC7C,YAAM,IAAI,MAAM,IAAI,WAAW,EAAE,2BAA2B,CAAC,4CAA4C;AAAA,IAC3G;AACA,eAAW,QAAQ,OAAO;AACxB,UAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,cAAM,IAAI,MAAM,IAAI,WAAW,EAAE,2BAA2B,CAAC,4CAA4C;AAAA,MAC3G;AAAA,IACF;AACA,QAAI,cAAc,UAAa,OAAO,cAAc,UAAU;AAC5D,YAAM,IAAI,MAAM,IAAI,WAAW,EAAE,2BAA2B,CAAC,+BAA+B;AAAA,IAC9F;AAAA,EACF;AACF;AAiBA,SAAS,uBAAuB,YAA8B;AAC5D,QAAM,eAAe,oBAAI,IAAY;AACrC,aAAW,SAAS,WAAW,QAAQ;AACrC,QAAI,MAAM,eAAe,QAAW;AAClC,UAAI,CAAC,MAAM,QAAQ,MAAM,UAAU,GAAG;AACpC,cAAM,IAAI,MAAM,IAAI,WAAW,EAAE,YAAY,MAAM,EAAE,6CAA6C;AAAA,MACpG;AACA,iBAAW,OAAO,MAAM,YAAY;AAClC,YAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,GAAG;AAC/C,gBAAM,IAAI,MAAM,IAAI,WAAW,EAAE,YAAY,MAAM,EAAE,iDAAiD;AAAA,QACxG;AACA,YAAI,QAAQ,MAAM,IAAI;AACpB,gBAAM,IAAI,MAAM,IAAI,WAAW,EAAE,YAAY,MAAM,EAAE,uCAAuC;AAAA,QAC9F;AACA,YAAI,CAAC,aAAa,IAAI,GAAG,GAAG;AAC1B,gBAAM,IAAI;AAAA,YACR,IAAI,WAAW,EAAE,YAAY,MAAM,EAAE,kBAAkB,GAAG;AAAA,UAC5D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,iBAAa,IAAI,MAAM,EAAE;AAAA,EAC3B;AACF;AAgBA,SAAS,iBAAiB,YAA8B;AACtD,MAAI,WAAW,aAAa,OAAW;AACvC,MAAI,CAAC,MAAM,QAAQ,WAAW,QAAQ,GAAG;AACvC,UAAM,IAAI;AAAA,MACR,IAAI,WAAW,EAAE,0DAA0D,OAAO,WAAW,QAAQ;AAAA,IACvG;AAAA,EACF;AACA,MAAI,WAAW,SAAS,WAAW,GAAG;AACpC,UAAM,IAAI,MAAM,IAAI,WAAW,EAAE,sFAAiF;AAAA,EACpH;AACA,WAAS,IAAI,GAAG,IAAI,WAAW,SAAS,QAAQ,KAAK;AACnD,UAAM,OAAO,WAAW,SAAS,CAAC;AAClC,QAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,YAAM,IAAI,MAAM,IAAI,WAAW,EAAE,cAAc,CAAC,sCAAsC;AAAA,IACxF;AAAA,EACF;AACF;AAmBA,SAAS,+BACP,cACA,OACA,MACM;AACN,MAAI,CAAC,eAAe,IAAI,KAAK,IAAI,EAAG;AACpC,MAAI,KAAK,mBAAmB,OAAW;AACvC,MAAI,KAAK,iBAAiB,KAAM;AAChC,QAAM,IAAI;AAAA,IACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,WAAW,KAAK,IAAI;AAAA,EAI5E;AACF;AAWA,SAAS,0BACP,cACA,OACA,MACM;AACN,MAAI,KAAK,gBAAgB,KAAK,iBAAiB,MAAM;AACnD,UAAM,IAAI;AAAA,MACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE;AAAA,IAGxD;AAAA,EACF;AACF;AAQA,SAAS,uBACP,cACA,OACA,MACM;AACN,MAAI,CAAC,KAAK,iBAAiB,OAAQ;AACnC,aAAW,UAAU,KAAK,iBAAiB;AACzC,UAAM,UAAU,OAAO,SAAS;AAChC,UAAM,cAAc,OAAO,aAAa;AACxC,QAAI,CAAC,WAAW,CAAC,aAAa;AAC5B,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,6BAChD,OAAO,GAAG;AAAA,MAClB;AAAA,IACF;AACA,QAAI,WAAW,aAAa;AAC1B,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,6BAChD,OAAO,GAAG;AAAA,MAClB;AAAA,IACF;AAIA,QAAI,eAAe,OAAO,aAAa,aAAa,OAAO,aAAa,aAAa;AACnF,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,6BAChD,OAAO,GAAG,iCAAiC,OAAO,QAAQ;AAAA,MAElE;AAAA,IACF;AAAA,EACF;AACF;AA0BA,SAAS,2BACP,cACA,OACA,MACM;AACN,QAAM,WAAW,KAAK;AACtB,QAAM,cAAc,KAAK;AACzB,MAAI,aAAa,UAAa,gBAAgB,OAAW;AAEzD,MAAI,aAAa,UAAa,gBAAgB,QAAW;AAKvD,UAAM,IAAI,KAAK,UAAU,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC;AACxE,UAAM,IAAI,KAAK,UAAU,MAAM,QAAQ,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;AACjF,QAAI,MAAM,GAAG;AACX,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE;AAAA,MAGxD;AAAA,IACF;AAAA,EACF;AAKA,MAAI,aAAa,UAAa,gBAAgB,QAAW;AACvD,SAAK,qBAAqB;AAAA,EAC5B,WAAW,aAAa,UAAa,gBAAgB,QAAW;AAC9D,SAAK,uBAAuB;AAAA,EAC9B;AAEA,QAAM,kBAAkB,aAAa,SAAY,uBAAuB;AACxE,QAAM,WAAW,KAAK;AACtB,QAAM,UAAU,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AAC9D,MAAI,CAAC,KAAK,UAAU;AAClB,UAAM,IAAI;AAAA,MACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe;AAAA,IAC7E;AAAA,EACF;AACA,QAAM,eAAe,IAAI,IAAI,MAAM,MAAM,IAAI,OAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAAG;AACrD,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe;AAAA,MAC7E;AAAA,IACF;AACA,QAAI,WAAW,KAAK,IAAI;AACtB,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe;AAAA,MAC7E;AAAA,IACF;AACA,UAAM,aAAa,aAAa,IAAI,MAAM;AAC1C,QAAI,CAAC,YAAY;AACf,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe,YAAY,MAAM;AAAA,MAC/F;AAAA,IACF;AACA,QAAI,CAAC,WAAW,UAAU;AACxB,YAAM,IAAI;AAAA,QACR,IAAI,YAAY,YAAY,MAAM,EAAE,WAAW,KAAK,EAAE,MAAM,eAAe,YAAY,MAAM;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,cAAsB,OAA2C;AAC1F,MAAI,MAAM,eAAe,OAAW;AACpC,QAAM,KAAK,MAAM;AACjB,MAAI,CAAC,MAAM,OAAO,OAAO,UAAU;AACjC,UAAM,IAAI,MAAM,IAAI,YAAY,YAAY,MAAM,EAAE,wDAAwD;AAAA,EAC9G;AACA,QAAM,EAAE,IAAI,UAAU,IAAI;AAC1B,MAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG;AAC7C,UAAM,IAAI,MAAM,IAAI,YAAY,YAAY,MAAM,EAAE,6CAA6C;AAAA,EACnG;AACA,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,MAAM,IAAI,YAAY,YAAY,MAAM,EAAE,oDAAoD;AAAA,EAC1G;AAKA,MAAI,CAAE,qBAA2C,SAAS,SAAS,GAAG;AACpE,UAAM,IAAI;AAAA,MACR,IAAI,YAAY,YAAY,MAAM,EAAE,4BAA4B,SAAS,8BAA8B,qBAAqB,KAAK,IAAI,CAAC;AAAA,IACxI;AAAA,EACF;AAIA,MAAI,MAAM,aAAa,MAAM;AAC3B,UAAM,IAAI,MAAM,IAAI,YAAY,YAAY,MAAM,EAAE,0DAA0D;AAAA,EAChH;AACF;AAeA,SAAS,4BACP,cACA,OACA,MACM;AACN,QAAM,aAAa,KAAK,gBAAgB;AACxC,QAAM,YAAY,KAAK,mBAAmB;AAE1C,MAAI,cAAc,WAAW;AAC3B,UAAM,IAAI,MAAM,IAAI,YAAY,WAAW,KAAK,EAAE,oEAA+D;AAAA,EACnH;AAEA,MAAI,YAAY;AACd,QAAI,KAAK,gBAAgB,MAAM;AAC7B,UAAI,CAAC,MAAM,YAAY;AACrB,cAAM,IAAI;AAAA,UACR,IAAI,YAAY,WAAW,KAAK,EAAE;AAAA,QACpC;AAAA,MACF;AACA,WAAK,iBAAiB,MAAM,WAAW;AAAA,IACzC;AACA,WAAO,KAAK;AACZ;AAAA,EACF;AAEA,MAAI,aAAa,MAAM,cAAc,KAAK,mBAAmB,MAAM,WAAW,IAAI;AAChF,UAAM,IAAI;AAAA,MACR,IAAI,YAAY,WAAW,KAAK,EAAE,sBAAsB,KAAK,cAAc,iDAAiD,MAAM,WAAW,EAAE;AAAA,IACjJ;AAAA,EACF;AACF;","names":["prefix"]}

package/dist/lib/testing/storyboard/provenance.d.mts

@@ -0,0 +1,3 @@
+import type { Storyboard } from './types.mjs';
+export declare function markStoryboardComplianceRoot<T extends Storyboard>(storyboard: T, complianceDir: string): T;
+export declare function trustedStoryboardComplianceRoot(storyboard: object): string | undefined;

package/dist/lib/testing/storyboard/provenance.d.ts

@@ -0,0 +1,4 @@
+import type { Storyboard } from './types';
+export declare function markStoryboardComplianceRoot<T extends Storyboard>(storyboard: T, complianceDir: string): T;
+export declare function trustedStoryboardComplianceRoot(storyboard: object): string | undefined;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/lib/testing/storyboard/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../../src/lib/testing/storyboard/provenance.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAY1C,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,UAAU,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,CAAC,CAG1G;AAED,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtF"}

package/dist/lib/testing/storyboard/provenance.js

@@ -0,0 +1,38 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var provenance_exports = {};
+__export(provenance_exports, {
+  markStoryboardComplianceRoot: () => markStoryboardComplianceRoot,
+  trustedStoryboardComplianceRoot: () => trustedStoryboardComplianceRoot
+});
+module.exports = __toCommonJS(provenance_exports);
+const complianceRoots = /* @__PURE__ */ new WeakMap();
+function markStoryboardComplianceRoot(storyboard, complianceDir) {
+  complianceRoots.set(storyboard, complianceDir);
+  return storyboard;
+}
+function trustedStoryboardComplianceRoot(storyboard) {
+  return complianceRoots.get(storyboard);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  markStoryboardComplianceRoot,
+  trustedStoryboardComplianceRoot
+});
+//# sourceMappingURL=provenance.js.map

package/dist/lib/testing/storyboard/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/lib/testing/storyboard/provenance.ts"],"sourcesContent":["import type { Storyboard } from './types';\n\n/**\n * Loader-owned compliance provenance.\n *\n * Storyboard YAML is data, not authority to select arbitrary local filesystem\n * roots. Keep the trusted cache root out-of-band so an ad-hoc `--file`\n * storyboard cannot forge the public `compliance_dir` diagnostic field and\n * cause bundle-relative fixtures or credentials to be read from elsewhere.\n */\nconst complianceRoots = new WeakMap<object, string>();\n\nexport function markStoryboardComplianceRoot<T extends Storyboard>(storyboard: T, complianceDir: string): T {\n  complianceRoots.set(storyboard, complianceDir);\n  return storyboard;\n}\n\nexport function trustedStoryboardComplianceRoot(storyboard: object): string | undefined {\n  return complianceRoots.get(storyboard);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,MAAM,kBAAkB,oBAAI,QAAwB;AAE7C,SAAS,6BAAmD,YAAe,eAA0B;AAC1G,kBAAgB,IAAI,YAAY,aAAa;AAC7C,SAAO;AACT;AAEO,SAAS,gCAAgC,YAAwC;AACtF,SAAO,gBAAgB,IAAI,UAAU;AACvC;","names":[]}

package/dist/lib/testing/storyboard/provenance.mjs

@@ -0,0 +1,13 @@
+const complianceRoots = /* @__PURE__ */ new WeakMap();
+function markStoryboardComplianceRoot(storyboard, complianceDir) {
+  complianceRoots.set(storyboard, complianceDir);
+  return storyboard;
+}
+function trustedStoryboardComplianceRoot(storyboard) {
+  return complianceRoots.get(storyboard);
+}
+export {
+  markStoryboardComplianceRoot,
+  trustedStoryboardComplianceRoot
+};
+//# sourceMappingURL=provenance.mjs.map

package/dist/lib/testing/storyboard/provenance.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/lib/testing/storyboard/provenance.ts"],"sourcesContent":["import type { Storyboard } from './types';\n\n/**\n * Loader-owned compliance provenance.\n *\n * Storyboard YAML is data, not authority to select arbitrary local filesystem\n * roots. Keep the trusted cache root out-of-band so an ad-hoc `--file`\n * storyboard cannot forge the public `compliance_dir` diagnostic field and\n * cause bundle-relative fixtures or credentials to be read from elsewhere.\n */\nconst complianceRoots = new WeakMap<object, string>();\n\nexport function markStoryboardComplianceRoot<T extends Storyboard>(storyboard: T, complianceDir: string): T {\n  complianceRoots.set(storyboard, complianceDir);\n  return storyboard;\n}\n\nexport function trustedStoryboardComplianceRoot(storyboard: object): string | undefined {\n  return complianceRoots.get(storyboard);\n}\n"],"mappings":"AAUA,MAAM,kBAAkB,oBAAI,QAAwB;AAE7C,SAAS,6BAAmD,YAAe,eAA0B;AAC1G,kBAAgB,IAAI,YAAY,aAAa;AAC7C,SAAO;AACT;AAEO,SAAS,gCAAgC,YAAwC;AACtF,SAAO,gBAAgB,IAAI,UAAU;AACvC;","names":[]}

package/dist/lib/testing/storyboard/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../../src/lib/testing/storyboard/runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmIH,OAAO,KAAK,EAiBV,2BAA2B,EAG3B,UAAU,EACV,cAAc,EAEd,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAEhB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EAErB,uBAAuB,EACvB,qBAAqB,EAGtB,MAAM,SAAS,CAAC;AASjB,OAAO,KAAK,EAA4B,cAAc,EAAE,MAAM,UAAU,CAAC;AAqCzE,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,oBAAoB,GAC5B,oBAAoB,CAEtB;AAED,wBAAgB,0BAA0B,CACxC,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,OAAO,EAAE,oBAAoB,GAC5B,oBAAoB,CAUtB;AA+ED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAS/E;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,2BAA2B,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA0DlH;AAipBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE9D;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAEpC;AAED,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAEpC;AAoCD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,EACjC,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AA8yBD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EAAE,EACnB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,cAAc,GAC5B,gBAAgB,CA+ClB;AAq/DD;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,qBAAqB,EAAE,GAC9B,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CA0B9G;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,uBAAuB,CA4BlG;AAMD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAe/B;AAmjGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6DzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBpH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,cAAc,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzB;AAkfD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,iBAAsB,GAC9B,qBAAqB,GAAG,SAAS,CAgBnC"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../../src/lib/testing/storyboard/runner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAoIH,OAAO,KAAK,EAiBV,2BAA2B,EAG3B,UAAU,EACV,cAAc,EAEd,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,EAEhB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EAErB,uBAAuB,EACvB,qBAAqB,EAGtB,MAAM,SAAS,CAAC;AASjB,OAAO,KAAK,EAA4B,cAAc,EAAE,MAAM,UAAU,CAAC;AAqCzE,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,oBAAoB,GAC5B,oBAAoB,CAMtB;AAED,wBAAgB,0BAA0B,CACxC,kBAAkB,EAAE,MAAM,GAAG,SAAS,EACtC,OAAO,EAAE,oBAAoB,GAC5B,oBAAoB,CAUtB;AA+ED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAS/E;AAoCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,2BAA2B,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA0DlH;AAipBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE9D;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAEpC;AAED,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAEpC;AAoCD;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,EACjC,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,gBAAgB,CAAC,CAoB3B;AA8yBD;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EAAE,EACnB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,cAAc,GAC5B,gBAAgB,CA+ClB;AAq/DD;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,qBAAqB,EAAE,GAC9B,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CA0B9G;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,uBAAuB,CA4BlG;AAMD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAkB/B;AAomGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA6DzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBpH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,cAAc,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzB;AAkfD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,UAAU,EACtB,OAAO,GAAE,iBAAsB,GAC9B,qBAAqB,GAAG,SAAS,CAgBnC"}

package/dist/lib/testing/storyboard/runner.js

@@ -66,6 +66,7 @@ var import_probes = require('./probes.js');
 var import_capabilities_types = require('../../signing/agent-resolver/capabilities-types.js');
 var import_test_kit = require('./test-kit.js');
 var import_loader = require('./loader.js');
+var import_provenance = require('./provenance.js');
 var import_probe_dispatch = require('./request-signing/probe-dispatch.js');
 var import_webhook_receiver = require('./webhook-receiver.js');
 var import_webhook_assertions = require('./webhook-assertions.js');
@@ -102,7 +103,10 @@ const CONTROLLER_SEEDING_FAILED_DETAIL = "Skipped: pre-flight comply_test_contro
 const FIXTURE_SEED_UNSUPPORTED_DETAIL = "Skipped: pre-flight comply_test_controller seeding requires a seed_* scenario this agent does not implement (`fixture_seed_unsupported`).";
 const OAUTH_NOT_ADVERTISED_DETAIL = "Skipped: agent does not advertise OAuth \u2014 /.well-known/oauth-protected-resource returned 404 (RFC 9728 \xA73). API-key path must carry auth_mechanism_verified for this storyboard to pass.";
 function applyStoryboardVersionOptions(storyboard, options) {
-  return applyAdcpVersionRunOptions(storyboard.adcp_version, options);
+  const versioned = applyAdcpVersionRunOptions(storyboard.adcp_version, options);
+  const mayInheritStoryboardDir = options.adcpVersion === void 0 || options.adcpVersion === storyboard.adcp_version;
+  const complianceDir = versioned.complianceDir ?? (mayInheritStoryboardDir ? (0, import_provenance.trustedStoryboardComplianceRoot)(storyboard) : void 0);
+  return complianceDir && versioned.complianceDir !== complianceDir ? { ...versioned, complianceDir } : versioned;
 }
 function applyAdcpVersionRunOptions(defaultAdcpVersion, options) {
   const adcpVersion = options.adcpVersion ?? defaultAdcpVersion;
@@ -591,6 +595,7 @@ async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
   return (0, import_protocols.withMCPConnectionScope)(
     async () => {
       options = applyStoryboardVersionOptions(storyboard, options);
+      options = (0, import_test_kit.resolveDeclaredTestKit)(storyboard, options);
       options = { ...options, transport: (0, import_protocols.normalizeTransportOptions)(options.transport) };
       const schemaRoot = getRunSchemaRoot(options);
       if (schemaRoot) {
@@ -2410,6 +2415,7 @@ async function runStoryboardStep(agentUrl, storyboard, stepId, options = {}) {
     async () => {
       (0, import_loader.validateStoryboardShape)(storyboard);
       options = applyStoryboardVersionOptions(storyboard, options);
+      options = (0, import_test_kit.resolveDeclaredTestKit)(storyboard, options);
       const schemaRoot = getRunSchemaRoot(options);
       if (schemaRoot) {
         return await (0, import_schema_loader.withExternalSchemaRoot)(
@@ -2770,7 +2776,23 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   }
   const testsMissingIdempotencyKey = step.omit_idempotency_key === true && (0, import_idempotency.isMutatingTask)(effectiveStep.task);
   const testsMissingAccount = step.omit_account === true && effectiveStep.task === "create_media_buy";
-  const rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+  let rawProbeHeaders;
+  try {
+    rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+  } catch (err) {
+    return {
+      step_id: step.id,
+      phase_id: phaseId,
+      title: step.title,
+      task: step.task,
+      passed: false,
+      duration_ms: 0,
+      validations: [],
+      context,
+      error: `Step auth configuration error: ${err instanceof Error ? err.message : String(err)}`,
+      extraction: { path: "none" }
+    };
+  }
   const useRawProbe = rawProbeHeaders !== void 0;
   let taskResult;
   let stepResult;
@@ -3078,7 +3100,9 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   }
   let passed;
   if (step.expect_error) {
-    passed = !taskResult?.success || !!stepResult.error;
+    const responsePayload = taskResult?.data;
+    const payloadReportsFailure = responsePayload?.success === false;
+    passed = !taskResult?.success || !!stepResult.error || payloadReportsFailure;
   } else if (crossResponses) {
     passed = stepResult.passed;
   } else {
@@ -4505,6 +4529,11 @@ function authHeadersForStep(directive, options) {
     value = directive.value;
   } else if ("from_test_kit" in directive && directive.from_test_kit) {
     value = options.test_kit?.auth?.api_key;
+    if (!value) {
+      throw new Error(
+        "step declares auth.from_test_kit but no test kit with auth.api_key is configured \u2014 declare prerequisites.test_kit and authorize its cache with options.complianceDir (CLI: --compliance-dir), or pass options.test_kit (CLI: --test-kit)."
+      );
+    }
   } else if ("value_strategy" in directive && directive.value_strategy) {
     if (directive.value_strategy === "random_invalid") value = (0, import_probes.generateRandomInvalidApiKey)();
     else if (directive.value_strategy === "random_invalid_jwt") value = (0, import_probes.generateRandomInvalidJwt)();
@@ -4528,8 +4557,16 @@ function basicAuthHeadersForStep(directive, options) {
       )
     };
   }
-  const source = directive.from_test_kit !== void 0 ? resolveStepBasicFromTestKit(directive.from_test_kit, options) : directive.basic !== void 0 ? directive.basic : directive;
-  if (source === void 0) return {};
+  const usesTestKit = directive.from_test_kit === true || typeof directive.from_test_kit === "string" && directive.from_test_kit.length > 0;
+  const source = usesTestKit ? resolveStepBasicFromTestKit(directive.from_test_kit, options) : directive.basic !== void 0 ? directive.basic : directive;
+  if (source === void 0) {
+    if (usesTestKit) {
+      throw new Error(
+        "step declares auth.from_test_kit (basic) but no test kit with matching credentials is configured \u2014 declare prerequisites.test_kit and authorize its cache with options.complianceDir (CLI: --compliance-dir), or pass options.test_kit (CLI: --test-kit)."
+      );
+    }
+    return {};
+  }
   return { authorization: encodeBasicAuthHeader(source, "step.auth.basic") };
 }
 function resolveStepBasicFromTestKit(fromTestKit, options) {