@adcp/sdk 14.0.0-rc.37 → 14.0.0-rc.39

package/dist/lib/testing/storyboard/request-signing/probe-dispatch.d.ts

@@ -1,22 +1,97 @@
 import type { HttpProbeResult, StoryboardRunOptions } from '../types';
 /**
- * Resolve the vector transport for a graded agent. Defaults to `'mcp'`: the
- * storyboard runner reaches agents through `tools/call` (MCP, or the
- * AdCP-over-A2A binding) — never through per-task HTTP paths — so replaying
- * the vectors' recorded REST targets (`/adcp/create_media_buy`, raw task
- * body) verbatim guarantees a routing 404 on every MCP-transport agent
- * before its verifier can run (adcontextprotocol/adcp#6548). Operators
- * grading a REST-binding agent opt back in with
- * `request_signing.transport: 'raw'`.
+ * Detail surfaced on each vector step an A2A run cannot frame. Written for
+ * the operator reading a conformance report: it has to say what coverage is
+ * missing and what would restore it.
+ *
+ * Reported as detailed reason `signing_transport_unavailable`, canonical
+ * `not_applicable` with the sub-reason token as `skip.detail` — the output
+ * contract's registered shape. What keeps the gap from reading as a pass is
+ * `signingCoverage` in the runner, not the reason: no vector reached the
+ * agent, so the storyboard cannot pass and the track grades `partial`
+ * instead of letting a sibling storyboard's passes roll it up green.
+ */
+export declare const SIGNING_VECTORS_UNAVAILABLE_DETAIL: string;
+/**
+ * Resolve the vector transport for a graded agent.
+ *
+ * Defaults to `'mcp'`: the storyboard runner reaches MCP agents through
+ * `tools/call` — never through per-task HTTP paths — so replaying the
+ * vectors' recorded REST targets (`/adcp/create_media_buy`, raw task body)
+ * verbatim guarantees a routing 404 on every MCP-transport agent before its
+ * verifier can run (adcontextprotocol/adcp#6548). Operators grading a
+ * REST-binding agent opt back in with `request_signing.transport: 'raw'`.
+ *
+ * Returns `undefined` on an A2A run that didn't pick a transport explicitly:
+ * neither dispatch shape this runner implements is an A2A request, so the
+ * caller skips those vectors as `signing_transport_unavailable` instead of
+ * POSTing an MCP envelope at an A2A
+ * endpoint and grading the resulting 405 as a signature failure
+ * (adcp-client#2954). An explicit `transport` still wins — that's the escape
+ * hatch for an agent whose MCP or REST binding answers on the same URL as its
+ * A2A card.
+ *
+ * There is no `'a2a'` member yet because the path isn't wired here, not
+ * because the official client is incapable: `@a2a-js/sdk` issues the JSON-RPC
+ * methods these vectors target, `tasks/cancel` included. Wiring it means
+ * signing a request the official client issues — applying each vector's RFC
+ * 9421 headers to that client's own request — plus an upstream answer for how
+ * a verifier scopes `required_for` over A2A methods. RFC 9421 conformance
+ * needs byte-level control of the request, which `builder.ts` has for the two
+ * bindings AdCP defines for these fixtures; there is no third binding to
+ * write bytes against, and picking one here would be the SDK inventing it.
+ * The only vectors that still grade are the ones needing no wire exchange at
+ * all — see `gradableWithoutVectorTransport`.
  */
 export declare function resolveVectorTransport(rsOpts: {
     transport?: 'raw' | 'mcp';
-}): 'raw' | 'mcp';
+}, protocol?: 'mcp' | 'a2a'): 'raw' | 'mcp' | undefined;
 /**
  * Dispatch a synthesized request-signing step. The step ID encodes the vector
  * (`positive-<id>` / `negative-<id>`); this helper decodes it, runs the
  * grader's per-vector logic, and maps the `VectorGradeResult` to an
- * `HttpProbeResult`-shaped return so the existing validation pipeline
- * (`http_status`, `http_status_in`) works unchanged.
+ * `HttpProbeResult`-shaped return so the HTTP validation pipeline
+ * (`http_status`, `http_status_in`) works unchanged for probed vectors.
+ *
+ * Vectors the grader decides in-library rather than over HTTP (the
+ * `jwks_override` negatives) carry `http_status: 0` by contract — there is no
+ * wire exchange to report. Their verdict travels on `error`: unset when the
+ * library verifier produced the expected rejection, set to the grader's
+ * diagnostic otherwise. `synthesizeNegativeStep` pairs those vectors with a
+ * `probe_passed` validation that reads exactly that field; asserting an HTTP
+ * status against them would compare a grade to a status code that no
+ * implementation can move (adcp-client#2955).
  */
 export declare function probeRequestSigningVector(stepId: string, agentUrl: string, options: StoryboardRunOptions): Promise<HttpProbeResult>;
+/**
+ * Wire-name grammar for `request_signing.protocol_methods_*`, mirroring the
+ * `items` constraint the capabilities schema ships for each AdCP line:
+ *
+ *   - 3.2+ — slash paths of one or more segments (`tasks/cancel`,
+ *     `tasks/pushNotificationConfig/set`) or A2A 1.0 PascalCase names
+ *     (`CancelTask`), 256 characters max, and never `tools/call`.
+ *   - pre-3.2 — a single lowercase slash pair (`tasks/cancel`), with no
+ *     length cap, because that line's schema declares none.
+ *
+ * Keyed by line rather than taking the union of both, because the union is
+ * unsafe in one direction: honouring a 3.2-only name on a 3.1 run accepts a
+ * declaration that line's schema rejects, and any accepted declaration
+ * omitting the vector's method suppresses that vector.
+ *
+ * Pinned against both shipped schemas by test — a grammar that drifts wider
+ * than the schema re-opens exactly that hole.
+ */
+export declare const PROTOCOL_METHOD_GRAMMARS: {
+    readonly since_3_2: {
+        readonly pattern: RegExp;
+        readonly maxLength: number | undefined;
+        readonly forbidden: readonly string[];
+    };
+    readonly pre_3_2: {
+        readonly pattern: RegExp;
+        readonly maxLength: number | undefined;
+        readonly forbidden: readonly string[];
+    };
+};
+/** Token validator for an AdCP version string, per `PROTOCOL_METHOD_GRAMMARS`. */
+export declare function protocolMethodGrammarFor(version: string): (token: string) => boolean;

package/dist/lib/testing/storyboard/request-signing/probe-dispatch.js

@@ -18,15 +18,23 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var probe_dispatch_exports = {};
 __export(probe_dispatch_exports, {
+  PROTOCOL_METHOD_GRAMMARS: () => PROTOCOL_METHOD_GRAMMARS,
+  SIGNING_VECTORS_UNAVAILABLE_DETAIL: () => SIGNING_VECTORS_UNAVAILABLE_DETAIL,
   probeRequestSigningVector: () => probeRequestSigningVector,
+  protocolMethodGrammarFor: () => protocolMethodGrammarFor,
   resolveVectorTransport: () => resolveVectorTransport
 });
 module.exports = __toCommonJS(probe_dispatch_exports);
+var import_path = require("path");
 var import_grader = require('./grader.js');
 var import_synthesize = require('./synthesize.js');
 var import_vector_loader = require('./vector-loader.js');
-function resolveVectorTransport(rsOpts) {
-  return rsOpts.transport ?? "mcp";
+var import_version = require('../../../version.js');
+const SIGNING_VECTORS_UNAVAILABLE_DETAIL = "Coverage unavailable: this runner dispatches request-signing vectors two ways \u2014 a verbatim replay of the vector's recorded REST request (`raw`), or the same body re-framed as an MCP `tools/call` envelope (`mcp`) \u2014 and it does not yet dispatch them through the official A2A client, so nothing about this agent's verifier was graded on this run (adcontextprotocol/adcp-client#2954). Remedy: grade the verifier through the agent's MCP or REST binding, or set `request_signing.transport` (CLI `--signing-transport`) when that binding answers at this same URL.";
+function resolveVectorTransport(rsOpts, protocol) {
+  if (rsOpts.transport) return rsOpts.transport;
+  if (protocol === "a2a") return void 0;
+  return "mcp";
 }
 async function probeRequestSigningVector(stepId, agentUrl, options) {
   const parsed = (0, import_synthesize.parseRequestSigningStepId)(stepId);
@@ -40,22 +48,42 @@ async function probeRequestSigningVector(stepId, agentUrl, options) {
     };
   }
   const rsOpts = options.request_signing ?? {};
-  if (parsed.kind === "negative" && rsOpts.skipRateAbuse) {
-    try {
-      const loaded = (0, import_vector_loader.loadRequestSigningVectors)({
-        version: options.adcpVersion,
-        complianceDir: options.complianceDir
-      });
-      const vector = loaded.negative.find((v) => v.id === parsed.vector_id);
-      if (vector?.requires_contract === "rate_abuse") {
-        return skipProbe(agentUrl, "rate_abuse_opt_out");
-      }
-    } catch {
-    }
+  const transport = resolveVectorTransport(rsOpts, options.protocol);
+  if (rsOpts.onlyVectors && !rsOpts.onlyVectors.includes(parsed.vector_id)) {
+    return skipProbe(agentUrl, "not_in_only_vectors");
   }
   if (rsOpts.skipVectors?.includes(parsed.vector_id)) {
     return skipProbe(agentUrl, "operator_skip");
   }
+  let loaded;
+  try {
+    loaded = (0, import_vector_loader.loadRequestSigningVectors)({
+      version: options.adcpVersion,
+      complianceDir: options.complianceDir
+    });
+  } catch (err) {
+    return probeError(
+      agentUrl,
+      `request_signing_probe: could not load request-signing vectors: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const vector = parsed.kind === "negative" ? loaded.negative.find((v) => v.id === parsed.vector_id) : loaded.positive.find((v) => v.id === parsed.vector_id);
+  if (!vector) {
+    return probeError(
+      agentUrl,
+      `request_signing_probe: ${parsed.kind} vector "${parsed.vector_id}" is not in the vector set this run loaded`
+    );
+  }
+  const semantic = (0, import_grader.semanticVectorExclusion)(vector, declaredProtocolMethodCoverage(options, loaded.sourceDir));
+  if (semantic) {
+    return skipProbe(agentUrl, semantic.skip_reason, semantic.diagnostic);
+  }
+  if (parsed.kind === "negative" && rsOpts.skipRateAbuse && vector.requires_contract === "rate_abuse") {
+    return skipProbe(agentUrl, "rate_abuse_opt_out");
+  }
+  if (!transport && !gradableWithoutVectorTransport(parsed.kind, vector)) {
+    return skipProbe(agentUrl, "signing_transport_unavailable", SIGNING_VECTORS_UNAVAILABLE_DETAIL);
+  }
   try {
     const result = await (0, import_grader.gradeOneVector)(parsed.vector_id, parsed.kind, agentUrl, {
       ...options.adcpVersion && { version: options.adcpVersion },
@@ -66,7 +94,10 @@ async function probeRequestSigningVector(stepId, agentUrl, options) {
       onlyVectors: rsOpts.onlyVectors,
       skipVectors: rsOpts.skipVectors,
       skipRateAbuse: rsOpts.skipRateAbuse,
-      transport: resolveVectorTransport(rsOpts),
+      // A vector reaching here without a resolved transport is in-library
+      // only (`gradableWithoutVectorTransport`); the grader never probes it,
+      // so the value is inert.
+      transport: transport ?? "mcp",
       // The auto-initialize handshake authenticates like any MCP client;
       // agents commonly require auth on `initialize` (the signed vectors
       // themselves stay bearer-less — the signature is their auth).
@@ -86,23 +117,86 @@ async function probeRequestSigningVector(stepId, agentUrl, options) {
       status: result.http_status,
       headers,
       body: result.diagnostic ?? null,
-      error: result.passed ? void 0 : result.diagnostic ?? "vector grade failed"
+      error: result.passed ? void 0 : result.diagnostic ?? "vector grade failed",
+      // Carry the grader's transport-fault provenance through. Without it a
+      // DNS or connect failure reaches the coverage classifier looking like
+      // an in-library grade — `status: 0` with text — and the report tells
+      // the operator only the SDK self-check ran, which is false and points
+      // them away from the connection they need to fix.
+      ...result.transport_error === true && { probe_error: true }
     };
   } catch (err) {
-    return {
-      url: agentUrl,
-      status: 0,
-      headers: {},
-      body: null,
-      error: `request_signing_probe threw: ${err instanceof Error ? err.message : String(err)}`
-    };
+    return probeError(agentUrl, `request_signing_probe threw: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
-function skipProbe(url, reason) {
-  return { url, status: 0, headers: {}, body: null, skipped: true, skip_reason: reason };
+function gradableWithoutVectorTransport(kind, vector) {
+  return kind === "negative" && vector.jwks_override !== void 0;
+}
+function declaredProtocolMethodCoverage(options, sourceDir) {
+  const raw = options._profile?.raw_capabilities;
+  if (!raw || typeof raw !== "object") return void 0;
+  const block = raw.request_signing;
+  if (!block || typeof block !== "object") return void 0;
+  const declared = block;
+  if (declared.supported !== true) return void 0;
+  const bucket = declaredProtocolMethods(
+    declared.protocol_methods_required_for,
+    protocolMethodGrammarFor(complianceLineOf(sourceDir) ?? options.adcpVersion ?? import_version.ADCP_VERSION)
+  );
+  if (!bucket.ok) return void 0;
+  return { ...bucket.value && { protocol_methods_required_for: bucket.value } };
+}
+function complianceLineOf(sourceDir) {
+  const version = (0, import_path.basename)((0, import_path.dirname)((0, import_path.dirname)(sourceDir)));
+  return /^\d+\.\d+/.test(version) ? version : void 0;
+}
+function declaredProtocolMethods(value, isValidToken) {
+  if (value === void 0) return { ok: true };
+  if (!Array.isArray(value)) return { ok: false };
+  return value.every((entry) => typeof entry === "string" && isValidToken(entry)) ? { ok: true, value } : { ok: false };
+}
+const PROTOCOL_METHOD_GRAMMARS = {
+  since_3_2: {
+    pattern: /^(?:[a-z][A-Za-z0-9_]*(?:\/[A-Za-z][A-Za-z0-9_]*)+|[A-Z][A-Za-z0-9_]*)$/,
+    maxLength: 256,
+    forbidden: ["tools/call"]
+  },
+  // 3.1 declares no `maxLength`, so imposing one would reject a name that
+  // line's schema accepts — and a rejected declaration is graded, which
+  // fails a vector the agent never claimed. Each line matches its own schema.
+  pre_3_2: {
+    pattern: /^[a-z][a-z0-9_]*\/[a-z][a-z0-9_]*$/,
+    maxLength: void 0,
+    forbidden: []
+  }
+};
+function protocolMethodGrammarFor(version) {
+  const trimmed = version.startsWith("v") ? version.slice(1) : version;
+  const match = /^(\d+)(?:\.(\d+))?/.exec(trimmed);
+  const major = Number.parseInt(match?.[1] ?? "0", 10);
+  const minor = Number.parseInt(match?.[2] ?? "0", 10);
+  const grammar = major > 3 || major === 3 && minor >= 2 ? PROTOCOL_METHOD_GRAMMARS.since_3_2 : PROTOCOL_METHOD_GRAMMARS.pre_3_2;
+  return (token) => (grammar.maxLength === void 0 || token.length <= grammar.maxLength) && grammar.pattern.test(token) && !grammar.forbidden.includes(token);
+}
+function probeError(url, message) {
+  return { url, status: 0, headers: {}, body: null, error: message, probe_error: true };
+}
+function skipProbe(url, reason, detail) {
+  return {
+    url,
+    status: 0,
+    headers: {},
+    body: null,
+    skipped: true,
+    skip_reason: reason,
+    ...detail && { error: detail }
+  };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  PROTOCOL_METHOD_GRAMMARS,
+  SIGNING_VECTORS_UNAVAILABLE_DETAIL,
   probeRequestSigningVector,
+  protocolMethodGrammarFor,
   resolveVectorTransport
 });

package/dist/lib/testing/storyboard/request-signing/probe-dispatch.mjs

@@ -1,8 +1,13 @@
-import { gradeOneVector } from "./grader.mjs";
+import { basename, dirname } from "path";
+import { gradeOneVector, semanticVectorExclusion } from "./grader.mjs";
 import { parseRequestSigningStepId } from "./synthesize.mjs";
 import { loadRequestSigningVectors } from "./vector-loader.mjs";
-function resolveVectorTransport(rsOpts) {
-  return rsOpts.transport ?? "mcp";
+import { ADCP_VERSION } from "../../../version.mjs";
+const SIGNING_VECTORS_UNAVAILABLE_DETAIL = "Coverage unavailable: this runner dispatches request-signing vectors two ways \u2014 a verbatim replay of the vector's recorded REST request (`raw`), or the same body re-framed as an MCP `tools/call` envelope (`mcp`) \u2014 and it does not yet dispatch them through the official A2A client, so nothing about this agent's verifier was graded on this run (adcontextprotocol/adcp-client#2954). Remedy: grade the verifier through the agent's MCP or REST binding, or set `request_signing.transport` (CLI `--signing-transport`) when that binding answers at this same URL.";
+function resolveVectorTransport(rsOpts, protocol) {
+  if (rsOpts.transport) return rsOpts.transport;
+  if (protocol === "a2a") return void 0;
+  return "mcp";
 }
 async function probeRequestSigningVector(stepId, agentUrl, options) {
   const parsed = parseRequestSigningStepId(stepId);
@@ -16,22 +21,42 @@ async function probeRequestSigningVector(stepId, agentUrl, options) {
     };
   }
   const rsOpts = options.request_signing ?? {};
-  if (parsed.kind === "negative" && rsOpts.skipRateAbuse) {
-    try {
-      const loaded = loadRequestSigningVectors({
-        version: options.adcpVersion,
-        complianceDir: options.complianceDir
-      });
-      const vector = loaded.negative.find((v) => v.id === parsed.vector_id);
-      if (vector?.requires_contract === "rate_abuse") {
-        return skipProbe(agentUrl, "rate_abuse_opt_out");
-      }
-    } catch {
-    }
+  const transport = resolveVectorTransport(rsOpts, options.protocol);
+  if (rsOpts.onlyVectors && !rsOpts.onlyVectors.includes(parsed.vector_id)) {
+    return skipProbe(agentUrl, "not_in_only_vectors");
   }
   if (rsOpts.skipVectors?.includes(parsed.vector_id)) {
     return skipProbe(agentUrl, "operator_skip");
   }
+  let loaded;
+  try {
+    loaded = loadRequestSigningVectors({
+      version: options.adcpVersion,
+      complianceDir: options.complianceDir
+    });
+  } catch (err) {
+    return probeError(
+      agentUrl,
+      `request_signing_probe: could not load request-signing vectors: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const vector = parsed.kind === "negative" ? loaded.negative.find((v) => v.id === parsed.vector_id) : loaded.positive.find((v) => v.id === parsed.vector_id);
+  if (!vector) {
+    return probeError(
+      agentUrl,
+      `request_signing_probe: ${parsed.kind} vector "${parsed.vector_id}" is not in the vector set this run loaded`
+    );
+  }
+  const semantic = semanticVectorExclusion(vector, declaredProtocolMethodCoverage(options, loaded.sourceDir));
+  if (semantic) {
+    return skipProbe(agentUrl, semantic.skip_reason, semantic.diagnostic);
+  }
+  if (parsed.kind === "negative" && rsOpts.skipRateAbuse && vector.requires_contract === "rate_abuse") {
+    return skipProbe(agentUrl, "rate_abuse_opt_out");
+  }
+  if (!transport && !gradableWithoutVectorTransport(parsed.kind, vector)) {
+    return skipProbe(agentUrl, "signing_transport_unavailable", SIGNING_VECTORS_UNAVAILABLE_DETAIL);
+  }
   try {
     const result = await gradeOneVector(parsed.vector_id, parsed.kind, agentUrl, {
       ...options.adcpVersion && { version: options.adcpVersion },
@@ -42,7 +67,10 @@ async function probeRequestSigningVector(stepId, agentUrl, options) {
       onlyVectors: rsOpts.onlyVectors,
       skipVectors: rsOpts.skipVectors,
       skipRateAbuse: rsOpts.skipRateAbuse,
-      transport: resolveVectorTransport(rsOpts),
+      // A vector reaching here without a resolved transport is in-library
+      // only (`gradableWithoutVectorTransport`); the grader never probes it,
+      // so the value is inert.
+      transport: transport ?? "mcp",
       // The auto-initialize handshake authenticates like any MCP client;
       // agents commonly require auth on `initialize` (the signed vectors
       // themselves stay bearer-less — the signature is their auth).
@@ -62,22 +90,85 @@ async function probeRequestSigningVector(stepId, agentUrl, options) {
       status: result.http_status,
       headers,
       body: result.diagnostic ?? null,
-      error: result.passed ? void 0 : result.diagnostic ?? "vector grade failed"
+      error: result.passed ? void 0 : result.diagnostic ?? "vector grade failed",
+      // Carry the grader's transport-fault provenance through. Without it a
+      // DNS or connect failure reaches the coverage classifier looking like
+      // an in-library grade — `status: 0` with text — and the report tells
+      // the operator only the SDK self-check ran, which is false and points
+      // them away from the connection they need to fix.
+      ...result.transport_error === true && { probe_error: true }
     };
   } catch (err) {
-    return {
-      url: agentUrl,
-      status: 0,
-      headers: {},
-      body: null,
-      error: `request_signing_probe threw: ${err instanceof Error ? err.message : String(err)}`
-    };
+    return probeError(agentUrl, `request_signing_probe threw: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
-function skipProbe(url, reason) {
-  return { url, status: 0, headers: {}, body: null, skipped: true, skip_reason: reason };
+function gradableWithoutVectorTransport(kind, vector) {
+  return kind === "negative" && vector.jwks_override !== void 0;
+}
+function declaredProtocolMethodCoverage(options, sourceDir) {
+  const raw = options._profile?.raw_capabilities;
+  if (!raw || typeof raw !== "object") return void 0;
+  const block = raw.request_signing;
+  if (!block || typeof block !== "object") return void 0;
+  const declared = block;
+  if (declared.supported !== true) return void 0;
+  const bucket = declaredProtocolMethods(
+    declared.protocol_methods_required_for,
+    protocolMethodGrammarFor(complianceLineOf(sourceDir) ?? options.adcpVersion ?? ADCP_VERSION)
+  );
+  if (!bucket.ok) return void 0;
+  return { ...bucket.value && { protocol_methods_required_for: bucket.value } };
+}
+function complianceLineOf(sourceDir) {
+  const version = basename(dirname(dirname(sourceDir)));
+  return /^\d+\.\d+/.test(version) ? version : void 0;
+}
+function declaredProtocolMethods(value, isValidToken) {
+  if (value === void 0) return { ok: true };
+  if (!Array.isArray(value)) return { ok: false };
+  return value.every((entry) => typeof entry === "string" && isValidToken(entry)) ? { ok: true, value } : { ok: false };
+}
+const PROTOCOL_METHOD_GRAMMARS = {
+  since_3_2: {
+    pattern: /^(?:[a-z][A-Za-z0-9_]*(?:\/[A-Za-z][A-Za-z0-9_]*)+|[A-Z][A-Za-z0-9_]*)$/,
+    maxLength: 256,
+    forbidden: ["tools/call"]
+  },
+  // 3.1 declares no `maxLength`, so imposing one would reject a name that
+  // line's schema accepts — and a rejected declaration is graded, which
+  // fails a vector the agent never claimed. Each line matches its own schema.
+  pre_3_2: {
+    pattern: /^[a-z][a-z0-9_]*\/[a-z][a-z0-9_]*$/,
+    maxLength: void 0,
+    forbidden: []
+  }
+};
+function protocolMethodGrammarFor(version) {
+  const trimmed = version.startsWith("v") ? version.slice(1) : version;
+  const match = /^(\d+)(?:\.(\d+))?/.exec(trimmed);
+  const major = Number.parseInt(match?.[1] ?? "0", 10);
+  const minor = Number.parseInt(match?.[2] ?? "0", 10);
+  const grammar = major > 3 || major === 3 && minor >= 2 ? PROTOCOL_METHOD_GRAMMARS.since_3_2 : PROTOCOL_METHOD_GRAMMARS.pre_3_2;
+  return (token) => (grammar.maxLength === void 0 || token.length <= grammar.maxLength) && grammar.pattern.test(token) && !grammar.forbidden.includes(token);
+}
+function probeError(url, message) {
+  return { url, status: 0, headers: {}, body: null, error: message, probe_error: true };
+}
+function skipProbe(url, reason, detail) {
+  return {
+    url,
+    status: 0,
+    headers: {},
+    body: null,
+    skipped: true,
+    skip_reason: reason,
+    ...detail && { error: detail }
+  };
 }
 export {
+  PROTOCOL_METHOD_GRAMMARS,
+  SIGNING_VECTORS_UNAVAILABLE_DETAIL,
   probeRequestSigningVector,
+  protocolMethodGrammarFor,
   resolveVectorTransport
 };

package/dist/lib/testing/storyboard/request-signing/synthesize.js

@@ -60,10 +60,30 @@ function synthesizePositiveStep(vector) {
   };
 }
 function synthesizeNegativeStep(vector) {
-  return {
+  const base = {
     id: `${NEGATIVE_STEP_PREFIX}${vector.id}`,
     title: `Negative: ${vector.name}`,
-    task: REQUEST_SIGNING_PROBE_TASK,
+    task: REQUEST_SIGNING_PROBE_TASK
+  };
+  const inLibraryTitle = `Negative (SDK verifier self-check, agent not contacted): ${vector.name}`;
+  if (vector.jwks_override) {
+    return {
+      ...base,
+      title: inLibraryTitle,
+      narrative: `Vector ${vector.id} publishes an inline malformed JWK, so it is graded against the library verifier rather than sent to the agent; expect rejection with error="${vector.expected_error_code}".`,
+      validations: [
+        {
+          check: "probe_passed",
+          // Name the grading plane in the description: this step reports on
+          // the SDK verifier, not on the agent under test, and a report
+          // reader counting graded vectors has to be able to tell.
+          description: `SDK verifier rejects ${vector.id} with error="${vector.expected_error_code}" (graded in-library; the agent under test is not contacted)`
+        }
+      ]
+    };
+  }
+  return {
+    ...base,
     narrative: `Build vector ${vector.id} with its documented mutation and send to the agent; expect 401 with WWW-Authenticate: Signature error="${vector.expected_error_code}".`,
     validations: [
       {

package/dist/lib/testing/storyboard/request-signing/synthesize.mjs

@@ -33,10 +33,30 @@ function synthesizePositiveStep(vector) {
   };
 }
 function synthesizeNegativeStep(vector) {
-  return {
+  const base = {
     id: `${NEGATIVE_STEP_PREFIX}${vector.id}`,
     title: `Negative: ${vector.name}`,
-    task: REQUEST_SIGNING_PROBE_TASK,
+    task: REQUEST_SIGNING_PROBE_TASK
+  };
+  const inLibraryTitle = `Negative (SDK verifier self-check, agent not contacted): ${vector.name}`;
+  if (vector.jwks_override) {
+    return {
+      ...base,
+      title: inLibraryTitle,
+      narrative: `Vector ${vector.id} publishes an inline malformed JWK, so it is graded against the library verifier rather than sent to the agent; expect rejection with error="${vector.expected_error_code}".`,
+      validations: [
+        {
+          check: "probe_passed",
+          // Name the grading plane in the description: this step reports on
+          // the SDK verifier, not on the agent under test, and a report
+          // reader counting graded vectors has to be able to tell.
+          description: `SDK verifier rejects ${vector.id} with error="${vector.expected_error_code}" (graded in-library; the agent under test is not contacted)`
+        }
+      ]
+    };
+  }
+  return {
+    ...base,
     narrative: `Build vector ${vector.id} with its documented mutation and send to the agent; expect 401 with WWW-Authenticate: Signature error="${vector.expected_error_code}".`,
     validations: [
       {