@adcp/sdk 15.0.0 → 15.2.0

package/dist/lib/testing/storyboard/request-signing/a2a-dispatch.d.mts

@@ -116,3 +116,15 @@ export declare function operationFromVectorUrl(vectorUrl: string): string;
 export declare function resolveA2aDispatchTarget(agentUrl: string, options?: A2aDispatchOptions): Promise<{
     endpoint: string;
 }>;
+/**
+ * The A2A HTTP+JSON binding base URL the agent card declares, if any.
+ *
+ * Reads the raw card (not the SDK's normalization, which exposes only the
+ * interfaces its own transports drive) and accepts both card dialects:
+ * `supportedInterfaces[]` with `protocolBinding` (1.0) and `url` /
+ * `preferredTransport` / `additionalInterfaces[]` with `transport` (0.3).
+ * Returns `undefined` when the card does not resolve or declares no
+ * HTTP+JSON interface; the caller treats that as "this binding is not served"
+ * rather than guessing a path.
+ */
+export declare function resolveA2aHttpJsonEndpoint(agentUrl: string, options?: A2aDispatchOptions): Promise<string | undefined>;

package/dist/lib/testing/storyboard/request-signing/a2a-dispatch.d.ts

@@ -116,3 +116,15 @@ export declare function operationFromVectorUrl(vectorUrl: string): string;
 export declare function resolveA2aDispatchTarget(agentUrl: string, options?: A2aDispatchOptions): Promise<{
     endpoint: string;
 }>;
+/**
+ * The A2A HTTP+JSON binding base URL the agent card declares, if any.
+ *
+ * Reads the raw card (not the SDK's normalization, which exposes only the
+ * interfaces its own transports drive) and accepts both card dialects:
+ * `supportedInterfaces[]` with `protocolBinding` (1.0) and `url` /
+ * `preferredTransport` / `additionalInterfaces[]` with `transport` (0.3).
+ * Returns `undefined` when the card does not resolve or declares no
+ * HTTP+JSON interface; the caller treats that as "this binding is not served"
+ * rather than guessing a path.
+ */
+export declare function resolveA2aHttpJsonEndpoint(agentUrl: string, options?: A2aDispatchOptions): Promise<string | undefined>;

package/dist/lib/testing/storyboard/request-signing/a2a-dispatch.js

@@ -30,7 +30,8 @@ var a2a_dispatch_exports = {};
 __export(a2a_dispatch_exports, {
   captureA2aRequest: () => captureA2aRequest,
   operationFromVectorUrl: () => operationFromVectorUrl,
-  resolveA2aDispatchTarget: () => resolveA2aDispatchTarget
+  resolveA2aDispatchTarget: () => resolveA2aDispatchTarget,
+  resolveA2aHttpJsonEndpoint: () => resolveA2aHttpJsonEndpoint
 });
 module.exports = __toCommonJS(a2a_dispatch_exports);
 var import_agent_transport_fetch = require('../../../net/agent-transport-fetch.js');
@@ -172,9 +173,35 @@ async function resolveA2aDispatchTarget(agentUrl, options = {}) {
   }
   throw new Error("the A2A client returned without issuing a dispatch probe; no endpoint was resolved");
 }
+async function resolveA2aHttpJsonEndpoint(agentUrl, options = {}) {
+  const cardFetch = buildGuardedCardFetch(agentUrl, options);
+  const isHttpJson = (value) => typeof value === "string" && value.replace(/\s+/g, "").toUpperCase() === "HTTP+JSON";
+  for (const cardUrl of (0, import_a2a_discovery.buildCardUrls)(agentUrl)) {
+    let card;
+    try {
+      const res = await cardFetch(cardUrl, { headers: { accept: "application/json" }, redirect: "manual" });
+      if (!res.ok) continue;
+      card = await res.json();
+    } catch {
+      continue;
+    }
+    const interfaces = [];
+    for (const key of ["supportedInterfaces", "additionalInterfaces"]) {
+      const list = card[key];
+      if (Array.isArray(list)) interfaces.push(...list.filter((i) => !!i));
+    }
+    if (typeof card.url === "string") interfaces.push({ url: card.url, transport: card.preferredTransport });
+    const match = interfaces.find(
+      (i) => typeof i.url === "string" && (isHttpJson(i.protocolBinding) || isHttpJson(i.transport))
+    );
+    if (match) return match.url;
+  }
+  return void 0;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   captureA2aRequest,
   operationFromVectorUrl,
-  resolveA2aDispatchTarget
+  resolveA2aDispatchTarget,
+  resolveA2aHttpJsonEndpoint
 });

package/dist/lib/testing/storyboard/request-signing/a2a-dispatch.mjs

@@ -137,8 +137,34 @@ async function resolveA2aDispatchTarget(agentUrl, options = {}) {
   }
   throw new Error("the A2A client returned without issuing a dispatch probe; no endpoint was resolved");
 }
+async function resolveA2aHttpJsonEndpoint(agentUrl, options = {}) {
+  const cardFetch = buildGuardedCardFetch(agentUrl, options);
+  const isHttpJson = (value) => typeof value === "string" && value.replace(/\s+/g, "").toUpperCase() === "HTTP+JSON";
+  for (const cardUrl of buildCardUrls(agentUrl)) {
+    let card;
+    try {
+      const res = await cardFetch(cardUrl, { headers: { accept: "application/json" }, redirect: "manual" });
+      if (!res.ok) continue;
+      card = await res.json();
+    } catch {
+      continue;
+    }
+    const interfaces = [];
+    for (const key of ["supportedInterfaces", "additionalInterfaces"]) {
+      const list = card[key];
+      if (Array.isArray(list)) interfaces.push(...list.filter((i) => !!i));
+    }
+    if (typeof card.url === "string") interfaces.push({ url: card.url, transport: card.preferredTransport });
+    const match = interfaces.find(
+      (i) => typeof i.url === "string" && (isHttpJson(i.protocolBinding) || isHttpJson(i.transport))
+    );
+    if (match) return match.url;
+  }
+  return void 0;
+}
 export {
   captureA2aRequest,
   operationFromVectorUrl,
-  resolveA2aDispatchTarget
+  resolveA2aDispatchTarget,
+  resolveA2aHttpJsonEndpoint
 };

package/dist/lib/testing/storyboard/request-signing/a2a-operation-resolution.d.mts

@@ -0,0 +1,61 @@
+/**
+ * Grading of the A2A operation-resolution vectors (adcp#7945, GHSA-frxv-c96c-4vqw).
+ *
+ * `request_signing.required_for` matches the AdCP operation a verifier resolves
+ * from the request. Over A2A that operation is the `skill` of the Message's sole
+ * DataPart, not the JSON-RPC method (`SendMessage`, `message/send`, ...). A
+ * verifier that matched only `tools/call` waved unsigned `create_media_buy`
+ * through. These vectors grade that rule black-box, against a live agent.
+ *
+ * ## Why this is not routed through the official-client capture
+ *
+ * The root vectors are framed by `@a2a-js/sdk` (`a2a-dispatch.ts`) because the
+ * request must be one a real buyer emits. These vectors are the opposite: the
+ * defect under test lives IN the bytes (a duplicate DataPart, a case-variant
+ * method, a batch array, a lone `Signature` header), and a well-behaved client
+ * refuses to emit most of them. So each vector's body and headers go out
+ * verbatim. Only the destination changes: the vector's URL is a placeholder, so
+ * the request is retargeted at the agent's real JSON-RPC endpoint, discovered
+ * from the agent card the same way the official-client path does. The four
+ * signed vectors are re-signed against that real URL with the shared test key
+ * (their recorded signatures are bound to the placeholder URL and cannot be
+ * replayed).
+ */
+import { type A2aVectorSource } from './vector-loader.mjs';
+import type { SignedRequestsRunnerContract } from './test-kit.mjs';
+import type { GradeOptions, VectorGradeResult } from './grader.mjs';
+import type { A2aVectorTier, TestKeyset } from './types.mjs';
+/** Id of the synthetic skipped row reported when no A2A vectors are available. */
+export declare const A2A_UNAVAILABLE_ROW_ID = "a2a/operation-resolution-vectors";
+export interface A2aTierSummary {
+    passed: number;
+    failed: number;
+    skipped: number;
+    /** Ids of failed vectors in this tier. */
+    failed_vectors: string[];
+}
+export interface A2aOperationResolutionSummary {
+    /** `false` when the compliance bundle (and any override) carried no A2A vectors. */
+    vectors_available: boolean;
+    source: A2aVectorSource;
+    source_dir?: string;
+    /** Set when `vectors_available` is `false`: why nothing was graded. */
+    message?: string;
+    /**
+     * Per-tier counts. `contradiction-resolution` is MUST for a 3.2 verifier;
+     * `hardening` is SHOULD in 3.2.x and MUST from 3.3. Both count toward the
+     * report's pass/fail; the split tells an operator which one failed.
+     */
+    tiers: Record<A2aVectorTier, A2aTierSummary>;
+}
+export interface A2aGradeOutcome {
+    positive: VectorGradeResult[];
+    negative: VectorGradeResult[];
+    summary: A2aOperationResolutionSummary;
+}
+/**
+ * Grade every A2A operation-resolution vector against *agentUrl*. Returns
+ * `undefined` when the caller restricted the run (`onlyVectors`) to ids outside
+ * this corpus, so a single-vector regression run is not buried in skip rows.
+ */
+export declare function gradeA2aOperationResolution(agentUrl: string, keys: TestKeyset, contract: SignedRequestsRunnerContract | undefined, options: GradeOptions): Promise<A2aGradeOutcome | undefined>;

package/dist/lib/testing/storyboard/request-signing/a2a-operation-resolution.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Grading of the A2A operation-resolution vectors (adcp#7945, GHSA-frxv-c96c-4vqw).
+ *
+ * `request_signing.required_for` matches the AdCP operation a verifier resolves
+ * from the request. Over A2A that operation is the `skill` of the Message's sole
+ * DataPart, not the JSON-RPC method (`SendMessage`, `message/send`, ...). A
+ * verifier that matched only `tools/call` waved unsigned `create_media_buy`
+ * through. These vectors grade that rule black-box, against a live agent.
+ *
+ * ## Why this is not routed through the official-client capture
+ *
+ * The root vectors are framed by `@a2a-js/sdk` (`a2a-dispatch.ts`) because the
+ * request must be one a real buyer emits. These vectors are the opposite: the
+ * defect under test lives IN the bytes (a duplicate DataPart, a case-variant
+ * method, a batch array, a lone `Signature` header), and a well-behaved client
+ * refuses to emit most of them. So each vector's body and headers go out
+ * verbatim. Only the destination changes: the vector's URL is a placeholder, so
+ * the request is retargeted at the agent's real JSON-RPC endpoint, discovered
+ * from the agent card the same way the official-client path does. The four
+ * signed vectors are re-signed against that real URL with the shared test key
+ * (their recorded signatures are bound to the placeholder URL and cannot be
+ * replayed).
+ */
+import { type A2aVectorSource } from './vector-loader';
+import type { SignedRequestsRunnerContract } from './test-kit';
+import type { GradeOptions, VectorGradeResult } from './grader';
+import type { A2aVectorTier, TestKeyset } from './types';
+/** Id of the synthetic skipped row reported when no A2A vectors are available. */
+export declare const A2A_UNAVAILABLE_ROW_ID = "a2a/operation-resolution-vectors";
+export interface A2aTierSummary {
+    passed: number;
+    failed: number;
+    skipped: number;
+    /** Ids of failed vectors in this tier. */
+    failed_vectors: string[];
+}
+export interface A2aOperationResolutionSummary {
+    /** `false` when the compliance bundle (and any override) carried no A2A vectors. */
+    vectors_available: boolean;
+    source: A2aVectorSource;
+    source_dir?: string;
+    /** Set when `vectors_available` is `false`: why nothing was graded. */
+    message?: string;
+    /**
+     * Per-tier counts. `contradiction-resolution` is MUST for a 3.2 verifier;
+     * `hardening` is SHOULD in 3.2.x and MUST from 3.3. Both count toward the
+     * report's pass/fail; the split tells an operator which one failed.
+     */
+    tiers: Record<A2aVectorTier, A2aTierSummary>;
+}
+export interface A2aGradeOutcome {
+    positive: VectorGradeResult[];
+    negative: VectorGradeResult[];
+    summary: A2aOperationResolutionSummary;
+}
+/**
+ * Grade every A2A operation-resolution vector against *agentUrl*. Returns
+ * `undefined` when the caller restricted the run (`onlyVectors`) to ids outside
+ * this corpus, so a single-vector regression run is not buried in skip rows.
+ */
+export declare function gradeA2aOperationResolution(agentUrl: string, keys: TestKeyset, contract: SignedRequestsRunnerContract | undefined, options: GradeOptions): Promise<A2aGradeOutcome | undefined>;

package/dist/lib/testing/storyboard/request-signing/a2a-operation-resolution.js

@@ -0,0 +1,298 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var a2a_operation_resolution_exports = {};
+__export(a2a_operation_resolution_exports, {
+  A2A_UNAVAILABLE_ROW_ID: () => A2A_UNAVAILABLE_ROW_ID,
+  gradeA2aOperationResolution: () => gradeA2aOperationResolution
+});
+module.exports = __toCommonJS(a2a_operation_resolution_exports);
+var import_builder = require('./builder.js');
+var import_probe = require('./probe.js');
+var import_a2a_dispatch = require('./a2a-dispatch.js');
+var import_vector_loader = require('./vector-loader.js');
+const A2A_UNAVAILABLE_ROW_ID = "a2a/operation-resolution-vectors";
+const ALTERNATE_ACCEPTED_CODES = {
+  "a2a/negative/023-batch-body": ["request_signature_required"]
+};
+function emptyTiers() {
+  return {
+    "contradiction-resolution": { passed: 0, failed: 0, skipped: 0, failed_vectors: [] },
+    hardening: { passed: 0, failed: 0, skipped: 0, failed_vectors: [] }
+  };
+}
+async function gradeA2aOperationResolution(agentUrl, keys, contract, options) {
+  if (options.onlyVectors && !options.onlyVectors.some((id) => id.startsWith("a2a/"))) return void 0;
+  const loaded = (0, import_vector_loader.loadA2aOperationResolutionVectors)(options);
+  const tiers = emptyTiers();
+  if (loaded.source === "none") {
+    return {
+      positive: [],
+      negative: [
+        {
+          vector_id: A2A_UNAVAILABLE_ROW_ID,
+          kind: "negative",
+          passed: true,
+          skipped: true,
+          skip_reason: "a2a_vectors_unavailable",
+          diagnostic: import_vector_loader.A2A_VECTORS_UNAVAILABLE_MESSAGE,
+          http_status: 0,
+          probe_duration_ms: 0
+        }
+      ],
+      summary: {
+        vectors_available: false,
+        source: "none",
+        message: import_vector_loader.A2A_VECTORS_UNAVAILABLE_MESSAGE,
+        tiers
+      }
+    };
+  }
+  const dispatchOptions = {
+    allowPrivateIp: options.allowPrivateIp === true,
+    ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
+    ...options.cardFetch ? { cardFetch: options.cardFetch } : {}
+  };
+  const probeOptions = {
+    allowPrivateIp: options.allowPrivateIp === true,
+    timeoutMs: options.timeoutMs
+  };
+  let jsonRpcEndpoint;
+  const jsonRpc = () => jsonRpcEndpoint ??= (0, import_a2a_dispatch.resolveA2aDispatchTarget)(agentUrl, dispatchOptions).then((target) => target.endpoint);
+  let httpJsonEndpoint;
+  const httpJson = () => httpJsonEndpoint ??= (0, import_a2a_dispatch.resolveA2aHttpJsonEndpoint)(agentUrl, dispatchOptions);
+  const requiredFor = options.agentCapability?.required_for ?? options.agentRequiredFor;
+  const protocolMethodsRequiredFor = options.agentCapability !== void 0 ? options.agentCapability.protocol_methods_required_for ?? [] : options.agentProtocolMethodsRequiredFor;
+  const contentDigestPolicy = options.agentCapability?.covers_content_digest ?? options.agentContentDigestPolicy;
+  const results = [];
+  const grade = async (vector) => {
+    const skip = preflightSkip(vector, {
+      options,
+      contract,
+      requiredFor,
+      protocolMethodsRequiredFor,
+      contentDigestPolicy
+    });
+    if (skip) return skip;
+    let url;
+    if (isHttpJsonBinding(vector)) {
+      const base = await httpJson();
+      if (!base) {
+        return skipped(
+          vector,
+          "transport_ungradable",
+          `Vector ${vector.id} grades the A2A HTTP+JSON binding (POST \u2026/message:send), but the agent card declares no HTTP+JSON interface. An agent that does not serve that binding cannot be bypassed through it.`
+        );
+      }
+      url = `${base.replace(/\/+$/, "")}/${lastPathSegment(vector.request.url)}`;
+    } else {
+      url = await jsonRpc();
+    }
+    const request = buildRequest(vector, url, keys);
+    const probe = await (0, import_probe.probeSignedRequest)(request, probeOptions);
+    return vector.kind === "positive" ? gradePositive(vector, probe) : gradeNegative(vector, probe);
+  };
+  for (const vector of [...loaded.positive, ...loaded.negative]) {
+    const result = await grade(vector);
+    results.push(result);
+    const tier = tiers[vector.tier];
+    if (result.skipped) tier.skipped++;
+    else if (result.passed) tier.passed++;
+    else {
+      tier.failed++;
+      tier.failed_vectors.push(vector.id);
+    }
+  }
+  return {
+    positive: results.filter((r) => r.kind === "positive"),
+    negative: results.filter((r) => r.kind === "negative"),
+    summary: {
+      vectors_available: true,
+      source: loaded.source,
+      ...loaded.sourceDir ? { source_dir: loaded.sourceDir } : {},
+      tiers
+    }
+  };
+}
+function skipped(vector, skip_reason, diagnostic) {
+  return {
+    vector_id: vector.id,
+    kind: vector.kind,
+    tier: vector.tier,
+    passed: true,
+    // skipped is not failed; overall pass/fail excludes skipped
+    skipped: true,
+    skip_reason,
+    ...vector.kind === "negative" && vector.expected_outcome.error_code ? { expected_error_code: vector.expected_outcome.error_code } : {},
+    ...diagnostic ? { diagnostic } : {},
+    http_status: 0,
+    probe_duration_ms: 0
+  };
+}
+function preflightSkip(vector, ctx) {
+  const { options } = ctx;
+  if (options.onlyVectors && !options.onlyVectors.includes(vector.id)) {
+    return skipped(vector, "not_in_only_vectors");
+  }
+  if (options.skipVectors?.includes(vector.id)) return skipped(vector, "operator_skip");
+  const mismatch = capabilityMismatch(vector, ctx.requiredFor, ctx.protocolMethodsRequiredFor);
+  if (mismatch) return skipped(vector, "capability_profile_mismatch", mismatch);
+  if (vector.kind === "positive" && isSigned(vector) && ctx.contentDigestPolicy === "forbidden") {
+    return skipped(
+      vector,
+      "capability_profile_mismatch",
+      `Vector ${vector.id} is signed with content-digest covered, but the agent declares covers_content_digest='forbidden'.`
+    );
+  }
+  if (vector.kind === "positive" && vector.expected_outcome.status === "verified" && !options.allowLiveSideEffects && ctx.contract?.endpoint_scope !== "sandbox") {
+    return skipped(
+      vector,
+      "live_side_effect_opt_in_required",
+      `Vector ${vector.id} sends a validly signed ${vector.expected_outcome.resolved_operation ?? "operation"} request the agent will accept and run. Pass allowLiveSideEffects: true (or point the grader at an endpoint whose signed-requests-runner contract declares endpoint_scope: sandbox) to run it.`
+    );
+  }
+  return void 0;
+}
+function capabilityMismatch(vector, requiredFor, protocolMethodsRequiredFor) {
+  if (vector.kind === "negative") {
+    if (vector.expected_outcome.error_code !== "request_signature_required") return void 0;
+    const methods = vector.verifier_capability.protocol_methods_required_for ?? [];
+    if (methods.length > 0) {
+      if (!protocolMethodsRequiredFor) return void 0;
+      const missing = methods.filter((m) => !protocolMethodsRequiredFor.includes(m));
+      return missing.length === 0 ? void 0 : `Vector asserts protocol_methods_required_for includes [${missing.join(", ")}] but the agent declares [${protocolMethodsRequiredFor.join(", ")}]. Add the method to request_signing.protocol_methods_required_for to grade it.`;
+    }
+    const operation2 = vector.expected_outcome.resolved_operation;
+    if (!requiredFor || typeof operation2 !== "string" || requiredFor.includes(operation2)) return void 0;
+    return `Vector asserts ${operation2} is in required_for but the agent declares required_for [${requiredFor.join(", ")}]. The vector tests a rejection path the agent has not opted into; add the operation to request_signing.required_for to grade it.`;
+  }
+  if (vector.expected_outcome.status !== "unsigned") return void 0;
+  const operation = vector.expected_outcome.resolved_operation;
+  if (requiredFor && typeof operation === "string" && requiredFor.includes(operation)) {
+    return `Vector asserts ${operation} needs no signature, but the agent declares it in required_for.`;
+  }
+  const method = jsonRpcMethodOf(vector.request.body);
+  if (protocolMethodsRequiredFor && method !== void 0 && protocolMethodsRequiredFor.includes(method)) {
+    return `Vector asserts an unsigned ${method} is accepted, but the agent declares ${method} in protocol_methods_required_for.`;
+  }
+  return void 0;
+}
+function hasHeader(headers, name) {
+  return Object.keys(headers).some((key) => key.toLowerCase() === name);
+}
+function isSigned(vector) {
+  return hasHeader(vector.request.headers, "signature-input");
+}
+function isHttpJsonBinding(vector) {
+  try {
+    return /(?:^|\/)message:(?:send|stream)$/.test(new URL(vector.request.url).pathname);
+  } catch {
+    return false;
+  }
+}
+function lastPathSegment(url) {
+  return new URL(url).pathname.split("/").filter(Boolean).pop() ?? "";
+}
+function jsonRpcMethodOf(body) {
+  if (!body) return void 0;
+  try {
+    const parsed = JSON.parse(body);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      const method = parsed.method;
+      return typeof method === "string" ? method : void 0;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function buildRequest(vector, url, keys) {
+  const request = { ...vector.request, url, headers: { ...vector.request.headers } };
+  if (!isSigned(vector)) return request;
+  const asPositive = {
+    kind: "positive",
+    id: vector.id,
+    name: vector.name,
+    signing_profile_version: vector.signing_profile_version,
+    reference_now: vector.reference_now,
+    request,
+    verifier_capability: vector.verifier_capability,
+    jwks_ref: vector.jwks_ref
+  };
+  return (0, import_builder.buildPositiveRequest)(asPositive, keys, { transport: "raw" });
+}
+function isSignatureChallenge(probe) {
+  if (probe.status !== 401) return false;
+  if (probe.wwwAuthenticateErrorCode !== void 0) return true;
+  return /(?:^|,)\s*Signature\b/i.test(probe.headers["www-authenticate"] ?? "");
+}
+function gradePositive(vector, probe) {
+  const rejected = isSignatureChallenge(probe);
+  const passed = !probe.error && !rejected;
+  let diagnostic;
+  if (probe.error) diagnostic = `probe error: ${probe.error}`;
+  else if (rejected) {
+    const code = probe.wwwAuthenticateErrorCode ?? "(none)";
+    diagnostic = vector.expected_outcome.status === "verified" ? `expected the signed request to be accepted past the signature layer, got 401 with error="${code}". Check the grader test key is registered with the agent. Vector: ${vector.name}` : `expected no signature rejection (the resolved operation does not require one), got 401 with error="${code}". Vector: ${vector.name}`;
+  }
+  return {
+    vector_id: vector.id,
+    kind: "positive",
+    tier: vector.tier,
+    passed,
+    http_status: probe.status,
+    probe_url: probe.url,
+    ...probe.wwwAuthenticateErrorCode ? { actual_error_code: probe.wwwAuthenticateErrorCode } : {},
+    ...diagnostic ? { diagnostic } : {},
+    ...probe.error !== void 0 && { transport_error: true },
+    probe_duration_ms: probe.duration_ms
+  };
+}
+function gradeNegative(vector, probe) {
+  const expected = vector.expected_error_code;
+  const accepted = [expected, ...ALTERNATE_ACCEPTED_CODES[vector.id] ?? []];
+  const actual = probe.wwwAuthenticateErrorCode;
+  const passed = !probe.error && probe.status === 401 && actual !== void 0 && accepted.includes(actual);
+  let diagnostic;
+  if (!passed) {
+    const wanted = accepted.map((code) => `"${code}"`).join(" or ");
+    if (probe.error) diagnostic = `probe error: ${probe.error}`;
+    else if (probe.status !== 401) {
+      diagnostic = `expected 401 with error=${wanted}, got ${probe.status}. The request reached the agent's dispatcher: the verifier did not resolve the operation from the A2A DataPart skill (GHSA-frxv-c96c-4vqw). Vector: ${vector.name}`;
+    } else {
+      diagnostic = `expected error=${wanted}, got error="${actual ?? "(none)"}". Vector: ${vector.name}`;
+    }
+  }
+  return {
+    vector_id: vector.id,
+    kind: "negative",
+    tier: vector.tier,
+    passed,
+    http_status: probe.status,
+    probe_url: probe.url,
+    expected_error_code: expected,
+    ...actual ? { actual_error_code: actual } : {},
+    ...diagnostic ? { diagnostic } : {},
+    ...probe.error !== void 0 && { transport_error: true },
+    probe_duration_ms: probe.duration_ms
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  A2A_UNAVAILABLE_ROW_ID,
+  gradeA2aOperationResolution
+});