@adcp/sdk 15.0.0 → 15.2.1

package/dist/lib/testing/storyboard/request-signing/types.d.mts

@@ -66,6 +66,49 @@ export interface NegativeVector {
     spec_reference?: string;
 }
 export type Vector = PositiveVector | NegativeVector;
+/**
+ * Conformance tier of an A2A operation-resolution vector (adcp#7945).
+ *
+ * - `contradiction-resolution`: grades the security erratum that fixes the
+ *   `security.mdx` / A2A-profile contradiction. MUST for a 3.2 verifier.
+ * - `hardening`: grades clauses that go further. SHOULD in 3.2.x, MUST from 3.3.
+ */
+export type A2aVectorTier = 'contradiction-resolution' | 'hardening';
+export declare const A2A_VECTOR_TIERS: readonly A2aVectorTier[];
+/**
+ * `expected_outcome` of an A2A operation-resolution vector. Wider than the
+ * root vectors': positives carry `status`, and both kinds may name the
+ * operation the verifier MUST resolve (`null` = "no operation") plus the
+ * dispatch the agent MUST perform. `failed_step: 0` is the pre-check, not a
+ * numbered checklist step.
+ */
+export interface A2aExpectedOutcome {
+    success: boolean;
+    /** Positives only: `verified` (valid signature) or `unsigned` (no signature required). */
+    status?: 'verified' | 'unsigned';
+    /** Negatives only: `request_signature_required` or `request_body_malformed`. */
+    error_code?: RequestSignatureErrorCode;
+    failed_step?: number | string;
+    resolved_operation?: string | null;
+    dispatched_operation?: string;
+    dispatch?: string;
+}
+/** Positive A2A operation-resolution vector. Ids are prefixed `a2a/positive/`. */
+export interface A2aPositiveVector extends PositiveVector {
+    tier: A2aVectorTier;
+    expected_outcome: A2aExpectedOutcome & {
+        success: true;
+        status: 'verified' | 'unsigned';
+    };
+}
+/** Negative A2A operation-resolution vector. Ids are prefixed `a2a/negative/`. */
+export interface A2aNegativeVector extends NegativeVector {
+    tier: A2aVectorTier;
+    expected_outcome: A2aExpectedOutcome & {
+        success: false;
+    };
+}
+export type A2aVector = A2aPositiveVector | A2aNegativeVector;
 export interface TestKeypair {
     kid: string;
     kty: string;

package/dist/lib/testing/storyboard/request-signing/types.d.ts

@@ -66,6 +66,49 @@ export interface NegativeVector {
     spec_reference?: string;
 }
 export type Vector = PositiveVector | NegativeVector;
+/**
+ * Conformance tier of an A2A operation-resolution vector (adcp#7945).
+ *
+ * - `contradiction-resolution`: grades the security erratum that fixes the
+ *   `security.mdx` / A2A-profile contradiction. MUST for a 3.2 verifier.
+ * - `hardening`: grades clauses that go further. SHOULD in 3.2.x, MUST from 3.3.
+ */
+export type A2aVectorTier = 'contradiction-resolution' | 'hardening';
+export declare const A2A_VECTOR_TIERS: readonly A2aVectorTier[];
+/**
+ * `expected_outcome` of an A2A operation-resolution vector. Wider than the
+ * root vectors': positives carry `status`, and both kinds may name the
+ * operation the verifier MUST resolve (`null` = "no operation") plus the
+ * dispatch the agent MUST perform. `failed_step: 0` is the pre-check, not a
+ * numbered checklist step.
+ */
+export interface A2aExpectedOutcome {
+    success: boolean;
+    /** Positives only: `verified` (valid signature) or `unsigned` (no signature required). */
+    status?: 'verified' | 'unsigned';
+    /** Negatives only: `request_signature_required` or `request_body_malformed`. */
+    error_code?: RequestSignatureErrorCode;
+    failed_step?: number | string;
+    resolved_operation?: string | null;
+    dispatched_operation?: string;
+    dispatch?: string;
+}
+/** Positive A2A operation-resolution vector. Ids are prefixed `a2a/positive/`. */
+export interface A2aPositiveVector extends PositiveVector {
+    tier: A2aVectorTier;
+    expected_outcome: A2aExpectedOutcome & {
+        success: true;
+        status: 'verified' | 'unsigned';
+    };
+}
+/** Negative A2A operation-resolution vector. Ids are prefixed `a2a/negative/`. */
+export interface A2aNegativeVector extends NegativeVector {
+    tier: A2aVectorTier;
+    expected_outcome: A2aExpectedOutcome & {
+        success: false;
+    };
+}
+export type A2aVector = A2aPositiveVector | A2aNegativeVector;
 export interface TestKeypair {
     kid: string;
     kty: string;

package/dist/lib/testing/storyboard/request-signing/types.js

@@ -18,11 +18,14 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var types_exports = {};
 __export(types_exports, {
+  A2A_VECTOR_TIERS: () => A2A_VECTOR_TIERS,
   CONTRACT_IDS: () => CONTRACT_IDS
 });
 module.exports = __toCommonJS(types_exports);
 const CONTRACT_IDS = ["replay_window", "revocation", "rate_abuse"];
+const A2A_VECTOR_TIERS = ["contradiction-resolution", "hardening"];
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  A2A_VECTOR_TIERS,
   CONTRACT_IDS
 });

package/dist/lib/testing/storyboard/request-signing/types.mjs

@@ -1,4 +1,6 @@
 const CONTRACT_IDS = ["replay_window", "revocation", "rate_abuse"];
+const A2A_VECTOR_TIERS = ["contradiction-resolution", "hardening"];
 export {
+  A2A_VECTOR_TIERS,
   CONTRACT_IDS
 };

package/dist/lib/testing/storyboard/request-signing/vector-loader.d.mts

@@ -1,7 +1,22 @@
-import type { NegativeVector, PositiveVector, TestKeypair, TestKeyset } from './types.mjs';
+import type { A2aNegativeVector, A2aPositiveVector, NegativeVector, PositiveVector, TestKeypair, TestKeyset } from './types.mjs';
 export interface LoadVectorsOptions {
     complianceDir?: string;
     version?: string;
+    /**
+     * Explicit directory holding the A2A operation-resolution vectors
+     * (`positive/` and `negative/` subdirectories). Takes precedence over the
+     * compliance cache and the vendored copy; falls back to the
+     * `ADCP_A2A_VECTORS_DIR` environment variable. A configured directory that
+     * does not exist is an error, not a silent fall-through.
+     */
+    a2aVectorsDir?: string;
+    /**
+     * Allow falling back to the vendored `test/fixtures/request-signing-a2a`
+     * copy when the compliance cache has no A2A vectors. Default `true`. Set
+     * `false` to see exactly what an installed package sees (the fixtures are
+     * not shipped), e.g. to test the "unavailable" report.
+     */
+    a2aVendoredFallback?: boolean;
 }
 export interface LoadedVectors {
     positive: PositiveVector[];
@@ -21,4 +36,30 @@ export declare function loadRequestSigningVectors(options?: LoadVectorsOptions):
 export declare function loadRequestSigningKeys(options?: LoadVectorsOptions): TestKeyset;
 /** Test-only: clear the memoization cache so a fresh cache path is reread. */
 export declare function __resetVectorCache(): void;
+/** Where the A2A operation-resolution vectors came from. */
+export type A2aVectorSource = 'override' | 'compliance_cache' | 'vendored_fixture' | 'none';
+export interface LoadedA2aVectors {
+    positive: A2aPositiveVector[];
+    negative: A2aNegativeVector[];
+    source: A2aVectorSource;
+    /** Directory the vectors were read from; absent when `source` is `'none'`. */
+    sourceDir?: string;
+}
+/** Reported verbatim when the grader finds no A2A operation-resolution vectors. */
+export declare const A2A_VECTORS_UNAVAILABLE_MESSAGE = "a2a operation-resolution vectors unavailable in this compliance bundle";
+/** Env var naming an explicit A2A vector directory (tests, pre-release bundles). */
+export declare const A2A_VECTORS_DIR_ENV = "ADCP_A2A_VECTORS_DIR";
+/**
+ * Load the A2A operation-resolution vectors.
+ *
+ * Resolution order:
+ *   1. `options.a2aVectorsDir`, else `$ADCP_A2A_VECTORS_DIR` (explicit; must exist).
+ *   2. `<complianceCache>/test-vectors/request-signing/a2a/`.
+ *   3. The vendored `test/fixtures/request-signing-a2a/` copy, when present
+ *      (repo checkouts only; never shipped).
+ *
+ * Returns `source: 'none'` with empty arrays when none exist; callers MUST
+ * report that rather than treating it as a pass.
+ */
+export declare function loadA2aOperationResolutionVectors(options?: LoadVectorsOptions): LoadedA2aVectors;
 export declare function findKey(keyset: TestKeyset, kid: string): TestKeypair;

package/dist/lib/testing/storyboard/request-signing/vector-loader.d.ts

@@ -1,7 +1,22 @@
-import type { NegativeVector, PositiveVector, TestKeypair, TestKeyset } from './types';
+import type { A2aNegativeVector, A2aPositiveVector, NegativeVector, PositiveVector, TestKeypair, TestKeyset } from './types';
 export interface LoadVectorsOptions {
     complianceDir?: string;
     version?: string;
+    /**
+     * Explicit directory holding the A2A operation-resolution vectors
+     * (`positive/` and `negative/` subdirectories). Takes precedence over the
+     * compliance cache and the vendored copy; falls back to the
+     * `ADCP_A2A_VECTORS_DIR` environment variable. A configured directory that
+     * does not exist is an error, not a silent fall-through.
+     */
+    a2aVectorsDir?: string;
+    /**
+     * Allow falling back to the vendored `test/fixtures/request-signing-a2a`
+     * copy when the compliance cache has no A2A vectors. Default `true`. Set
+     * `false` to see exactly what an installed package sees (the fixtures are
+     * not shipped), e.g. to test the "unavailable" report.
+     */
+    a2aVendoredFallback?: boolean;
 }
 export interface LoadedVectors {
     positive: PositiveVector[];
@@ -21,4 +36,30 @@ export declare function loadRequestSigningVectors(options?: LoadVectorsOptions):
 export declare function loadRequestSigningKeys(options?: LoadVectorsOptions): TestKeyset;
 /** Test-only: clear the memoization cache so a fresh cache path is reread. */
 export declare function __resetVectorCache(): void;
+/** Where the A2A operation-resolution vectors came from. */
+export type A2aVectorSource = 'override' | 'compliance_cache' | 'vendored_fixture' | 'none';
+export interface LoadedA2aVectors {
+    positive: A2aPositiveVector[];
+    negative: A2aNegativeVector[];
+    source: A2aVectorSource;
+    /** Directory the vectors were read from; absent when `source` is `'none'`. */
+    sourceDir?: string;
+}
+/** Reported verbatim when the grader finds no A2A operation-resolution vectors. */
+export declare const A2A_VECTORS_UNAVAILABLE_MESSAGE = "a2a operation-resolution vectors unavailable in this compliance bundle";
+/** Env var naming an explicit A2A vector directory (tests, pre-release bundles). */
+export declare const A2A_VECTORS_DIR_ENV = "ADCP_A2A_VECTORS_DIR";
+/**
+ * Load the A2A operation-resolution vectors.
+ *
+ * Resolution order:
+ *   1. `options.a2aVectorsDir`, else `$ADCP_A2A_VECTORS_DIR` (explicit; must exist).
+ *   2. `<complianceCache>/test-vectors/request-signing/a2a/`.
+ *   3. The vendored `test/fixtures/request-signing-a2a/` copy, when present
+ *      (repo checkouts only; never shipped).
+ *
+ * Returns `source: 'none'` with empty arrays when none exist; callers MUST
+ * report that rather than treating it as a pass.
+ */
+export declare function loadA2aOperationResolutionVectors(options?: LoadVectorsOptions): LoadedA2aVectors;
 export declare function findKey(keyset: TestKeyset, kid: string): TestKeypair;

package/dist/lib/testing/storyboard/request-signing/vector-loader.js

@@ -18,8 +18,11 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var vector_loader_exports = {};
 __export(vector_loader_exports, {
+  A2A_VECTORS_DIR_ENV: () => A2A_VECTORS_DIR_ENV,
+  A2A_VECTORS_UNAVAILABLE_MESSAGE: () => A2A_VECTORS_UNAVAILABLE_MESSAGE,
   __resetVectorCache: () => __resetVectorCache,
   findKey: () => findKey,
+  loadA2aOperationResolutionVectors: () => loadA2aOperationResolutionVectors,
   loadRequestSigningKeys: () => loadRequestSigningKeys,
   loadRequestSigningVectors: () => loadRequestSigningVectors,
   selectRequestSigningVectors: () => selectRequestSigningVectors,
@@ -57,7 +60,8 @@ const ERROR_CODES = /* @__PURE__ */ new Set([
   "request_signature_invalid",
   "request_signature_digest_mismatch",
   "request_signature_replayed",
-  "request_signature_rate_abuse"
+  "request_signature_rate_abuse",
+  "request_body_malformed"
 ]);
 const CONTRACT_ID_SET = new Set(import_types.CONTRACT_IDS);
 const VECTOR_CACHE = /* @__PURE__ */ new Map();
@@ -93,6 +97,98 @@ function loadRequestSigningKeys(options = {}) {
 }
 function __resetVectorCache() {
   VECTOR_CACHE.clear();
+  A2A_VECTOR_CACHE.clear();
+}
+const A2A_VECTORS_UNAVAILABLE_MESSAGE = "a2a operation-resolution vectors unavailable in this compliance bundle";
+const A2A_VECTORS_DIR_ENV = "ADCP_A2A_VECTORS_DIR";
+const A2A_VECTOR_CACHE = /* @__PURE__ */ new Map();
+function vendoredA2aVectorsDir() {
+  return (0, import_path.resolve)(__dirname, "..", "..", "..", "..", "..", "test", "fixtures", "request-signing-a2a");
+}
+function hasA2aVectorDirs(dir) {
+  return (0, import_fs.existsSync)((0, import_path.join)(dir, "positive")) && (0, import_fs.existsSync)((0, import_path.join)(dir, "negative"));
+}
+function loadA2aOperationResolutionVectors(options = {}) {
+  const explicit = options.a2aVectorsDir ?? (process.env[A2A_VECTORS_DIR_ENV] || void 0);
+  let source;
+  let dir;
+  if (explicit) {
+    if (!hasA2aVectorDirs(explicit)) {
+      throw new Error(`A2A operation-resolution vectors not found at ${explicit} (expected positive/ and negative/).`);
+    }
+    source = "override";
+    dir = explicit;
+  } else {
+    const cacheDir = (0, import_path.join)((0, import_compliance.getComplianceCacheDir)(options), "test-vectors", "request-signing", "a2a");
+    const vendored = vendoredA2aVectorsDir();
+    if (hasA2aVectorDirs(cacheDir)) {
+      source = "compliance_cache";
+      dir = cacheDir;
+    } else if (options.a2aVendoredFallback !== false && hasA2aVectorDirs(vendored)) {
+      source = "vendored_fixture";
+      dir = vendored;
+    } else {
+      return { positive: [], negative: [], source: "none" };
+    }
+  }
+  let parsed = A2A_VECTOR_CACHE.get(dir);
+  if (!parsed) {
+    parsed = {
+      positive: loadDir((0, import_path.join)(dir, "positive"), parseA2aPositive, "a2a/positive/"),
+      negative: loadDir((0, import_path.join)(dir, "negative"), parseA2aNegative, "a2a/negative/")
+    };
+    A2A_VECTOR_CACHE.set(dir, parsed);
+  }
+  return { ...parsed, source, sourceDir: dir };
+}
+function parseA2aTier(id, r) {
+  const tier = r.tier;
+  if (typeof tier !== "string" || !import_types.A2A_VECTOR_TIERS.includes(tier)) {
+    throw new Error(`${id}: tier must be one of ${import_types.A2A_VECTOR_TIERS.join(", ")} (got ${JSON.stringify(tier)})`);
+  }
+  return tier;
+}
+function parseA2aOutcome(id, r) {
+  const o = r.expected_outcome;
+  const resolved = o.resolved_operation;
+  if (resolved !== void 0 && resolved !== null && typeof resolved !== "string") {
+    throw new Error(`${id}: expected_outcome.resolved_operation must be a string or null`);
+  }
+  const status = o.status;
+  if (status !== void 0 && status !== "verified" && status !== "unsigned") {
+    throw new Error(`${id}: expected_outcome.status must be "verified" or "unsigned"`);
+  }
+  return {
+    success: o.success,
+    ...status !== void 0 && { status },
+    ...typeof o.error_code === "string" && { error_code: o.error_code },
+    ...o.failed_step !== void 0 && { failed_step: o.failed_step },
+    ...resolved !== void 0 && { resolved_operation: resolved },
+    ...typeof o.dispatched_operation === "string" && { dispatched_operation: o.dispatched_operation },
+    ...typeof o.dispatch === "string" && { dispatch: o.dispatch }
+  };
+}
+function parseA2aPositive(id, raw) {
+  const r = raw;
+  const base = parsePositive(id, raw);
+  const expected_outcome = parseA2aOutcome(id, r);
+  if (expected_outcome.status === void 0) {
+    throw new Error(`${id}: positive A2A vector requires expected_outcome.status`);
+  }
+  return {
+    ...base,
+    tier: parseA2aTier(id, r),
+    expected_outcome
+  };
+}
+function parseA2aNegative(id, raw) {
+  const r = raw;
+  const base = parseNegative(id, raw);
+  return {
+    ...base,
+    tier: parseA2aTier(id, r),
+    expected_outcome: parseA2aOutcome(id, r)
+  };
 }
 function loadDir(dir, parse, idPrefix = "") {
   if (!(0, import_fs.existsSync)(dir)) {
@@ -284,8 +380,11 @@ function strArray(v, where) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  A2A_VECTORS_DIR_ENV,
+  A2A_VECTORS_UNAVAILABLE_MESSAGE,
   __resetVectorCache,
   findKey,
+  loadA2aOperationResolutionVectors,
   loadRequestSigningKeys,
   loadRequestSigningVectors,
   selectRequestSigningVectors,

package/dist/lib/testing/storyboard/request-signing/vector-loader.mjs

@@ -1,7 +1,12 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
 import { existsSync, readFileSync, readdirSync } from "fs";
-import { basename, join } from "path";
+import { basename, join, resolve } from "path";
 import { getComplianceCacheDir } from "../compliance.mjs";
-import { CONTRACT_IDS } from "./types.mjs";
+import { A2A_VECTOR_TIERS, CONTRACT_IDS } from "./types.mjs";
 function selectRequestSigningVectors(loaded, signingProfileVersion) {
   const profile = signingProfileVersion ? loaded.profiles[signingProfileVersion] : void 0;
   if (!signingProfileVersion) return { positive: loaded.positive, negative: loaded.negative };
@@ -29,7 +34,8 @@ const ERROR_CODES = /* @__PURE__ */ new Set([
   "request_signature_invalid",
   "request_signature_digest_mismatch",
   "request_signature_replayed",
-  "request_signature_rate_abuse"
+  "request_signature_rate_abuse",
+  "request_body_malformed"
 ]);
 const CONTRACT_ID_SET = new Set(CONTRACT_IDS);
 const VECTOR_CACHE = /* @__PURE__ */ new Map();
@@ -65,6 +71,98 @@ function loadRequestSigningKeys(options = {}) {
 }
 function __resetVectorCache() {
   VECTOR_CACHE.clear();
+  A2A_VECTOR_CACHE.clear();
+}
+const A2A_VECTORS_UNAVAILABLE_MESSAGE = "a2a operation-resolution vectors unavailable in this compliance bundle";
+const A2A_VECTORS_DIR_ENV = "ADCP_A2A_VECTORS_DIR";
+const A2A_VECTOR_CACHE = /* @__PURE__ */ new Map();
+function vendoredA2aVectorsDir() {
+  return resolve(__dirname, "..", "..", "..", "..", "..", "test", "fixtures", "request-signing-a2a");
+}
+function hasA2aVectorDirs(dir) {
+  return existsSync(join(dir, "positive")) && existsSync(join(dir, "negative"));
+}
+function loadA2aOperationResolutionVectors(options = {}) {
+  const explicit = options.a2aVectorsDir ?? (process.env[A2A_VECTORS_DIR_ENV] || void 0);
+  let source;
+  let dir;
+  if (explicit) {
+    if (!hasA2aVectorDirs(explicit)) {
+      throw new Error(`A2A operation-resolution vectors not found at ${explicit} (expected positive/ and negative/).`);
+    }
+    source = "override";
+    dir = explicit;
+  } else {
+    const cacheDir = join(getComplianceCacheDir(options), "test-vectors", "request-signing", "a2a");
+    const vendored = vendoredA2aVectorsDir();
+    if (hasA2aVectorDirs(cacheDir)) {
+      source = "compliance_cache";
+      dir = cacheDir;
+    } else if (options.a2aVendoredFallback !== false && hasA2aVectorDirs(vendored)) {
+      source = "vendored_fixture";
+      dir = vendored;
+    } else {
+      return { positive: [], negative: [], source: "none" };
+    }
+  }
+  let parsed = A2A_VECTOR_CACHE.get(dir);
+  if (!parsed) {
+    parsed = {
+      positive: loadDir(join(dir, "positive"), parseA2aPositive, "a2a/positive/"),
+      negative: loadDir(join(dir, "negative"), parseA2aNegative, "a2a/negative/")
+    };
+    A2A_VECTOR_CACHE.set(dir, parsed);
+  }
+  return { ...parsed, source, sourceDir: dir };
+}
+function parseA2aTier(id, r) {
+  const tier = r.tier;
+  if (typeof tier !== "string" || !A2A_VECTOR_TIERS.includes(tier)) {
+    throw new Error(`${id}: tier must be one of ${A2A_VECTOR_TIERS.join(", ")} (got ${JSON.stringify(tier)})`);
+  }
+  return tier;
+}
+function parseA2aOutcome(id, r) {
+  const o = r.expected_outcome;
+  const resolved = o.resolved_operation;
+  if (resolved !== void 0 && resolved !== null && typeof resolved !== "string") {
+    throw new Error(`${id}: expected_outcome.resolved_operation must be a string or null`);
+  }
+  const status = o.status;
+  if (status !== void 0 && status !== "verified" && status !== "unsigned") {
+    throw new Error(`${id}: expected_outcome.status must be "verified" or "unsigned"`);
+  }
+  return {
+    success: o.success,
+    ...status !== void 0 && { status },
+    ...typeof o.error_code === "string" && { error_code: o.error_code },
+    ...o.failed_step !== void 0 && { failed_step: o.failed_step },
+    ...resolved !== void 0 && { resolved_operation: resolved },
+    ...typeof o.dispatched_operation === "string" && { dispatched_operation: o.dispatched_operation },
+    ...typeof o.dispatch === "string" && { dispatch: o.dispatch }
+  };
+}
+function parseA2aPositive(id, raw) {
+  const r = raw;
+  const base = parsePositive(id, raw);
+  const expected_outcome = parseA2aOutcome(id, r);
+  if (expected_outcome.status === void 0) {
+    throw new Error(`${id}: positive A2A vector requires expected_outcome.status`);
+  }
+  return {
+    ...base,
+    tier: parseA2aTier(id, r),
+    expected_outcome
+  };
+}
+function parseA2aNegative(id, raw) {
+  const r = raw;
+  const base = parseNegative(id, raw);
+  return {
+    ...base,
+    tier: parseA2aTier(id, r),
+    expected_outcome: parseA2aOutcome(id, r)
+  };
 }
 function loadDir(dir, parse, idPrefix = "") {
   if (!existsSync(dir)) {
@@ -255,8 +353,11 @@ function strArray(v, where) {
   return v;
 }
 export {
+  A2A_VECTORS_DIR_ENV,
+  A2A_VECTORS_UNAVAILABLE_MESSAGE,
   __resetVectorCache,
   findKey,
+  loadA2aOperationResolutionVectors,
   loadRequestSigningKeys,
   loadRequestSigningVectors,
   selectRequestSigningVectors,

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.0.0";
+export declare const RUNNER_CAPABILITY_VERSION = "15.2.1";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.0.0";
+export declare const RUNNER_CAPABILITY_VERSION = "15.2.1";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/types/accept-proposal.d.ts

@@ -2264,7 +2264,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/acquire-rights.d.ts

@@ -159,7 +159,7 @@ export interface AcquireRightsError {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/activate-signal.d.ts

@@ -140,7 +140,7 @@ export interface ActivateSignalError {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/build-creative.d.ts

@@ -381,7 +381,7 @@ export interface BuildCreativeSubmitted {
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {

package/dist/lib/types/buy-products.d.ts

@@ -2504,7 +2504,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/control-media-buy.d.ts

@@ -1330,7 +1330,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**

package/dist/lib/types/core.generated.d.mts

@@ -10912,7 +10912,7 @@ export type None2 = None;
  */
 export type AccountReference = {
     /**
-     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
+     * Seller-assigned account identifier. For upstream-managed account namespaces, this value comes from list_accounts; for seller-defined namespaces without a list_accounts surface, it is supplied out-of-band. Buyer-declared account sellers MAY echo account_id from sync_accounts as an internal handle, but they MUST continue accepting the account's current natural-key AccountRef on subsequent calls. Buyers of buyer-declared accounts send the natural key; a seller MAY also accept its echoed account_id, and buyers MUST NOT assume it does. A former key tombstoned by identity reconciliation returns ACCOUNT_MOVED to authorized callers.
      */
     account_id: string;
 } | {
@@ -22999,7 +22999,7 @@ export interface CollectionListChangedWebhook {
      */
     cache_valid_until?: string;
     /**
-     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/implementation/security#webhook-security.
+     * HMAC-SHA256 webhook signature over {unix_timestamp}.{raw_http_body_bytes} using the secret exchanged out-of-band when the seller registered with the governance agent. Recipients MUST verify against the X-ADCP-Signature and X-ADCP-Timestamp headers using timing-safe comparison and MUST reject requests where |now - timestamp| > 300 seconds. The body copy of this field is a convenience only — the headers are authoritative. See docs/building/by-layer/L1/security#webhook-security.
      */
     signature: string;
     ext?: ExtensionObject;
@@ -25202,7 +25202,7 @@ export type AudienceSelector = {
  */
 export interface AuthorizedAgentBaseFields {
     /**
-     * The authorized agent's API endpoint URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
+     * The authorized agent's protocol endpoint URL: the exact agent URL buyers are given and send AdCP requests to, including the path (e.g., `https://agent.example.com/mcp`). A bare origin matches only an agent served at the root. An agent reachable at more than one agent URL (for example, separate MCP and A2A endpoints) needs one entry per URL. Callers comparing this URL against a registry (sales-agent list, signal-provider registry, TMP provider lookup, etc.) MUST canonicalize both sides per the AdCP URL canonicalization rules, not byte-equality — two URLs that differ only in case, default port, or percent-encoding of unreserved characters are the same agent. See docs/reference/url-canonicalization.
      */
     url: string;
     /**
@@ -32304,7 +32304,7 @@ export interface ReportingWebhook {
     token?: string;
     /**
      * @deprecated
-     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/implementation/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
+     * Legacy authentication configuration for webhook delivery (A2A-compatible). Opts the receiver into Bearer or HMAC-SHA256 signing. Both schemes are deprecated; the preferred signing profile for new integrations is RFC 9421, where the seller signs with a key published at its brand.json agents[] entry and the buyer verifies against the seller's JWKS — no shared secret crosses the wire (see docs/building/by-layer/L1/security.mdx#webhook-callbacks). This field is required in AdCP 3.x; the requirement is removed in AdCP 4.0 when the default RFC 9421 path becomes the only path.
      */
     authentication: {
         /**
@@ -37714,7 +37714,7 @@ export type TMPProviderRegistration = ({
      */
     provider_id: string;
     /**
-     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/implementation/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
+     * Base URL the router calls. The router appends /context for Context Match and /identity for Identity Match. MUST be HTTPS in production, validated against the canonical reserved IPv4 and IPv6 ranges, with the TCP connection pinned to the validated IP (DNS re-resolution alone is insufficient against rebinding). Publishers comparing two provider registrations for the same `endpoint` MUST canonicalize both per the AdCP URL canonicalization rules; two registrations differing only in case, default port, or path-slash collapsing are the same provider. See docs/trusted-match/specification#provider-registration-security, docs/building/by-layer/L1/security#webhook-url-validation-ssrf, and docs/reference/url-canonicalization.
      */
     endpoint: string;
     /**