@adcp/sdk 15.9.0 → 16.0.0-beta.1

package/dist/lib/testing/compliance/comply.js

@@ -429,13 +429,18 @@ async function comply(agentUrl, options = {}) {
       `Refusing to run compliance against a non-HTTPS URL: ${agentUrl}. Production agents MUST terminate TLS. Pass { allow_http: true } (or --allow-http) for local development.`
     );
   }
-  return (0, import_protocols.withMCPConnectionScope)(async () => {
-    try {
-      return await complyImpl(agentUrl, options);
-    } finally {
-      await (0, import_protocols.closeScopedConnections)(options.protocol);
-    }
-  });
+  return (0, import_client.withTestClientScope)(
+    () => (0, import_protocols.withMCPConnectionScope)(
+      async () => {
+        try {
+          return await complyImpl(agentUrl, options);
+        } finally {
+          await (0, import_protocols.closeScopedConnections)(options.protocol);
+        }
+      },
+      { isolate: true }
+    )
+  );
 }
 function sanitizeAgentText(text, max = 500) {
   const cleaned = text.replace(/[\p{C}\u2028\u2029\u202A-\u202E\u2066-\u2069]/gu, "").trim();
@@ -912,6 +917,15 @@ function buildNotApplicableStoryboardResult(agentUrl, na) {
   };
 }
 async function runComplyStoryboard(agentUrl, storyboard, runOptions, profile, routeStoryboard) {
+  runOptions = { ...runOptions, _discoveryPass: {} };
+  const resolution = (0, import_client.getOrCreateClientResolution)(agentUrl, runOptions);
+  const discovered = await (0, import_client.getOrDiscoverProfile)(resolution.client, runOptions);
+  if (discovered.step.passed) {
+    profile = discovered.profile;
+    runOptions = { ...runOptions, _profile: profile, agentTools: profile.tools };
+  } else {
+    runOptions = { ...runOptions, _profile: void 0, agentTools: void 0 };
+  }
   if (!routeStoryboard || (0, import_runner.storyboardCapabilityGateUnmet)(storyboard, runOptions) !== null) {
     return (0, import_runner.runStoryboard)(agentUrl, storyboard, runOptions);
   }
@@ -1371,7 +1385,7 @@ async function complyImpl(agentUrl, options) {
       profile,
       step: profileStep,
       caughtError: profileCaughtError
-    } = await (0, import_client.discoverAgentProfile)(discoveryClient, signal, complianceIndex.adcp_version);
+    } = await (0, import_client.getOrDiscoverProfile)(discoveryClient, { ...discoveryOptions, signal }, complianceIndex.adcp_version);
     if (testOptions.versionEnvelope === void 0 && profile.tools.includes("get_adcp_capabilities") && profile.raw_capabilities === void 0 && !profileStep.error?.startsWith("VERSION_UNSUPPORTED:")) {
       const legacyDiscoveryOptions = { ...effectiveOptions, versionEnvelope: "major-only" };
       const legacyDiscoveryClient = (0, import_client.createTestClient)(
@@ -1379,7 +1393,11 @@ async function complyImpl(agentUrl, options) {
         effectiveOptions.protocol ?? "mcp",
         legacyDiscoveryOptions
       );
-      const legacyDiscovery = await (0, import_client.discoverAgentProfile)(legacyDiscoveryClient, signal, complianceIndex.adcp_version);
+      const legacyDiscovery = await (0, import_client.getOrDiscoverProfile)(
+        legacyDiscoveryClient,
+        { ...legacyDiscoveryOptions, signal },
+        complianceIndex.adcp_version
+      );
       if (legacyDiscovery.profile.raw_capabilities !== void 0) {
         discoveryOptions = legacyDiscoveryOptions;
         discoveryClient = legacyDiscoveryClient;
@@ -1394,7 +1412,7 @@ async function complyImpl(agentUrl, options) {
       ...testOptions.adcpVersion !== void 0 && { callerAdcpVersion: testOptions.adcpVersion },
       ...testOptions.versionEnvelope !== void 0 && { callerVersionEnvelope: testOptions.versionEnvelope }
     });
-    const client = discoveryOptions === effectiveOptions ? discoveryClient : (0, import_client.createTestClient)(agentUrl, effectiveOptions.protocol ?? "mcp", effectiveOptions);
+    const client = discoveryOptions === effectiveOptions ? discoveryClient : (0, import_client.getOrCreateClientResolution)(agentUrl, effectiveOptions).client;
     (0, import_client.seedTestClientSigningCapability)(client, profile, complianceIndex.adcp_version);
     effectiveOptions._client = client;
     effectiveOptions._profile = profile;
@@ -1456,6 +1474,7 @@ async function complyImpl(agentUrl, options) {
         if (runnable.length > 0) {
           allObservations.push(...authCheck.observations);
           effectiveOptions._profile = degraded;
+          (0, import_client.seedAuthRejectedTestClientProfile)(client, degraded, complianceIndex.adcp_version);
           return await runWithDegradedProfile(
             agentUrl,
             degraded,

package/dist/lib/testing/compliance/comply.mjs

@@ -1,4 +1,11 @@
-import { createTestClient, discoverAgentProfile, seedTestClientSigningCapability } from "../client.mjs";
+import {
+  createTestClient,
+  getOrCreateClientResolution,
+  getOrDiscoverProfile,
+  seedTestClientSigningCapability,
+  seedAuthRejectedTestClientProfile,
+  withTestClientScope
+} from "../client.mjs";
 import { collectDetachedAssertionFailures, mapStoryboardResultsToTrackResult, TRACK_LABELS } from "./storyboard-tracks.mjs";
 import {
   applyAdcpVersionRunOptions,
@@ -412,13 +419,18 @@ async function comply(agentUrl, options = {}) {
       `Refusing to run compliance against a non-HTTPS URL: ${agentUrl}. Production agents MUST terminate TLS. Pass { allow_http: true } (or --allow-http) for local development.`
     );
   }
-  return withMCPConnectionScope(async () => {
-    try {
-      return await complyImpl(agentUrl, options);
-    } finally {
-      await closeScopedConnections(options.protocol);
-    }
-  });
+  return withTestClientScope(
+    () => withMCPConnectionScope(
+      async () => {
+        try {
+          return await complyImpl(agentUrl, options);
+        } finally {
+          await closeScopedConnections(options.protocol);
+        }
+      },
+      { isolate: true }
+    )
+  );
 }
 function sanitizeAgentText(text, max = 500) {
   const cleaned = text.replace(/[\p{C}\u2028\u2029\u202A-\u202E\u2066-\u2069]/gu, "").trim();
@@ -895,6 +907,15 @@ function buildNotApplicableStoryboardResult(agentUrl, na) {
   };
 }
 async function runComplyStoryboard(agentUrl, storyboard, runOptions, profile, routeStoryboard) {
+  runOptions = { ...runOptions, _discoveryPass: {} };
+  const resolution = getOrCreateClientResolution(agentUrl, runOptions);
+  const discovered = await getOrDiscoverProfile(resolution.client, runOptions);
+  if (discovered.step.passed) {
+    profile = discovered.profile;
+    runOptions = { ...runOptions, _profile: profile, agentTools: profile.tools };
+  } else {
+    runOptions = { ...runOptions, _profile: void 0, agentTools: void 0 };
+  }
   if (!routeStoryboard || storyboardCapabilityGateUnmet(storyboard, runOptions) !== null) {
     return runStoryboard(agentUrl, storyboard, runOptions);
   }
@@ -1354,7 +1375,7 @@ async function complyImpl(agentUrl, options) {
       profile,
       step: profileStep,
       caughtError: profileCaughtError
-    } = await discoverAgentProfile(discoveryClient, signal, complianceIndex.adcp_version);
+    } = await getOrDiscoverProfile(discoveryClient, { ...discoveryOptions, signal }, complianceIndex.adcp_version);
     if (testOptions.versionEnvelope === void 0 && profile.tools.includes("get_adcp_capabilities") && profile.raw_capabilities === void 0 && !profileStep.error?.startsWith("VERSION_UNSUPPORTED:")) {
       const legacyDiscoveryOptions = { ...effectiveOptions, versionEnvelope: "major-only" };
       const legacyDiscoveryClient = createTestClient(
@@ -1362,7 +1383,11 @@ async function complyImpl(agentUrl, options) {
         effectiveOptions.protocol ?? "mcp",
         legacyDiscoveryOptions
       );
-      const legacyDiscovery = await discoverAgentProfile(legacyDiscoveryClient, signal, complianceIndex.adcp_version);
+      const legacyDiscovery = await getOrDiscoverProfile(
+        legacyDiscoveryClient,
+        { ...legacyDiscoveryOptions, signal },
+        complianceIndex.adcp_version
+      );
       if (legacyDiscovery.profile.raw_capabilities !== void 0) {
         discoveryOptions = legacyDiscoveryOptions;
         discoveryClient = legacyDiscoveryClient;
@@ -1377,7 +1402,7 @@ async function complyImpl(agentUrl, options) {
       ...testOptions.adcpVersion !== void 0 && { callerAdcpVersion: testOptions.adcpVersion },
       ...testOptions.versionEnvelope !== void 0 && { callerVersionEnvelope: testOptions.versionEnvelope }
     });
-    const client = discoveryOptions === effectiveOptions ? discoveryClient : createTestClient(agentUrl, effectiveOptions.protocol ?? "mcp", effectiveOptions);
+    const client = discoveryOptions === effectiveOptions ? discoveryClient : getOrCreateClientResolution(agentUrl, effectiveOptions).client;
     seedTestClientSigningCapability(client, profile, complianceIndex.adcp_version);
     effectiveOptions._client = client;
     effectiveOptions._profile = profile;
@@ -1439,6 +1464,7 @@ async function complyImpl(agentUrl, options) {
         if (runnable.length > 0) {
           allObservations.push(...authCheck.observations);
           effectiveOptions._profile = degraded;
+          seedAuthRejectedTestClientProfile(client, degraded, complianceIndex.adcp_version);
           return await runWithDegradedProfile(
             agentUrl,
             degraded,

package/dist/lib/testing/storyboard/account-sync-contract.d.mts

@@ -0,0 +1,3 @@
+import type { AssertionSpec } from './assertions.mjs';
+/** Opt-in invariant for account provisioning storyboards, including fresh keys. */
+export declare const accountSyncContractAssertion: AssertionSpec;

package/dist/lib/testing/storyboard/account-sync-contract.d.ts

@@ -0,0 +1,3 @@
+import type { AssertionSpec } from './assertions';
+/** Opt-in invariant for account provisioning storyboards, including fresh keys. */
+export declare const accountSyncContractAssertion: AssertionSpec;

package/dist/lib/testing/storyboard/account-sync-contract.js

@@ -0,0 +1,79 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var account_sync_contract_exports = {};
+__export(account_sync_contract_exports, {
+  accountSyncContractAssertion: () => accountSyncContractAssertion
+});
+module.exports = __toCommonJS(account_sync_contract_exports);
+var import_account_key = require('../../core/account-key.js');
+const accountSyncContractAssertion = {
+  id: "account.sync_contract",
+  default: false,
+  description: "Natural-key syncs preserve identity, accept or reject terms, and expose agent billing fields.",
+  onStep(ctx, step) {
+    if (step.skipped || !["sync_accounts", "list_accounts"].includes(step.task)) return [];
+    const payload = step.request?.payload;
+    const raw = step.response ?? step.response_record?.payload;
+    const response = raw?.data ?? raw;
+    if (!Array.isArray(response?.accounts)) return [];
+    const seen = ctx.state.accounts ??= /* @__PURE__ */ new Map();
+    const results = [];
+    for (const [index, row] of response.accounts.entries()) {
+      if (row.action === "failed" || row.status === "rejected") continue;
+      const problems = [];
+      const entry = payload?.accounts?.[index];
+      if (step.task === "list_accounts" && [...seen.values()].some((prior) => prior.id === row.account_id && prior.billing === "agent") && row.billing === void 0)
+        problems.push("known agent-billed account omits billing");
+      if (row.billing === "agent" && row.payment_terms === void 0)
+        problems.push("agent-billed account omits payment_terms");
+      if (step.task === "sync_accounts" && entry) {
+        if (entry.billing === "agent" && row.billing === void 0) problems.push("agent-billed sync omits billing");
+        if (entry.billing === "agent" && row.billing !== void 0 && row.billing !== "agent")
+          problems.push("agent-billed sync changed billing party");
+        if (entry.payment_terms !== void 0 && row.status === "active" && row.payment_terms !== entry.payment_terms)
+          problems.push("active account did not accept requested payment_terms");
+        const ref = entry.account ?? entry;
+        if ("brand" in ref && ref.brand && typeof ref.operator === "string" && payload?.dry_run !== true) {
+          const key = JSON.stringify([step.agent_url ?? ctx.agentUrl, (0, import_account_key.accountReferenceKey)(ref)]);
+          const prior = seen.get(key);
+          if (prior && (prior.id !== row.account_id || (payload?.idempotency_key === void 0 || !prior.requestKeys.has(payload.idempotency_key)) && row.action === "created"))
+            problems.push("repeat natural-key sync created a different account or reported created");
+          const requestKeys = prior?.requestKeys ?? /* @__PURE__ */ new Set();
+          requestKeys.add(payload?.idempotency_key);
+          seen.set(key, {
+            id: prior?.id ?? row.account_id,
+            billing: row.billing,
+            requestKeys
+          });
+        }
+      }
+      results.push({
+        passed: problems.length === 0,
+        description: `Account contract for ${step.task} row ${index}`,
+        step_id: step.step_id,
+        ...problems.length && { error: problems.join("; ") }
+      });
+    }
+    return results;
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  accountSyncContractAssertion
+});

package/dist/lib/testing/storyboard/account-sync-contract.mjs

@@ -0,0 +1,55 @@
+import { accountReferenceKey } from "../../core/account-key.mjs";
+const accountSyncContractAssertion = {
+  id: "account.sync_contract",
+  default: false,
+  description: "Natural-key syncs preserve identity, accept or reject terms, and expose agent billing fields.",
+  onStep(ctx, step) {
+    if (step.skipped || !["sync_accounts", "list_accounts"].includes(step.task)) return [];
+    const payload = step.request?.payload;
+    const raw = step.response ?? step.response_record?.payload;
+    const response = raw?.data ?? raw;
+    if (!Array.isArray(response?.accounts)) return [];
+    const seen = ctx.state.accounts ??= /* @__PURE__ */ new Map();
+    const results = [];
+    for (const [index, row] of response.accounts.entries()) {
+      if (row.action === "failed" || row.status === "rejected") continue;
+      const problems = [];
+      const entry = payload?.accounts?.[index];
+      if (step.task === "list_accounts" && [...seen.values()].some((prior) => prior.id === row.account_id && prior.billing === "agent") && row.billing === void 0)
+        problems.push("known agent-billed account omits billing");
+      if (row.billing === "agent" && row.payment_terms === void 0)
+        problems.push("agent-billed account omits payment_terms");
+      if (step.task === "sync_accounts" && entry) {
+        if (entry.billing === "agent" && row.billing === void 0) problems.push("agent-billed sync omits billing");
+        if (entry.billing === "agent" && row.billing !== void 0 && row.billing !== "agent")
+          problems.push("agent-billed sync changed billing party");
+        if (entry.payment_terms !== void 0 && row.status === "active" && row.payment_terms !== entry.payment_terms)
+          problems.push("active account did not accept requested payment_terms");
+        const ref = entry.account ?? entry;
+        if ("brand" in ref && ref.brand && typeof ref.operator === "string" && payload?.dry_run !== true) {
+          const key = JSON.stringify([step.agent_url ?? ctx.agentUrl, accountReferenceKey(ref)]);
+          const prior = seen.get(key);
+          if (prior && (prior.id !== row.account_id || (payload?.idempotency_key === void 0 || !prior.requestKeys.has(payload.idempotency_key)) && row.action === "created"))
+            problems.push("repeat natural-key sync created a different account or reported created");
+          const requestKeys = prior?.requestKeys ?? /* @__PURE__ */ new Set();
+          requestKeys.add(payload?.idempotency_key);
+          seen.set(key, {
+            id: prior?.id ?? row.account_id,
+            billing: row.billing,
+            requestKeys
+          });
+        }
+      }
+      results.push({
+        passed: problems.length === 0,
+        description: `Account contract for ${step.task} row ${index}`,
+        step_id: step.step_id,
+        ...problems.length && { error: problems.join("; ") }
+      });
+    }
+    return results;
+  }
+};
+export {
+  accountSyncContractAssertion
+};

package/dist/lib/testing/storyboard/default-invariants.js

@@ -26,6 +26,7 @@ var import_envelope_allowlist = require('../../server/envelope-allowlist.js');
 var import_error_codes = require('../../types/error-codes.js');
 var import_state_machine = require('../../server/state-machine.js');
 var import_assertions = require('./assertions.js');
+var import_account_sync_contract = require('./account-sync-contract.js');
 const REGISTERED = /* @__PURE__ */ new Set();
 function registerOnce(id, spec) {
   if (REGISTERED.has(id)) return;
@@ -33,6 +34,7 @@ function registerOnce(id, spec) {
   (0, import_assertions.registerAssertion)(spec);
 }
 function registerDefaultInvariants() {
+  registerOnce(import_account_sync_contract.accountSyncContractAssertion.id, import_account_sync_contract.accountSyncContractAssertion);
   registerOnce("idempotency.conflict_no_payload_leak", {
     id: "idempotency.conflict_no_payload_leak",
     default: true,

package/dist/lib/testing/storyboard/default-invariants.mjs

@@ -6,6 +6,7 @@ import {
   MEDIA_BUY_TRANSITIONS as MEDIA_BUY_TRANSITIONS_TYPED
 } from "../../server/state-machine.mjs";
 import { registerAssertion } from "./assertions.mjs";
+import { accountSyncContractAssertion } from "./account-sync-contract.mjs";
 const REGISTERED = /* @__PURE__ */ new Set();
 function registerOnce(id, spec) {
   if (REGISTERED.has(id)) return;
@@ -13,6 +14,7 @@ function registerOnce(id, spec) {
   registerAssertion(spec);
 }
 function registerDefaultInvariants() {
+  registerOnce(accountSyncContractAssertion.id, accountSyncContractAssertion);
   registerOnce("idempotency.conflict_no_payload_leak", {
     id: "idempotency.conflict_no_payload_leak",
     default: true,

package/dist/lib/testing/storyboard/runner.js

@@ -759,6 +759,7 @@ function filterResponseHeaders(headers) {
 }
 async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
   options = applyReusableProfileOptions(options);
+  if ((0, import_client.hasTestClientScope)() && !options._discoveryPass) options = { ...options, _discoveryPass: {} };
   return (0, import_protocols.withMCPConnectionScope)(
     async () => {
       options = applyStoryboardVersionOptions(storyboard, options);
@@ -768,6 +769,18 @@ async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
       });
       options = (0, import_test_kit.resolveDeclaredTestKit)(storyboard, options);
       options = (0, import_native_a2a_compliance.applyNativeA2AComplianceTransportOptions)(options);
+      if ((0, import_client.hasTestClientScope)() && options._client && !options.agents) {
+        const resolution = (0, import_client.getOrCreateClientResolution)(
+          typeof agentUrlOrUrls === "string" ? agentUrlOrUrls : agentUrlOrUrls[0],
+          options
+        );
+        const discovered = await (0, import_client.getOrDiscoverProfile)(resolution.client, options);
+        options = {
+          ...options,
+          _profile: discovered.step.passed ? discovered.profile : void 0,
+          agentTools: discovered.step.passed ? discovered.profile.tools : void 0
+        };
+      }
       const schemaRoot = getRunSchemaRoot(options);
       if (schemaRoot) {
         return await (0, import_schema_loader.withExternalSchemaRoot)(
@@ -778,7 +791,7 @@ async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
       }
       return await runStoryboardBody(agentUrlOrUrls, storyboard, options);
     },
-    { isolate: true }
+    { isolate: !(0, import_client.hasTestClientScope)() }
   );
 }
 async function runStoryboardBody(agentUrlOrUrls, storyboard, options) {
@@ -1529,7 +1542,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
   let clients;
   let routingContext;
   let profile;
-  let callerOwnsClients = false;
+  let callerOwnsClients = (0, import_client.hasTestClientScope)();
   if (useRouting) {
     try {
       routingContext = await (0, import_agent_routing.buildRoutingContext)(storyboard, options);
@@ -1541,7 +1554,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         duration_ms: 0,
         error: detail
       };
-      await (0, import_protocols.closeScopedConnections)(options.protocol);
+      if (!callerOwnsClients) await (0, import_protocols.closeScopedConnections)(options.protocol);
       return buildDiscoveryFailedResult(agentUrls, storyboard, failedStep);
     }
     clients = [...routingContext.clients.values()];
@@ -1555,17 +1568,19 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
   } else {
     const clientResolutions = agentUrls.map((url) => (0, import_client.getOrCreateClientResolution)(url, options));
     clients = clientResolutions.map((r) => r.client);
-    callerOwnsClients = clientResolutions.some((r) => r.reusedShared);
+    callerOwnsClients ||= clientResolutions.some((r) => r.reusedShared);
     resetClientSessions(clients);
-    if (!callerOwnsClients) {
+    if ((0, import_client.hasTestClientScope)() || !callerOwnsClients) {
       const discovered = await (0, import_client.getOrDiscoverProfile)(clients[0], options);
       if (discovered.step.passed === false) {
-        await (0, import_protocols.closeScopedConnections)(options.protocol);
+        if (!callerOwnsClients) await (0, import_protocols.closeScopedConnections)(options.protocol);
         return buildDiscoveryFailedResult(agentUrls, storyboard, discovered.step);
       }
       profile = discovered.profile;
       const profileTools = (0, import_agent_routing.normalizeAgentToolNames)(profile?.tools);
-      if (!options.agentTools && profileTools) {
+      if ((0, import_client.hasTestClientScope)() && profileTools) {
+        options = { ...options, agentTools: profileTools, _profile: profile };
+      } else if (!options.agentTools && profileTools) {
         options = { ...options, agentTools: profileTools, _profile: profile };
       } else if (profile && !options._profile) {
         options = { ...options, _profile: profile };
@@ -3108,7 +3123,7 @@ async function runStoryboardStep(agentUrl, storyboard, stepId, options = {}) {
       }
       return await runStoryboardStepBody(agentUrl, storyboard, stepId, options);
     },
-    { isolate: true }
+    { isolate: !(0, import_client.hasTestClientScope)() }
   );
 }
 async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {

package/dist/lib/testing/storyboard/runner.mjs

@@ -6,6 +6,7 @@ import {
   createTestClient,
   getOrCreateClientResolution,
   getOrDiscoverProfile,
+  hasTestClientScope,
   runStep
 } from "../client.mjs";
 import {
@@ -781,6 +782,7 @@ function filterResponseHeaders(headers) {
 }
 async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
   options = applyReusableProfileOptions(options);
+  if (hasTestClientScope() && !options._discoveryPass) options = { ...options, _discoveryPass: {} };
   return withMCPConnectionScope(
     async () => {
       options = applyStoryboardVersionOptions(storyboard, options);
@@ -790,6 +792,18 @@ async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
       });
       options = resolveDeclaredTestKit(storyboard, options);
       options = applyNativeA2AComplianceTransportOptions(options);
+      if (hasTestClientScope() && options._client && !options.agents) {
+        const resolution = getOrCreateClientResolution(
+          typeof agentUrlOrUrls === "string" ? agentUrlOrUrls : agentUrlOrUrls[0],
+          options
+        );
+        const discovered = await getOrDiscoverProfile(resolution.client, options);
+        options = {
+          ...options,
+          _profile: discovered.step.passed ? discovered.profile : void 0,
+          agentTools: discovered.step.passed ? discovered.profile.tools : void 0
+        };
+      }
       const schemaRoot = getRunSchemaRoot(options);
       if (schemaRoot) {
         return await withExternalSchemaRoot(
@@ -800,7 +814,7 @@ async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
       }
       return await runStoryboardBody(agentUrlOrUrls, storyboard, options);
     },
-    { isolate: true }
+    { isolate: !hasTestClientScope() }
   );
 }
 async function runStoryboardBody(agentUrlOrUrls, storyboard, options) {
@@ -1551,7 +1565,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
   let clients;
   let routingContext;
   let profile;
-  let callerOwnsClients = false;
+  let callerOwnsClients = hasTestClientScope();
   if (useRouting) {
     try {
       routingContext = await buildRoutingContext(storyboard, options);
@@ -1563,7 +1577,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         duration_ms: 0,
         error: detail
       };
-      await closeScopedConnections(options.protocol);
+      if (!callerOwnsClients) await closeScopedConnections(options.protocol);
       return buildDiscoveryFailedResult(agentUrls, storyboard, failedStep);
     }
     clients = [...routingContext.clients.values()];
@@ -1577,17 +1591,19 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
   } else {
     const clientResolutions = agentUrls.map((url) => getOrCreateClientResolution(url, options));
     clients = clientResolutions.map((r) => r.client);
-    callerOwnsClients = clientResolutions.some((r) => r.reusedShared);
+    callerOwnsClients ||= clientResolutions.some((r) => r.reusedShared);
     resetClientSessions(clients);
-    if (!callerOwnsClients) {
+    if (hasTestClientScope() || !callerOwnsClients) {
       const discovered = await getOrDiscoverProfile(clients[0], options);
       if (discovered.step.passed === false) {
-        await closeScopedConnections(options.protocol);
+        if (!callerOwnsClients) await closeScopedConnections(options.protocol);
         return buildDiscoveryFailedResult(agentUrls, storyboard, discovered.step);
       }
       profile = discovered.profile;
       const profileTools = normalizeAgentToolNames(profile?.tools);
-      if (!options.agentTools && profileTools) {
+      if (hasTestClientScope() && profileTools) {
+        options = { ...options, agentTools: profileTools, _profile: profile };
+      } else if (!options.agentTools && profileTools) {
         options = { ...options, agentTools: profileTools, _profile: profile };
       } else if (profile && !options._profile) {
         options = { ...options, _profile: profile };
@@ -3130,7 +3146,7 @@ async function runStoryboardStep(agentUrl, storyboard, stepId, options = {}) {
       }
       return await runStoryboardStepBody(agentUrl, storyboard, stepId, options);
     },
-    { isolate: true }
+    { isolate: !hasTestClientScope() }
   );
 }
 async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.9.0";
+export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.1";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "15.9.0";
+export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.1";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/types/adcp.d.mts

@@ -285,6 +285,8 @@ export interface AdcpPrivateJsonWebKey {
 export type AgentRequestSigningConfig = AgentRequestSigningConfigInline | AgentRequestSigningConfigProvider;
 /** Operation-list overrides shared by both `request_signing` shapes. */
 export interface AgentRequestSigningOperationOverrides {
+    /** Experimental 3.3 opt-in. Omitted retains the RFC 9421 AdCP profile. */
+    profile?: 'rfc9421' | 'web-bot-auth';
     /**
      * AdCP operation names to sign regardless of the seller's advertisement.
      * Useful during pilots before a counterparty flips an op into `required_for`.
@@ -365,6 +367,8 @@ export interface AgentRequestSigningConfigProvider extends AgentRequestSigningOp
      * KMS adapter.
      */
     provider: SigningProvider;
+    /** Required for Web Bot Auth: public JWK used to derive the RFC 7638 kid. */
+    public_key?: import('../signing/types.mjs').AdcpJsonWebKey;
     /** Agent base URL — same semantics as the inline shape. */
     agent_url: string;
 }

package/dist/lib/types/adcp.d.ts

@@ -285,6 +285,8 @@ export interface AdcpPrivateJsonWebKey {
 export type AgentRequestSigningConfig = AgentRequestSigningConfigInline | AgentRequestSigningConfigProvider;
 /** Operation-list overrides shared by both `request_signing` shapes. */
 export interface AgentRequestSigningOperationOverrides {
+    /** Experimental 3.3 opt-in. Omitted retains the RFC 9421 AdCP profile. */
+    profile?: 'rfc9421' | 'web-bot-auth';
     /**
      * AdCP operation names to sign regardless of the seller's advertisement.
      * Useful during pilots before a counterparty flips an op into `required_for`.
@@ -365,6 +367,8 @@ export interface AgentRequestSigningConfigProvider extends AgentRequestSigningOp
      * KMS adapter.
      */
     provider: SigningProvider;
+    /** Required for Web Bot Auth: public JWK used to derive the RFC 7638 kid. */
+    public_key?: import('../signing/types').AdcpJsonWebKey;
     /** Agent base URL — same semantics as the inline shape. */
     agent_url: string;
 }

package/dist/lib/types/schemas.generated.d.ts

@@ -23522,7 +23522,7 @@ export declare const SyncReportingStatusRequestSchema: z.ZodObject<{
     context: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
     ext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$loose> & {
-    pick: <M extends z.core.util.Mask<"account" | "ext" | "adcp_major_version" | "adcp_version" | "context" | "idempotency_key" | "statuses">>(mask: M & Record<Exclude<keyof M, "account" | "ext" | "adcp_major_version" | "adcp_version" | "context" | "idempotency_key" | "statuses">, never>) => z.ZodObject<Pick<{
+    pick: <M extends z.core.util.Mask<"account" | "ext" | "context" | "adcp_version" | "adcp_major_version" | "idempotency_key" | "statuses">>(mask: M & Record<Exclude<keyof M, "account" | "ext" | "context" | "adcp_version" | "adcp_major_version" | "idempotency_key" | "statuses">, never>) => z.ZodObject<Pick<{
         adcp_version: z.ZodOptional<z.ZodString>;
         adcp_major_version: z.ZodOptional<z.ZodNumber>;
         account: z.ZodUnion<readonly [z.ZodObject<{
@@ -23727,8 +23727,8 @@ export declare const SyncReportingStatusRequestSchema: z.ZodObject<{
         }>;
         context: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
         ext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, Extract<"account", keyof M> | Extract<"ext", keyof M> | Extract<"adcp_major_version", keyof M> | Extract<"adcp_version", keyof M> | Extract<"context", keyof M> | Extract<"idempotency_key", keyof M> | Extract<"statuses", keyof M>> extends infer T ? { [k in keyof T]: T[k]; } : never, z.core.$loose>;
-    omit: <M extends z.core.util.Mask<"account" | "ext" | "adcp_major_version" | "adcp_version" | "context" | "idempotency_key" | "statuses">>(mask: M & Record<Exclude<keyof M, "account" | "ext" | "adcp_major_version" | "adcp_version" | "context" | "idempotency_key" | "statuses">, never>) => z.ZodObject<Omit<{
+    }, Extract<"account", keyof M> | Extract<"ext", keyof M> | Extract<"context", keyof M> | Extract<"adcp_version", keyof M> | Extract<"adcp_major_version", keyof M> | Extract<"idempotency_key", keyof M> | Extract<"statuses", keyof M>> extends infer T ? { [k in keyof T]: T[k]; } : never, z.core.$loose>;
+    omit: <M extends z.core.util.Mask<"account" | "ext" | "context" | "adcp_version" | "adcp_major_version" | "idempotency_key" | "statuses">>(mask: M & Record<Exclude<keyof M, "account" | "ext" | "context" | "adcp_version" | "adcp_major_version" | "idempotency_key" | "statuses">, never>) => z.ZodObject<Omit<{
         adcp_version: z.ZodOptional<z.ZodString>;
         adcp_major_version: z.ZodOptional<z.ZodNumber>;
         account: z.ZodUnion<readonly [z.ZodObject<{
@@ -23933,8 +23933,8 @@ export declare const SyncReportingStatusRequestSchema: z.ZodObject<{
         }>;
         context: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
         ext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, Extract<"account", keyof M> | Extract<"ext", keyof M> | Extract<"adcp_major_version", keyof M> | Extract<"adcp_version", keyof M> | Extract<"context", keyof M> | Extract<"idempotency_key", keyof M> | Extract<"statuses", keyof M>> extends infer T ? { [k in keyof T]: T[k]; } : never, z.core.$loose>;
-    extend: <U extends z.core.$ZodLooseShape>(shape: U) => z.ZodObject<(("account" | "ext" | "adcp_major_version" | "adcp_version" | "context" | "idempotency_key" | "statuses") & keyof U extends never ? {
+    }, Extract<"account", keyof M> | Extract<"ext", keyof M> | Extract<"context", keyof M> | Extract<"adcp_version", keyof M> | Extract<"adcp_major_version", keyof M> | Extract<"idempotency_key", keyof M> | Extract<"statuses", keyof M>> extends infer T ? { [k in keyof T]: T[k]; } : never, z.core.$loose>;
+    extend: <U extends z.core.$ZodLooseShape>(shape: U) => z.ZodObject<(("account" | "ext" | "context" | "adcp_version" | "adcp_major_version" | "idempotency_key" | "statuses") & keyof U extends never ? {
         adcp_version: z.ZodOptional<z.ZodString>;
         adcp_major_version: z.ZodOptional<z.ZodNumber>;
         account: z.ZodUnion<readonly [z.ZodObject<{
@@ -24550,7 +24550,7 @@ export declare const SyncReportingStatusRequestSchema: z.ZodObject<{
         }>;
         context: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
         ext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, U> & Partial<Record<"account" | "ext" | "adcp_major_version" | "adcp_version" | "context" | "idempotency_key" | "statuses", z.core.SomeType>>) => z.ZodObject<(("account" | "ext" | "adcp_major_version" | "adcp_version" | "context" | "idempotency_key" | "statuses") & keyof U extends never ? {
+    }, U> & Partial<Record<"account" | "ext" | "context" | "adcp_version" | "adcp_major_version" | "idempotency_key" | "statuses", z.core.SomeType>>) => z.ZodObject<(("account" | "ext" | "context" | "adcp_version" | "adcp_major_version" | "idempotency_key" | "statuses") & keyof U extends never ? {
         adcp_version: z.ZodOptional<z.ZodString>;
         adcp_major_version: z.ZodOptional<z.ZodNumber>;
         account: z.ZodUnion<readonly [z.ZodObject<{

package/dist/lib/utils/capabilities.d.mts

@@ -53,6 +53,7 @@ export interface MediaBuyFeatures {
  * Account management capabilities declared by the seller
  */
 export interface AccountCapabilities {
+    agentOnboarding?: import('../identity-3.3/types.mjs').AgentOnboarding;
     /** Seller-issued IDs are stable and accepted wherever an account reference is used. */
     stableAccountId?: boolean;
     /** Optional account change feed; absence does not imply support. */