@adcp/sdk 16.0.0-beta.7 → 16.0.0-beta.9

package/dist/lib/testing/storyboard/runner.mjs

@@ -2,6 +2,7 @@ import { createHash, createHmac } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, join } from "node:path";
 import { ACCOUNT_FREE_DISCOVERY_TASKS } from "./account-policy.mjs";
+import { prepareCreativeBuildProbe } from "./creative-build-probe.mjs";
 import {
   createTestClient,
   getOrCreateClientResolution,
@@ -43,6 +44,11 @@ import {
   validateRateLimitTripSpec
 } from "./rate-limit-trip.mjs";
 import { redactSecrets } from "../../utils/redact-secrets.mjs";
+import {
+  rememberPropertyListCredentials,
+  verifyPropertyListReference,
+  withPropertyListCredentialRedaction
+} from "./property-list-reference.mjs";
 import { ResponseSchemaValidationError } from "../../utils/response-unwrapper.mjs";
 import { injectLegacyEnvelopeStatus, normalizeLegacyMediaBuyStatusForReturn } from "../../utils/envelope-status-compat.mjs";
 import { queryUpstreamTraffic } from "../test-controller.mjs";
@@ -785,38 +791,48 @@ function filterResponseHeaders(headers) {
 async function runStoryboard(agentUrlOrUrls, storyboard, options = {}) {
   options = applyReusableProfileOptions(options);
   if (hasTestClientScope() && !options._discoveryPass) options = { ...options, _discoveryPass: {} };
-  return withMCPConnectionScope(
-    async () => {
-      options = applyStoryboardVersionOptions(storyboard, options);
-      options = applyFunctionalRequestSigning(options, {
-        ...options.complianceDir && { complianceDir: options.complianceDir },
-        ...options.adcpVersion && { version: options.adcpVersion }
-      });
-      options = resolveDeclaredTestKit(storyboard, options);
-      options = applyNativeA2AComplianceTransportOptions(options);
-      if (hasTestClientScope() && options._client && !options.agents) {
-        const resolution = getOrCreateClientResolution(
-          typeof agentUrlOrUrls === "string" ? agentUrlOrUrls : agentUrlOrUrls[0],
-          options
+  return withPropertyListCredentialRedaction(
+    () => withMCPConnectionScope(
+      async () => {
+        options = applyStoryboardVersionOptions(storyboard, options);
+        options = applyFunctionalRequestSigning(options, {
+          ...options.complianceDir && { complianceDir: options.complianceDir },
+          ...options.adcpVersion && { version: options.adcpVersion }
+        });
+        options = resolveDeclaredTestKit(storyboard, options);
+        options = applyNativeA2AComplianceTransportOptions(options);
+        if (storyboard.requires?.[0] === "property_list_reference_runner" && storyboardCapabilityPredicates(storyboard).length === 0 && propertyListReferenceNeedsMcp(options)) {
+          return buildRequirementUnmetResult(
+            Array.isArray(agentUrlOrUrls) ? agentUrlOrUrls : [agentUrlOrUrls],
+            storyboard,
+            "property_list_reference_runner",
+            "Credential-isolated property-list references currently require MCP; A2A probe coverage is unavailable."
+          );
+        }
+        if (hasTestClientScope() && options._client && !options.agents) {
+          const resolution = getOrCreateClientResolution(
+            typeof agentUrlOrUrls === "string" ? agentUrlOrUrls : agentUrlOrUrls[0],
+            options
+          );
+          const discovered = await getOrDiscoverProfile(resolution.client, options);
+          options = {
+            ...options,
+            _profile: discovered.step.passed ? discovered.profile : void 0,
+            agentTools: discovered.step.passed ? discovered.profile.tools : void 0
+          };
+        }
+        const schemaRoot = getRunSchemaRoot(options);
+        const runBody = () => withServedReleaseSchemaRoots(
+          options.servedReleaseSchemaRoots,
+          () => runStoryboardBody(agentUrlOrUrls, storyboard, options)
         );
-        const discovered = await getOrDiscoverProfile(resolution.client, options);
-        options = {
-          ...options,
-          _profile: discovered.step.passed ? discovered.profile : void 0,
-          agentTools: discovered.step.passed ? discovered.profile.tools : void 0
-        };
-      }
-      const schemaRoot = getRunSchemaRoot(options);
-      const runBody = () => withServedReleaseSchemaRoots(
-        options.servedReleaseSchemaRoots,
-        () => runStoryboardBody(agentUrlOrUrls, storyboard, options)
-      );
-      if (schemaRoot) {
-        return await withExternalSchemaRoot(schemaRoot.adcpVersion, schemaRoot.schemaRoot, runBody);
-      }
-      return await runBody();
-    },
-    { isolate: !hasTestClientScope() }
+        if (schemaRoot) {
+          return await withExternalSchemaRoot(schemaRoot.adcpVersion, schemaRoot.schemaRoot, runBody);
+        }
+        return await runBody();
+      },
+      { isolate: !hasTestClientScope() }
+    )
   );
 }
 async function runStoryboardBody(agentUrlOrUrls, storyboard, options) {
@@ -896,6 +912,7 @@ async function runStoryboardBody(agentUrlOrUrls, storyboard, options) {
         'runStoryboard: webhook_receiver is incompatible with multi_instance_strategy: "multi-pass". Each pass would bind a fresh receiver URL, so agents caching the pass-1 URL would deliver to a dead port in pass 2. Use round-robin when the storyboard needs a webhook receiver, or run multi-pass on a storyboard without webhook observation.'
       );
     }
+    if (storyboard.creative_build_probe) return executeStoryboardPass(agentUrls, storyboard, options, 0);
     return runMultiPass(agentUrls, storyboard, options);
   }
   if (options.agents) {
@@ -1048,6 +1065,7 @@ const REQUIREMENT_TO_SKIP_REASON = {
   webhook_replay_receiver: "not_applicable",
   trusted_match_context_router_runner: "not_applicable",
   trusted_match_publisher_auth_runner: "requirement_unmet",
+  property_list_reference_runner: "requirement_unmet",
   request_signer: "not_applicable",
   multi_agent: "requirement_unmet"
 };
@@ -1154,6 +1172,9 @@ function buildRequiredAnyOfToolsMissingResult(agentUrls, storyboard, detail) {
     notices: []
   };
 }
+function propertyListReferenceNeedsMcp(options) {
+  return options.agents ? Object.values(options.agents).some((agent) => (agent.transport ?? options.protocol) === "a2a") : options.protocol === "a2a";
+}
 async function checkRequires(requires, storyboard, options, profile, precomputed) {
   let preparedPublisherAuthProbes = getPreparedTrustedMatchPublisherAuth(options);
   for (const requirement of requires) {
@@ -1192,6 +1213,15 @@ async function checkRequires(requires, storyboard, options, profile, precomputed
       }
       case "real_wire":
         break;
+      case "property_list_reference_runner": {
+        if (propertyListReferenceNeedsMcp(options)) {
+          return {
+            requirement,
+            detail: "Credential-isolated property-list references currently require MCP; A2A probe coverage is unavailable."
+          };
+        }
+        break;
+      }
       case "webhook_receiver": {
         if (options.webhook_receiver === void 0) {
           return {
@@ -1481,7 +1511,7 @@ function collectCapabilityNotices(storyboard, profile) {
     if (requestSigning?.["supported"] !== true) {
       notices.push({
         severity: "future_required",
-        code: "request_signing.required",
+        code: "request_signing_required_in_4_0",
         message: "RFC 9421 request signing (`request_signing.supported: true`) is not advertised. Required for spend-committing operations in AdCP 4.0 \u2014 declare the capability and pre-register the runner compliance test keypair before the 4.0 cut.",
         effective_version: "4.0",
         capability_path: "request_signing.supported",
@@ -1502,7 +1532,7 @@ function collectCapabilityNotices(storyboard, profile) {
     if (webhookSigning?.["legacy_hmac_fallback"] === true) {
       notices.push({
         severity: "deprecation",
-        code: "webhook_signing.legacy_hmac_fallback.removed",
+        code: "legacy_hmac_fallback_removed_in_4_0",
         message: "`webhook_signing.legacy_hmac_fallback: true` is deprecated and removed in AdCP 4.0. Migrate webhook signature verification to RFC 9421 before the 4.0 cut.",
         effective_version: "4.0",
         capability_path: "webhook_signing.legacy_hmac_fallback",
@@ -2022,16 +2052,118 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
   }
   let seedingPhaseResult = null;
   let seedingFailed = false;
+  let creativeBuildCatalogFailed = false;
   let seedingMissingController = false;
   let seedingUnsupported = false;
   let fixtureUnsatisfied = false;
   let fixtureBindings;
   let fixtureResolutionRecords;
   let fixtureCoverageGap;
+  if (storyboard.creative_build_probe && !skipControllerSeedingForPhaseGates) {
+    let resolution;
+    try {
+      resolution = routingContext || isMultiInstance ? {
+        status: "unsatisfied",
+        detail: `fixture_unsatisfied: creative_format:${storyboard.creative_build_probe.context_prefix}: resolve an independent fixture for each routed or replicated agent in a single-agent run`
+      } : prepareCreativeBuildProbe(
+        profile?.raw_capabilities,
+        storyboard.creative_build_probe,
+        options.test_kit,
+        options.adcpVersion
+      );
+    } catch (error) {
+      await Promise.allSettled([
+        ...webhookReceiver ? [webhookReceiver.close()] : [],
+        ...!callerOwnsClients ? [closeScopedConnections(options.protocol)] : []
+      ]);
+      throw error;
+    }
+    const handle = storyboard.creative_build_probe.context_prefix;
+    fixtureResolutionRecords = [
+      {
+        fixture_type: "creative_format",
+        handle,
+        requirements: resolution.status === "resolved" ? resolution.requirements : [],
+        status: resolution.status,
+        ...resolution.status === "resolved" ? {
+          seller_ids: resolution.capabilityId !== void 0 ? { capability_id: resolution.capabilityId } : { format_id: resolution.formatId }
+        } : {},
+        strategy: "discover",
+        strategies_attempted: [
+          {
+            strategy: "discover",
+            disposition: resolution.status === "unsatisfied" ? "unavailable" : resolution.status,
+            detail: resolution.status === "resolved" ? `Bound build route using ${resolution.source} input` : resolution.detail
+          }
+        ]
+      }
+    ];
+    if (resolution.status !== "resolved") {
+      const noPhasesIndex = phaseResults.findIndex((phase) => phase.phase_id === "no_phases");
+      if (noPhasesIndex >= 0) {
+        skippedCount -= phaseResults[noPhasesIndex].steps.filter((step) => step.skipped).length;
+        phaseResults.splice(noPhasesIndex, 1);
+      }
+    }
+    if (resolution.status === "failed") {
+      seedingFailed = true;
+      creativeBuildCatalogFailed = true;
+      failedCount += 1;
+      seedingPhaseResult = {
+        phase_id: "fixture_resolution",
+        phase_title: "Creative build fixture resolution",
+        passed: false,
+        duration_ms: 0,
+        steps: [
+          {
+            storyboard_id: storyboard.id,
+            phase_id: "fixture_resolution",
+            step_id: "creative_build_catalog",
+            title: "Validate advertised creative build catalog",
+            task: "get_adcp_capabilities",
+            passed: false,
+            duration_ms: 0,
+            context: {},
+            extraction: { path: "none" },
+            validations: [
+              {
+                check: "creative_build_probe_catalog",
+                passed: false,
+                description: "Advertised creative catalog satisfies its format and routing contract",
+                error: resolution.detail
+              }
+            ]
+          }
+        ]
+      };
+    } else if (resolution.status === "resolved") {
+      for (const key of [
+        "capability_id",
+        "target_format_id",
+        "message",
+        "creative_manifest",
+        "creative_id",
+        "transformer_id",
+        "config"
+      ]) {
+        delete context[`${handle}_${key}`];
+      }
+      Object.assign(context, resolution.context);
+      options = { ...options, contracts: [.../* @__PURE__ */ new Set([...options.contracts ?? [], "creative_build_probe_runner"])] };
+    } else {
+      fixtureUnsatisfied = true;
+      if (preSeeded === void 0 || preSeeded.attach) skippedCount += 1;
+      fixtureCoverageGap = {
+        reason: "fixture_unsatisfied",
+        detail: resolution.detail,
+        fixtures: [{ fixture_type: "creative_format", handle, requirements: [] }]
+      };
+    }
+  }
   {
     let seeding;
     try {
-      seeding = creativeAssetFixtureGap || skipControllerSeedingForPhaseGates ? null : preSeeded !== void 0 ? preSeeded.result : await runControllerSeeding(
+      seeding = creativeAssetFixtureGap || fixtureUnsatisfied || seedingFailed || skipControllerSeedingForPhaseGates ? null : preSeeded !== void 0 ? preSeeded.result : await runControllerSeeding(
         clients[0],
         storyboard,
         options,
@@ -2092,7 +2224,7 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         }
       }
       fixtureBindings = seeding.bindings;
-      fixtureResolutionRecords = seeding.resolutionRecords;
+      fixtureResolutionRecords = fixtureResolutionRecords ? [...fixtureResolutionRecords, ...seeding.resolutionRecords ?? []] : seeding.resolutionRecords;
       fixtureUnsatisfied = seeding.fixtureUnsatisfied === true && seeding.failedCount === 0;
       if (fixtureUnsatisfied) {
         const noPhasesIndex = phaseResults.findIndex((phase) => phase.phase_id === "no_phases");
@@ -2334,6 +2466,12 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
       } : seedingUnsupported ? {
         skip_reason: "fixture_seed_unsupported",
         skip: { reason: "not_applicable", detail: FIXTURE_SEED_UNSUPPORTED_DETAIL }
+      } : creativeBuildCatalogFailed ? {
+        skip_reason: "prerequisite_failed",
+        skip: {
+          reason: "prerequisite_failed",
+          detail: "Creative build catalog validation failed in fixture_resolution.creative_build_catalog."
+        }
       } : seedingFailed ? {
         skip_reason: "controller_seeding_failed",
         skip: { reason: "prerequisite_failed", detail: CONTROLLER_SEEDING_FAILED_DETAIL }
@@ -3129,32 +3267,57 @@ function summarizeStrictValidation(phases) {
 }
 async function runStoryboardStep(agentUrl, storyboard, stepId, options = {}) {
   options = applyReusableProfileOptions(options);
-  return withMCPConnectionScope(
-    async () => {
-      storyboard = normalizeValidationOnlyTasks(storyboard);
-      validateStoryboardShape(storyboard);
-      options = applyStoryboardVersionOptions(storyboard, options);
-      options = applyFunctionalRequestSigning(options, {
-        ...options.complianceDir && { complianceDir: options.complianceDir },
-        ...options.adcpVersion && { version: options.adcpVersion }
-      });
-      options = resolveDeclaredTestKit(storyboard, options);
-      options = applyNativeA2AComplianceTransportOptions(options);
-      const schemaRoot = getRunSchemaRoot(options);
-      const runBody = () => withServedReleaseSchemaRoots(
-        options.servedReleaseSchemaRoots,
-        () => runStoryboardStepBody(agentUrl, storyboard, stepId, options)
-      );
-      if (schemaRoot) {
-        return await withExternalSchemaRoot(schemaRoot.adcpVersion, schemaRoot.schemaRoot, runBody);
-      }
-      return await runBody();
-    },
-    { isolate: !hasTestClientScope() }
+  return withPropertyListCredentialRedaction(
+    () => withMCPConnectionScope(
+      async () => {
+        storyboard = normalizeValidationOnlyTasks(storyboard);
+        validateStoryboardShape(storyboard);
+        options = applyStoryboardVersionOptions(storyboard, options);
+        options = applyFunctionalRequestSigning(options, {
+          ...options.complianceDir && { complianceDir: options.complianceDir },
+          ...options.adcpVersion && { version: options.adcpVersion }
+        });
+        options = resolveDeclaredTestKit(storyboard, options);
+        options = applyNativeA2AComplianceTransportOptions(options);
+        const schemaRoot = getRunSchemaRoot(options);
+        const runBody = () => withServedReleaseSchemaRoots(
+          options.servedReleaseSchemaRoots,
+          () => runStoryboardStepBody(agentUrl, storyboard, stepId, options)
+        );
+        if (schemaRoot) {
+          return await withExternalSchemaRoot(schemaRoot.adcpVersion, schemaRoot.schemaRoot, runBody);
+        }
+        return await runBody();
+      },
+      { isolate: !hasTestClientScope() }
+    )
   );
 }
 async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
   validateTestKit(options.test_kit);
+  if (storyboard.requires?.[0] === "property_list_reference_runner" && storyboardCapabilityPredicates(storyboard).length === 0 && propertyListReferenceNeedsMcp(options)) {
+    const found2 = flattenSteps(storyboard).find((entry) => entry.step.id === stepId);
+    if (!found2) throw new Error(`Step "${stepId}" not found in storyboard "${storyboard.id}".`);
+    return {
+      storyboard_id: storyboard.id,
+      step_id: stepId,
+      phase_id: found2.phaseId,
+      title: found2.step.title,
+      task: found2.step.task,
+      passed: true,
+      skipped: true,
+      skip_reason: "requirement_unmet",
+      skip: {
+        reason: "requirement_unmet",
+        requirement: "property_list_reference_runner",
+        detail: "Credential-isolated property-list references currently require MCP; A2A probe coverage is unavailable."
+      },
+      duration_ms: 0,
+      validations: [],
+      context: { ...storyboard.context, ...options.context },
+      extraction: { path: "none" }
+    };
+  }
   const clientResolution = getOrCreateClientResolution(agentUrl, options);
   const client = clientResolution.client;
   let profile;
@@ -3205,6 +3368,77 @@ async function runStoryboardStepBody(agentUrl, storyboard, stepId, options) {
       return result;
     }
   }
+  if (storyboard.creative_build_probe) {
+    let resolution;
+    try {
+      resolution = prepareCreativeBuildProbe(
+        profile?.raw_capabilities,
+        storyboard.creative_build_probe,
+        options.test_kit,
+        options.adcpVersion
+      );
+    } catch (error) {
+      if (!clientResolution.reusedShared) {
+        await Promise.allSettled([closeScopedConnections(options.protocol)]);
+      }
+      throw error;
+    }
+    if (resolution.status === "failed") {
+      if (!clientResolution.reusedShared) await closeScopedConnections(options.protocol);
+      return {
+        storyboard_id: storyboard.id,
+        step_id: found.step.id,
+        phase_id: found.phaseId,
+        title: found.step.title,
+        task: found.step.task,
+        passed: false,
+        duration_ms: 0,
+        validations: [
+          {
+            check: "creative_build_probe_catalog",
+            passed: false,
+            description: "Advertised creative catalog satisfies its format and routing contract",
+            error: resolution.detail
+          }
+        ],
+        context,
+        extraction: { path: "none" },
+        contributions: Array.from(options.contributions ?? [])
+      };
+    }
+    if (resolution.status === "unsatisfied") {
+      if (!clientResolution.reusedShared) await closeScopedConnections(options.protocol);
+      return {
+        storyboard_id: storyboard.id,
+        step_id: found.step.id,
+        phase_id: found.phaseId,
+        title: found.step.title,
+        task: found.step.task,
+        passed: true,
+        skipped: true,
+        skip_reason: "fixture_unsatisfied",
+        skip: { reason: "not_applicable", detail: resolution.detail },
+        duration_ms: 0,
+        validations: [],
+        context,
+        extraction: { path: "none" },
+        contributions: Array.from(options.contributions ?? [])
+      };
+    }
+    for (const key of [
+      "capability_id",
+      "target_format_id",
+      "message",
+      "creative_manifest",
+      "creative_id",
+      "transformer_id",
+      "config"
+    ]) {
+      delete context[`${storyboard.creative_build_probe.context_prefix}_${key}`];
+    }
+    Object.assign(context, resolution.context);
+    options = { ...options, contracts: [.../* @__PURE__ */ new Set([...options.contracts ?? [], "creative_build_probe_runner"])] };
+  }
   const injectedReceiver = options._webhookReceiver;
   const webhookReceiver = injectedReceiver ?? (options.webhook_receiver ? await createWebhookReceiver({
     ...options.webhook_receiver.mode && { mode: options.webhook_receiver.mode },
@@ -3986,6 +4220,10 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     }
   }
   const effectiveRequestUrl = requestUrl ?? runState.agentUrl;
+  rememberPropertyListCredentials(
+    taskResult?.data ?? (caughtError instanceof ResponseSchemaValidationError ? caughtError.data : void 0),
+    (step.validations ?? []).flatMap((validation) => validation.auth_token_path ? [validation.auth_token_path] : [])
+  );
   const requestRecord = {
     transport: options.protocol === "a2a" ? "a2a" : "mcp",
     operation: effectiveStep.task,
@@ -4172,6 +4410,9 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
           (av) => injectContext({ __v: av }, context, runState.runnerVars).__v
         );
       }
+      if (resolved.denied_list_id !== void 0) {
+        resolved.denied_list_id = injectContext({ value: resolved.denied_list_id }, context, runState.runnerVars).value;
+      }
       return resolved;
     });
     const upstreamTraffic = await prefetchUpstreamTraffic(
@@ -4216,7 +4457,30 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
         };
       })()
     };
-    validations = runValidations(resolvedValidations, vctx);
+    validations = runValidations(
+      resolvedValidations.filter((validation) => validation.check !== "property_list_reference"),
+      vctx
+    );
+    for (const validation of resolvedValidations.filter((validation2) => validation2.check === "property_list_reference")) {
+      const result = effectiveStep.task !== "create_property_list" || !validationTaskResult?.success ? {
+        check: validation.check,
+        passed: false,
+        description: validation.description,
+        error: "property_list_reference requires a successful create_property_list response."
+      } : options.protocol === "a2a" ? {
+        check: validation.check,
+        passed: false,
+        description: validation.description,
+        error: "Credential-isolated reference resolution requires MCP."
+      } : await verifyPropertyListReference(validation, validationTaskResult.data, {
+        agentUrl: client.getDiscoveredMcpEndpoint?.() ?? runState.agentUrl,
+        version: options.adcpVersion ?? options._serverAdcpVersion,
+        signal: options.signal,
+        allowHttp: options.allow_http,
+        redactValues: runCredentialValues(options)
+      });
+      validations.push(decorateValidationResult(result, vctx, validation));
+    }
     if (crossResponses && crossResponses.dispatches.length > 1) {
       const perResponseValidations = resolvedValidations.filter(
         (v) => v.check !== "cross_response_field_equal" && v.check !== "cross_response_count_distinct"

package/dist/lib/testing/storyboard/types.d.mts

@@ -1,3 +1,4 @@
+import type { CreativeBuildProbeSpec } from './creative-build-probe.mjs';
 /**
  * Types for storyboard-driven testing.
  *
@@ -269,6 +270,8 @@ export interface Storyboard {
      * Omitted handles retain the compatibility strategy `["seed"]`.
      */
     fixture_resolution?: StoryboardFixtureResolution;
+    /** Opt-in runner preparation; does not add an agent protocol capability. */
+    creative_build_probe?: CreativeBuildProbeSpec;
     /**
      * Initial context values declared by the storyboard YAML. Runner callers may
      * override these defaults with `StoryboardRunOptions.context`.
@@ -475,7 +478,7 @@ export interface FixtureResolutionAttempt {
 export type FixtureResolutionEvidence = FixtureResolutionAttempt;
 /** Machine-readable record emitted exactly once for every fixture handle. */
 export interface FixtureResolutionRecord {
-    fixture_type: 'product' | 'pricing_option';
+    fixture_type: 'product' | 'pricing_option' | 'creative_format';
     handle: string;
     product_handle?: string;
     requirements: FixtureMatchClause[];
@@ -483,8 +486,10 @@ export interface FixtureResolutionRecord {
     status: FixtureResolutionStatus;
     strategy?: FixtureResolutionStrategy;
     seller_ids?: {
-        product_id: string;
+        product_id?: string;
         pricing_option_id?: string;
+        capability_id?: string;
+        format_id?: Record<string, unknown>;
     };
 }
 /** One storyboard-scoped coverage gap produced by fixture resolution. */
@@ -890,7 +895,10 @@ export interface RateLimitTripSpec {
     /** Maximum retry_after wait the runner will honor. Defaults to 30 seconds. */
     replay_max_wait_seconds?: number;
 }
-export type StoryboardValidationCheck = 'response_schema' | 'field_present' | 'field_absent' | 'envelope_field_present' | 'envelope_field_absent' | 'envelope_field_value' | 'envelope_field_value_or_absent' | 'field_value' | 'field_value_or_absent'
+export type StoryboardValidationCheck = 'response_schema' | 'field_present'
+/** Every item carries a non-null field at `array[*].field`; absent, null,
+ *  or empty arrays grade not_applicable rather than passing vacuously. */
+ | 'all_fields_present' | 'field_absent' | 'envelope_field_present' | 'envelope_field_absent' | 'envelope_field_value' | 'envelope_field_value_or_absent' | 'field_value' | 'field_value_or_absent'
 /**
  * Assert that a string field in the task payload matches a JavaScript
  * regular expression source declared in `pattern`. Fails when the path is
@@ -1042,7 +1050,7 @@ export type StoryboardValidationCheck = 'response_schema' | 'field_present' | 'f
  * class: normalization, directionality, or range containment. Added for
  * adcp-client#2060.
  */
- | 'canonical_format_satisfaction'
+ | 'canonical_format_satisfaction' | 'property_list_reference'
 /**
  * Assert the cardinality of the array at `path`. Two configurations are
  * supported: exact-count via `value: N` (passes only when the resolved
@@ -1230,6 +1238,23 @@ export interface RefsResolveScope {
     equals: string;
 }
 export interface StoryboardValidation {
+    /** Managing endpoint; $agent_url uses the issuer's discovered MCP endpoint (adcp#8289). */
+    agent_url?: string;
+    /** Creation-response path to the issued list ID. Defaults to list.list_id. */
+    list_id_path?: string;
+    /** Creation-response path to the read-only credential. Defaults to auth_token. */
+    auth_token_path?: string;
+    /** Existing owner-created control list; accepts a resolved $context.<key>. */
+    denied_list_id?: string;
+    /** Maximum identifiers requested per page, 1 through 10000. Required by the probe. */
+    page_size?: number;
+    /** Maximum pages to traverse, 1 through 100. Required by the probe. */
+    max_pages?: number;
+    /** Exact unordered snapshot, compared by (type, value). Required by the probe. */
+    expected_identifiers?: Array<{
+        type: string;
+        value: string;
+    }>;
     /** Stable authored validation identifier echoed into runner results when present. */
     id?: string;
     /** Known validation kind, or a future string graded not_applicable by older runners. */
@@ -2152,7 +2177,7 @@ export interface RunnerSelectionResult {
  *
  * Spec: adcp-client#1626, adcp-client#2281, adcp-client#2356.
  */
-export type RequirementName = 'controller' | 'seeded_state' | 'real_wire' | 'webhook_receiver' | 'webhook_replay_receiver' | 'trusted_match_context_router_runner' | 'trusted_match_publisher_auth_runner' | 'request_signer' | 'multi_agent';
+export type RequirementName = 'controller' | 'seeded_state' | 'real_wire' | 'webhook_receiver' | 'webhook_replay_receiver' | 'trusted_match_context_router_runner' | 'trusted_match_publisher_auth_runner' | 'property_list_reference_runner' | 'request_signer' | 'multi_agent';
 /**
  * Enumeration of every requirement this SDK knows how to satisfy. The loader
  * accepts other non-empty strings for forward compatibility; the runner treats
@@ -2180,12 +2205,9 @@ export interface SchemaValidationError {
  * a deprecation or future-required advisory is the kind of thing a CI
  * gate or dashboard SHOULD have explicit handling for.
  *
- * Code naming generally follows the dot-namespaced convention `<topic>.<event>`
- * (e.g. `request_signing.required`, `webhook_signing.legacy_hmac_fallback.removed`);
- * prefer the upstream runner-output contract's canonical code when it
- * registers a different spelling. The *when* lives in the `effective_version`
- * field, never in the code. This keeps the surface stable across spec versions
- * — codes don't proliferate `_in_4_0` / `_in_5_0` siblings as the spec evolves.
+ * Use the upstream runner-output contract's canonical codes so consumers can
+ * aggregate the same advisory across runners. Keep each code stable for the
+ * same advisory, including its version suffix where the contract defines one.
  *
  * Adding a new code is a wire-surface change AND a TypeScript breaking
  * change for adopters who narrowed on `code`. Coordinate with the upstream
@@ -2199,10 +2221,10 @@ export type NoticeCode =
 'signed_requests_specialism_deprecated'
 /** Agent lacks `request_signing.supported: true`. Required for spend-committing
  *  operations in AdCP 4.0 per `effective_version`. */
- | 'request_signing.required'
+ | 'request_signing_required_in_4_0'
 /** Agent advertises `webhook_signing.legacy_hmac_fallback: true`. Removed in
  *  AdCP 4.0 per `effective_version`. */
- | 'webhook_signing.legacy_hmac_fallback.removed'
+ | 'legacy_hmac_fallback_removed_in_4_0'
 /** Runner stripped request fields missing from the agent's advertised tool input schema. */
  | 'input_schema_field_stripped'
 /** The preflight get_adcp_capabilities response failed schema validation. */
@@ -2310,9 +2332,9 @@ export interface ValidationResult {
     /** Optional remediation hint. */
     remediation?: string;
     /**
-     * Marker for an implemented check whose declared applicability conditions
-     * were not met. Unknown authored check kinds fail closed; they never set
-     * this flag or contribute a false green result. Entries carrying this flag
+     * Marker for a check that could not be graded because its applicability
+     * conditions were not met or the runner does not recognize its authored kind.
+     * Entries carrying this flag
      * contribute to `validations_not_applicable` so consumers can distinguish
      * inapplicable coverage from clean passes.
      */