@adcp/sdk 16.0.0-beta.8 → 16.0.0

package/dist/lib/signing/web-bot-auth.js

@@ -70,8 +70,9 @@ const WEB_BOT_AUTH_PROFILE = "web-bot-auth";
 const WEB_BOT_AUTH_DRAFT_REVISION = "draft-ietf-webbotauth-httpsig-protocol-00";
 const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
-const WEB_BOT_AUTH_ALGORITHMS = Object.freeze(["ed25519", "rsa-pss-sha512"]);
+const WEB_BOT_AUTH_ALGORITHMS = Object.freeze(["ed25519"]);
 const DIRECTORY_TAG = "http-message-signatures-directory";
+const PRIVATE_JWK_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth", "k"]);
 const CLOCK_SKEW_SECONDS = 60;
 const MAX_LIFETIME_SECONDS = 300;
 const REQUIRED_PARAMETERS = ["created", "expires", "nonce", "keyid", "alg", "tag"];
@@ -182,26 +183,29 @@ function jwkThumbprint(jwk) {
   else return denied("unsupported_key");
   return (0, import_crypto.createHash)("sha256").update(JSON.stringify(fields)).digest("base64url");
 }
+function keyAlgorithm(jwk) {
+  return jwk.kty === "OKP" && jwk.crv === "Ed25519" ? "ed25519" : void 0;
+}
 function algorithm(jwk) {
-  if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "ed25519";
-  if (jwk.kty === "RSA" && typeof jwk.n === "string" && jwk.e === "AQAB") {
-    const bytes = Buffer.from(jwk.n, "base64url").length;
-    if (bytes >= 256 && bytes <= 512) return "rsa-pss-sha512";
-  }
-  return denied("unsupported_key");
+  return keyAlgorithm(jwk) ?? denied("unsupported_key");
 }
 function signingAlgorithm(jwk) {
   try {
     return algorithm(jwk);
   } catch {
-    throw new TypeError(
-      "Web Bot Auth signs with Ed25519 or RSA-PSS-SHA512 (2048-4096 bit, e=65537) keys only; ES256 remains on the AdCP RFC 9421 profile"
-    );
+    throw new TypeError("Web Bot Auth signs with Ed25519 keys only; ES256 remains on the AdCP RFC 9421 profile");
   }
 }
 function assertWebBotAuthSigningKey(key) {
   signingAlgorithm("privateKey" in key ? key.privateKey : key.publicKey);
 }
+function signingOrigin(value) {
+  try {
+    return receivedAgentOrigin((0, import_canonicalize.canonicalAgentOrigin)(value));
+  } catch {
+    throw new TypeError("Web Bot Auth signs as an https origin only (WBA section 5.2.1)");
+  }
+}
 function inputs(headers, limit) {
   const members = dictionary((0, import_canonicalize2.getHeaderValue)(headers, "signature-input"), "Signature-Input");
   if (members.size > limit) bad("signature_input");
@@ -214,6 +218,7 @@ function inputs(headers, limit) {
   });
 }
 function receivedAgentOrigin(value) {
+  if (!value.startsWith("https://")) return denied("agent_origin");
   try {
     (0, import_select_agent.canonicalAgentUrl)(value);
     const origin = (0, import_canonicalize.canonicalAgentOrigin)(value);
@@ -436,8 +441,10 @@ async function verifyWebBotAuth(request, options) {
       if (!(member2[0] instanceof ArrayBuffer) || member2[1].size !== 0) bad("signature");
     for (const member2 of agents?.values() ?? []) if (typeof member2[0] !== "string") bad("signature_agent");
     if (!inputMembers || !signatureMembers) return denied("headers_missing");
-    if (inputMembers.size !== 1 || signatureMembers.size !== 1) denied("signature_count");
-    label = inputMembers.keys().next().value;
+    const tagged = [...inputMembers].filter(([, member2]) => member2[1].get("tag") === WEB_BOT_AUTH_PROFILE);
+    if (tagged.length === 0) denied("profile");
+    if (tagged.length > 1) denied("signature_count");
+    label = tagged[0][0];
     if (!signatureMembers.has(label)) denied("signature_label");
     try {
       (0, import_parser.parseSignature)(signatureHeader, label, "rfc8941-base64");
@@ -450,7 +457,6 @@ async function verifyWebBotAuth(request, options) {
     } catch {
       return denied("parameters");
     }
-    if (input.params.tag !== WEB_BOT_AUTH_PROFILE) denied("profile");
     if (!agents || agents.size !== 1) denied(agents ? "agent_count" : "agent_missing");
     const agentMember = `signature-agent;key="${label}"`;
     const agentComponents = input.components.filter((c) => c.startsWith("signature-agent;"));
@@ -458,7 +464,7 @@ async function verifyWebBotAuth(request, options) {
     const member = agents.get(label);
     if (!member) denied("agent_not_covered");
     const type = member[1].get("type");
-    if (type !== void 0 && type !== "directory") denied("agent_type");
+    if (type !== void 0 && String(type) !== "directory") denied("agent_type");
     const origin = receivedAgentOrigin(member[0]);
     const { created, expires, nonce, keyid, alg } = input.params;
     if ([created, expires, nonce, keyid, alg].some((value) => value === void 0)) denied("parameters_missing");
@@ -582,11 +588,13 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
     let expires = Infinity;
     for (const raw of document.keys) {
       if (!raw || typeof raw !== "object") denied("directory_key");
+      if (Object.keys(raw).some((k) => PRIVATE_JWK_MEMBERS.has(k.toLowerCase()) || k.startsWith("_private")))
+        denied("directory_key");
+      if (!keyAlgorithm(raw)) continue;
       const thumbprint = jwkThumbprint(raw);
       const key = { ...raw, kid: raw.kid ?? thumbprint };
-      if (key.kid !== thumbprint || kids.has(key.kid) || key.d !== void 0 || Object.keys(key).some((k) => k.startsWith("_private")) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
+      if (key.kid !== thumbprint || kids.has(key.kid) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
         denied("directory_key");
-      algorithm(key);
       kids.add(key.kid);
       keys.push(key);
       const proof = signatures.find((input) => input.params.keyid === key.kid && input.params.tag === DIRECTORY_TAG);
@@ -629,6 +637,7 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
       );
       expires = Math.min(expires, proof.params.expires);
     }
+    if (!keys.length) denied("directory_keys");
     return { keys, expires, signed: true, proof: response };
   } catch (error) {
     if (error instanceof WebBotAuthError) {
@@ -758,7 +767,7 @@ async function signWebBotAuth(request, key, options) {
     throw new TypeError(
       "Web Bot Auth relays were removed from the profile (adcp#7894): an intermediary signs as itself with one signature"
     );
-  const origin = (0, import_canonicalize.canonicalAgentOrigin)(options.origin);
+  const origin = signingOrigin(options.origin);
   const label = options.label ?? "sig1";
   if (!/^[a-z][a-z0-9_.*-]*$/.test(label)) throw new TypeError("Invalid signature label");
   const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
@@ -813,7 +822,7 @@ async function signWebBotAuth(request, key, options) {
   return headers;
 }
 async function createSignedSignatureDirectory(originUrl, signingKeys, options = {}) {
-  const origin = (0, import_canonicalize.canonicalAgentOrigin)(originUrl);
+  const origin = signingOrigin(originUrl);
   const now = Math.floor((options.now ?? (() => Date.now() / 1e3))());
   const lifetime = options.lifetimeSeconds ?? 86400;
   if (!Number.isFinite(now) || !Number.isSafeInteger(lifetime) || lifetime < 1 || !Number.isSafeInteger(now + lifetime))
@@ -822,12 +831,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
   const keys = signingKeys.map((key) => {
     const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
     signingAlgorithm(jwk);
-    return {
-      kty: jwk.kty,
-      ...jwk.kty === "RSA" ? { n: jwk.n, e: jwk.e } : { crv: jwk.crv, x: jwk.x },
-      kid: jwkThumbprint(jwk),
-      use: "sig"
-    };
+    return { kty: jwk.kty, crv: jwk.crv, x: jwk.x, kid: jwkThumbprint(jwk), use: "sig" };
   });
   if (new Set(keys.map((k) => k.kid)).size !== keys.length) throw new TypeError("Duplicate directory key");
   const body = JSON.stringify({ keys });
@@ -873,6 +877,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
 }
 function createWebBotAuthFetch(upstream, key, options) {
   assertWebBotAuthSigningKey(key);
+  signingOrigin(options.origin);
   return async (input, init) => {
     const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
     if (options.shouldSign && !options.shouldSign(url, init)) return upstream(input, init);

package/dist/lib/signing/web-bot-auth.mjs

@@ -26,8 +26,9 @@ const WEB_BOT_AUTH_PROFILE = "web-bot-auth";
 const WEB_BOT_AUTH_DRAFT_REVISION = "draft-ietf-webbotauth-httpsig-protocol-00";
 const SIGNATURE_DIRECTORY_PATH = "/.well-known/http-message-signatures-directory";
 const SIGNATURE_DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json";
-const WEB_BOT_AUTH_ALGORITHMS = Object.freeze(["ed25519", "rsa-pss-sha512"]);
+const WEB_BOT_AUTH_ALGORITHMS = Object.freeze(["ed25519"]);
 const DIRECTORY_TAG = "http-message-signatures-directory";
+const PRIVATE_JWK_MEMBERS = /* @__PURE__ */ new Set(["d", "p", "q", "dp", "dq", "qi", "oth", "k"]);
 const CLOCK_SKEW_SECONDS = 60;
 const MAX_LIFETIME_SECONDS = 300;
 const REQUIRED_PARAMETERS = ["created", "expires", "nonce", "keyid", "alg", "tag"];
@@ -138,26 +139,29 @@ function jwkThumbprint(jwk) {
   else return denied("unsupported_key");
   return createHash("sha256").update(JSON.stringify(fields)).digest("base64url");
 }
+function keyAlgorithm(jwk) {
+  return jwk.kty === "OKP" && jwk.crv === "Ed25519" ? "ed25519" : void 0;
+}
 function algorithm(jwk) {
-  if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "ed25519";
-  if (jwk.kty === "RSA" && typeof jwk.n === "string" && jwk.e === "AQAB") {
-    const bytes = Buffer.from(jwk.n, "base64url").length;
-    if (bytes >= 256 && bytes <= 512) return "rsa-pss-sha512";
-  }
-  return denied("unsupported_key");
+  return keyAlgorithm(jwk) ?? denied("unsupported_key");
 }
 function signingAlgorithm(jwk) {
   try {
     return algorithm(jwk);
   } catch {
-    throw new TypeError(
-      "Web Bot Auth signs with Ed25519 or RSA-PSS-SHA512 (2048-4096 bit, e=65537) keys only; ES256 remains on the AdCP RFC 9421 profile"
-    );
+    throw new TypeError("Web Bot Auth signs with Ed25519 keys only; ES256 remains on the AdCP RFC 9421 profile");
   }
 }
 function assertWebBotAuthSigningKey(key) {
   signingAlgorithm("privateKey" in key ? key.privateKey : key.publicKey);
 }
+function signingOrigin(value) {
+  try {
+    return receivedAgentOrigin(canonicalAgentOrigin(value));
+  } catch {
+    throw new TypeError("Web Bot Auth signs as an https origin only (WBA section 5.2.1)");
+  }
+}
 function inputs(headers, limit) {
   const members = dictionary(getHeaderValue(headers, "signature-input"), "Signature-Input");
   if (members.size > limit) bad("signature_input");
@@ -170,6 +174,7 @@ function inputs(headers, limit) {
   });
 }
 function receivedAgentOrigin(value) {
+  if (!value.startsWith("https://")) return denied("agent_origin");
   try {
     canonicalAgentUrl(value);
     const origin = canonicalAgentOrigin(value);
@@ -392,8 +397,10 @@ async function verifyWebBotAuth(request, options) {
       if (!(member2[0] instanceof ArrayBuffer) || member2[1].size !== 0) bad("signature");
     for (const member2 of agents?.values() ?? []) if (typeof member2[0] !== "string") bad("signature_agent");
     if (!inputMembers || !signatureMembers) return denied("headers_missing");
-    if (inputMembers.size !== 1 || signatureMembers.size !== 1) denied("signature_count");
-    label = inputMembers.keys().next().value;
+    const tagged = [...inputMembers].filter(([, member2]) => member2[1].get("tag") === WEB_BOT_AUTH_PROFILE);
+    if (tagged.length === 0) denied("profile");
+    if (tagged.length > 1) denied("signature_count");
+    label = tagged[0][0];
     if (!signatureMembers.has(label)) denied("signature_label");
     try {
       parseSignature(signatureHeader, label, "rfc8941-base64");
@@ -406,7 +413,6 @@ async function verifyWebBotAuth(request, options) {
     } catch {
       return denied("parameters");
     }
-    if (input.params.tag !== WEB_BOT_AUTH_PROFILE) denied("profile");
     if (!agents || agents.size !== 1) denied(agents ? "agent_count" : "agent_missing");
     const agentMember = `signature-agent;key="${label}"`;
     const agentComponents = input.components.filter((c) => c.startsWith("signature-agent;"));
@@ -414,7 +420,7 @@ async function verifyWebBotAuth(request, options) {
     const member = agents.get(label);
     if (!member) denied("agent_not_covered");
     const type = member[1].get("type");
-    if (type !== void 0 && type !== "directory") denied("agent_type");
+    if (type !== void 0 && String(type) !== "directory") denied("agent_type");
     const origin = receivedAgentOrigin(member[0]);
     const { created, expires, nonce, keyid, alg } = input.params;
     if ([created, expires, nonce, keyid, alg].some((value) => value === void 0)) denied("parameters_missing");
@@ -538,11 +544,13 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
     let expires = Infinity;
     for (const raw of document.keys) {
       if (!raw || typeof raw !== "object") denied("directory_key");
+      if (Object.keys(raw).some((k) => PRIVATE_JWK_MEMBERS.has(k.toLowerCase()) || k.startsWith("_private")))
+        denied("directory_key");
+      if (!keyAlgorithm(raw)) continue;
       const thumbprint = jwkThumbprint(raw);
       const key = { ...raw, kid: raw.kid ?? thumbprint };
-      if (key.kid !== thumbprint || kids.has(key.kid) || key.d !== void 0 || Object.keys(key).some((k) => k.startsWith("_private")) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
+      if (key.kid !== thumbprint || kids.has(key.kid) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
         denied("directory_key");
-      algorithm(key);
       kids.add(key.kid);
       keys.push(key);
       const proof = signatures.find((input) => input.params.keyid === key.kid && input.params.tag === DIRECTORY_TAG);
@@ -585,6 +593,7 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
       );
       expires = Math.min(expires, proof.params.expires);
     }
+    if (!keys.length) denied("directory_keys");
     return { keys, expires, signed: true, proof: response };
   } catch (error) {
     if (error instanceof WebBotAuthError) {
@@ -714,7 +723,7 @@ async function signWebBotAuth(request, key, options) {
     throw new TypeError(
       "Web Bot Auth relays were removed from the profile (adcp#7894): an intermediary signs as itself with one signature"
     );
-  const origin = canonicalAgentOrigin(options.origin);
+  const origin = signingOrigin(options.origin);
   const label = options.label ?? "sig1";
   if (!/^[a-z][a-z0-9_.*-]*$/.test(label)) throw new TypeError("Invalid signature label");
   const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
@@ -769,7 +778,7 @@ async function signWebBotAuth(request, key, options) {
   return headers;
 }
 async function createSignedSignatureDirectory(originUrl, signingKeys, options = {}) {
-  const origin = canonicalAgentOrigin(originUrl);
+  const origin = signingOrigin(originUrl);
   const now = Math.floor((options.now ?? (() => Date.now() / 1e3))());
   const lifetime = options.lifetimeSeconds ?? 86400;
   if (!Number.isFinite(now) || !Number.isSafeInteger(lifetime) || lifetime < 1 || !Number.isSafeInteger(now + lifetime))
@@ -778,12 +787,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
   const keys = signingKeys.map((key) => {
     const jwk = "privateKey" in key ? key.privateKey : key.publicKey;
     signingAlgorithm(jwk);
-    return {
-      kty: jwk.kty,
-      ...jwk.kty === "RSA" ? { n: jwk.n, e: jwk.e } : { crv: jwk.crv, x: jwk.x },
-      kid: jwkThumbprint(jwk),
-      use: "sig"
-    };
+    return { kty: jwk.kty, crv: jwk.crv, x: jwk.x, kid: jwkThumbprint(jwk), use: "sig" };
   });
   if (new Set(keys.map((k) => k.kid)).size !== keys.length) throw new TypeError("Duplicate directory key");
   const body = JSON.stringify({ keys });
@@ -829,6 +833,7 @@ async function createSignedSignatureDirectory(originUrl, signingKeys, options =
 }
 function createWebBotAuthFetch(upstream, key, options) {
   assertWebBotAuthSigningKey(key);
+  signingOrigin(options.origin);
   return async (input, init) => {
     const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
     if (options.shouldSign && !options.shouldSign(url, init)) return upstream(input, init);

package/dist/lib/testing/compliance/comply.js

@@ -758,11 +758,9 @@ function inferDiscoveredServerAdcpVersion(profile, complianceVersion) {
   }
   if (profile.adcp_build_version) return profile.adcp_build_version;
   if (isLegacyPre31TypescriptSdkProfile(profile)) return "3.0";
-  if (isLegacyV2Profile(profile)) return "v2.5";
   return void 0;
 }
 function negotiateVersionEnvelope(profile, complianceVersion) {
-  if (isLegacyV2Profile(profile)) return "none";
   const supported = profile.adcp_supported_versions;
   if (supported?.length && supported.every(import_adcp_version_config.isPre31AdcpVersion)) return "major-only";
   if (profile.adcp_build_version && (0, import_adcp_version_config.isPre31AdcpVersion)(profile.adcp_build_version)) return "major-only";
@@ -770,12 +768,6 @@ function negotiateVersionEnvelope(profile, complianceVersion) {
   if ((0, import_adcp_version_config.isPre31AdcpVersion)(complianceVersion) && isLegacyV3Profile(profile)) return "major-only";
   return void 0;
 }
-function isLegacyV2Profile(profile) {
-  if (profile.adcp_version === "v2") return true;
-  const majors = profile.adcp_major_versions ?? [];
-  if (majors.length > 0) return majors.includes(2) && !majors.includes(3);
-  return !profile.tools.includes("get_adcp_capabilities");
-}
 function isLegacyV3Profile(profile) {
   if (profile.adcp_version === "v3") return true;
   if (profile.adcp_major_versions?.includes(3)) return true;

package/dist/lib/testing/compliance/comply.mjs

@@ -748,11 +748,9 @@ function inferDiscoveredServerAdcpVersion(profile, complianceVersion) {
   }
   if (profile.adcp_build_version) return profile.adcp_build_version;
   if (isLegacyPre31TypescriptSdkProfile(profile)) return "3.0";
-  if (isLegacyV2Profile(profile)) return "v2.5";
   return void 0;
 }
 function negotiateVersionEnvelope(profile, complianceVersion) {
-  if (isLegacyV2Profile(profile)) return "none";
   const supported = profile.adcp_supported_versions;
   if (supported?.length && supported.every(isPre31AdcpVersion)) return "major-only";
   if (profile.adcp_build_version && isPre31AdcpVersion(profile.adcp_build_version)) return "major-only";
@@ -760,12 +758,6 @@ function negotiateVersionEnvelope(profile, complianceVersion) {
   if (isPre31AdcpVersion(complianceVersion) && isLegacyV3Profile(profile)) return "major-only";
   return void 0;
 }
-function isLegacyV2Profile(profile) {
-  if (profile.adcp_version === "v2") return true;
-  const majors = profile.adcp_major_versions ?? [];
-  if (majors.length > 0) return majors.includes(2) && !majors.includes(3);
-  return !profile.tools.includes("get_adcp_capabilities");
-}
 function isLegacyV3Profile(profile) {
   if (profile.adcp_version === "v3") return true;
   if (profile.adcp_major_versions?.includes(3)) return true;

package/dist/lib/testing/compliance/storyboard-tracks.js

@@ -151,11 +151,22 @@ function mapStepToTestStep(stepResult) {
   }).join("; ");
   return {
     step: stepResult.title,
+    step_id: stepResult.step_id,
     task: stepResult.task,
     passed: stepResult.passed,
     duration_ms: stepResult.duration_ms,
     error: stepResult.error,
     details: validationDetails || void 0,
+    validations: stepResult.validations.map((v) => ({
+      ...v.id !== void 0 && { id: v.id },
+      check: v.check,
+      passed: v.passed,
+      ...v.severity !== void 0 && { severity: v.severity },
+      ...v.not_applicable !== void 0 && { not_applicable: v.not_applicable },
+      ...v.severity_promoted_from_advisory !== void 0 && {
+        severity_promoted_from_advisory: v.severity_promoted_from_advisory
+      }
+    })),
     observation_data: stepResult.response,
     warnings: stepResult.skipped ? [stepResult.skip?.detail ?? skipReasonLabel(stepResult.skip_reason) ?? "Step skipped"] : void 0,
     ...stepResult.skipped && { skipped: true },

package/dist/lib/testing/compliance/storyboard-tracks.mjs

@@ -126,11 +126,22 @@ function mapStepToTestStep(stepResult) {
   }).join("; ");
   return {
     step: stepResult.title,
+    step_id: stepResult.step_id,
     task: stepResult.task,
     passed: stepResult.passed,
     duration_ms: stepResult.duration_ms,
     error: stepResult.error,
     details: validationDetails || void 0,
+    validations: stepResult.validations.map((v) => ({
+      ...v.id !== void 0 && { id: v.id },
+      check: v.check,
+      passed: v.passed,
+      ...v.severity !== void 0 && { severity: v.severity },
+      ...v.not_applicable !== void 0 && { not_applicable: v.not_applicable },
+      ...v.severity_promoted_from_advisory !== void 0 && {
+        severity_promoted_from_advisory: v.severity_promoted_from_advisory
+      }
+    })),
     observation_data: stepResult.response,
     warnings: stepResult.skipped ? [stepResult.skip?.detail ?? skipReasonLabel(stepResult.skip_reason) ?? "Step skipped"] : void 0,
     ...stepResult.skipped && { skipped: true },

package/dist/lib/testing/index.d.mts

@@ -18,3 +18,5 @@ export { runAgainstLocalAgent } from './local-agent-runner.mjs';
 export type { LocalAgentRunResult, PerStoryboardOverride, RunAgainstLocalAgentOptions } from './local-agent-runner.mjs';
 export { registerExternalSchemaRoot, unregisterExternalSchemaRoot, withExternalSchemaRoot, withServedReleaseSchemaRoots, } from '../validation/index.mjs';
 export { runStoryboard, runStoryboardStep, applyAdcpVersionRunOptions, applyStoryboardVersionOptions, getFirstStepPreview, parseStoryboard, loadStoryboardFile, normalizeValidationOnlyTasks, VALIDATION_ONLY_TASK, applyFixtureBindingsToRequest, buildFixtureResolutionSpecs, FixtureBindingRegistry, matchesFixtureRequirements, normalizeFixtureMatchExpression, validateFixtureResolutionDeclarations, getComplianceCacheDir, loadComplianceIndex, listBundles, loadBundleStoryboards, listAllComplianceStoryboards, getComplianceStoryboardById, findBundleById, resolveBundleOrStoryboard, resolveStoryboardsForCapabilities, isComplianceVersionSupported, CapabilityResolutionError, TASK_TO_METHOD, executeStoryboardTask, expandCreativeAssetDirectives, findUnresolvedCreativeAssetDirectives, extractContext, injectContext, runValidations, resolvePath, RateLimitTripObserver, RATE_LIMIT_TRIP_CONTRACT, RATE_LIMIT_TRIP_DEFAULT_REPLAY_MAX_WAIT_SECONDS, RATE_LIMIT_TRIP_MAX_ATTEMPTS_MAX, RATE_LIMIT_TRIP_MAX_ATTEMPTS_MIN, validateRateLimitTripSpec, getSandboxEntities, getSandboxBrands, getSandboxBrand, isSandboxDomain, clearSandboxCache, registerAssertion, getAssertion, listAssertions, listDefaultAssertions, clearAssertionRegistry, resolveAssertions, type AssertionSpec, type AssertionContext, type AssertionResult, type RegisterAssertionOptions, type Storyboard, type StoryboardFixtureResolution, type FixtureResolutionStrategy, type FixtureMatchOperator, type FixtureMatchClause, type FixtureResolutionDeclaration, type ProductFixtureResolutionDeclaration, type PricingOptionFixtureResolutionDeclaration, type FixtureResolutionStatus, type FixtureResolutionRecord, type FixtureResolutionAttempt, type FixtureResolutionEvidence, type FixtureResolutionCoverageGap, type StoryboardInvariants, type StoryboardInvariantsObject, type StepInvariantsObject, type StoryboardPhase, type StoryboardStep, type RateLimitTripSpec, type StoryboardValidation, type RateLimitTripClient, type RateLimitTripFailureCode, type RateLimitTripObservation, type RateLimitTripObserverOptions, type RateLimitTripResponseSnapshot, type RateLimitTripStructuredResult, type RateLimitTripTaskOptions, type StoryboardContext, type StoryboardRunOptions, type TrustedMatchContextProviderEndpoint, type TrustedMatchContextRegistrationContext, type TrustedMatchContextRouterRunnerOptions, type TrustedMatchPublisherAuthOperation, type TrustedMatchPublisherCredentialState, type TrustedMatchPublisherAuthTls, type TrustedMatchPublisherAuthProbeConfiguration, type TrustedMatchPublisherAuthRunner, type ValidationResult, type StoryboardStepPreview, type StoryboardStepResult, type StoryboardStepHint, type StoryboardStepHintBase, type ContextValueRejectedHint, type ShapeDriftHint, type MissingRequiredFieldHint, type FormatMismatchHint, type MonotonicViolationHint, type ContextProvenanceEntry, type StoryboardPhaseResult, type StoryboardResult, type RunnerNotice, type NoticeCode, type NoticeSeverity, type AgentCapabilities, type BundleKind, type BundleRef, type CapabilityResolutionCode, type ComplianceIndex, type ComplianceIndexProtocol, type ComplianceIndexSpecialism, type ResolveOptions, type ResolvedBundle, type ResolvedStoryboards, type SandboxBrand, type SandboxAgent, type SandboxEntities, type BrandJson, type AdagentsJson, gradeOAuthMetadataGraph, gradeOAuthMetadataGraphVector, loadOAuthMetadataGraphVectors, normalizeOAuthResourceForComparison, redactOAuthUrlForOutput, type GradeOAuthMetadataGraphOptions, type OAuthMetadataGraphErrorCode, type OAuthMetadataGraphFinding, type OAuthMetadataGraphGrade, type OAuthMetadataGraphObservation, type OAuthMetadataGraphVector, type OAuthMetadataGraphVectorCorpus, BrandJsonSchema, AdagentsJsonSchema, MCP_SESSION_PROBE_TASK, } from './storyboard/index.mjs';
+export { resolveCreativeBuildProbe, validateCreativeBuildProbeSpec } from './storyboard/index.mjs';
+export type { CreativeBuildProbeSpec, CreativeBuildProbeInputFixture, CreativeBuildProbeResolution, } from './storyboard/index.mjs';

package/dist/lib/testing/index.d.ts

@@ -18,3 +18,5 @@ export { runAgainstLocalAgent } from './local-agent-runner';
 export type { LocalAgentRunResult, PerStoryboardOverride, RunAgainstLocalAgentOptions } from './local-agent-runner';
 export { registerExternalSchemaRoot, unregisterExternalSchemaRoot, withExternalSchemaRoot, withServedReleaseSchemaRoots, } from '../validation';
 export { runStoryboard, runStoryboardStep, applyAdcpVersionRunOptions, applyStoryboardVersionOptions, getFirstStepPreview, parseStoryboard, loadStoryboardFile, normalizeValidationOnlyTasks, VALIDATION_ONLY_TASK, applyFixtureBindingsToRequest, buildFixtureResolutionSpecs, FixtureBindingRegistry, matchesFixtureRequirements, normalizeFixtureMatchExpression, validateFixtureResolutionDeclarations, getComplianceCacheDir, loadComplianceIndex, listBundles, loadBundleStoryboards, listAllComplianceStoryboards, getComplianceStoryboardById, findBundleById, resolveBundleOrStoryboard, resolveStoryboardsForCapabilities, isComplianceVersionSupported, CapabilityResolutionError, TASK_TO_METHOD, executeStoryboardTask, expandCreativeAssetDirectives, findUnresolvedCreativeAssetDirectives, extractContext, injectContext, runValidations, resolvePath, RateLimitTripObserver, RATE_LIMIT_TRIP_CONTRACT, RATE_LIMIT_TRIP_DEFAULT_REPLAY_MAX_WAIT_SECONDS, RATE_LIMIT_TRIP_MAX_ATTEMPTS_MAX, RATE_LIMIT_TRIP_MAX_ATTEMPTS_MIN, validateRateLimitTripSpec, getSandboxEntities, getSandboxBrands, getSandboxBrand, isSandboxDomain, clearSandboxCache, registerAssertion, getAssertion, listAssertions, listDefaultAssertions, clearAssertionRegistry, resolveAssertions, type AssertionSpec, type AssertionContext, type AssertionResult, type RegisterAssertionOptions, type Storyboard, type StoryboardFixtureResolution, type FixtureResolutionStrategy, type FixtureMatchOperator, type FixtureMatchClause, type FixtureResolutionDeclaration, type ProductFixtureResolutionDeclaration, type PricingOptionFixtureResolutionDeclaration, type FixtureResolutionStatus, type FixtureResolutionRecord, type FixtureResolutionAttempt, type FixtureResolutionEvidence, type FixtureResolutionCoverageGap, type StoryboardInvariants, type StoryboardInvariantsObject, type StepInvariantsObject, type StoryboardPhase, type StoryboardStep, type RateLimitTripSpec, type StoryboardValidation, type RateLimitTripClient, type RateLimitTripFailureCode, type RateLimitTripObservation, type RateLimitTripObserverOptions, type RateLimitTripResponseSnapshot, type RateLimitTripStructuredResult, type RateLimitTripTaskOptions, type StoryboardContext, type StoryboardRunOptions, type TrustedMatchContextProviderEndpoint, type TrustedMatchContextRegistrationContext, type TrustedMatchContextRouterRunnerOptions, type TrustedMatchPublisherAuthOperation, type TrustedMatchPublisherCredentialState, type TrustedMatchPublisherAuthTls, type TrustedMatchPublisherAuthProbeConfiguration, type TrustedMatchPublisherAuthRunner, type ValidationResult, type StoryboardStepPreview, type StoryboardStepResult, type StoryboardStepHint, type StoryboardStepHintBase, type ContextValueRejectedHint, type ShapeDriftHint, type MissingRequiredFieldHint, type FormatMismatchHint, type MonotonicViolationHint, type ContextProvenanceEntry, type StoryboardPhaseResult, type StoryboardResult, type RunnerNotice, type NoticeCode, type NoticeSeverity, type AgentCapabilities, type BundleKind, type BundleRef, type CapabilityResolutionCode, type ComplianceIndex, type ComplianceIndexProtocol, type ComplianceIndexSpecialism, type ResolveOptions, type ResolvedBundle, type ResolvedStoryboards, type SandboxBrand, type SandboxAgent, type SandboxEntities, type BrandJson, type AdagentsJson, gradeOAuthMetadataGraph, gradeOAuthMetadataGraphVector, loadOAuthMetadataGraphVectors, normalizeOAuthResourceForComparison, redactOAuthUrlForOutput, type GradeOAuthMetadataGraphOptions, type OAuthMetadataGraphErrorCode, type OAuthMetadataGraphFinding, type OAuthMetadataGraphGrade, type OAuthMetadataGraphObservation, type OAuthMetadataGraphVector, type OAuthMetadataGraphVectorCorpus, BrandJsonSchema, AdagentsJsonSchema, MCP_SESSION_PROBE_TASK, } from './storyboard';
+export { resolveCreativeBuildProbe, validateCreativeBuildProbeSpec } from './storyboard';
+export type { CreativeBuildProbeSpec, CreativeBuildProbeInputFixture, CreativeBuildProbeResolution, } from './storyboard';

package/dist/lib/testing/index.js

@@ -139,6 +139,7 @@ __export(testing_exports, {
   resolveAccountForMediaBuy: () => import_agent_tester.resolveAccountForMediaBuy,
   resolveAssertions: () => import_storyboard.resolveAssertions,
   resolveBundleOrStoryboard: () => import_storyboard.resolveBundleOrStoryboard,
+  resolveCreativeBuildProbe: () => import_storyboard2.resolveCreativeBuildProbe,
   resolvePath: () => import_storyboard.resolvePath,
   resolveStoryboardsForCapabilities: () => import_storyboard.resolveStoryboardsForCapabilities,
   runAgainstLocalAgent: () => import_local_agent_runner.runAgainstLocalAgent,
@@ -190,6 +191,7 @@ __export(testing_exports, {
   testTerminalStateEnforcement: () => import_agent_tester.testTerminalStateEnforcement,
   testValidation: () => import_agent_tester.testValidation,
   unregisterExternalSchemaRoot: () => import_validation.unregisterExternalSchemaRoot,
+  validateCreativeBuildProbeSpec: () => import_storyboard2.validateCreativeBuildProbeSpec,
   validateFixtureResolutionDeclarations: () => import_storyboard.validateFixtureResolutionDeclarations,
   validateRateLimitTripSpec: () => import_storyboard.validateRateLimitTripSpec,
   withExternalSchemaRoot: () => import_validation.withExternalSchemaRoot,
@@ -209,6 +211,7 @@ var import_test_controller_bridge = require('../server/test-controller-bridge.js
 var import_local_agent_runner = require('./local-agent-runner.js');
 var import_validation = require('../validation/index.js');
 var import_storyboard = require('./storyboard/index.js');
+var import_storyboard2 = require('./storyboard/index.js');
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AdagentsJsonSchema,
@@ -332,6 +335,7 @@ var import_storyboard = require('./storyboard/index.js');
   resolveAccountForMediaBuy,
   resolveAssertions,
   resolveBundleOrStoryboard,
+  resolveCreativeBuildProbe,
   resolvePath,
   resolveStoryboardsForCapabilities,
   runAgainstLocalAgent,
@@ -383,6 +387,7 @@ var import_storyboard = require('./storyboard/index.js');
   testTerminalStateEnforcement,
   testValidation,
   unregisterExternalSchemaRoot,
+  validateCreativeBuildProbeSpec,
   validateFixtureResolutionDeclarations,
   validateRateLimitTripSpec,
   withExternalSchemaRoot,

package/dist/lib/testing/index.mjs

@@ -189,6 +189,7 @@ import {
   AdagentsJsonSchema,
   MCP_SESSION_PROBE_TASK
 } from "./storyboard/index.mjs";
+import { resolveCreativeBuildProbe, validateCreativeBuildProbeSpec } from "./storyboard/index.mjs";
 export {
   AdagentsJsonSchema,
   BrandJsonSchema,
@@ -311,6 +312,7 @@ export {
   resolveAccountForMediaBuy,
   resolveAssertions,
   resolveBundleOrStoryboard,
+  resolveCreativeBuildProbe,
   resolvePath,
   resolveStoryboardsForCapabilities,
   runAgainstLocalAgent,
@@ -362,6 +364,7 @@ export {
   testTerminalStateEnforcement,
   testValidation,
   unregisterExternalSchemaRoot,
+  validateCreativeBuildProbeSpec,
   validateFixtureResolutionDeclarations,
   validateRateLimitTripSpec,
   withExternalSchemaRoot,

package/dist/lib/testing/scenarios/capabilities.d.mts

@@ -3,7 +3,7 @@
  *
  * Tests agent capability discovery including:
  * - get_adcp_capabilities (v3 agents)
- * - Synthetic capability detection (v2 agents)
+ * - Rejection of agents missing AdCP 3 capability discovery
  * - Protocol/tool cross-validation
  */
 import type { TestOptions, TestStepResult, AgentProfile } from '../types.mjs';
@@ -14,7 +14,7 @@ import type { TestOptions, TestStepResult, AgentProfile } from '../types.mjs';
  * 1. Discover agent profile (tools list)
  * 2. If get_adcp_capabilities exists, call it and validate response
  * 3. Cross-check reported protocols against available tools
- * 4. For v2 agents, build synthetic capabilities and note v3 upgrade path
+ * 4. Reject agents without AdCP 3 discovery
  */
 export declare function testCapabilityDiscovery(agentUrl: string, options: TestOptions): Promise<{
     steps: TestStepResult[];

package/dist/lib/testing/scenarios/capabilities.d.ts

@@ -3,7 +3,7 @@
  *
  * Tests agent capability discovery including:
  * - get_adcp_capabilities (v3 agents)
- * - Synthetic capability detection (v2 agents)
+ * - Rejection of agents missing AdCP 3 capability discovery
  * - Protocol/tool cross-validation
  */
 import type { TestOptions, TestStepResult, AgentProfile } from '../types';
@@ -14,7 +14,7 @@ import type { TestOptions, TestStepResult, AgentProfile } from '../types';
  * 1. Discover agent profile (tools list)
  * 2. If get_adcp_capabilities exists, call it and validate response
  * 3. Cross-check reported protocols against available tools
- * 4. For v2 agents, build synthetic capabilities and note v3 upgrade path
+ * 4. Reject agents without AdCP 3 discovery
  */
 export declare function testCapabilityDiscovery(agentUrl: string, options: TestOptions): Promise<{
     steps: TestStepResult[];

package/dist/lib/testing/scenarios/capabilities.js

@@ -72,8 +72,8 @@ async function testCapabilityDiscovery(agentUrl, options) {
       step.error = result.error || "get_adcp_capabilities failed";
       steps.push(step);
       const toolInfos = profile.tools.map((name) => ({ name }));
-      capabilities = (0, import_capabilities.buildSyntheticCapabilities)(toolInfos);
-      profile.adcp_version = "v2";
+      capabilities = (0, import_capabilities.buildSyntheticV3Capabilities)(toolInfos);
+      profile.adcp_version = "v3";
       profile.supported_protocols = capabilities.protocols;
       steps.push({
         step: "Fallback to synthetic capabilities",
@@ -83,54 +83,21 @@ async function testCapabilityDiscovery(agentUrl, options) {
       });
     } else {
       const toolInfos = profile.tools.map((name) => ({ name }));
-      capabilities = (0, import_capabilities.buildSyntheticCapabilities)(toolInfos);
-      profile.adcp_version = "v2";
+      capabilities = (0, import_capabilities.buildSyntheticV3Capabilities)(toolInfos);
+      profile.adcp_version = "v3";
       profile.supported_protocols = capabilities.protocols;
       step.passed = false;
       step.error = "get_adcp_capabilities returned no data";
       steps.push(step);
     }
   } else {
-    const toolInfos = profile.tools.map((name) => ({ name }));
-    capabilities = (0, import_capabilities.buildSyntheticCapabilities)(toolInfos);
-    profile.adcp_version = "v2";
-    profile.supported_protocols = capabilities.protocols;
-    profile.supports_governance = capabilities.protocols.includes("governance");
-    profile.supports_si = capabilities.protocols.includes("sponsored_intelligence");
     steps.push({
-      step: "Build synthetic capabilities (v2)",
-      task: void 0,
-      passed: true,
+      step: "Require AdCP 3 capability discovery",
+      passed: false,
       duration_ms: 0,
-      details: `Agent does not support get_adcp_capabilities. Detected ${capabilities.protocols.length} protocol(s) from tools.`,
-      response_preview: JSON.stringify(
-        {
-          version: capabilities.version,
-          protocols: capabilities.protocols,
-          features: capabilities.features,
-          _synthetic: true
-        },
-        null,
-        2
-      )
+      error: "Agent does not advertise get_adcp_capabilities. AdCP 2 reached end of life on 2026-08-01; upgrade the agent to AdCP 3."
     });
-    const v3ToolsPresent = [
-      ...import_capabilities.GOVERNANCE_TOOLS,
-      ...import_capabilities.SPONSORED_INTELLIGENCE_TOOLS,
-      ...import_capabilities.TRUSTED_MATCH_TOOLS,
-      ...import_capabilities.COMPLIANCE_TOOLS
-    ].filter((t) => profile.tools.includes(t));
-    if (v3ToolsPresent.length > 0) {
-      steps.push({
-        step: "v3 upgrade potential detected",
-        passed: true,
-        duration_ms: 0,
-        details: `Agent has ${v3ToolsPresent.length} v3 tool(s) but missing get_adcp_capabilities`,
-        warnings: [
-          `Consider implementing get_adcp_capabilities for better protocol discovery. v3 tools detected: ${v3ToolsPresent.join(", ")}`
-        ]
-      });
-    }
+    return { steps, profile };
   }
   const { steps: crossValidationSteps } = crossValidateProtocolsAndTools(capabilities, profile.tools);
   steps.push(...crossValidationSteps);