@adcp/sdk 16.0.0 → 16.2.0

package/dist/lib/registry/types.generated.d.mts

@@ -4314,6 +4314,12 @@ export interface components {
                 severity: string;
                 message: string;
             }[];
+            /** @description Advisory AdCP 4.0 readiness from the latest non-dry-run compliance run, graded against universal/v4-compatibility.yaml. Does not affect 3.x verification or conformance. Null when the latest run predates the report. */
+            v4_readiness?: {
+                registry_version: string;
+                target_version: string;
+                checks: components["schemas"]["V4ReadinessCheck"][];
+            } | null;
             /** @description Owner-scoped: the agent owner's membership tier. Populated only when the authenticated viewer owns the agent; null otherwise. Field is always present so response shape doesn't reveal ownership. */
             membership_tier?: string | null;
             /** @description Owner-scoped: human-readable label for membership_tier (e.g. 'Builder'). Null for non-owners. */
@@ -4388,6 +4394,23 @@ export interface components {
             /** Format: uri */
             reference_url?: string;
         };
+        V4ReadinessCheck: {
+            /** @description Stable check id from universal/v4-compatibility.yaml. */
+            id: string;
+            /** @enum {string} */
+            status: "passed" | "failing" | "not_observable";
+            /**
+             * @description Why a not_observable check could not be graded. Null for passed and failing.
+             * @enum {string|null}
+             */
+            reason: "storyboard_not_run" | "step_not_run" | "step_skipped" | "not_graded" | "notice_absent" | "not_observed_by_suite" | null;
+            issue: number | null;
+            change: string | null;
+            detection: string;
+            fix: string;
+            /** @description Migration guide anchor for the check. */
+            guide_url: string | null;
+        };
         /** @description Owner-scoped membership leg of badge eligibility. Non-owners receive eligible: null and an empty blocker list. */
         OwnerComplianceEligibility: {
             criteria_version: string;
@@ -4405,7 +4428,7 @@ export interface components {
             adcp_version: string;
             verified_at: string;
             /** @description Specialisms demonstrably passed (enums/specialism.json). Preview specialisms are excluded from stable badges. */
-            verified_specialisms: ("audience-sync" | "brand-rights" | "buyer-activation" | "buyer-discovery" | "buyer-monitoring" | "buyer-negotiation" | "buyer-recovery" | "collection-lists" | "content-standards" | "creative-ad-server" | "creative-generative" | "creative-template" | "creative-transformers" | "governance-aware-seller" | "governance-delivery-monitor" | "governance-spend-authority" | "property-lists" | "sales-broadcast-tv" | "sales-catalog-driven" | "sales-dooh" | "sales-exchange" | "sales-guaranteed" | "sales-non-guaranteed" | "sales-proposal-mode" | "sales-retail-media" | "sales-streaming-tv" | "sales-social" | "signal-marketplace" | "orchestrator-multi-agent" | "signal-owned" | "signed-requests" | "sponsored-intelligence")[];
+            verified_specialisms: ("audience-sync" | "brand-rights" | "buyer-activation" | "buyer-discovery" | "buyer-monitoring" | "buyer-negotiation" | "buyer-recovery" | "collection-lists" | "content-standards" | "creative-ad-server" | "creative-generative" | "creative-template" | "creative-transformers" | "governance-aware-seller" | "governance-delivery-monitor" | "governance-spend-authority" | "property-lists" | "sales-broadcast-tv" | "sales-catalog-driven" | "sales-dooh" | "sales-exchange" | "sales-fixed-rate" | "sales-guaranteed" | "sales-non-guaranteed" | "sales-proposal-mode" | "sales-retail-media" | "sales-streaming-tv" | "sales-social" | "signal-marketplace" | "orchestrator-multi-agent" | "signal-owned" | "signed-requests" | "sponsored-intelligence")[];
             /** @description Evidence modes earned. 'spec' = AdCP storyboards were exercised; 'live' = production traffic was observed. Independent of grading_profile and always non-empty when a badge is present. */
             verification_modes: ("spec" | "live")[];
             /**

package/dist/lib/registry/types.generated.d.ts

@@ -4314,6 +4314,12 @@ export interface components {
                 severity: string;
                 message: string;
             }[];
+            /** @description Advisory AdCP 4.0 readiness from the latest non-dry-run compliance run, graded against universal/v4-compatibility.yaml. Does not affect 3.x verification or conformance. Null when the latest run predates the report. */
+            v4_readiness?: {
+                registry_version: string;
+                target_version: string;
+                checks: components["schemas"]["V4ReadinessCheck"][];
+            } | null;
             /** @description Owner-scoped: the agent owner's membership tier. Populated only when the authenticated viewer owns the agent; null otherwise. Field is always present so response shape doesn't reveal ownership. */
             membership_tier?: string | null;
             /** @description Owner-scoped: human-readable label for membership_tier (e.g. 'Builder'). Null for non-owners. */
@@ -4388,6 +4394,23 @@ export interface components {
             /** Format: uri */
             reference_url?: string;
         };
+        V4ReadinessCheck: {
+            /** @description Stable check id from universal/v4-compatibility.yaml. */
+            id: string;
+            /** @enum {string} */
+            status: "passed" | "failing" | "not_observable";
+            /**
+             * @description Why a not_observable check could not be graded. Null for passed and failing.
+             * @enum {string|null}
+             */
+            reason: "storyboard_not_run" | "step_not_run" | "step_skipped" | "not_graded" | "notice_absent" | "not_observed_by_suite" | null;
+            issue: number | null;
+            change: string | null;
+            detection: string;
+            fix: string;
+            /** @description Migration guide anchor for the check. */
+            guide_url: string | null;
+        };
         /** @description Owner-scoped membership leg of badge eligibility. Non-owners receive eligible: null and an empty blocker list. */
         OwnerComplianceEligibility: {
             criteria_version: string;
@@ -4405,7 +4428,7 @@ export interface components {
             adcp_version: string;
             verified_at: string;
             /** @description Specialisms demonstrably passed (enums/specialism.json). Preview specialisms are excluded from stable badges. */
-            verified_specialisms: ("audience-sync" | "brand-rights" | "buyer-activation" | "buyer-discovery" | "buyer-monitoring" | "buyer-negotiation" | "buyer-recovery" | "collection-lists" | "content-standards" | "creative-ad-server" | "creative-generative" | "creative-template" | "creative-transformers" | "governance-aware-seller" | "governance-delivery-monitor" | "governance-spend-authority" | "property-lists" | "sales-broadcast-tv" | "sales-catalog-driven" | "sales-dooh" | "sales-exchange" | "sales-guaranteed" | "sales-non-guaranteed" | "sales-proposal-mode" | "sales-retail-media" | "sales-streaming-tv" | "sales-social" | "signal-marketplace" | "orchestrator-multi-agent" | "signal-owned" | "signed-requests" | "sponsored-intelligence")[];
+            verified_specialisms: ("audience-sync" | "brand-rights" | "buyer-activation" | "buyer-discovery" | "buyer-monitoring" | "buyer-negotiation" | "buyer-recovery" | "collection-lists" | "content-standards" | "creative-ad-server" | "creative-generative" | "creative-template" | "creative-transformers" | "governance-aware-seller" | "governance-delivery-monitor" | "governance-spend-authority" | "property-lists" | "sales-broadcast-tv" | "sales-catalog-driven" | "sales-dooh" | "sales-exchange" | "sales-fixed-rate" | "sales-guaranteed" | "sales-non-guaranteed" | "sales-proposal-mode" | "sales-retail-media" | "sales-streaming-tv" | "sales-social" | "signal-marketplace" | "orchestrator-multi-agent" | "signal-owned" | "signed-requests" | "sponsored-intelligence")[];
             /** @description Evidence modes earned. 'spec' = AdCP storyboards were exercised; 'live' = production traffic was observed. Independent of grading_profile and always non-empty when a badge is present. */
             verification_modes: ("spec" | "live")[];
             /**

package/dist/lib/server/account-sync-contract.js

@@ -28,6 +28,7 @@ module.exports = __toCommonJS(account_sync_contract_exports);
 var import_account_key = require('../core/account-key.js');
 var import_account = require('./decisioning/account.js');
 var import_async_outcome = require('./decisioning/async-outcome.js');
+const NATURAL_KEY_FIELDS = ["brand", "operator", "operator_unit", "currency", "timezone", "sandbox"];
 function isolateAccountCallbackInput(ctx) {
   const descriptors = Object.getOwnPropertyDescriptors(ctx);
   delete descriptors.input;
@@ -58,7 +59,9 @@ function naturalRef(entry) {
   const ref = entry.account ?? entry;
   if (!ref || "account_id" in ref || !("brand" in ref) || !ref.brand || typeof ref.operator !== "string")
     return void 0;
-  return ref;
+  return Object.fromEntries(
+    NATURAL_KEY_FIELDS.filter((field) => ref[field] !== void 0).map((field) => [field, ref[field]])
+  );
 }
 async function lookup(accounts, ref, ctx, onUnsupported) {
   try {

package/dist/lib/server/account-sync-contract.mjs

@@ -1,6 +1,7 @@
 import { accountReferenceKey } from "../core/account-key.mjs";
 import { AccountNotFoundError, toWireAccount } from "./decisioning/account.mjs";
 import { AdcpError } from "./decisioning/async-outcome.mjs";
+const NATURAL_KEY_FIELDS = ["brand", "operator", "operator_unit", "currency", "timezone", "sandbox"];
 function isolateAccountCallbackInput(ctx) {
   const descriptors = Object.getOwnPropertyDescriptors(ctx);
   delete descriptors.input;
@@ -31,7 +32,9 @@ function naturalRef(entry) {
   const ref = entry.account ?? entry;
   if (!ref || "account_id" in ref || !("brand" in ref) || !ref.brand || typeof ref.operator !== "string")
     return void 0;
-  return ref;
+  return Object.fromEntries(
+    NATURAL_KEY_FIELDS.filter((field) => ref[field] !== void 0).map((field) => [field, ref[field]])
+  );
 }
 async function lookup(accounts, ref, ctx, onUnsupported) {
   try {

package/dist/lib/server/decisioning/runtime/from-platform.js

@@ -1009,23 +1009,28 @@ function jsonValuesEqual(left, right) {
   return leftKeys.length === rightKeys.length && leftKeys.every((key) => Object.hasOwn(rightRecord, key) && jsonValuesEqual(leftRecord[key], rightRecord[key]));
 }
 function matchLegacyRefToDeclaration(declaration, ref, ownerId, legacyFormatConverter) {
-  const projected = (0, import_v1_to_v2.projectV1ProductToV2)(
-    {
-      product_id: ownerId,
-      name: ownerId,
-      description: ownerId,
-      format_ids: [ref]
-    },
-    { legacyFormatConverter }
-  );
-  if (projected.diagnostics.length > 0 || projected.v2.format_options.length !== 1) return "unresolved";
-  const expected = projected.v2.format_options[0];
-  if (declaration.format_kind !== expected.format_kind) return "kind_mismatch";
-  const params = declaration.params !== null && typeof declaration.params === "object" && !Array.isArray(declaration.params) ? declaration.params : {};
-  for (const [key, expectedValue] of Object.entries(expected.params)) {
-    if (!Object.hasOwn(params, key) || !jsonValuesEqual(params[key], expectedValue)) return "params_mismatch";
-  }
-  return "match";
+  const compare = (authoritativeOnly) => {
+    const projected = (0, import_v1_to_v2.projectV1ProductToV2)(
+      {
+        product_id: ownerId,
+        name: ownerId,
+        description: ownerId,
+        format_ids: [ref]
+      },
+      { legacyFormatConverter, _authoritativeOnly: authoritativeOnly }
+    );
+    if (projected.diagnostics.length > 0 || projected.v2.format_options.length !== 1) return "unresolved";
+    const expected = projected.v2.format_options[0];
+    if (declaration.format_kind !== expected.format_kind) return "kind_mismatch";
+    const params = declaration.params !== null && typeof declaration.params === "object" && !Array.isArray(declaration.params) ? declaration.params : {};
+    for (const [key, expectedValue] of Object.entries(expected.params)) {
+      if (!Object.hasOwn(params, key) || !jsonValuesEqual(params[key], expectedValue)) return "params_mismatch";
+    }
+    return "match";
+  };
+  const authoritative = compare(true);
+  if (authoritative !== "unresolved") return authoritative;
+  return compare(false) === "match" ? "match" : "unresolved";
 }
 function validateLegacyRefNarrowing(declaration, ref, ownerId, field, legacyFormatConverter) {
   const match = matchLegacyRefToDeclaration(declaration, ref, ownerId, legacyFormatConverter);

package/dist/lib/server/decisioning/runtime/from-platform.mjs

@@ -1041,23 +1041,28 @@ function jsonValuesEqual(left, right) {
   return leftKeys.length === rightKeys.length && leftKeys.every((key) => Object.hasOwn(rightRecord, key) && jsonValuesEqual(leftRecord[key], rightRecord[key]));
 }
 function matchLegacyRefToDeclaration(declaration, ref, ownerId, legacyFormatConverter) {
-  const projected = projectV1ProductToV2(
-    {
-      product_id: ownerId,
-      name: ownerId,
-      description: ownerId,
-      format_ids: [ref]
-    },
-    { legacyFormatConverter }
-  );
-  if (projected.diagnostics.length > 0 || projected.v2.format_options.length !== 1) return "unresolved";
-  const expected = projected.v2.format_options[0];
-  if (declaration.format_kind !== expected.format_kind) return "kind_mismatch";
-  const params = declaration.params !== null && typeof declaration.params === "object" && !Array.isArray(declaration.params) ? declaration.params : {};
-  for (const [key, expectedValue] of Object.entries(expected.params)) {
-    if (!Object.hasOwn(params, key) || !jsonValuesEqual(params[key], expectedValue)) return "params_mismatch";
-  }
-  return "match";
+  const compare = (authoritativeOnly) => {
+    const projected = projectV1ProductToV2(
+      {
+        product_id: ownerId,
+        name: ownerId,
+        description: ownerId,
+        format_ids: [ref]
+      },
+      { legacyFormatConverter, _authoritativeOnly: authoritativeOnly }
+    );
+    if (projected.diagnostics.length > 0 || projected.v2.format_options.length !== 1) return "unresolved";
+    const expected = projected.v2.format_options[0];
+    if (declaration.format_kind !== expected.format_kind) return "kind_mismatch";
+    const params = declaration.params !== null && typeof declaration.params === "object" && !Array.isArray(declaration.params) ? declaration.params : {};
+    for (const [key, expectedValue] of Object.entries(expected.params)) {
+      if (!Object.hasOwn(params, key) || !jsonValuesEqual(params[key], expectedValue)) return "params_mismatch";
+    }
+    return "match";
+  };
+  const authoritative = compare(true);
+  if (authoritative !== "unresolved") return authoritative;
+  return compare(false) === "match" ? "match" : "unresolved";
 }
 function validateLegacyRefNarrowing(declaration, ref, ownerId, field, legacyFormatConverter) {
   const match = matchLegacyRefToDeclaration(declaration, ref, ownerId, legacyFormatConverter);

package/dist/lib/server/index.d.mts

@@ -83,8 +83,8 @@ export { createPinAndBindFetch, WEBHOOK_SSRF_POLICY, LOOPBACK_OK_WEBHOOK_SSRF_PO
 export type { PinAndBindFetchOptions, DnsLookupAll } from './pin-and-bind-fetch.mjs';
 export { checkGovernance, createAdcpGovernanceEnforcementMiddleware, governanceDeniedError, governanceUnavailableError, } from './governance.mjs';
 export type { AdcpGovernanceEnforcementMiddleware, CheckGovernanceOptions, GovernanceCallResult, GovernanceApproved, GovernanceDenied, GovernanceConditions, } from './governance.mjs';
-export { GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from '../governance/index.mjs';
-export type { BuildGovernanceExecutionRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationErrorCode, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from '../governance/index.mjs';
+export { GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, verifyGovernanceAuthorization, verifyHistoricalGovernanceContext, createGovernanceAgentJwksResolver, } from '../governance/index.mjs';
+export type { BuildGovernanceExecutionRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationErrorCode, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, VerifyGovernanceAuthorizationOptions, VerifyHistoricalGovernanceContextOptions, HistoricalGovernanceContextResult, GovernanceBuyerIdentity, } from '../governance/index.mjs';
 export { clearDefaultResolvedListCache, createResolvedListCache, DEFAULT_RESOLVE_LIST_PAGE_SIZE, defaultResolvedListCache, resolvePropertyList, resolveCollectionList, resolvedListCacheKey, matchesPropertyList, matchesCollectionList, } from './targeting-helpers.mjs';
 export type { ResolvedListCache, ResolvedListCacheEntry, ResolvedListCacheValue, ResolvedListKind, ResolvedPropertyList, ResolvedCollectionList, ResolvedCollection, ResolveListCallTool, ResolveListOptions, } from './targeting-helpers.mjs';
 export * from './decisioning/index.mjs';

package/dist/lib/server/index.d.ts

@@ -83,8 +83,8 @@ export { createPinAndBindFetch, WEBHOOK_SSRF_POLICY, LOOPBACK_OK_WEBHOOK_SSRF_PO
 export type { PinAndBindFetchOptions, DnsLookupAll } from './pin-and-bind-fetch';
 export { checkGovernance, createAdcpGovernanceEnforcementMiddleware, governanceDeniedError, governanceUnavailableError, } from './governance';
 export type { AdcpGovernanceEnforcementMiddleware, CheckGovernanceOptions, GovernanceCallResult, GovernanceApproved, GovernanceDenied, GovernanceConditions, } from './governance';
-export { GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, verifyGovernanceAuthorization, createGovernanceAgentJwksResolver, } from '../governance';
-export type { BuildGovernanceExecutionRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationErrorCode, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, VerifyGovernanceAuthorizationOptions, GovernanceBuyerIdentity, } from '../governance';
+export { GovernanceAuthorizationError, GovernanceReplayStoreAdapter, InMemoryGovernanceReplayStore, buildGovernanceExecutionCommitment, buildGovernanceExecutionRequest, computeGovernedPayloadHash, createGovernanceEnforcementMiddleware, verifyGovernanceAuthorization, verifyHistoricalGovernanceContext, createGovernanceAgentJwksResolver, } from '../governance';
+export type { BuildGovernanceExecutionRequestInput, GovernanceAuthorizationClaims, GovernanceAuthorizationErrorCode, GovernanceAuthorizationResult, GovernanceAuthorizationSuccess, GovernanceCommitment, GovernanceEnforcementMiddleware, GovernanceEnforcementMiddlewareConfig, GovernanceEnforcementMiddlewareInput, GovernanceReplayStore, GovernanceReplayBinding, GovernanceRevocationResolver, GovernanceRevocationStatus, VerifyGovernanceAuthorizationOptions, VerifyHistoricalGovernanceContextOptions, HistoricalGovernanceContextResult, GovernanceBuyerIdentity, } from '../governance';
 export { clearDefaultResolvedListCache, createResolvedListCache, DEFAULT_RESOLVE_LIST_PAGE_SIZE, defaultResolvedListCache, resolvePropertyList, resolveCollectionList, resolvedListCacheKey, matchesPropertyList, matchesCollectionList, } from './targeting-helpers';
 export type { ResolvedListCache, ResolvedListCacheEntry, ResolvedListCacheValue, ResolvedListKind, ResolvedPropertyList, ResolvedCollectionList, ResolvedCollection, ResolveListCallTool, ResolveListOptions, } from './targeting-helpers';
 export * from './decisioning';

package/dist/lib/server/index.js

@@ -293,6 +293,7 @@ __export(server_exports, {
   verifyApiKey: () => import_auth.verifyApiKey,
   verifyBearer: () => import_auth.verifyBearer,
   verifyGovernanceAuthorization: () => import_governance2.verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext: () => import_governance2.verifyHistoricalGovernanceContext,
   verifyIntrospection: () => import_auth_introspection.verifyIntrospection,
   verifyProposalTermsDigest: () => import_verification.verifyProposalTermsDigest,
   verifySignatureAsAuthenticator: () => import_auth_signature.verifySignatureAsAuthenticator,
@@ -633,6 +634,7 @@ var import_property_lists = require('./property-lists.js');
   verifyApiKey,
   verifyBearer,
   verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext,
   verifyIntrospection,
   verifyProposalTermsDigest,
   verifySignatureAsAuthenticator,

package/dist/lib/server/index.mjs

@@ -236,6 +236,7 @@ import {
   computeGovernedPayloadHash,
   createGovernanceEnforcementMiddleware,
   verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext,
   createGovernanceAgentJwksResolver
 } from "../governance/index.mjs";
 import {
@@ -579,6 +580,7 @@ export {
   verifyApiKey,
   verifyBearer,
   verifyGovernanceAuthorization,
+  verifyHistoricalGovernanceContext,
   verifyIntrospection,
   verifyProposalTermsDigest,
   verifySignatureAsAuthenticator,

package/dist/lib/signing/web-bot-auth.js

@@ -35,6 +35,7 @@ __export(web_bot_auth_exports, {
   deferWebBotAuthPrincipalFailure: () => deferWebBotAuthPrincipalFailure,
   getWebBotAuthAuthorizationFailure: () => getWebBotAuthAuthorizationFailure,
   getWebBotAuthLegacyOriginGate: () => getWebBotAuthLegacyOriginGate,
+  isRefusedWebBotAuthTestKey: () => isRefusedWebBotAuthTestKey,
   isVerifiedWebBotSigner: () => isVerifiedWebBotSigner,
   isWebBotAuthRevocationChecked: () => isWebBotAuthRevocationChecked,
   jwkThumbprint: () => jwkThumbprint,
@@ -186,6 +187,14 @@ function jwkThumbprint(jwk) {
 function keyAlgorithm(jwk) {
   return jwk.kty === "OKP" && jwk.crv === "Ed25519" ? "ed25519" : void 0;
 }
+function importable(jwk) {
+  try {
+    (0, import_crypto2.jwkToPublicKey)(jwk);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function algorithm(jwk) {
   return keyAlgorithm(jwk) ?? denied("unsupported_key");
 }
@@ -562,6 +571,9 @@ async function legacyRevocationCheck(options, origin, keyid) {
 function testKeysAllowed(allowTestKeys) {
   return allowTestKeys === true && ["test", "development"].includes(process.env.NODE_ENV ?? "");
 }
+function isRefusedWebBotAuthTestKey(kid, allowTestKeys) {
+  return TEST_KIDS.has(kid) && !testKeysAllowed(allowTestKeys);
+}
 async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}) {
   try {
     if (!Number.isFinite(now)) denied("directory_invalid");
@@ -590,25 +602,24 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
       if (!raw || typeof raw !== "object") denied("directory_key");
       if (Object.keys(raw).some((k) => PRIVATE_JWK_MEMBERS.has(k.toLowerCase()) || k.startsWith("_private")))
         denied("directory_key");
-      if (!keyAlgorithm(raw)) continue;
+      if (!keyAlgorithm(raw) || !importable(raw)) continue;
       const thumbprint = jwkThumbprint(raw);
       const key = { ...raw, kid: raw.kid ?? thumbprint };
       if (key.kid !== thumbprint || kids.has(key.kid) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
         denied("directory_key");
       kids.add(key.kid);
-      keys.push(key);
       const proof = signatures.find((input) => input.params.keyid === key.kid && input.params.tag === DIRECTORY_TAG);
       if (!proof || !proof.components.includes("@authority;req") || !proof.components.includes("content-digest") || !Number.isSafeInteger(proof.params.created) || !Number.isSafeInteger(proof.params.expires) || proof.params.expires <= now || proof.params.expires <= proof.params.created)
-        denied("directory_proof");
+        continue;
       const proofComponents = [(0, import_http_message_sig.component)("@authority", { req: true }), (0, import_http_message_sig.component)("content-digest")];
       let covered;
       try {
         covered = proof.components.map(componentDescriptor);
       } catch {
-        return denied("directory_proof");
+        continue;
       }
       const requestHeaders = response.request.headers ?? {};
-      await verifyWithLibrary(
+      const proven = await verifyWithLibrary(
         {
           kind: "response",
           status: response.status,
@@ -634,7 +645,15 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
         // The library rejects a proof whose `created` is in the future (beyond skew).
         { requiredComponents: proofComponents, requiredParameters: ["created", "expires", "keyid", "tag"], now },
         async () => keyVerifier(key)
+      ).then(
+        () => true,
+        (error) => {
+          if (error instanceof WebBotAuthError) return false;
+          throw error;
+        }
       );
+      if (!proven) continue;
+      keys.push(key);
       expires = Math.min(expires, proof.params.expires);
     }
     if (!keys.length) denied("directory_keys");
@@ -922,6 +941,7 @@ function createWebBotAuthFetch(upstream, key, options) {
   deferWebBotAuthPrincipalFailure,
   getWebBotAuthAuthorizationFailure,
   getWebBotAuthLegacyOriginGate,
+  isRefusedWebBotAuthTestKey,
   isVerifiedWebBotSigner,
   isWebBotAuthRevocationChecked,
   jwkThumbprint,

package/dist/lib/signing/web-bot-auth.mjs

@@ -16,7 +16,7 @@ import { canonicalAgentUrl } from "./agent-resolver/select-agent.mjs";
 import { parseStrictJson } from "./agent-resolver/strict-json.mjs";
 import { getHeaderValue } from "./canonicalize.mjs";
 import { computeContentDigest, contentDigestMatches, contentDigestUsesEncoding } from "./content-digest.mjs";
-import { signWithPrivateJwkAsync, verifySignatureAsync } from "./crypto.mjs";
+import { jwkToPublicKey, signWithPrivateJwkAsync, verifySignatureAsync } from "./crypto.mjs";
 import {
   parseSignature,
   parseSignatureInputMember,
@@ -142,6 +142,14 @@ function jwkThumbprint(jwk) {
 function keyAlgorithm(jwk) {
   return jwk.kty === "OKP" && jwk.crv === "Ed25519" ? "ed25519" : void 0;
 }
+function importable(jwk) {
+  try {
+    jwkToPublicKey(jwk);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function algorithm(jwk) {
   return keyAlgorithm(jwk) ?? denied("unsupported_key");
 }
@@ -518,6 +526,9 @@ async function legacyRevocationCheck(options, origin, keyid) {
 function testKeysAllowed(allowTestKeys) {
   return allowTestKeys === true && ["test", "development"].includes(process.env.NODE_ENV ?? "");
 }
+function isRefusedWebBotAuthTestKey(kid, allowTestKeys) {
+  return TEST_KIDS.has(kid) && !testKeysAllowed(allowTestKeys);
+}
 async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}) {
   try {
     if (!Number.isFinite(now)) denied("directory_invalid");
@@ -546,25 +557,24 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
       if (!raw || typeof raw !== "object") denied("directory_key");
       if (Object.keys(raw).some((k) => PRIVATE_JWK_MEMBERS.has(k.toLowerCase()) || k.startsWith("_private")))
         denied("directory_key");
-      if (!keyAlgorithm(raw)) continue;
+      if (!keyAlgorithm(raw) || !importable(raw)) continue;
       const thumbprint = jwkThumbprint(raw);
       const key = { ...raw, kid: raw.kid ?? thumbprint };
       if (key.kid !== thumbprint || kids.has(key.kid) || key.adcp_use !== void 0 || !testKeysAllowed(options.allowTestKeys) && TEST_KIDS.has(key.kid))
         denied("directory_key");
       kids.add(key.kid);
-      keys.push(key);
       const proof = signatures.find((input) => input.params.keyid === key.kid && input.params.tag === DIRECTORY_TAG);
       if (!proof || !proof.components.includes("@authority;req") || !proof.components.includes("content-digest") || !Number.isSafeInteger(proof.params.created) || !Number.isSafeInteger(proof.params.expires) || proof.params.expires <= now || proof.params.expires <= proof.params.created)
-        denied("directory_proof");
+        continue;
       const proofComponents = [component("@authority", { req: true }), component("content-digest")];
       let covered;
       try {
         covered = proof.components.map(componentDescriptor);
       } catch {
-        return denied("directory_proof");
+        continue;
       }
       const requestHeaders = response.request.headers ?? {};
-      await verifyWithLibrary(
+      const proven = await verifyWithLibrary(
         {
           kind: "response",
           status: response.status,
@@ -590,7 +600,15 @@ async function verifyKeyDirectory(response, now = Date.now() / 1e3, options = {}
         // The library rejects a proof whose `created` is in the future (beyond skew).
         { requiredComponents: proofComponents, requiredParameters: ["created", "expires", "keyid", "tag"], now },
         async () => keyVerifier(key)
+      ).then(
+        () => true,
+        (error) => {
+          if (error instanceof WebBotAuthError) return false;
+          throw error;
+        }
       );
+      if (!proven) continue;
+      keys.push(key);
       expires = Math.min(expires, proof.params.expires);
     }
     if (!keys.length) denied("directory_keys");
@@ -877,6 +895,7 @@ export {
   deferWebBotAuthPrincipalFailure,
   getWebBotAuthAuthorizationFailure,
   getWebBotAuthLegacyOriginGate,
+  isRefusedWebBotAuthTestKey,
   isVerifiedWebBotSigner,
   isWebBotAuthRevocationChecked,
   jwkThumbprint,

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "16.0.0";
+export declare const RUNNER_CAPABILITY_VERSION = "16.2.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "16.0.0";
+export declare const RUNNER_CAPABILITY_VERSION = "16.2.0";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/v2/projection/catalog.d.mts

@@ -91,6 +91,12 @@ interface CatalogIndex {
     byUniqueId: Map<string, V1FormatDefinition | null>;
     entries: V1FormatDefinition[];
 }
+/**
+ * True when `agentUrl` names the AAO reference format agent (including its
+ * folded historical hosts). Ids under any other agent URL belong to that
+ * agent, so AAO naming conventions say nothing about what they mean.
+ */
+export declare function isAaoAgentUrl(agentUrl: string): boolean;
 /**
  * Load the catalog from a known path. Resolution order:
  *

package/dist/lib/v2/projection/catalog.d.ts

@@ -91,6 +91,12 @@ interface CatalogIndex {
     byUniqueId: Map<string, V1FormatDefinition | null>;
     entries: V1FormatDefinition[];
 }
+/**
+ * True when `agentUrl` names the AAO reference format agent (including its
+ * folded historical hosts). Ids under any other agent URL belong to that
+ * agent, so AAO naming conventions say nothing about what they mean.
+ */
+export declare function isAaoAgentUrl(agentUrl: string): boolean;
 /**
  * Load the catalog from a known path. Resolution order:
  *

package/dist/lib/v2/projection/catalog.js

@@ -30,6 +30,7 @@ var catalog_exports = {};
 __export(catalog_exports, {
   _resetCatalogCache: () => _resetCatalogCache,
   findCatalogEntryByCanonicalAndSize: () => findCatalogEntryByCanonicalAndSize,
+  isAaoAgentUrl: () => isAaoAgentUrl,
   loadCatalog: () => loadCatalog,
   lookupUniqueV1FormatById: () => lookupUniqueV1FormatById,
   lookupV1Format: () => lookupV1Format,
@@ -52,6 +53,9 @@ function normalizeAgentUrl(u) {
   if (canonical === null) return void 0;
   return AAO_LEGACY_AGENT_URL_ALIASES.has(canonical) ? import_constants.AAO_CANONICAL_AGENT_URL : canonical;
 }
+function isAaoAgentUrl(agentUrl) {
+  return normalizeAgentUrl(agentUrl) === import_constants.AAO_CANONICAL_AGENT_URL;
+}
 function indexKey(agentUrl, id) {
   const normalized = normalizeAgentUrl(agentUrl);
   return normalized === void 0 ? void 0 : `${normalized}::${id}`;
@@ -136,6 +140,7 @@ function findCatalogEntryByCanonicalAndSize(canonical, width, height, agentUrl,
 0 && (module.exports = {
   _resetCatalogCache,
   findCatalogEntryByCanonicalAndSize,
+  isAaoAgentUrl,
   loadCatalog,
   lookupUniqueV1FormatById,
   lookupV1Format,

package/dist/lib/v2/projection/catalog.mjs

@@ -19,6 +19,9 @@ function normalizeAgentUrl(u) {
   if (canonical === null) return void 0;
   return AAO_LEGACY_AGENT_URL_ALIASES.has(canonical) ? AAO_CANONICAL_AGENT_URL : canonical;
 }
+function isAaoAgentUrl(agentUrl) {
+  return normalizeAgentUrl(agentUrl) === AAO_CANONICAL_AGENT_URL;
+}
 function indexKey(agentUrl, id) {
   const normalized = normalizeAgentUrl(agentUrl);
   return normalized === void 0 ? void 0 : `${normalized}::${id}`;
@@ -102,6 +105,7 @@ function findCatalogEntryByCanonicalAndSize(canonical, width, height, agentUrl,
 export {
   _resetCatalogCache,
   findCatalogEntryByCanonicalAndSize,
+  isAaoAgentUrl,
   loadCatalog,
   lookupUniqueV1FormatById,
   lookupV1Format,

package/dist/lib/v2/projection/v1-to-v2.js

@@ -219,7 +219,8 @@ function projectFormatId(fid, productId, field, options) {
   const exactCatalogEntry = (0, import_catalog.lookupV1Format)(fid, options?._catalogPath);
   const canonicalAgentUrl = (0, import_resolve_agent_properties.canonicalizeAgentUrl)(fid.agent_url);
   const mayUseUniqueAlias = canonicalAgentUrl !== null && new URL(canonicalAgentUrl).protocol === "https:" && !(0, import_address_guards.isLikelyPrivateUrl)(canonicalAgentUrl);
-  const uniqueAliasEntry = exactCatalogEntry === void 0 && mayUseUniqueAlias ? (0, import_catalog.lookupUniqueV1FormatById)(fid.id, options?._catalogPath) : void 0;
+  const aaoGuessesApply = options?._authoritativeOnly !== true || (0, import_catalog.isAaoAgentUrl)(fid.agent_url);
+  const uniqueAliasEntry = exactCatalogEntry === void 0 && mayUseUniqueAlias && aaoGuessesApply ? (0, import_catalog.lookupUniqueV1FormatById)(fid.id, options?._catalogPath) : void 0;
   if (uniqueAliasEntry) {
     const explicit = projectWithLegacyConverter(fid, productId, field, options?.legacyFormatConverter);
     if (explicit) return explicit;
@@ -277,7 +278,7 @@ function projectFormatId(fid, productId, field, options) {
       }
     };
   }
-  const globMatch = (0, import_registry.forwardLookupByGlob)(fid.id);
+  const globMatch = aaoGuessesApply ? (0, import_registry.forwardLookupByGlob)(fid.id) : void 0;
   if (globMatch) {
     return {
       decl: {

package/dist/lib/v2/projection/v1-to-v2.mjs

@@ -4,7 +4,7 @@ import { createRequire as __adcpCreateRequire } from "node:module";
 const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
 const require2 = __adcpCreateRequire(import.meta.url);
 import { forwardLookupByGlob, forwardLookupByStructural } from "./registry.mjs";
-import { lookupUniqueV1FormatById, lookupV1Format } from "./catalog.mjs";
+import { isAaoAgentUrl, lookupUniqueV1FormatById, lookupV1Format } from "./catalog.mjs";
 import { AAO_CANONICAL_AGENT_URL } from "./constants.mjs";
 import { LIBRARY_VERSION } from "../../version.mjs";
 import { legacyFormatConverterFromCatalogSnapshots } from "./catalog-snapshot.mjs";
@@ -202,7 +202,8 @@ function projectFormatId(fid, productId, field, options) {
   const exactCatalogEntry = lookupV1Format(fid, options?._catalogPath);
   const canonicalAgentUrl = canonicalizeAgentUrl(fid.agent_url);
   const mayUseUniqueAlias = canonicalAgentUrl !== null && new URL(canonicalAgentUrl).protocol === "https:" && !isLikelyPrivateUrl(canonicalAgentUrl);
-  const uniqueAliasEntry = exactCatalogEntry === void 0 && mayUseUniqueAlias ? lookupUniqueV1FormatById(fid.id, options?._catalogPath) : void 0;
+  const aaoGuessesApply = options?._authoritativeOnly !== true || isAaoAgentUrl(fid.agent_url);
+  const uniqueAliasEntry = exactCatalogEntry === void 0 && mayUseUniqueAlias && aaoGuessesApply ? lookupUniqueV1FormatById(fid.id, options?._catalogPath) : void 0;
   if (uniqueAliasEntry) {
     const explicit = projectWithLegacyConverter(fid, productId, field, options?.legacyFormatConverter);
     if (explicit) return explicit;
@@ -260,7 +261,7 @@ function projectFormatId(fid, productId, field, options) {
       }
     };
   }
-  const globMatch = forwardLookupByGlob(fid.id);
+  const globMatch = aaoGuessesApply ? forwardLookupByGlob(fid.id) : void 0;
   if (globMatch) {
     return {
       decl: {