@adcp/sdk 16.4.0 → 16.5.0

package/dist/lib/signing/provider.mjs

@@ -0,0 +1,11 @@
+function freezeSigningProvider(provider) {
+  const keyid = provider.keyid;
+  const algorithm = provider.algorithm;
+  const adcpUse = provider.adcpUse;
+  const fingerprint = provider.fingerprint;
+  const sign = provider.sign.bind(provider);
+  return Object.freeze({ keyid, algorithm, adcpUse, fingerprint, sign });
+}
+export {
+  freezeSigningProvider
+};

package/dist/lib/signing/types.d.mts

@@ -20,6 +20,10 @@ export interface VerifierCapability {
      * AdCP tool names such as `create_media_buy`.
      */
     protocol_methods_required_for?: string[];
+    /** Protocol methods verified in shadow mode, using exact wire-name matching. */
+    protocol_methods_warn_for?: string[];
+    /** Protocol methods to sign when the buyer enables `sign_supported`. */
+    protocol_methods_supported_for?: string[];
 }
 export interface AdcpJsonWebKey {
     kid: string;

package/dist/lib/signing/types.d.ts

@@ -20,6 +20,10 @@ export interface VerifierCapability {
      * AdCP tool names such as `create_media_buy`.
      */
     protocol_methods_required_for?: string[];
+    /** Protocol methods verified in shadow mode, using exact wire-name matching. */
+    protocol_methods_warn_for?: string[];
+    /** Protocol methods to sign when the buyer enables `sign_supported`. */
+    protocol_methods_supported_for?: string[];
 }
 export interface AdcpJsonWebKey {
     kid: string;

package/dist/lib/signing/verifier.js

@@ -32,7 +32,9 @@ var import_content_digest = require('./content-digest.js');
 var import_errors = require('./errors.js');
 var import_errors2 = require('./agent-resolver/errors.js');
 var import_strict_json = require('./agent-resolver/strict-json.js');
+var import_body_validation = require('./body-validation.js');
 var import_parser = require('./parser.js');
+var import_nonce = require('./nonce.js');
 var import_crypto = require('./crypto.js');
 var import_operation_resolution = require('./operation-resolution.js');
 var import_webhook_auth_detection = require('./webhook-auth-detection.js');
@@ -220,18 +222,6 @@ async function verifyRequestSignature(request, options) {
       );
     }
   }
-  if (request.body !== void 0 && request.body.trim() !== "") {
-    try {
-      (0, import_strict_json.parseStrictJson)(request.body);
-    } catch (err) {
-      if (err instanceof import_strict_json.StrictJsonError) {
-        throw new import_errors.RequestSignatureError("request_body_malformed", 11, "Signed request body is not strict JSON", {
-          reason: err.code
-        });
-      }
-      throw err;
-    }
-  }
   if (authorizationValidUntil !== void 0 && currentTime() >= authorizationValidUntil) {
     throw new import_errors.RequestSignatureError(
       "request_signature_brand_origin_mismatch",
@@ -245,17 +235,27 @@ async function verifyRequestSignature(request, options) {
   if (insertResult === "replayed") {
     throw new import_errors.RequestSignatureError(
       "request_signature_replayed",
-      12,
+      13,
       `Replay of (keyid=${jwk.kid}, nonce=${parsedInput.params.nonce}) within signature window`
     );
   }
   if (insertResult === "rate_abuse") {
     throw new import_errors.RequestSignatureError(
       "request_signature_rate_abuse",
-      12,
+      13,
       `Per-keyid replay cache cap exceeded for keyid=${jwk.kid}`
     );
   }
+  try {
+    (0, import_body_validation.assertSignedBodyWellFormed)(request.body);
+  } catch (err) {
+    if (err instanceof import_strict_json.StrictJsonError) {
+      throw new import_errors.RequestSignatureError("request_body_malformed", 14, "Signed request body is not strict JSON", {
+        reason: err.code
+      });
+    }
+    throw err;
+  }
   if (authorizationValidUntil !== void 0 && currentTime() >= authorizationValidUntil) {
     throw new import_errors.RequestSignatureError(
       "request_signature_brand_origin_mismatch",
@@ -355,6 +355,13 @@ function requireParams(parsed) {
       `Signature-Input missing required parameter(s): ${missing.join(", ")}`
     );
   }
+  if (!(0, import_nonce.isValidSigningNonce)(parsed.params.nonce)) {
+    throw new import_errors.RequestSignatureError(
+      "request_signature_params_incomplete",
+      2,
+      "Signature nonce must be unpadded Base64URL containing at least 16 bytes"
+    );
+  }
 }
 function validateWindow(created, expires, now) {
   if (expires <= created) {

package/dist/lib/signing/verifier.mjs

@@ -14,8 +14,10 @@ import {
 } from "./content-digest.mjs";
 import { RequestSignatureError } from "./errors.mjs";
 import { AgentResolverError } from "./agent-resolver/errors.mjs";
-import { parseStrictJson, StrictJsonError } from "./agent-resolver/strict-json.mjs";
+import { StrictJsonError } from "./agent-resolver/strict-json.mjs";
+import { assertSignedBodyWellFormed } from "./body-validation.mjs";
 import { parseSignature, parseSignatureInput } from "./parser.mjs";
+import { isValidSigningNonce } from "./nonce.mjs";
 import { jwkToPublicKey, verifySignatureAsync } from "./crypto.mjs";
 import { isUnresolvableOperation } from "./operation-resolution.mjs";
 import { containsWebhookAuthentication, WEBHOOK_AUTH_TRAVERSAL_DEPTH } from "./webhook-auth-detection.mjs";
@@ -209,18 +211,6 @@ async function verifyRequestSignature(request, options) {
       );
     }
   }
-  if (request.body !== void 0 && request.body.trim() !== "") {
-    try {
-      parseStrictJson(request.body);
-    } catch (err) {
-      if (err instanceof StrictJsonError) {
-        throw new RequestSignatureError("request_body_malformed", 11, "Signed request body is not strict JSON", {
-          reason: err.code
-        });
-      }
-      throw err;
-    }
-  }
   if (authorizationValidUntil !== void 0 && currentTime() >= authorizationValidUntil) {
     throw new RequestSignatureError(
       "request_signature_brand_origin_mismatch",
@@ -234,17 +224,27 @@ async function verifyRequestSignature(request, options) {
   if (insertResult === "replayed") {
     throw new RequestSignatureError(
       "request_signature_replayed",
-      12,
+      13,
       `Replay of (keyid=${jwk.kid}, nonce=${parsedInput.params.nonce}) within signature window`
     );
   }
   if (insertResult === "rate_abuse") {
     throw new RequestSignatureError(
       "request_signature_rate_abuse",
-      12,
+      13,
       `Per-keyid replay cache cap exceeded for keyid=${jwk.kid}`
     );
   }
+  try {
+    assertSignedBodyWellFormed(request.body);
+  } catch (err) {
+    if (err instanceof StrictJsonError) {
+      throw new RequestSignatureError("request_body_malformed", 14, "Signed request body is not strict JSON", {
+        reason: err.code
+      });
+    }
+    throw err;
+  }
   if (authorizationValidUntil !== void 0 && currentTime() >= authorizationValidUntil) {
     throw new RequestSignatureError(
       "request_signature_brand_origin_mismatch",
@@ -344,6 +344,13 @@ function requireParams(parsed) {
       `Signature-Input missing required parameter(s): ${missing.join(", ")}`
     );
   }
+  if (!isValidSigningNonce(parsed.params.nonce)) {
+    throw new RequestSignatureError(
+      "request_signature_params_incomplete",
+      2,
+      "Signature nonce must be unpadded Base64URL containing at least 16 bytes"
+    );
+  }
 }
 function validateWindow(created, expires, now) {
   if (expires <= created) {

package/dist/lib/signing/webhook-verifier.d.mts

@@ -85,7 +85,7 @@ export interface VerifyWebhookResult {
 /**
  * Verify an inbound webhook's RFC 9421 signature.
  *
- * Checklist steps 1–13 plus sub-step 9a, matching the canonical numbering
+ * Checklist steps 1–14 plus sub-step 9a, matching the canonical numbering
  * in `security.mdx#verifier-checklist-for-webhooks` (and the `failed_step`
  * values on the conformance vectors at
  * `test-vectors/webhook-signing/negative/`). Throws

package/dist/lib/signing/webhook-verifier.d.ts

@@ -85,7 +85,7 @@ export interface VerifyWebhookResult {
 /**
  * Verify an inbound webhook's RFC 9421 signature.
  *
- * Checklist steps 1–13 plus sub-step 9a, matching the canonical numbering
+ * Checklist steps 1–14 plus sub-step 9a, matching the canonical numbering
  * in `security.mdx#verifier-checklist-for-webhooks` (and the `failed_step`
  * values on the conformance vectors at
  * `test-vectors/webhook-signing/negative/`). Throws

package/dist/lib/signing/webhook-verifier.js

@@ -29,8 +29,11 @@ var import_canonicalize = require('./canonicalize.js');
 var import_content_digest = require('./content-digest.js');
 var import_errors = require('./errors.js');
 var import_errors2 = require('./agent-resolver/errors.js');
+var import_strict_json = require('./agent-resolver/strict-json.js');
+var import_body_validation = require('./body-validation.js');
 var import_brand_jwks = require('./brand-jwks.js');
 var import_parser = require('./parser.js');
+var import_nonce = require('./nonce.js');
 var import_crypto = require('./crypto.js');
 var import_publisher_pins = require('./publisher-pins.js');
 var import_replay = require('./replay.js');
@@ -227,6 +230,16 @@ async function verifyWebhookSignature(request, options) {
       `Per-keyid replay cache cap exceeded on commit for keyid=${jwk.kid}.`
     );
   }
+  try {
+    (0, import_body_validation.assertSignedBodyWellFormed)(request.body);
+  } catch (err) {
+    if (err instanceof import_strict_json.StrictJsonError) {
+      throw new import_errors.WebhookSignatureError("webhook_body_malformed", 14, "Signed webhook body is not strict JSON", {
+        reason: err.code
+      });
+    }
+    throw err;
+  }
   if (keyResolution.operatorAuthorizationValidUntil !== void 0) {
     assertDelegatedOperatorAuthorizationActive(keyResolution.operatorAuthorizationValidUntil, currentTime());
   }
@@ -272,6 +285,13 @@ function requireParams(parsed) {
       `Signature-Input missing required parameter(s): ${missing.join(", ")}.`
     );
   }
+  if (!(0, import_nonce.isValidSigningNonce)(parsed.params.nonce)) {
+    throw new import_errors.WebhookSignatureError(
+      "webhook_signature_params_incomplete",
+      2,
+      "Signature nonce must be unpadded Base64URL containing at least 16 bytes"
+    );
+  }
 }
 function validateWindow(created, expires, now) {
   if (expires <= created) {

package/dist/lib/signing/webhook-verifier.mjs

@@ -2,8 +2,11 @@ import { buildSignatureBase, canonicalTargetUri, getHeaderValue } from "./canoni
 import { contentDigestMatches } from "./content-digest.mjs";
 import { RequestSignatureError, WebhookSignatureError } from "./errors.mjs";
 import { AgentResolverError } from "./agent-resolver/errors.mjs";
+import { StrictJsonError } from "./agent-resolver/strict-json.mjs";
+import { assertSignedBodyWellFormed } from "./body-validation.mjs";
 import { BrandJsonResolverError } from "./brand-jwks.mjs";
 import { parseSignature, parseSignatureInput } from "./parser.mjs";
+import { isValidSigningNonce } from "./nonce.mjs";
 import { jwkToPublicKey, verifySignatureAsync } from "./crypto.mjs";
 import { assertPublisherPins } from "./publisher-pins.mjs";
 import { InMemoryReplayStore } from "./replay.mjs";
@@ -200,6 +203,16 @@ async function verifyWebhookSignature(request, options) {
       `Per-keyid replay cache cap exceeded on commit for keyid=${jwk.kid}.`
     );
   }
+  try {
+    assertSignedBodyWellFormed(request.body);
+  } catch (err) {
+    if (err instanceof StrictJsonError) {
+      throw new WebhookSignatureError("webhook_body_malformed", 14, "Signed webhook body is not strict JSON", {
+        reason: err.code
+      });
+    }
+    throw err;
+  }
   if (keyResolution.operatorAuthorizationValidUntil !== void 0) {
     assertDelegatedOperatorAuthorizationActive(keyResolution.operatorAuthorizationValidUntil, currentTime());
   }
@@ -245,6 +258,13 @@ function requireParams(parsed) {
       `Signature-Input missing required parameter(s): ${missing.join(", ")}.`
     );
   }
+  if (!isValidSigningNonce(parsed.params.nonce)) {
+    throw new WebhookSignatureError(
+      "webhook_signature_params_incomplete",
+      2,
+      "Signature nonce must be unpadded Base64URL containing at least 16 bytes"
+    );
+  }
 }
 function validateWindow(created, expires, now) {
   if (expires <= created) {

package/dist/lib/testing/client.d.mts

@@ -1,6 +1,3 @@
-/**
- * Test client utilities for AdCP Agent E2E Testing
- */
 import type { GetSignalsResponse, AccountReference, BrandReference } from '../types/tools.generated.mjs';
 import type { TestOptions, TestStepResult, AgentProfile, Logger } from './types.mjs';
 /**

package/dist/lib/testing/client.d.ts

@@ -1,6 +1,3 @@
-/**
- * Test client utilities for AdCP Agent E2E Testing
- */
 import type { GetSignalsResponse, AccountReference, BrandReference } from '../types/tools.generated';
 import type { TestOptions, TestStepResult, AgentProfile, Logger } from './types';
 /**

package/dist/lib/testing/client.js

@@ -19,6 +19,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   createTestClient: () => createTestClient,
+  describeProfileDiscoveryFailure: () => describeProfileDiscoveryFailure,
   describeVersionUnsupported: () => describeVersionUnsupported,
   discoverAgentCapabilities: () => discoverAgentCapabilities,
   discoverAgentProfile: () => discoverAgentProfile,
@@ -28,6 +29,7 @@ __export(client_exports, {
   getOrCreateClient: () => getOrCreateClient,
   getOrCreateClientResolution: () => getOrCreateClientResolution,
   getOrDiscoverProfile: () => getOrDiscoverProfile,
+  getOrDiscoverStoryboardProfile: () => getOrDiscoverStoryboardProfile,
   hasTestClientScope: () => hasTestClientScope,
   resolveAccount: () => resolveAccount,
   resolveAuthPrincipal: () => resolveAuthPrincipal,
@@ -41,6 +43,7 @@ __export(client_exports, {
   withTestClientScope: () => withTestClientScope
 });
 module.exports = __toCommonJS(client_exports);
+var import_protocol_methods = require('../signing/protocol-methods.js');
 var import_ADCPMultiAgentClient = require('../core/ADCPMultiAgentClient.js');
 var import_union_errors = require('../utils/union-errors.js');
 var import_format_assets = require('../utils/format-assets.js');
@@ -59,6 +62,10 @@ var import_schema_loader = require('../validation/schema-loader.js');
 var import_error_extraction = require('../utils/error-extraction.js');
 var import_client = require('../signing/client.js');
 var import_storage_registry = require('../auth/oauth/storage-registry.js');
+var import_response_unwrapper = require('../utils/response-unwrapper.js');
+var import_discovery_evidence = require('./discovery-evidence.js');
+var import_redact_credential_patterns = require('../utils/redact-credential-patterns.js');
+var import_authorization_required = require('../auth/oauth/authorization-required.js');
 const TEST_CLIENT_VERSION_OPTIONS = /* @__PURE__ */ Symbol("adcp.testClientVersionOptions");
 const TEST_CLIENT_SCOPE_SALT = (0, import_node_crypto.randomBytes)(32);
 const testClientScope = new import_node_async_hooks.AsyncLocalStorage();
@@ -204,6 +211,8 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
       ...requestScopeMode !== void 0 && { requestScopeMode },
       ...requestSigningMode !== void 0 && { requestSigningMode },
       ...options.auth?.type === "oauth" && options.auth.storage && { oauthStorage: options.auth.storage },
+      connectionPartition: transport?.connectionPartition,
+      connectionReuse: transport?.connectionReuse,
       ...transport?.trustedFetchFn && { fetchFn: transport.trustedFetchFn },
       ...transport?.allowPrivateIp !== void 0 && { allowPrivateIp: transport.allowPrivateIp },
       ...transport?.maxResponseBytes !== void 0 && {
@@ -253,7 +262,7 @@ function testClientMatchesVersionOptions(client, agentUrl, options) {
   const expectedAdcpVersion = effectiveOptions.adcpVersion ?? import_version.ADCP_VERSION;
   const expectedWireAdcpVersion = effectiveOptions.wireAdcpVersion;
   const expectedVersionEnvelope = effectiveOptions.versionEnvelope ?? "auto";
-  return meta.agentUrl === agentUrl && meta.protocol === (effectiveOptions.protocol ?? "mcp") && meta.adcpVersion === expectedAdcpVersion && meta.wireAdcpVersion === expectedWireAdcpVersion && meta.versionEnvelope === expectedVersionEnvelope && meta.strictResponseSchemaValidation === (effectiveOptions.strictResponseSchemaValidation !== false) && meta.authMode === expectedAuthMode && meta.requestScopeMode === expectedRequestScopeMode && meta.requestSigningMode === expectedRequestSigningMode && meta.oauthStorage === expectedOAuthStorage && meta.fetchFn === expectedTransport?.trustedFetchFn && meta.allowPrivateIp === expectedTransport?.allowPrivateIp && meta.maxResponseBytes === expectedTransport?.maxResponseBytes && meta.requestTimeoutMs === expectedTransport?.requestTimeoutMs && meta.legacyCompatEnabled === expectedTransport?.legacyCompat?.enabled;
+  return meta.agentUrl === agentUrl && meta.protocol === (effectiveOptions.protocol ?? "mcp") && meta.adcpVersion === expectedAdcpVersion && meta.wireAdcpVersion === expectedWireAdcpVersion && meta.versionEnvelope === expectedVersionEnvelope && meta.strictResponseSchemaValidation === (effectiveOptions.strictResponseSchemaValidation !== false) && meta.authMode === expectedAuthMode && meta.requestScopeMode === expectedRequestScopeMode && meta.requestSigningMode === expectedRequestSigningMode && meta.oauthStorage === expectedOAuthStorage && meta.connectionPartition === expectedTransport?.connectionPartition && meta.connectionReuse === expectedTransport?.connectionReuse && meta.fetchFn === expectedTransport?.trustedFetchFn && meta.allowPrivateIp === expectedTransport?.allowPrivateIp && meta.maxResponseBytes === expectedTransport?.maxResponseBytes && meta.requestTimeoutMs === expectedTransport?.requestTimeoutMs && meta.legacyCompatEnabled === expectedTransport?.legacyCompat?.enabled;
 }
 function withTestKitAuthDefaults(options) {
   if (options.auth) return options;
@@ -326,7 +335,9 @@ function requestSigningReuseMode(config) {
       agentUrl: config.agent_url,
       jwksUri: config.jwks_uri,
       signSupported: config.sign_supported === true,
-      alwaysSign: config.always_sign ?? []
+      alwaysSign: config.always_sign ?? [],
+      alwaysSignProtocolMethods: config.always_sign_protocol_methods ?? [],
+      unsignedCapabilityBootstrap: (0, import_protocol_methods.hasUnsignedCapabilityBootstrap)(config)
     })
   ).digest("hex").slice(0, 16);
   return `${kind}:${fingerprint}`;
@@ -337,7 +348,7 @@ async function getOrDiscoverProfile(client, options, schemaAdcpVersion) {
   schemaAdcpVersion ??= profileBinding?.schemaAdcpVersion ?? options.adcpVersion;
   options.signal?.throwIfAborted();
   const scopeKey = scope?.active ? client.getCapabilityEvidenceScope().scopeKey : void 0;
-  if (options._profile && (!scope?.active || scope.authRejectedProfiles.has(options._profile) || !options._profile.capabilities_probe_error && options._client === client && profileBinding?.scopeKey === scopeKey)) {
+  if (options._profile && (!scope?.active || scope.authRejectedProfiles.has(options._profile) || !options._profile.capabilities_probe_error && !options._profile.capabilities_schema_issues?.length && options._client === client && profileBinding?.scopeKey === scopeKey)) {
     seedTestClientSigningCapability(client, options._profile, schemaAdcpVersion);
     return {
       profile: options._profile,
@@ -364,7 +375,7 @@ async function getOrDiscoverProfile(client, options, schemaAdcpVersion) {
       (result) => {
         if (options.signal?.aborted) {
           evict();
-        } else if (!result.step.passed || result.profile.capabilities_probe_error) {
+        } else if (!result.step.passed || describeProfileDiscoveryFailure(result.profile)) {
           if (options._discoveryPass && discovery) discovery.failed = true;
           else evict();
         }
@@ -404,6 +415,7 @@ function seedTestClientSigningCapability(client, profile, adcpVersion) {
     }
     profiles.set(profile, { scopeKey: client.getCapabilityEvidenceScope().scopeKey, schemaAdcpVersion: adcpVersion });
   }
+  if (describeProfileDiscoveryFailure(profile)) return;
   const raw = profile.raw_capabilities;
   if (!raw || typeof raw !== "object") return;
   const clientAccess = client;
@@ -411,7 +423,10 @@ function seedTestClientSigningCapability(client, profile, adcpVersion) {
   const agent = clientAccess.getAgent.call(client);
   const meta = client[TEST_CLIENT_VERSION_OPTIONS];
   const effectiveVersion = meta?.wireAdcpVersion ?? meta?.adcpVersion ?? (typeof clientAccess.getAdcpVersion === "function" ? clientAccess.getAdcpVersion.call(client) : void 0) ?? adcpVersion;
-  const signingContext = (0, import_client.buildAgentSigningContext)(agent, { adcpVersion: effectiveVersion });
+  const signingContext = (0, import_client.buildAgentSigningContext)(agent, {
+    adcpVersion: effectiveVersion,
+    connectionPartition: meta?.connectionPartition
+  });
   if (!signingContext) return;
   signingContext.cache.set(signingContext.capabilityCacheKey, {
     requestSigning: raw.request_signing,
@@ -494,17 +509,44 @@ function describeVersionUnsupported(result, requestedVersion) {
   const supportedText = supported?.length ? `; seller supports ${supported.map((version) => JSON.stringify(version)).join(", ")}` : "; seller did not report supported_versions";
   return `VERSION_UNSUPPORTED: ${requestedText}${supportedText}`;
 }
+async function getOrDiscoverStoryboardProfile(client, options, schemaAdcpVersion) {
+  const result = await getOrDiscoverProfile(client, options, schemaAdcpVersion);
+  const failure = describeProfileDiscoveryFailure(
+    result.profile,
+    options._requireValidCapabilityEvidence === true,
+    options._allowCapabilityDiagnostic === true
+  );
+  return failure ? { ...result, step: failure } : result;
+}
+function describeProfileDiscoveryFailure(profile, requireValidSchema = true, allowCapabilityDiagnostic = false) {
+  if (testClientScope.getStore()?.authRejectedProfiles.has(profile)) return void 0;
+  const raw = profile.raw_capabilities;
+  if (allowCapabilityDiagnostic && profile.tools.includes("get_adcp_capabilities") && profile.capabilities_failure?.task === "get_adcp_capabilities" && !profile.capabilities_probe_error?.startsWith("VERSION_UNSUPPORTED:"))
+    return void 0;
+  const schemaOnly = !profile.capabilities_probe_error && Boolean(profile.capabilities_schema_issues?.length);
+  const error = profile.capabilities_probe_error ?? ((!schemaOnly || requireValidSchema) && profile.capabilities_failure?.passed === false ? profile.capabilities_failure.error ?? "Capability discovery failed" : void 0) ?? (requireValidSchema && profile.capabilities_schema_issues?.length ? `get_adcp_capabilities response schema validation failed: ${profile.capabilities_schema_issues.map((issue) => `${issue.pointer || "/"} ${issue.message}`).join("; ")}` : void 0) ?? (raw !== void 0 && (raw === null || typeof raw !== "object" || Array.isArray(raw)) ? "Supplied profile.raw_capabilities must be an object" : void 0) ?? ((0, import_response_unwrapper.isTerminalAdcpError)(raw, "get_adcp_capabilities") ? "Supplied capability evidence contains an AdCP error" : void 0);
+  if (!error) return void 0;
+  return {
+    ...(0, import_discovery_evidence.redactDiscoveryEvidence)(profile.capabilities_failure),
+    step: "Discover agent capabilities",
+    task: profile.capabilities_failure?.task ?? "get_adcp_capabilities",
+    passed: false,
+    duration_ms: profile.capabilities_failure?.duration_ms ?? 0,
+    error: (0, import_redact_credential_patterns.redactCredentialPatterns)(error, false).slice(0, 4096)
+  };
+}
 async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
   const scopeKey = hasTestClientScope() ? client.getCapabilityEvidenceScope().scopeKey : void 0;
   const {
     result: agentInfo,
     step,
-    caughtError
+    caughtError: infoError
   } = await runStep(
     "Discover agent capabilities",
     "getAgentInfo",
     () => raceWithSignal(client.getAgentInfo({ signal }), signal)
   );
+  let caughtError = infoError;
   const profile = {
     name: agentInfo?.name || "Unknown",
     tools: agentInfo?.tools?.map((t) => t.name) || []
@@ -520,14 +562,37 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
       2
     );
   }
-  if (profile.tools.includes("get_adcp_capabilities")) {
+  if (step.passed && profile.tools.includes("get_adcp_capabilities")) {
+    const probeStart = Date.now();
+    step.request = {
+      transport: client.getAgent?.().protocol === "a2a" ? "a2a" : "mcp",
+      operation: "get_adcp_capabilities",
+      payload: {}
+    };
     try {
-      const caps = await raceWithSignal(client.getAdcpCapabilities({}, void 0, { signal }), signal);
+      const caps = await raceWithSignal(
+        client.getAdcpCapabilities({}, void 0, { signal }),
+        signal
+      );
+      if (caps.errorInstance instanceof import_authorization_required.NeedsAuthorizationError) caughtError = caps.errorInstance;
+      const observed = caps.debug_logs?.slice().reverse().find(
+        (log) => typeof log.message === "string" && (log.message.startsWith("MCP: Tool get_adcp_capabilities response received") || log.message.startsWith("A2A: Response received")) && log.response !== void 0
+      )?.response;
+      if (observed !== void 0)
+        step.response_record = {
+          transport: step.request.transport,
+          payload: (0, import_discovery_evidence.redactDiscoveryEvidence)(observed),
+          duration_ms: Date.now() - probeStart
+        };
+      const adcpError = caps.adcpError ?? caps.adcp_error;
+      if (adcpError) step.adcp_error = (0, import_discovery_evidence.redactDiscoveryEvidence)(adcpError);
       const versionUnsupported = describeVersionUnsupported(caps, testClientWireAdcpVersion(client, schemaAdcpVersion));
       if (versionUnsupported) {
         profile.capabilities_probe_error = versionUnsupported;
         step.passed = false;
         step.error = versionUnsupported;
+      } else if ((0, import_response_unwrapper.isTerminalAdcpError)(caps.data, "get_adcp_capabilities") || !caps?.success && !(0, import_capabilities.looksLikeV3Capabilities)(caps.data)) {
+        profile.capabilities_probe_error = caps.error ?? adcpError?.message ?? "get_adcp_capabilities was rejected";
       } else if (caps?.data) {
         profile.raw_capabilities = caps.data;
         const validation = (0, import_schema_loader.withServedValidationVersion)(
@@ -541,31 +606,57 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
             message: issue.message
           }));
         }
-        const parsed = (0, import_capabilities.parseCapabilitiesResponse)(caps.data);
-        profile.adcp_version = parsed.version;
-        profile.adcp_major_versions = parsed.majorVersions;
-        if (parsed.supportedVersions !== void 0) profile.adcp_supported_versions = parsed.supportedVersions;
-        if (parsed.buildVersion !== void 0) profile.adcp_build_version = parsed.buildVersion;
-        profile.supported_protocols = parsed.protocols;
-        profile.supports_governance = parsed.protocols.includes("governance");
-        profile.supports_si = parsed.protocols.includes("sponsored_intelligence");
-        const specialisms = caps.data.specialisms;
-        if (Array.isArray(specialisms)) {
-          profile.specialisms = specialisms.filter((s) => typeof s === "string");
+        if ((0, import_capabilities.looksLikeV3Capabilities)(caps.data)) {
+          const parsed = (0, import_capabilities.parseCapabilitiesResponse)(caps.data);
+          profile.adcp_version = parsed.version;
+          profile.adcp_major_versions = parsed.majorVersions;
+          if (parsed.supportedVersions !== void 0) profile.adcp_supported_versions = parsed.supportedVersions;
+          if (parsed.buildVersion !== void 0) profile.adcp_build_version = parsed.buildVersion;
+          profile.supported_protocols = parsed.protocols;
+          profile.supports_governance = parsed.protocols.includes("governance");
+          profile.supports_si = parsed.protocols.includes("sponsored_intelligence");
+          const specialisms = caps.data.specialisms;
+          if (Array.isArray(specialisms)) {
+            profile.specialisms = specialisms.filter((s) => typeof s === "string");
+          }
+          const libVersion = caps.data.library_version;
+          if (typeof libVersion === "string") profile.library_version = libVersion;
         }
-        const libVersion = caps.data.library_version;
-        if (typeof libVersion === "string") profile.library_version = libVersion;
       }
-      if (!versionUnsupported && (!caps?.success || !caps?.data) && !profile.capabilities_schema_issues?.length) {
+      if (!versionUnsupported && (!caps?.success || !caps?.data) && !profile.capabilities_schema_issues?.length && !profile.capabilities_probe_error) {
         profile.capabilities_probe_error = caps?.error || "get_adcp_capabilities returned no data";
       }
     } catch (err) {
+      caughtError = err;
       profile.capabilities_probe_error = err?.message || String(err);
+      if (err instanceof import_response_unwrapper.ResponseSchemaValidationError) {
+        step.response_record = { transport: step.request.transport, payload: (0, import_discovery_evidence.redactDiscoveryEvidence)(err.data) };
+      }
+    } finally {
+      step.duration_ms += Date.now() - probeStart;
     }
   }
-  if (scopeKey === void 0 || scopeKey === client.getCapabilityEvidenceScope().scopeKey) {
+  if (caughtError instanceof import_authorization_required.NeedsAuthorizationError && typeof client.getAgent === "function" && (0, import_authorization_required.hasValidatedMcpAuthorizationRequirements)(caughtError.requirements, client.getAgent().agent_uri)) {
+    step.authorization_required = (0, import_discovery_evidence.redactDiscoveryEvidence)(caughtError.requirements);
+  }
+  const failure = describeProfileDiscoveryFailure(profile);
+  if (!step.passed || failure) {
+    const evidence = { ...step, ...failure ?? {}, passed: false, duration_ms: step.duration_ms };
+    evidence.error = (0, import_redact_credential_patterns.redactCredentialPatterns)(evidence.error ?? "Agent discovery failed", false).slice(
+      0,
+      4096
+    );
+    profile.capabilities_failure = evidence;
+  }
+  if (!step.passed) step.error = (0, import_redact_credential_patterns.redactCredentialPatterns)(step.error ?? "Agent discovery failed", false);
+  if (!failure && step.passed && (scopeKey === void 0 || scopeKey === client.getCapabilityEvidenceScope().scopeKey)) {
     seedTestClientSigningCapability(client, profile, schemaAdcpVersion);
   }
+  if (step.passed && !failure) {
+    delete step.request;
+    delete step.response_record;
+    delete step.adcp_error;
+  }
   return { profile, step, ...caughtError !== void 0 && { caughtError } };
 }
 async function discoverAgentCapabilities(client, profile, options) {
@@ -867,6 +958,7 @@ function zodCodeToKeyword(code) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createTestClient,
+  describeProfileDiscoveryFailure,
   describeVersionUnsupported,
   discoverAgentCapabilities,
   discoverAgentProfile,
@@ -876,6 +968,7 @@ function zodCodeToKeyword(code) {
   getOrCreateClient,
   getOrCreateClientResolution,
   getOrDiscoverProfile,
+  getOrDiscoverStoryboardProfile,
   hasTestClientScope,
   resolveAccount,
   resolveAuthPrincipal,