@adcp/sdk 17.0.0-beta.1 → 17.0.0-beta.3

package/dist/lib/testing/storyboard/index.d.ts

@@ -6,6 +6,7 @@
  * The canonical storyboard set lives in the AdCP compliance tarball
  * and is pulled into `compliance/cache/{version}/` via `npm run sync-schemas`.
  */
+export { createStoryboardWebBotAuthFetch } from './web-bot-auth';
 export type { A2ATaskEnvelope, AgentEntry, Storyboard, StoryboardFixtureResolution, FixtureResolutionStrategy, FixtureMatchOperator, FixtureMatchClause, FixtureResolutionDeclaration, ProductFixtureResolutionDeclaration, PricingOptionFixtureResolutionDeclaration, FixtureResolutionStatus, FixtureResolutionRecord, FixtureResolutionAttempt, FixtureResolutionEvidence, FixtureResolutionCoverageGap, StoryboardInvariants, StoryboardInvariantsObject, StepInvariantsObject, StoryboardPhase, StoryboardStep, RateLimitTripSpec, StoryboardValidation, StoryboardValidationCheck, WebhookFilterSpec, WebhookRetryTriggerSpec, WebhookAssertionErrorCode, ContextOutput, ContextInput, ContextProvenanceEntry, ContextValueRejectedHint, ShapeDriftHint, MissingRequiredFieldHint, FormatMismatchHint, MonotonicViolationHint, ImpairmentCoherenceHint, ImpairmentCoherenceNotApplicableHint, StoryboardContext, StoryboardRunOptions, PrepareStoryboardFixturesOptions, TrustedMatchContextProviderEndpoint, TrustedMatchContextRegistrationContext, TrustedMatchContextRouterRunnerOptions, TrustedMatchPublisherAuthOperation, TrustedMatchPublisherCredentialState, TrustedMatchPublisherAuthTls, TrustedMatchPublisherAuthProbeConfiguration, TrustedMatchPublisherAuthRunner, ValidationResult, StoryboardStepPreview, StoryboardStepResult, StoryboardStepHint, StoryboardStepHintBase, StoryboardPhaseResult, StoryboardResult, AssertionResult, StrictValidationSummary, StrictValidationVerdict, UpstreamTrafficPayloadMatch, RunnerNotice, NoticeCode, NoticeSeverity, } from './types';
 export { WEBHOOK_IDEMPOTENCY_KEY_PATTERN } from './types';
 export { MCP_SESSION_PROBE_TASK } from './types';

package/dist/lib/testing/storyboard/index.js

@@ -60,6 +60,7 @@ __export(storyboard_exports, {
   clearSandboxCache: () => import_sandbox_entities.clearSandboxCache,
   compareCollectionPairs: () => import_collection_selection.compareCollectionPairs,
   createRunnerVariables: () => import_context.createRunnerVariables,
+  createStoryboardWebBotAuthFetch: () => import_web_bot_auth.createStoryboardWebBotAuthFetch,
   createWebhookReceiver: () => import_webhook_receiver.createWebhookReceiver,
   describeStoryboardCapabilityGates: () => import_runner.describeStoryboardCapabilityGates,
   detectContextRejectionHints: () => import_rejection_hints.detectContextRejectionHints,
@@ -136,6 +137,7 @@ __export(storyboard_exports, {
 });
 module.exports = __toCommonJS(storyboard_exports);
 var import_default_invariants = require('./default-invariants.js');
+var import_web_bot_auth = require('./web-bot-auth.js');
 var import_types = require('./types.js');
 var import_types2 = require('./types.js');
 var import_assertions = require('./assertions.js');
@@ -207,6 +209,7 @@ var import_creative_build_probe = require('./creative-build-probe.js');
   clearSandboxCache,
   compareCollectionPairs,
   createRunnerVariables,
+  createStoryboardWebBotAuthFetch,
   createWebhookReceiver,
   describeStoryboardCapabilityGates,
   detectContextRejectionHints,

package/dist/lib/testing/storyboard/index.mjs

@@ -1,5 +1,6 @@
 import { registerDefaultInvariants } from "./default-invariants.mjs";
 registerDefaultInvariants();
+import { createStoryboardWebBotAuthFetch } from "./web-bot-auth.mjs";
 import { WEBHOOK_IDEMPOTENCY_KEY_PATTERN } from "./types.mjs";
 import { MCP_SESSION_PROBE_TASK } from "./types.mjs";
 import {
@@ -164,6 +165,7 @@ export {
   clearSandboxCache,
   compareCollectionPairs,
   createRunnerVariables,
+  createStoryboardWebBotAuthFetch,
   createWebhookReceiver,
   describeStoryboardCapabilityGates,
   detectContextRejectionHints,

package/dist/lib/testing/storyboard/loader.js

@@ -96,6 +96,13 @@ function validateStoryboardShape(storyboard) {
     validateBranchSet(storyboard.id, phase);
     if (!phase.steps) continue;
     for (const step of phase.steps) {
+      if (step.enrich_request !== void 0 && (step.enrich_request !== true || !step.expect_error || step.negative_path !== "payload_well_formed")) {
+        throw new Error(
+          `[${storyboard.id}] ${step.id}: enrich_request requires expect_error: true and negative_path: payload_well_formed`
+        );
+      }
+      if (typeof step.auth === "object" && step.auth.type === "web_bot_auth" && (typeof step.auth.identity !== "string" || step.auth.identity.trim().length === 0))
+        throw new Error(`[${storyboard.id}] ${step.id}: web_bot_auth requires an identity name`);
       const rawStep = step;
       if (rawStep.task === void 0) {
         if (!Array.isArray(rawStep.validations) || rawStep.validations.length === 0) {

package/dist/lib/testing/storyboard/loader.mjs

@@ -68,6 +68,13 @@ function validateStoryboardShape(storyboard) {
     validateBranchSet(storyboard.id, phase);
     if (!phase.steps) continue;
     for (const step of phase.steps) {
+      if (step.enrich_request !== void 0 && (step.enrich_request !== true || !step.expect_error || step.negative_path !== "payload_well_formed")) {
+        throw new Error(
+          `[${storyboard.id}] ${step.id}: enrich_request requires expect_error: true and negative_path: payload_well_formed`
+        );
+      }
+      if (typeof step.auth === "object" && step.auth.type === "web_bot_auth" && (typeof step.auth.identity !== "string" || step.auth.identity.trim().length === 0))
+        throw new Error(`[${storyboard.id}] ${step.id}: web_bot_auth requires an identity name`);
       const rawStep = step;
       if (rawStep.task === void 0) {
         if (!Array.isArray(rawStep.validations) || rawStep.validations.length === 0) {

package/dist/lib/testing/storyboard/request-builder.js

@@ -248,12 +248,15 @@ const REQUEST_ENRICHERS = {
       budget: (typeof baseSample.budget === "number" ? baseSample.budget : void 0) ?? options.budget ?? Math.max(1e3, pricingOption?.min_spend_per_package ?? 1e3),
       pricing_option_id: fixturePricingOptionId ?? pricingOption?.pricing_option_id ?? context.pricing_option_id ?? "test-pricing"
     };
-    const sentPricingOption = fixtureProductId === void 0 && fixturePricingOptionId === void 0 ? pricingOption : findPricingOption(context, firstPkg.product_id, firstPkg.pricing_option_id);
-    if (baseSample.bid_price === void 0 && baseSample.bidding === void 0 && step.sample_request?.bidding === void 0 && sentPricingOption?.pricing_model === "cpm" && !(0, import_pricing_adapter.isFixedPricing)(sentPricingOption)) {
-      const floor = Number(sentPricingOption.floor_price) || 5;
-      firstPkg.bid_price = Math.round(floor * 1.5 * 100) / 100;
-    }
     const additionalPkgs = samplePackages.slice(1).map((p) => (0, import_context.injectContext)({ ...p }, context));
+    const packages = [firstPkg, ...additionalPkgs];
+    for (const pkg of packages) {
+      const sentPricingOption = pkg === firstPkg && fixtureProductId === void 0 && fixturePricingOptionId === void 0 ? pricingOption : findPricingOption(context, pkg.product_id, pkg.pricing_option_id);
+      if (pkg.bid_price === void 0 && pkg.bidding === void 0 && step.sample_request?.bidding === void 0 && sentPricingOption?.pricing_model === "cpm" && !(0, import_pricing_adapter.isFixedPricing)(sentPricingOption)) {
+        const floor = Number(sentPricingOption.floor_price) || 5;
+        pkg.bid_price = Math.round(floor * 1.5 * 100) / 100;
+      }
+    }
     const fixture = step.sample_request !== void 0 ? (0, import_context.injectContext)({ ...step.sample_request }, context) : {};
     const fixtureBody = omitEnvelopeFields(fixture);
     const fixtureHasPackages = Array.isArray(fixture.packages) && fixture.packages.length > 0;
@@ -275,7 +278,7 @@ const REQUEST_ENRICHERS = {
       brand: (0, import_client.resolveBrand)(options),
       start_time: startTime,
       end_time: endTime,
-      packages: [firstPkg, ...additionalPkgs]
+      packages
     };
   },
   update_media_buy(step, context, options) {

package/dist/lib/testing/storyboard/request-builder.mjs

@@ -222,12 +222,15 @@ const REQUEST_ENRICHERS = {
       budget: (typeof baseSample.budget === "number" ? baseSample.budget : void 0) ?? options.budget ?? Math.max(1e3, pricingOption?.min_spend_per_package ?? 1e3),
       pricing_option_id: fixturePricingOptionId ?? pricingOption?.pricing_option_id ?? context.pricing_option_id ?? "test-pricing"
     };
-    const sentPricingOption = fixtureProductId === void 0 && fixturePricingOptionId === void 0 ? pricingOption : findPricingOption(context, firstPkg.product_id, firstPkg.pricing_option_id);
-    if (baseSample.bid_price === void 0 && baseSample.bidding === void 0 && step.sample_request?.bidding === void 0 && sentPricingOption?.pricing_model === "cpm" && !isFixedPricing(sentPricingOption)) {
-      const floor = Number(sentPricingOption.floor_price) || 5;
-      firstPkg.bid_price = Math.round(floor * 1.5 * 100) / 100;
-    }
     const additionalPkgs = samplePackages.slice(1).map((p) => injectContext({ ...p }, context));
+    const packages = [firstPkg, ...additionalPkgs];
+    for (const pkg of packages) {
+      const sentPricingOption = pkg === firstPkg && fixtureProductId === void 0 && fixturePricingOptionId === void 0 ? pricingOption : findPricingOption(context, pkg.product_id, pkg.pricing_option_id);
+      if (pkg.bid_price === void 0 && pkg.bidding === void 0 && step.sample_request?.bidding === void 0 && sentPricingOption?.pricing_model === "cpm" && !isFixedPricing(sentPricingOption)) {
+        const floor = Number(sentPricingOption.floor_price) || 5;
+        pkg.bid_price = Math.round(floor * 1.5 * 100) / 100;
+      }
+    }
     const fixture = step.sample_request !== void 0 ? injectContext({ ...step.sample_request }, context) : {};
     const fixtureBody = omitEnvelopeFields(fixture);
     const fixtureHasPackages = Array.isArray(fixture.packages) && fixture.packages.length > 0;
@@ -249,7 +252,7 @@ const REQUEST_ENRICHERS = {
       brand: resolveBrand(options),
       start_time: startTime,
       end_time: endTime,
-      packages: [firstPkg, ...additionalPkgs]
+      packages
     };
   },
   update_media_buy(step, context, options) {

package/dist/lib/testing/storyboard/request-signing/vector-loader.d.mts

@@ -34,6 +34,8 @@ export declare function signingProfileForAdcpVersion(version?: string): '3.2' |
 export declare function loadRequestSigningVectors(options?: LoadVectorsOptions): LoadedVectors;
 /** Load only the shared signing keyset, without requiring the grader vectors. */
 export declare function loadRequestSigningKeys(options?: LoadVectorsOptions): TestKeyset;
+/** Refresh only the signing fixtures belonging to a changed custom compliance root. */
+export declare function invalidateRequestSigningVectorCache(complianceDir: string): void;
 /** Test-only: clear the memoization cache so a fresh cache path is reread. */
 export declare function __resetVectorCache(): void;
 /** Where the A2A operation-resolution vectors came from. */

package/dist/lib/testing/storyboard/request-signing/vector-loader.d.ts

@@ -34,6 +34,8 @@ export declare function signingProfileForAdcpVersion(version?: string): '3.2' |
 export declare function loadRequestSigningVectors(options?: LoadVectorsOptions): LoadedVectors;
 /** Load only the shared signing keyset, without requiring the grader vectors. */
 export declare function loadRequestSigningKeys(options?: LoadVectorsOptions): TestKeyset;
+/** Refresh only the signing fixtures belonging to a changed custom compliance root. */
+export declare function invalidateRequestSigningVectorCache(complianceDir: string): void;
 /** Test-only: clear the memoization cache so a fresh cache path is reread. */
 export declare function __resetVectorCache(): void;
 /** Where the A2A operation-resolution vectors came from. */

package/dist/lib/testing/storyboard/request-signing/vector-loader.js

@@ -22,6 +22,7 @@ __export(vector_loader_exports, {
   A2A_VECTORS_UNAVAILABLE_MESSAGE: () => A2A_VECTORS_UNAVAILABLE_MESSAGE,
   __resetVectorCache: () => __resetVectorCache,
   findKey: () => findKey,
+  invalidateRequestSigningVectorCache: () => invalidateRequestSigningVectorCache,
   loadA2aOperationResolutionVectors: () => loadA2aOperationResolutionVectors,
   loadRequestSigningKeys: () => loadRequestSigningKeys,
   loadRequestSigningVectors: () => loadRequestSigningVectors,
@@ -95,6 +96,15 @@ function loadRequestSigningKeys(options = {}) {
   const cacheDir = (0, import_compliance.getComplianceCacheDir)(options);
   return loadKeys((0, import_path.join)(cacheDir, "test-vectors", "request-signing", "keys.json"));
 }
+function invalidateRequestSigningVectorCache(complianceDir) {
+  const sourceDir = (0, import_path.resolve)(complianceDir, "test-vectors", "request-signing");
+  for (const key of VECTOR_CACHE.keys()) {
+    if ((0, import_path.resolve)(key) === sourceDir) VECTOR_CACHE.delete(key);
+  }
+  for (const key of A2A_VECTOR_CACHE.keys()) {
+    if ((0, import_path.resolve)(key) === (0, import_path.join)(sourceDir, "a2a")) A2A_VECTOR_CACHE.delete(key);
+  }
+}
 function __resetVectorCache() {
   VECTOR_CACHE.clear();
   A2A_VECTOR_CACHE.clear();
@@ -384,6 +394,7 @@ function strArray(v, where) {
   A2A_VECTORS_UNAVAILABLE_MESSAGE,
   __resetVectorCache,
   findKey,
+  invalidateRequestSigningVectorCache,
   loadA2aOperationResolutionVectors,
   loadRequestSigningKeys,
   loadRequestSigningVectors,

package/dist/lib/testing/storyboard/request-signing/vector-loader.mjs

@@ -69,6 +69,15 @@ function loadRequestSigningKeys(options = {}) {
   const cacheDir = getComplianceCacheDir(options);
   return loadKeys(join(cacheDir, "test-vectors", "request-signing", "keys.json"));
 }
+function invalidateRequestSigningVectorCache(complianceDir) {
+  const sourceDir = resolve(complianceDir, "test-vectors", "request-signing");
+  for (const key of VECTOR_CACHE.keys()) {
+    if (resolve(key) === sourceDir) VECTOR_CACHE.delete(key);
+  }
+  for (const key of A2A_VECTOR_CACHE.keys()) {
+    if (resolve(key) === join(sourceDir, "a2a")) A2A_VECTOR_CACHE.delete(key);
+  }
+}
 function __resetVectorCache() {
   VECTOR_CACHE.clear();
   A2A_VECTOR_CACHE.clear();
@@ -357,6 +366,7 @@ export {
   A2A_VECTORS_UNAVAILABLE_MESSAGE,
   __resetVectorCache,
   findKey,
+  invalidateRequestSigningVectorCache,
   loadA2aOperationResolutionVectors,
   loadRequestSigningKeys,
   loadRequestSigningVectors,

package/dist/lib/testing/storyboard/runner.js

@@ -61,6 +61,9 @@ __export(runner_exports, {
   summarizeStrictValidation: () => summarizeStrictValidation
 });
 module.exports = __toCommonJS(runner_exports);
+var import_web_bot_auth = require('./web-bot-auth.js');
+var import_web_bot_auth2 = require('../../signing/web-bot-auth.js');
+var import_agent_transport_fetch = require('../../net/agent-transport-fetch.js');
 var import_node_crypto = require("node:crypto");
 var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
@@ -2206,6 +2209,19 @@ function resolveBindingAccountScope(storyboard, options) {
 }
 function resolveBindingCredential(options, step) {
   const parts = [];
+  if (options.web_bot_auth) {
+    parts.push(`wba_target:${JSON.stringify(options.web_bot_auth.publicUrl ?? null)}`);
+    for (const [name, identity] of Object.entries(options.web_bot_auth.identities).sort(
+      ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
+    )) {
+      try {
+        const jwk = "privateKey" in identity.key ? identity.key.privateKey : identity.key.publicKey;
+        parts.push(`wba_identity:${JSON.stringify([name, identity.origin, (0, import_web_bot_auth2.jwkThumbprint)(jwk)])}`);
+      } catch {
+        parts.push(`wba_identity:${JSON.stringify([name, "invalid"])}`);
+      }
+    }
+  }
   if (step?.auth !== void 0) {
     parts.push(`step_auth:${JSON.stringify(describeStepAuthDirective(step.auth))}`);
   }
@@ -4867,7 +4883,7 @@ function buildStepRequest(step, effectiveStep, context, options, runnerVars) {
   const governedFixture = payloadBoundGovernance && effectiveStep.task !== "check_governance" && effectiveStep.task !== "report_plan_outcome" && (governedSource !== void 0 && Object.prototype.hasOwnProperty.call(governedSource, "governance_context") || contextGovernance);
   if (options.request) {
     request = (0, import_context.injectContext)({ ...options.request }, context, runnerVars);
-  } else if (step.expect_error && step.sample_request) {
+  } else if (step.expect_error && step.sample_request && step.enrich_request !== true) {
     request = (0, import_context.injectContext)({ ...step.sample_request }, context, runnerVars);
   } else if (governedFixture) {
     request = (0, import_context.injectContext)({ ...step.sample_request ?? {} }, context, runnerVars);
@@ -5242,18 +5258,49 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && (0, import_idempotency.requestUsesIdempotency)(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
-  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
+  const useWebBotAuth = typeof step.auth === "object" && step.auth.type === "web_bot_auth";
+  const useSdkAuthOverride = useWebBotAuth || typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
   let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    let signedFetch;
+    if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+      if ((step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check)))
+        throw new Error(
+          "web_bot_auth steps require tool-response validations; HTTP probe assertions are not supported"
+        );
+      if (options.web_bot_auth?.publicUrl && options.protocol === "a2a")
+        throw new Error("web_bot_auth.publicUrl loopback delivery supports MCP only; use HTTPS directly for A2A");
+      if (!options.web_bot_auth?.publicUrl && new URL(runState.agentUrl).protocol !== "https:")
+        throw new Error("web_bot_auth.publicUrl is required to sign for a non-HTTPS agent");
+      const name = step.auth.identity;
+      const identities = options.web_bot_auth?.identities;
+      const identity = identities && Object.hasOwn(identities, name) ? identities[name] : void 0;
+      if (!identity) throw new Error("web_bot_auth identity is not configured in options.web_bot_auth.identities");
+      signedFetch = (0, import_web_bot_auth.createStoryboardWebBotAuthFetch)(
+        (0, import_agent_transport_fetch.createAgentTransportFetch)(runState.agentUrl, {
+          trustedFetchFn: options.transport?.trustedFetchFn,
+          allowPrivateIp: options.transport?.allowPrivateIp
+        }),
+        identity.key,
+        {
+          agentUrl: runState.agentUrl,
+          origin: identity.origin,
+          ...options.web_bot_auth?.publicUrl && {
+            target: { publicUrl: options.web_bot_auth.publicUrl, loopbackUrl: runState.agentUrl }
+          }
+        }
+      );
+    }
     if (useSdkAuthOverride) {
       if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
       authOverrideClient = createAuthOverrideClient(
         runState.agentUrl,
         options.protocol ?? "mcp",
         options,
-        rawProbeHeaders
+        rawProbeHeaders,
+        signedFetch
       );
     }
   } catch (err) {
@@ -5547,7 +5594,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     runState.agentProfile?.raw_capabilities,
     "request_signing.required_for"
   );
-  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && runState.storyboardRequiresRequestSigner !== true) {
+  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && !useWebBotAuth && runState.storyboardRequiresRequestSigner !== true) {
     const next2 = getNextStepPreview(step.id, allSteps, context, runState.runnerVars);
     const detail = `Agent declared request_signing.required_for includes "${effectiveStep.task}" and rejected the unsigned request with request_signature_required; storyboard "${storyboardId}" does not require request_signer.`;
     return {
@@ -7679,6 +7726,8 @@ function selectProtectedToolTarget(tools) {
 function sessionControlMechanismFor(auth) {
   if (auth === "none") return "any";
   switch (auth.type) {
+    case "web_bot_auth":
+      throw new Error("web_bot_auth is not supported by session probes");
     case "oauth_bearer":
       return "oauth_bearer";
     case "basic":
@@ -7704,6 +7753,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
       )
     };
   }
+  if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+    return { kind: "error", error: "web_bot_auth is not supported by MCP session probes; select an AdCP tool step" };
+  }
   const signatureBound = signatureBoundTools(options);
   const candidates = protectedToolCandidates(options.agentTools);
   if (signatureBound === "unparseable") {
@@ -7763,7 +7815,7 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   };
 }
 function authHeadersForStep(directive, options) {
-  if (directive === "none") return {};
+  if (directive === "none" || directive.type === "web_bot_auth") return {};
   if (directive.type === "basic") return basicAuthHeadersForStep(directive, options);
   let value;
   if ("value" in directive && directive.value) {
@@ -7811,7 +7863,7 @@ function isCredentialHeaderName(name) {
   if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
   return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders, signedFetch) {
   const runSecrets = runCredentialValues(options);
   const headers = {};
   for (const [name, value] of Object.entries(options.headers ?? {})) {
@@ -7842,6 +7894,7 @@ function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
     test_kit: void 0,
     _client: void 0,
     functional_request_signing: void 0,
+    ...signedFetch && { transport: { ...options.transport, trustedFetchFn: signedFetch } },
     headers: Object.keys(headers).length > 0 ? headers : void 0
   });
 }

package/dist/lib/testing/storyboard/runner.mjs

@@ -1,3 +1,6 @@
+import { createStoryboardWebBotAuthFetch } from "./web-bot-auth.mjs";
+import { jwkThumbprint } from "../../signing/web-bot-auth.mjs";
+import { createAgentTransportFetch } from "../../net/agent-transport-fetch.mjs";
 import { createHash, createHmac } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, join } from "node:path";
@@ -2248,6 +2251,19 @@ function resolveBindingAccountScope(storyboard, options) {
 }
 function resolveBindingCredential(options, step) {
   const parts = [];
+  if (options.web_bot_auth) {
+    parts.push(`wba_target:${JSON.stringify(options.web_bot_auth.publicUrl ?? null)}`);
+    for (const [name, identity] of Object.entries(options.web_bot_auth.identities).sort(
+      ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
+    )) {
+      try {
+        const jwk = "privateKey" in identity.key ? identity.key.privateKey : identity.key.publicKey;
+        parts.push(`wba_identity:${JSON.stringify([name, identity.origin, jwkThumbprint(jwk)])}`);
+      } catch {
+        parts.push(`wba_identity:${JSON.stringify([name, "invalid"])}`);
+      }
+    }
+  }
   if (step?.auth !== void 0) {
     parts.push(`step_auth:${JSON.stringify(describeStepAuthDirective(step.auth))}`);
   }
@@ -4909,7 +4925,7 @@ function buildStepRequest(step, effectiveStep, context, options, runnerVars) {
   const governedFixture = payloadBoundGovernance && effectiveStep.task !== "check_governance" && effectiveStep.task !== "report_plan_outcome" && (governedSource !== void 0 && Object.prototype.hasOwnProperty.call(governedSource, "governance_context") || contextGovernance);
   if (options.request) {
     request = injectContext({ ...options.request }, context, runnerVars);
-  } else if (step.expect_error && step.sample_request) {
+  } else if (step.expect_error && step.sample_request && step.enrich_request !== true) {
     request = injectContext({ ...step.sample_request }, context, runnerVars);
   } else if (governedFixture) {
     request = injectContext({ ...step.sample_request ?? {} }, context, runnerVars);
@@ -5284,18 +5300,49 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && requestUsesIdempotency(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
-  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
+  const useWebBotAuth = typeof step.auth === "object" && step.auth.type === "web_bot_auth";
+  const useSdkAuthOverride = useWebBotAuth || typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
   let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    let signedFetch;
+    if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+      if ((step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check)))
+        throw new Error(
+          "web_bot_auth steps require tool-response validations; HTTP probe assertions are not supported"
+        );
+      if (options.web_bot_auth?.publicUrl && options.protocol === "a2a")
+        throw new Error("web_bot_auth.publicUrl loopback delivery supports MCP only; use HTTPS directly for A2A");
+      if (!options.web_bot_auth?.publicUrl && new URL(runState.agentUrl).protocol !== "https:")
+        throw new Error("web_bot_auth.publicUrl is required to sign for a non-HTTPS agent");
+      const name = step.auth.identity;
+      const identities = options.web_bot_auth?.identities;
+      const identity = identities && Object.hasOwn(identities, name) ? identities[name] : void 0;
+      if (!identity) throw new Error("web_bot_auth identity is not configured in options.web_bot_auth.identities");
+      signedFetch = createStoryboardWebBotAuthFetch(
+        createAgentTransportFetch(runState.agentUrl, {
+          trustedFetchFn: options.transport?.trustedFetchFn,
+          allowPrivateIp: options.transport?.allowPrivateIp
+        }),
+        identity.key,
+        {
+          agentUrl: runState.agentUrl,
+          origin: identity.origin,
+          ...options.web_bot_auth?.publicUrl && {
+            target: { publicUrl: options.web_bot_auth.publicUrl, loopbackUrl: runState.agentUrl }
+          }
+        }
+      );
+    }
     if (useSdkAuthOverride) {
       if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
       authOverrideClient = createAuthOverrideClient(
         runState.agentUrl,
         options.protocol ?? "mcp",
         options,
-        rawProbeHeaders
+        rawProbeHeaders,
+        signedFetch
       );
     }
   } catch (err) {
@@ -5589,7 +5636,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     runState.agentProfile?.raw_capabilities,
     "request_signing.required_for"
   );
-  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && runState.storyboardRequiresRequestSigner !== true) {
+  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && !useWebBotAuth && runState.storyboardRequiresRequestSigner !== true) {
     const next2 = getNextStepPreview(step.id, allSteps, context, runState.runnerVars);
     const detail = `Agent declared request_signing.required_for includes "${effectiveStep.task}" and rejected the unsigned request with request_signature_required; storyboard "${storyboardId}" does not require request_signer.`;
     return {
@@ -7721,6 +7768,8 @@ function selectProtectedToolTarget(tools) {
 function sessionControlMechanismFor(auth) {
   if (auth === "none") return "any";
   switch (auth.type) {
+    case "web_bot_auth":
+      throw new Error("web_bot_auth is not supported by session probes");
     case "oauth_bearer":
       return "oauth_bearer";
     case "basic":
@@ -7746,6 +7795,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
       )
     };
   }
+  if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+    return { kind: "error", error: "web_bot_auth is not supported by MCP session probes; select an AdCP tool step" };
+  }
   const signatureBound = signatureBoundTools(options);
   const candidates = protectedToolCandidates(options.agentTools);
   if (signatureBound === "unparseable") {
@@ -7805,7 +7857,7 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   };
 }
 function authHeadersForStep(directive, options) {
-  if (directive === "none") return {};
+  if (directive === "none" || directive.type === "web_bot_auth") return {};
   if (directive.type === "basic") return basicAuthHeadersForStep(directive, options);
   let value;
   if ("value" in directive && directive.value) {
@@ -7853,7 +7905,7 @@ function isCredentialHeaderName(name) {
   if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
   return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders, signedFetch) {
   const runSecrets = runCredentialValues(options);
   const headers = {};
   for (const [name, value] of Object.entries(options.headers ?? {})) {
@@ -7884,6 +7936,7 @@ function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
     test_kit: void 0,
     _client: void 0,
     functional_request_signing: void 0,
+    ...signedFetch && { transport: { ...options.transport, trustedFetchFn: signedFetch } },
     headers: Object.keys(headers).length > 0 ? headers : void 0
   });
 }

package/dist/lib/testing/storyboard/types.d.mts

@@ -704,6 +704,10 @@ export interface ContextInput {
 export type StepAuthDirective = 
 /** Strip transport credentials entirely. The step MUST hit the agent unauthenticated. */
 'none' | {
+    type: 'web_bot_auth';
+    /** Name in the runner's runtime-only `web_bot_auth.identities` map. */
+    identity: string;
+} | {
     type: 'api_key';
     /** Literal Bearer value sent as `Authorization: Bearer <value>`. */
     value?: string;
@@ -838,6 +842,11 @@ export interface StoryboardStep {
      * seller; schema validation remains enabled for `payload_well_formed`.
      */
     negative_path?: 'schema_invalid' | 'payload_well_formed';
+    /** Opt a schema-valid semantic rejection probe into normal request enrichment.
+     * Explicit fixture values remain authoritative. Invalid-input probes must
+     * retain the default, which sends the authored request without enrichment.
+     */
+    enrich_request?: true;
     /**
      * Per-step invariant opt-out. See `StepInvariantsObject`. Use when a
      * specific step deliberately trips a default invariant (e.g. a
@@ -1694,6 +1703,15 @@ export interface PrepareStoryboardFixturesOptions extends StoryboardRunOptions {
     prepared_fixtures_preparation_authorizer?: PreparedFixturesPreparationAuthorizer;
 }
 export interface StoryboardRunOptions extends TestOptions {
+    /** Runtime signing keys; storyboard YAML contains only identity names. */
+    web_bot_auth?: {
+        identities: Record<string, {
+            origin: string;
+            key: import('../../signing/web-bot-auth.mjs').WebBotSigningKey;
+        }>;
+        /** Sign this public HTTPS endpoint, delivering to the loopback agent URL. */
+        publicUrl?: string;
+    };
     /** Compliance cache root for bundle-scoped fixtures and test vectors. */
     complianceDir?: string;
     /**

package/dist/lib/testing/storyboard/types.d.ts

@@ -704,6 +704,10 @@ export interface ContextInput {
 export type StepAuthDirective = 
 /** Strip transport credentials entirely. The step MUST hit the agent unauthenticated. */
 'none' | {
+    type: 'web_bot_auth';
+    /** Name in the runner's runtime-only `web_bot_auth.identities` map. */
+    identity: string;
+} | {
     type: 'api_key';
     /** Literal Bearer value sent as `Authorization: Bearer <value>`. */
     value?: string;
@@ -838,6 +842,11 @@ export interface StoryboardStep {
      * seller; schema validation remains enabled for `payload_well_formed`.
      */
     negative_path?: 'schema_invalid' | 'payload_well_formed';
+    /** Opt a schema-valid semantic rejection probe into normal request enrichment.
+     * Explicit fixture values remain authoritative. Invalid-input probes must
+     * retain the default, which sends the authored request without enrichment.
+     */
+    enrich_request?: true;
     /**
      * Per-step invariant opt-out. See `StepInvariantsObject`. Use when a
      * specific step deliberately trips a default invariant (e.g. a
@@ -1694,6 +1703,15 @@ export interface PrepareStoryboardFixturesOptions extends StoryboardRunOptions {
     prepared_fixtures_preparation_authorizer?: PreparedFixturesPreparationAuthorizer;
 }
 export interface StoryboardRunOptions extends TestOptions {
+    /** Runtime signing keys; storyboard YAML contains only identity names. */
+    web_bot_auth?: {
+        identities: Record<string, {
+            origin: string;
+            key: import('../../signing/web-bot-auth').WebBotSigningKey;
+        }>;
+        /** Sign this public HTTPS endpoint, delivering to the loopback agent URL. */
+        publicUrl?: string;
+    };
     /** Compliance cache root for bundle-scoped fixtures and test vectors. */
     complianceDir?: string;
     /**

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.1";
+export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.3";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.1";
+export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.3";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/web-bot-auth.d.mts

@@ -0,0 +1,10 @@
+import { type WebBotSigningKey, type WebBotSigningOptions } from '../../signing/web-bot-auth.mjs';
+/** Sign the public HTTPS target while the official transport delivers to loopback. */
+export declare function createStoryboardWebBotAuthFetch(upstream: typeof fetch, key: WebBotSigningKey, options: WebBotSigningOptions & {
+    /** Pin the destination origin for direct HTTPS delivery. */
+    agentUrl?: string;
+    target?: {
+        publicUrl: string;
+        loopbackUrl: string;
+    };
+}): typeof fetch;

package/dist/lib/testing/storyboard/web-bot-auth.d.ts

@@ -0,0 +1,10 @@
+import { type WebBotSigningKey, type WebBotSigningOptions } from '../../signing/web-bot-auth';
+/** Sign the public HTTPS target while the official transport delivers to loopback. */
+export declare function createStoryboardWebBotAuthFetch(upstream: typeof fetch, key: WebBotSigningKey, options: WebBotSigningOptions & {
+    /** Pin the destination origin for direct HTTPS delivery. */
+    agentUrl?: string;
+    target?: {
+        publicUrl: string;
+        loopbackUrl: string;
+    };
+}): typeof fetch;