@adcp/sdk 17.0.0-beta.2 → 17.0.0-beta.3

package/dist/lib/testing/index.d.ts

@@ -23,3 +23,4 @@ export { COLLECTION_DIAGNOSTIC_LIMIT, COLLECTION_PAIR_LIMIT, COLLECTION_TARGETIN
 export type { CollectionNormalizationCode, CollectionNormalizationFailure, CollectionNormalizationResult, CrossPublisherCollectionRelation, CollectionPair, CollectionSelectionEvaluation, CollectionSelectionSelector, CollectionSelectionWitness, CollectionSelectorObject, CollectionWitnessKind, CollectionWitnessReadResult, FixtureContextOutput, NormalizedCollectionSelectors, PreparedFixtureBinding, PreparedFixtureSelection, PreparedFixturesAuthorizer, PreparedFixturesDecision, PreparedFixturesDisposition, PreparedFixturesLookup, PreparedFixturesPreparationLookup, PreparedFixturesPreparationAuthorizer, PreparedFixturesRefusal, PreparedFixturesRefusalCode, PreparedFixturesReference, PreparedSchemaArtifact, ProtectedContextViolationCode, ResolvedCollectionSelectionSelector, } from './storyboard';
 export { resolveCreativeBuildProbe, validateCreativeBuildProbeSpec } from './storyboard';
 export type { CreativeBuildProbeSpec, CreativeBuildProbeInputFixture, CreativeBuildProbeResolution, } from './storyboard';
+export { createStoryboardWebBotAuthFetch } from './storyboard/web-bot-auth';

package/dist/lib/testing/index.js

@@ -67,6 +67,7 @@ __export(testing_exports, {
   comply: () => import_compliance.comply,
   createComplyController: () => import_comply_controller.createComplyController,
   createSeedFixtureCache: () => import_test_controller.createSeedFixtureCache,
+  createStoryboardWebBotAuthFetch: () => import_web_bot_auth.createStoryboardWebBotAuthFetch,
   createTestAgent: () => import_test_helpers.createTestAgent,
   createTestClient: () => import_agent_tester.createTestClient,
   creativeAgent: () => import_test_helpers.creativeAgent,
@@ -234,6 +235,7 @@ var import_validation = require('../validation/index.js');
 var import_storyboard = require('./storyboard/index.js');
 var import_storyboard2 = require('./storyboard/index.js');
 var import_storyboard3 = require('./storyboard/index.js');
+var import_web_bot_auth = require('./storyboard/web-bot-auth.js');
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AdagentsJsonSchema,
@@ -285,6 +287,7 @@ var import_storyboard3 = require('./storyboard/index.js');
   comply,
   createComplyController,
   createSeedFixtureCache,
+  createStoryboardWebBotAuthFetch,
   createTestAgent,
   createTestClient,
   creativeAgent,

package/dist/lib/testing/index.mjs

@@ -212,6 +212,7 @@ import {
   withPreparedFixtures
 } from "./storyboard/index.mjs";
 import { resolveCreativeBuildProbe, validateCreativeBuildProbeSpec } from "./storyboard/index.mjs";
+import { createStoryboardWebBotAuthFetch } from "./storyboard/web-bot-auth.mjs";
 export {
   AdagentsJsonSchema,
   BrandJsonSchema,
@@ -262,6 +263,7 @@ export {
   comply,
   createComplyController,
   createSeedFixtureCache,
+  createStoryboardWebBotAuthFetch,
   createTestAgent,
   createTestClient,
   creativeAgent,

package/dist/lib/testing/storyboard/canonical-format-satisfaction.js

@@ -47,13 +47,6 @@ const HANDLED_CANONICAL_PARAM_KEYS = /* @__PURE__ */ new Set([
   "duration_ms_range"
 ]);
 const ARRAY_SUBSET_PARAM_KEYS = /* @__PURE__ */ new Set(["video_codecs", "audio_codecs", "mime_types", "file_types", "formats"]);
-const OMITTABLE_DECLARATION_PARAMS = /* @__PURE__ */ new Set([
-  "asset_source",
-  "buyer_asset_acceptance",
-  "composition_model",
-  "slots",
-  "ssl_required"
-]);
 function validateCanonicalFormatSatisfaction(validation, request, context, taskResult) {
   if (typeof validation.value !== "boolean") {
     return {
@@ -484,14 +477,7 @@ function requireRemainingParamContainment(productParams, requestParams) {
   for (const [key, productValue] of Object.entries(productParams)) {
     if (HANDLED_CANONICAL_PARAM_KEYS.has(key) || productValue === void 0) continue;
     if (Array.isArray(productValue) && productValue.length === 0) continue;
-    if (requestParams[key] === void 0) {
-      if (OMITTABLE_DECLARATION_PARAMS.has(key)) continue;
-      return {
-        ok: false,
-        bug_class: "directionality",
-        detail: `Under-specified selector: product constrains params.${key}, but the request selector omits ${key}`
-      };
-    }
+    if (requestParams[key] === void 0) continue;
     const requestValue = requestParams[key];
     if (ARRAY_SUBSET_PARAM_KEYS.has(key)) {
       const subset = requireArraySubset(key, productValue, requestValue);

package/dist/lib/testing/storyboard/canonical-format-satisfaction.mjs

@@ -23,13 +23,6 @@ const HANDLED_CANONICAL_PARAM_KEYS = /* @__PURE__ */ new Set([
   "duration_ms_range"
 ]);
 const ARRAY_SUBSET_PARAM_KEYS = /* @__PURE__ */ new Set(["video_codecs", "audio_codecs", "mime_types", "file_types", "formats"]);
-const OMITTABLE_DECLARATION_PARAMS = /* @__PURE__ */ new Set([
-  "asset_source",
-  "buyer_asset_acceptance",
-  "composition_model",
-  "slots",
-  "ssl_required"
-]);
 function validateCanonicalFormatSatisfaction(validation, request, context, taskResult) {
   if (typeof validation.value !== "boolean") {
     return {
@@ -460,14 +453,7 @@ function requireRemainingParamContainment(productParams, requestParams) {
   for (const [key, productValue] of Object.entries(productParams)) {
     if (HANDLED_CANONICAL_PARAM_KEYS.has(key) || productValue === void 0) continue;
     if (Array.isArray(productValue) && productValue.length === 0) continue;
-    if (requestParams[key] === void 0) {
-      if (OMITTABLE_DECLARATION_PARAMS.has(key)) continue;
-      return {
-        ok: false,
-        bug_class: "directionality",
-        detail: `Under-specified selector: product constrains params.${key}, but the request selector omits ${key}`
-      };
-    }
+    if (requestParams[key] === void 0) continue;
     const requestValue = requestParams[key];
     if (ARRAY_SUBSET_PARAM_KEYS.has(key)) {
       const subset = requireArraySubset(key, productValue, requestValue);

package/dist/lib/testing/storyboard/index.d.mts

@@ -6,6 +6,7 @@
  * The canonical storyboard set lives in the AdCP compliance tarball
  * and is pulled into `compliance/cache/{version}/` via `npm run sync-schemas`.
  */
+export { createStoryboardWebBotAuthFetch } from './web-bot-auth.mjs';
 export type { A2ATaskEnvelope, AgentEntry, Storyboard, StoryboardFixtureResolution, FixtureResolutionStrategy, FixtureMatchOperator, FixtureMatchClause, FixtureResolutionDeclaration, ProductFixtureResolutionDeclaration, PricingOptionFixtureResolutionDeclaration, FixtureResolutionStatus, FixtureResolutionRecord, FixtureResolutionAttempt, FixtureResolutionEvidence, FixtureResolutionCoverageGap, StoryboardInvariants, StoryboardInvariantsObject, StepInvariantsObject, StoryboardPhase, StoryboardStep, RateLimitTripSpec, StoryboardValidation, StoryboardValidationCheck, WebhookFilterSpec, WebhookRetryTriggerSpec, WebhookAssertionErrorCode, ContextOutput, ContextInput, ContextProvenanceEntry, ContextValueRejectedHint, ShapeDriftHint, MissingRequiredFieldHint, FormatMismatchHint, MonotonicViolationHint, ImpairmentCoherenceHint, ImpairmentCoherenceNotApplicableHint, StoryboardContext, StoryboardRunOptions, PrepareStoryboardFixturesOptions, TrustedMatchContextProviderEndpoint, TrustedMatchContextRegistrationContext, TrustedMatchContextRouterRunnerOptions, TrustedMatchPublisherAuthOperation, TrustedMatchPublisherCredentialState, TrustedMatchPublisherAuthTls, TrustedMatchPublisherAuthProbeConfiguration, TrustedMatchPublisherAuthRunner, ValidationResult, StoryboardStepPreview, StoryboardStepResult, StoryboardStepHint, StoryboardStepHintBase, StoryboardPhaseResult, StoryboardResult, AssertionResult, StrictValidationSummary, StrictValidationVerdict, UpstreamTrafficPayloadMatch, RunnerNotice, NoticeCode, NoticeSeverity, } from './types.mjs';
 export { WEBHOOK_IDEMPOTENCY_KEY_PATTERN } from './types.mjs';
 export { MCP_SESSION_PROBE_TASK } from './types.mjs';

package/dist/lib/testing/storyboard/index.d.ts

@@ -6,6 +6,7 @@
  * The canonical storyboard set lives in the AdCP compliance tarball
  * and is pulled into `compliance/cache/{version}/` via `npm run sync-schemas`.
  */
+export { createStoryboardWebBotAuthFetch } from './web-bot-auth';
 export type { A2ATaskEnvelope, AgentEntry, Storyboard, StoryboardFixtureResolution, FixtureResolutionStrategy, FixtureMatchOperator, FixtureMatchClause, FixtureResolutionDeclaration, ProductFixtureResolutionDeclaration, PricingOptionFixtureResolutionDeclaration, FixtureResolutionStatus, FixtureResolutionRecord, FixtureResolutionAttempt, FixtureResolutionEvidence, FixtureResolutionCoverageGap, StoryboardInvariants, StoryboardInvariantsObject, StepInvariantsObject, StoryboardPhase, StoryboardStep, RateLimitTripSpec, StoryboardValidation, StoryboardValidationCheck, WebhookFilterSpec, WebhookRetryTriggerSpec, WebhookAssertionErrorCode, ContextOutput, ContextInput, ContextProvenanceEntry, ContextValueRejectedHint, ShapeDriftHint, MissingRequiredFieldHint, FormatMismatchHint, MonotonicViolationHint, ImpairmentCoherenceHint, ImpairmentCoherenceNotApplicableHint, StoryboardContext, StoryboardRunOptions, PrepareStoryboardFixturesOptions, TrustedMatchContextProviderEndpoint, TrustedMatchContextRegistrationContext, TrustedMatchContextRouterRunnerOptions, TrustedMatchPublisherAuthOperation, TrustedMatchPublisherCredentialState, TrustedMatchPublisherAuthTls, TrustedMatchPublisherAuthProbeConfiguration, TrustedMatchPublisherAuthRunner, ValidationResult, StoryboardStepPreview, StoryboardStepResult, StoryboardStepHint, StoryboardStepHintBase, StoryboardPhaseResult, StoryboardResult, AssertionResult, StrictValidationSummary, StrictValidationVerdict, UpstreamTrafficPayloadMatch, RunnerNotice, NoticeCode, NoticeSeverity, } from './types';
 export { WEBHOOK_IDEMPOTENCY_KEY_PATTERN } from './types';
 export { MCP_SESSION_PROBE_TASK } from './types';

package/dist/lib/testing/storyboard/index.js

@@ -60,6 +60,7 @@ __export(storyboard_exports, {
   clearSandboxCache: () => import_sandbox_entities.clearSandboxCache,
   compareCollectionPairs: () => import_collection_selection.compareCollectionPairs,
   createRunnerVariables: () => import_context.createRunnerVariables,
+  createStoryboardWebBotAuthFetch: () => import_web_bot_auth.createStoryboardWebBotAuthFetch,
   createWebhookReceiver: () => import_webhook_receiver.createWebhookReceiver,
   describeStoryboardCapabilityGates: () => import_runner.describeStoryboardCapabilityGates,
   detectContextRejectionHints: () => import_rejection_hints.detectContextRejectionHints,
@@ -136,6 +137,7 @@ __export(storyboard_exports, {
 });
 module.exports = __toCommonJS(storyboard_exports);
 var import_default_invariants = require('./default-invariants.js');
+var import_web_bot_auth = require('./web-bot-auth.js');
 var import_types = require('./types.js');
 var import_types2 = require('./types.js');
 var import_assertions = require('./assertions.js');
@@ -207,6 +209,7 @@ var import_creative_build_probe = require('./creative-build-probe.js');
   clearSandboxCache,
   compareCollectionPairs,
   createRunnerVariables,
+  createStoryboardWebBotAuthFetch,
   createWebhookReceiver,
   describeStoryboardCapabilityGates,
   detectContextRejectionHints,

package/dist/lib/testing/storyboard/index.mjs

@@ -1,5 +1,6 @@
 import { registerDefaultInvariants } from "./default-invariants.mjs";
 registerDefaultInvariants();
+import { createStoryboardWebBotAuthFetch } from "./web-bot-auth.mjs";
 import { WEBHOOK_IDEMPOTENCY_KEY_PATTERN } from "./types.mjs";
 import { MCP_SESSION_PROBE_TASK } from "./types.mjs";
 import {
@@ -164,6 +165,7 @@ export {
   clearSandboxCache,
   compareCollectionPairs,
   createRunnerVariables,
+  createStoryboardWebBotAuthFetch,
   createWebhookReceiver,
   describeStoryboardCapabilityGates,
   detectContextRejectionHints,

package/dist/lib/testing/storyboard/loader.js

@@ -96,6 +96,13 @@ function validateStoryboardShape(storyboard) {
     validateBranchSet(storyboard.id, phase);
     if (!phase.steps) continue;
     for (const step of phase.steps) {
+      if (step.enrich_request !== void 0 && (step.enrich_request !== true || !step.expect_error || step.negative_path !== "payload_well_formed")) {
+        throw new Error(
+          `[${storyboard.id}] ${step.id}: enrich_request requires expect_error: true and negative_path: payload_well_formed`
+        );
+      }
+      if (typeof step.auth === "object" && step.auth.type === "web_bot_auth" && (typeof step.auth.identity !== "string" || step.auth.identity.trim().length === 0))
+        throw new Error(`[${storyboard.id}] ${step.id}: web_bot_auth requires an identity name`);
       const rawStep = step;
       if (rawStep.task === void 0) {
         if (!Array.isArray(rawStep.validations) || rawStep.validations.length === 0) {

package/dist/lib/testing/storyboard/loader.mjs

@@ -68,6 +68,13 @@ function validateStoryboardShape(storyboard) {
     validateBranchSet(storyboard.id, phase);
     if (!phase.steps) continue;
     for (const step of phase.steps) {
+      if (step.enrich_request !== void 0 && (step.enrich_request !== true || !step.expect_error || step.negative_path !== "payload_well_formed")) {
+        throw new Error(
+          `[${storyboard.id}] ${step.id}: enrich_request requires expect_error: true and negative_path: payload_well_formed`
+        );
+      }
+      if (typeof step.auth === "object" && step.auth.type === "web_bot_auth" && (typeof step.auth.identity !== "string" || step.auth.identity.trim().length === 0))
+        throw new Error(`[${storyboard.id}] ${step.id}: web_bot_auth requires an identity name`);
       const rawStep = step;
       if (rawStep.task === void 0) {
         if (!Array.isArray(rawStep.validations) || rawStep.validations.length === 0) {

package/dist/lib/testing/storyboard/request-builder.js

@@ -248,12 +248,15 @@ const REQUEST_ENRICHERS = {
       budget: (typeof baseSample.budget === "number" ? baseSample.budget : void 0) ?? options.budget ?? Math.max(1e3, pricingOption?.min_spend_per_package ?? 1e3),
       pricing_option_id: fixturePricingOptionId ?? pricingOption?.pricing_option_id ?? context.pricing_option_id ?? "test-pricing"
     };
-    const sentPricingOption = fixtureProductId === void 0 && fixturePricingOptionId === void 0 ? pricingOption : findPricingOption(context, firstPkg.product_id, firstPkg.pricing_option_id);
-    if (baseSample.bid_price === void 0 && baseSample.bidding === void 0 && step.sample_request?.bidding === void 0 && sentPricingOption?.pricing_model === "cpm" && !(0, import_pricing_adapter.isFixedPricing)(sentPricingOption)) {
-      const floor = Number(sentPricingOption.floor_price) || 5;
-      firstPkg.bid_price = Math.round(floor * 1.5 * 100) / 100;
-    }
     const additionalPkgs = samplePackages.slice(1).map((p) => (0, import_context.injectContext)({ ...p }, context));
+    const packages = [firstPkg, ...additionalPkgs];
+    for (const pkg of packages) {
+      const sentPricingOption = pkg === firstPkg && fixtureProductId === void 0 && fixturePricingOptionId === void 0 ? pricingOption : findPricingOption(context, pkg.product_id, pkg.pricing_option_id);
+      if (pkg.bid_price === void 0 && pkg.bidding === void 0 && step.sample_request?.bidding === void 0 && sentPricingOption?.pricing_model === "cpm" && !(0, import_pricing_adapter.isFixedPricing)(sentPricingOption)) {
+        const floor = Number(sentPricingOption.floor_price) || 5;
+        pkg.bid_price = Math.round(floor * 1.5 * 100) / 100;
+      }
+    }
     const fixture = step.sample_request !== void 0 ? (0, import_context.injectContext)({ ...step.sample_request }, context) : {};
     const fixtureBody = omitEnvelopeFields(fixture);
     const fixtureHasPackages = Array.isArray(fixture.packages) && fixture.packages.length > 0;
@@ -275,7 +278,7 @@ const REQUEST_ENRICHERS = {
       brand: (0, import_client.resolveBrand)(options),
       start_time: startTime,
       end_time: endTime,
-      packages: [firstPkg, ...additionalPkgs]
+      packages
     };
   },
   update_media_buy(step, context, options) {

package/dist/lib/testing/storyboard/request-builder.mjs

@@ -222,12 +222,15 @@ const REQUEST_ENRICHERS = {
       budget: (typeof baseSample.budget === "number" ? baseSample.budget : void 0) ?? options.budget ?? Math.max(1e3, pricingOption?.min_spend_per_package ?? 1e3),
       pricing_option_id: fixturePricingOptionId ?? pricingOption?.pricing_option_id ?? context.pricing_option_id ?? "test-pricing"
     };
-    const sentPricingOption = fixtureProductId === void 0 && fixturePricingOptionId === void 0 ? pricingOption : findPricingOption(context, firstPkg.product_id, firstPkg.pricing_option_id);
-    if (baseSample.bid_price === void 0 && baseSample.bidding === void 0 && step.sample_request?.bidding === void 0 && sentPricingOption?.pricing_model === "cpm" && !isFixedPricing(sentPricingOption)) {
-      const floor = Number(sentPricingOption.floor_price) || 5;
-      firstPkg.bid_price = Math.round(floor * 1.5 * 100) / 100;
-    }
     const additionalPkgs = samplePackages.slice(1).map((p) => injectContext({ ...p }, context));
+    const packages = [firstPkg, ...additionalPkgs];
+    for (const pkg of packages) {
+      const sentPricingOption = pkg === firstPkg && fixtureProductId === void 0 && fixturePricingOptionId === void 0 ? pricingOption : findPricingOption(context, pkg.product_id, pkg.pricing_option_id);
+      if (pkg.bid_price === void 0 && pkg.bidding === void 0 && step.sample_request?.bidding === void 0 && sentPricingOption?.pricing_model === "cpm" && !isFixedPricing(sentPricingOption)) {
+        const floor = Number(sentPricingOption.floor_price) || 5;
+        pkg.bid_price = Math.round(floor * 1.5 * 100) / 100;
+      }
+    }
     const fixture = step.sample_request !== void 0 ? injectContext({ ...step.sample_request }, context) : {};
     const fixtureBody = omitEnvelopeFields(fixture);
     const fixtureHasPackages = Array.isArray(fixture.packages) && fixture.packages.length > 0;
@@ -249,7 +252,7 @@ const REQUEST_ENRICHERS = {
       brand: resolveBrand(options),
       start_time: startTime,
       end_time: endTime,
-      packages: [firstPkg, ...additionalPkgs]
+      packages
     };
   },
   update_media_buy(step, context, options) {

package/dist/lib/testing/storyboard/runner.js

@@ -61,6 +61,9 @@ __export(runner_exports, {
   summarizeStrictValidation: () => summarizeStrictValidation
 });
 module.exports = __toCommonJS(runner_exports);
+var import_web_bot_auth = require('./web-bot-auth.js');
+var import_web_bot_auth2 = require('../../signing/web-bot-auth.js');
+var import_agent_transport_fetch = require('../../net/agent-transport-fetch.js');
 var import_node_crypto = require("node:crypto");
 var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
@@ -2206,6 +2209,19 @@ function resolveBindingAccountScope(storyboard, options) {
 }
 function resolveBindingCredential(options, step) {
   const parts = [];
+  if (options.web_bot_auth) {
+    parts.push(`wba_target:${JSON.stringify(options.web_bot_auth.publicUrl ?? null)}`);
+    for (const [name, identity] of Object.entries(options.web_bot_auth.identities).sort(
+      ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
+    )) {
+      try {
+        const jwk = "privateKey" in identity.key ? identity.key.privateKey : identity.key.publicKey;
+        parts.push(`wba_identity:${JSON.stringify([name, identity.origin, (0, import_web_bot_auth2.jwkThumbprint)(jwk)])}`);
+      } catch {
+        parts.push(`wba_identity:${JSON.stringify([name, "invalid"])}`);
+      }
+    }
+  }
   if (step?.auth !== void 0) {
     parts.push(`step_auth:${JSON.stringify(describeStepAuthDirective(step.auth))}`);
   }
@@ -4867,7 +4883,7 @@ function buildStepRequest(step, effectiveStep, context, options, runnerVars) {
   const governedFixture = payloadBoundGovernance && effectiveStep.task !== "check_governance" && effectiveStep.task !== "report_plan_outcome" && (governedSource !== void 0 && Object.prototype.hasOwnProperty.call(governedSource, "governance_context") || contextGovernance);
   if (options.request) {
     request = (0, import_context.injectContext)({ ...options.request }, context, runnerVars);
-  } else if (step.expect_error && step.sample_request) {
+  } else if (step.expect_error && step.sample_request && step.enrich_request !== true) {
     request = (0, import_context.injectContext)({ ...step.sample_request }, context, runnerVars);
   } else if (governedFixture) {
     request = (0, import_context.injectContext)({ ...step.sample_request ?? {} }, context, runnerVars);
@@ -5242,18 +5258,49 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && (0, import_idempotency.requestUsesIdempotency)(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
-  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
+  const useWebBotAuth = typeof step.auth === "object" && step.auth.type === "web_bot_auth";
+  const useSdkAuthOverride = useWebBotAuth || typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
   let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    let signedFetch;
+    if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+      if ((step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check)))
+        throw new Error(
+          "web_bot_auth steps require tool-response validations; HTTP probe assertions are not supported"
+        );
+      if (options.web_bot_auth?.publicUrl && options.protocol === "a2a")
+        throw new Error("web_bot_auth.publicUrl loopback delivery supports MCP only; use HTTPS directly for A2A");
+      if (!options.web_bot_auth?.publicUrl && new URL(runState.agentUrl).protocol !== "https:")
+        throw new Error("web_bot_auth.publicUrl is required to sign for a non-HTTPS agent");
+      const name = step.auth.identity;
+      const identities = options.web_bot_auth?.identities;
+      const identity = identities && Object.hasOwn(identities, name) ? identities[name] : void 0;
+      if (!identity) throw new Error("web_bot_auth identity is not configured in options.web_bot_auth.identities");
+      signedFetch = (0, import_web_bot_auth.createStoryboardWebBotAuthFetch)(
+        (0, import_agent_transport_fetch.createAgentTransportFetch)(runState.agentUrl, {
+          trustedFetchFn: options.transport?.trustedFetchFn,
+          allowPrivateIp: options.transport?.allowPrivateIp
+        }),
+        identity.key,
+        {
+          agentUrl: runState.agentUrl,
+          origin: identity.origin,
+          ...options.web_bot_auth?.publicUrl && {
+            target: { publicUrl: options.web_bot_auth.publicUrl, loopbackUrl: runState.agentUrl }
+          }
+        }
+      );
+    }
     if (useSdkAuthOverride) {
       if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
       authOverrideClient = createAuthOverrideClient(
         runState.agentUrl,
         options.protocol ?? "mcp",
         options,
-        rawProbeHeaders
+        rawProbeHeaders,
+        signedFetch
       );
     }
   } catch (err) {
@@ -5547,7 +5594,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     runState.agentProfile?.raw_capabilities,
     "request_signing.required_for"
   );
-  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && runState.storyboardRequiresRequestSigner !== true) {
+  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && !useWebBotAuth && runState.storyboardRequiresRequestSigner !== true) {
     const next2 = getNextStepPreview(step.id, allSteps, context, runState.runnerVars);
     const detail = `Agent declared request_signing.required_for includes "${effectiveStep.task}" and rejected the unsigned request with request_signature_required; storyboard "${storyboardId}" does not require request_signer.`;
     return {
@@ -7679,6 +7726,8 @@ function selectProtectedToolTarget(tools) {
 function sessionControlMechanismFor(auth) {
   if (auth === "none") return "any";
   switch (auth.type) {
+    case "web_bot_auth":
+      throw new Error("web_bot_auth is not supported by session probes");
     case "oauth_bearer":
       return "oauth_bearer";
     case "basic":
@@ -7704,6 +7753,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
       )
     };
   }
+  if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+    return { kind: "error", error: "web_bot_auth is not supported by MCP session probes; select an AdCP tool step" };
+  }
   const signatureBound = signatureBoundTools(options);
   const candidates = protectedToolCandidates(options.agentTools);
   if (signatureBound === "unparseable") {
@@ -7763,7 +7815,7 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   };
 }
 function authHeadersForStep(directive, options) {
-  if (directive === "none") return {};
+  if (directive === "none" || directive.type === "web_bot_auth") return {};
   if (directive.type === "basic") return basicAuthHeadersForStep(directive, options);
   let value;
   if ("value" in directive && directive.value) {
@@ -7811,7 +7863,7 @@ function isCredentialHeaderName(name) {
   if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
   return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders, signedFetch) {
   const runSecrets = runCredentialValues(options);
   const headers = {};
   for (const [name, value] of Object.entries(options.headers ?? {})) {
@@ -7842,6 +7894,7 @@ function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
     test_kit: void 0,
     _client: void 0,
     functional_request_signing: void 0,
+    ...signedFetch && { transport: { ...options.transport, trustedFetchFn: signedFetch } },
     headers: Object.keys(headers).length > 0 ? headers : void 0
   });
 }

package/dist/lib/testing/storyboard/runner.mjs

@@ -1,3 +1,6 @@
+import { createStoryboardWebBotAuthFetch } from "./web-bot-auth.mjs";
+import { jwkThumbprint } from "../../signing/web-bot-auth.mjs";
+import { createAgentTransportFetch } from "../../net/agent-transport-fetch.mjs";
 import { createHash, createHmac } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, join } from "node:path";
@@ -2248,6 +2251,19 @@ function resolveBindingAccountScope(storyboard, options) {
 }
 function resolveBindingCredential(options, step) {
   const parts = [];
+  if (options.web_bot_auth) {
+    parts.push(`wba_target:${JSON.stringify(options.web_bot_auth.publicUrl ?? null)}`);
+    for (const [name, identity] of Object.entries(options.web_bot_auth.identities).sort(
+      ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
+    )) {
+      try {
+        const jwk = "privateKey" in identity.key ? identity.key.privateKey : identity.key.publicKey;
+        parts.push(`wba_identity:${JSON.stringify([name, identity.origin, jwkThumbprint(jwk)])}`);
+      } catch {
+        parts.push(`wba_identity:${JSON.stringify([name, "invalid"])}`);
+      }
+    }
+  }
   if (step?.auth !== void 0) {
     parts.push(`step_auth:${JSON.stringify(describeStepAuthDirective(step.auth))}`);
   }
@@ -4909,7 +4925,7 @@ function buildStepRequest(step, effectiveStep, context, options, runnerVars) {
   const governedFixture = payloadBoundGovernance && effectiveStep.task !== "check_governance" && effectiveStep.task !== "report_plan_outcome" && (governedSource !== void 0 && Object.prototype.hasOwnProperty.call(governedSource, "governance_context") || contextGovernance);
   if (options.request) {
     request = injectContext({ ...options.request }, context, runnerVars);
-  } else if (step.expect_error && step.sample_request) {
+  } else if (step.expect_error && step.sample_request && step.enrich_request !== true) {
     request = injectContext({ ...step.sample_request }, context, runnerVars);
   } else if (governedFixture) {
     request = injectContext({ ...step.sample_request ?? {} }, context, runnerVars);
@@ -5284,18 +5300,49 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && requestUsesIdempotency(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
-  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
+  const useWebBotAuth = typeof step.auth === "object" && step.auth.type === "web_bot_auth";
+  const useSdkAuthOverride = useWebBotAuth || typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
   let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    let signedFetch;
+    if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+      if ((step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check)))
+        throw new Error(
+          "web_bot_auth steps require tool-response validations; HTTP probe assertions are not supported"
+        );
+      if (options.web_bot_auth?.publicUrl && options.protocol === "a2a")
+        throw new Error("web_bot_auth.publicUrl loopback delivery supports MCP only; use HTTPS directly for A2A");
+      if (!options.web_bot_auth?.publicUrl && new URL(runState.agentUrl).protocol !== "https:")
+        throw new Error("web_bot_auth.publicUrl is required to sign for a non-HTTPS agent");
+      const name = step.auth.identity;
+      const identities = options.web_bot_auth?.identities;
+      const identity = identities && Object.hasOwn(identities, name) ? identities[name] : void 0;
+      if (!identity) throw new Error("web_bot_auth identity is not configured in options.web_bot_auth.identities");
+      signedFetch = createStoryboardWebBotAuthFetch(
+        createAgentTransportFetch(runState.agentUrl, {
+          trustedFetchFn: options.transport?.trustedFetchFn,
+          allowPrivateIp: options.transport?.allowPrivateIp
+        }),
+        identity.key,
+        {
+          agentUrl: runState.agentUrl,
+          origin: identity.origin,
+          ...options.web_bot_auth?.publicUrl && {
+            target: { publicUrl: options.web_bot_auth.publicUrl, loopbackUrl: runState.agentUrl }
+          }
+        }
+      );
+    }
     if (useSdkAuthOverride) {
       if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
       authOverrideClient = createAuthOverrideClient(
         runState.agentUrl,
         options.protocol ?? "mcp",
         options,
-        rawProbeHeaders
+        rawProbeHeaders,
+        signedFetch
       );
     }
   } catch (err) {
@@ -5589,7 +5636,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     runState.agentProfile?.raw_capabilities,
     "request_signing.required_for"
   );
-  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && runState.storyboardRequiresRequestSigner !== true) {
+  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && !useWebBotAuth && runState.storyboardRequiresRequestSigner !== true) {
     const next2 = getNextStepPreview(step.id, allSteps, context, runState.runnerVars);
     const detail = `Agent declared request_signing.required_for includes "${effectiveStep.task}" and rejected the unsigned request with request_signature_required; storyboard "${storyboardId}" does not require request_signer.`;
     return {
@@ -7721,6 +7768,8 @@ function selectProtectedToolTarget(tools) {
 function sessionControlMechanismFor(auth) {
   if (auth === "none") return "any";
   switch (auth.type) {
+    case "web_bot_auth":
+      throw new Error("web_bot_auth is not supported by session probes");
     case "oauth_bearer":
       return "oauth_bearer";
     case "basic":
@@ -7746,6 +7795,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
       )
     };
   }
+  if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+    return { kind: "error", error: "web_bot_auth is not supported by MCP session probes; select an AdCP tool step" };
+  }
   const signatureBound = signatureBoundTools(options);
   const candidates = protectedToolCandidates(options.agentTools);
   if (signatureBound === "unparseable") {
@@ -7805,7 +7857,7 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   };
 }
 function authHeadersForStep(directive, options) {
-  if (directive === "none") return {};
+  if (directive === "none" || directive.type === "web_bot_auth") return {};
   if (directive.type === "basic") return basicAuthHeadersForStep(directive, options);
   let value;
   if ("value" in directive && directive.value) {
@@ -7853,7 +7905,7 @@ function isCredentialHeaderName(name) {
   if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
   return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders, signedFetch) {
   const runSecrets = runCredentialValues(options);
   const headers = {};
   for (const [name, value] of Object.entries(options.headers ?? {})) {
@@ -7884,6 +7936,7 @@ function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
     test_kit: void 0,
     _client: void 0,
     functional_request_signing: void 0,
+    ...signedFetch && { transport: { ...options.transport, trustedFetchFn: signedFetch } },
     headers: Object.keys(headers).length > 0 ? headers : void 0
   });
 }

package/dist/lib/testing/storyboard/types.d.mts

@@ -704,6 +704,10 @@ export interface ContextInput {
 export type StepAuthDirective = 
 /** Strip transport credentials entirely. The step MUST hit the agent unauthenticated. */
 'none' | {
+    type: 'web_bot_auth';
+    /** Name in the runner's runtime-only `web_bot_auth.identities` map. */
+    identity: string;
+} | {
     type: 'api_key';
     /** Literal Bearer value sent as `Authorization: Bearer <value>`. */
     value?: string;
@@ -838,6 +842,11 @@ export interface StoryboardStep {
      * seller; schema validation remains enabled for `payload_well_formed`.
      */
     negative_path?: 'schema_invalid' | 'payload_well_formed';
+    /** Opt a schema-valid semantic rejection probe into normal request enrichment.
+     * Explicit fixture values remain authoritative. Invalid-input probes must
+     * retain the default, which sends the authored request without enrichment.
+     */
+    enrich_request?: true;
     /**
      * Per-step invariant opt-out. See `StepInvariantsObject`. Use when a
      * specific step deliberately trips a default invariant (e.g. a
@@ -1694,6 +1703,15 @@ export interface PrepareStoryboardFixturesOptions extends StoryboardRunOptions {
     prepared_fixtures_preparation_authorizer?: PreparedFixturesPreparationAuthorizer;
 }
 export interface StoryboardRunOptions extends TestOptions {
+    /** Runtime signing keys; storyboard YAML contains only identity names. */
+    web_bot_auth?: {
+        identities: Record<string, {
+            origin: string;
+            key: import('../../signing/web-bot-auth.mjs').WebBotSigningKey;
+        }>;
+        /** Sign this public HTTPS endpoint, delivering to the loopback agent URL. */
+        publicUrl?: string;
+    };
     /** Compliance cache root for bundle-scoped fixtures and test vectors. */
     complianceDir?: string;
     /**

package/dist/lib/testing/storyboard/types.d.ts

@@ -704,6 +704,10 @@ export interface ContextInput {
 export type StepAuthDirective = 
 /** Strip transport credentials entirely. The step MUST hit the agent unauthenticated. */
 'none' | {
+    type: 'web_bot_auth';
+    /** Name in the runner's runtime-only `web_bot_auth.identities` map. */
+    identity: string;
+} | {
     type: 'api_key';
     /** Literal Bearer value sent as `Authorization: Bearer <value>`. */
     value?: string;
@@ -838,6 +842,11 @@ export interface StoryboardStep {
      * seller; schema validation remains enabled for `payload_well_formed`.
      */
     negative_path?: 'schema_invalid' | 'payload_well_formed';
+    /** Opt a schema-valid semantic rejection probe into normal request enrichment.
+     * Explicit fixture values remain authoritative. Invalid-input probes must
+     * retain the default, which sends the authored request without enrichment.
+     */
+    enrich_request?: true;
     /**
      * Per-step invariant opt-out. See `StepInvariantsObject`. Use when a
      * specific step deliberately trips a default invariant (e.g. a
@@ -1694,6 +1703,15 @@ export interface PrepareStoryboardFixturesOptions extends StoryboardRunOptions {
     prepared_fixtures_preparation_authorizer?: PreparedFixturesPreparationAuthorizer;
 }
 export interface StoryboardRunOptions extends TestOptions {
+    /** Runtime signing keys; storyboard YAML contains only identity names. */
+    web_bot_auth?: {
+        identities: Record<string, {
+            origin: string;
+            key: import('../../signing/web-bot-auth').WebBotSigningKey;
+        }>;
+        /** Sign this public HTTPS endpoint, delivering to the loopback agent URL. */
+        publicUrl?: string;
+    };
     /** Compliance cache root for bundle-scoped fixtures and test vectors. */
     complianceDir?: string;
     /**

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.2";
+export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.3";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**