@adcp/sdk 17.0.0-beta.2 → 17.0.0-beta.4

package/dist/lib/testing/storyboard/runner.js

@@ -61,6 +61,9 @@ __export(runner_exports, {
   summarizeStrictValidation: () => summarizeStrictValidation
 });
 module.exports = __toCommonJS(runner_exports);
+var import_web_bot_auth = require('./web-bot-auth.js');
+var import_web_bot_auth2 = require('../../signing/web-bot-auth.js');
+var import_agent_transport_fetch = require('../../net/agent-transport-fetch.js');
 var import_node_crypto = require("node:crypto");
 var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
@@ -2206,6 +2209,19 @@ function resolveBindingAccountScope(storyboard, options) {
 }
 function resolveBindingCredential(options, step) {
   const parts = [];
+  if (options.web_bot_auth) {
+    parts.push(`wba_target:${JSON.stringify(options.web_bot_auth.publicUrl ?? null)}`);
+    for (const [name, identity] of Object.entries(options.web_bot_auth.identities).sort(
+      ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
+    )) {
+      try {
+        const jwk = "privateKey" in identity.key ? identity.key.privateKey : identity.key.publicKey;
+        parts.push(`wba_identity:${JSON.stringify([name, identity.origin, (0, import_web_bot_auth2.jwkThumbprint)(jwk)])}`);
+      } catch {
+        parts.push(`wba_identity:${JSON.stringify([name, "invalid"])}`);
+      }
+    }
+  }
   if (step?.auth !== void 0) {
     parts.push(`step_auth:${JSON.stringify(describeStepAuthDirective(step.auth))}`);
   }
@@ -4867,7 +4883,7 @@ function buildStepRequest(step, effectiveStep, context, options, runnerVars) {
   const governedFixture = payloadBoundGovernance && effectiveStep.task !== "check_governance" && effectiveStep.task !== "report_plan_outcome" && (governedSource !== void 0 && Object.prototype.hasOwnProperty.call(governedSource, "governance_context") || contextGovernance);
   if (options.request) {
     request = (0, import_context.injectContext)({ ...options.request }, context, runnerVars);
-  } else if (step.expect_error && step.sample_request) {
+  } else if (step.expect_error && step.sample_request && step.enrich_request !== true) {
     request = (0, import_context.injectContext)({ ...step.sample_request }, context, runnerVars);
   } else if (governedFixture) {
     request = (0, import_context.injectContext)({ ...step.sample_request ?? {} }, context, runnerVars);
@@ -5242,18 +5258,49 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && (0, import_idempotency.requestUsesIdempotency)(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
-  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
+  const useWebBotAuth = typeof step.auth === "object" && step.auth.type === "web_bot_auth";
+  const useSdkAuthOverride = useWebBotAuth || typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
   let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    let signedFetch;
+    if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+      if ((step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check)))
+        throw new Error(
+          "web_bot_auth steps require tool-response validations; HTTP probe assertions are not supported"
+        );
+      if (options.web_bot_auth?.publicUrl && options.protocol === "a2a")
+        throw new Error("web_bot_auth.publicUrl loopback delivery supports MCP only; use HTTPS directly for A2A");
+      if (!options.web_bot_auth?.publicUrl && new URL(runState.agentUrl).protocol !== "https:")
+        throw new Error("web_bot_auth.publicUrl is required to sign for a non-HTTPS agent");
+      const name = step.auth.identity;
+      const identities = options.web_bot_auth?.identities;
+      const identity = identities && Object.hasOwn(identities, name) ? identities[name] : void 0;
+      if (!identity) throw new Error("web_bot_auth identity is not configured in options.web_bot_auth.identities");
+      signedFetch = (0, import_web_bot_auth.createStoryboardWebBotAuthFetch)(
+        (0, import_agent_transport_fetch.createAgentTransportFetch)(runState.agentUrl, {
+          trustedFetchFn: options.transport?.trustedFetchFn,
+          allowPrivateIp: options.transport?.allowPrivateIp
+        }),
+        identity.key,
+        {
+          agentUrl: runState.agentUrl,
+          origin: identity.origin,
+          ...options.web_bot_auth?.publicUrl && {
+            target: { publicUrl: options.web_bot_auth.publicUrl, loopbackUrl: runState.agentUrl }
+          }
+        }
+      );
+    }
     if (useSdkAuthOverride) {
       if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
       authOverrideClient = createAuthOverrideClient(
         runState.agentUrl,
         options.protocol ?? "mcp",
         options,
-        rawProbeHeaders
+        rawProbeHeaders,
+        signedFetch
       );
     }
   } catch (err) {
@@ -5547,7 +5594,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     runState.agentProfile?.raw_capabilities,
     "request_signing.required_for"
   );
-  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && runState.storyboardRequiresRequestSigner !== true) {
+  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && !useWebBotAuth && runState.storyboardRequiresRequestSigner !== true) {
     const next2 = getNextStepPreview(step.id, allSteps, context, runState.runnerVars);
     const detail = `Agent declared request_signing.required_for includes "${effectiveStep.task}" and rejected the unsigned request with request_signature_required; storyboard "${storyboardId}" does not require request_signer.`;
     return {
@@ -7679,6 +7726,8 @@ function selectProtectedToolTarget(tools) {
 function sessionControlMechanismFor(auth) {
   if (auth === "none") return "any";
   switch (auth.type) {
+    case "web_bot_auth":
+      throw new Error("web_bot_auth is not supported by session probes");
     case "oauth_bearer":
       return "oauth_bearer";
     case "basic":
@@ -7704,6 +7753,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
       )
     };
   }
+  if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+    return { kind: "error", error: "web_bot_auth is not supported by MCP session probes; select an AdCP tool step" };
+  }
   const signatureBound = signatureBoundTools(options);
   const candidates = protectedToolCandidates(options.agentTools);
   if (signatureBound === "unparseable") {
@@ -7763,7 +7815,7 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   };
 }
 function authHeadersForStep(directive, options) {
-  if (directive === "none") return {};
+  if (directive === "none" || directive.type === "web_bot_auth") return {};
   if (directive.type === "basic") return basicAuthHeadersForStep(directive, options);
   let value;
   if ("value" in directive && directive.value) {
@@ -7811,7 +7863,7 @@ function isCredentialHeaderName(name) {
   if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
   return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders, signedFetch) {
   const runSecrets = runCredentialValues(options);
   const headers = {};
   for (const [name, value] of Object.entries(options.headers ?? {})) {
@@ -7842,6 +7894,7 @@ function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
     test_kit: void 0,
     _client: void 0,
     functional_request_signing: void 0,
+    ...signedFetch && { transport: { ...options.transport, trustedFetchFn: signedFetch } },
     headers: Object.keys(headers).length > 0 ? headers : void 0
   });
 }

package/dist/lib/testing/storyboard/runner.mjs

@@ -1,3 +1,6 @@
+import { createStoryboardWebBotAuthFetch } from "./web-bot-auth.mjs";
+import { jwkThumbprint } from "../../signing/web-bot-auth.mjs";
+import { createAgentTransportFetch } from "../../net/agent-transport-fetch.mjs";
 import { createHash, createHmac } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, join } from "node:path";
@@ -2248,6 +2251,19 @@ function resolveBindingAccountScope(storyboard, options) {
 }
 function resolveBindingCredential(options, step) {
   const parts = [];
+  if (options.web_bot_auth) {
+    parts.push(`wba_target:${JSON.stringify(options.web_bot_auth.publicUrl ?? null)}`);
+    for (const [name, identity] of Object.entries(options.web_bot_auth.identities).sort(
+      ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
+    )) {
+      try {
+        const jwk = "privateKey" in identity.key ? identity.key.privateKey : identity.key.publicKey;
+        parts.push(`wba_identity:${JSON.stringify([name, identity.origin, jwkThumbprint(jwk)])}`);
+      } catch {
+        parts.push(`wba_identity:${JSON.stringify([name, "invalid"])}`);
+      }
+    }
+  }
   if (step?.auth !== void 0) {
     parts.push(`step_auth:${JSON.stringify(describeStepAuthDirective(step.auth))}`);
   }
@@ -4909,7 +4925,7 @@ function buildStepRequest(step, effectiveStep, context, options, runnerVars) {
   const governedFixture = payloadBoundGovernance && effectiveStep.task !== "check_governance" && effectiveStep.task !== "report_plan_outcome" && (governedSource !== void 0 && Object.prototype.hasOwnProperty.call(governedSource, "governance_context") || contextGovernance);
   if (options.request) {
     request = injectContext({ ...options.request }, context, runnerVars);
-  } else if (step.expect_error && step.sample_request) {
+  } else if (step.expect_error && step.sample_request && step.enrich_request !== true) {
     request = injectContext({ ...step.sample_request }, context, runnerVars);
   } else if (governedFixture) {
     request = injectContext({ ...step.sample_request ?? {} }, context, runnerVars);
@@ -5284,18 +5300,49 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && requestUsesIdempotency(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
-  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
+  const useWebBotAuth = typeof step.auth === "object" && step.auth.type === "web_bot_auth";
+  const useSdkAuthOverride = useWebBotAuth || typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
   let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    let signedFetch;
+    if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+      if ((step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check)))
+        throw new Error(
+          "web_bot_auth steps require tool-response validations; HTTP probe assertions are not supported"
+        );
+      if (options.web_bot_auth?.publicUrl && options.protocol === "a2a")
+        throw new Error("web_bot_auth.publicUrl loopback delivery supports MCP only; use HTTPS directly for A2A");
+      if (!options.web_bot_auth?.publicUrl && new URL(runState.agentUrl).protocol !== "https:")
+        throw new Error("web_bot_auth.publicUrl is required to sign for a non-HTTPS agent");
+      const name = step.auth.identity;
+      const identities = options.web_bot_auth?.identities;
+      const identity = identities && Object.hasOwn(identities, name) ? identities[name] : void 0;
+      if (!identity) throw new Error("web_bot_auth identity is not configured in options.web_bot_auth.identities");
+      signedFetch = createStoryboardWebBotAuthFetch(
+        createAgentTransportFetch(runState.agentUrl, {
+          trustedFetchFn: options.transport?.trustedFetchFn,
+          allowPrivateIp: options.transport?.allowPrivateIp
+        }),
+        identity.key,
+        {
+          agentUrl: runState.agentUrl,
+          origin: identity.origin,
+          ...options.web_bot_auth?.publicUrl && {
+            target: { publicUrl: options.web_bot_auth.publicUrl, loopbackUrl: runState.agentUrl }
+          }
+        }
+      );
+    }
     if (useSdkAuthOverride) {
       if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
       authOverrideClient = createAuthOverrideClient(
         runState.agentUrl,
         options.protocol ?? "mcp",
         options,
-        rawProbeHeaders
+        rawProbeHeaders,
+        signedFetch
       );
     }
   } catch (err) {
@@ -5589,7 +5636,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     runState.agentProfile?.raw_capabilities,
     "request_signing.required_for"
   );
-  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && runState.storyboardRequiresRequestSigner !== true) {
+  if (taskResult?.adcp_error?.code === "request_signature_required" && Array.isArray(requiredForSigning) && requiredForSigning.includes(effectiveStep.task) && options.functional_request_signing === void 0 && !useWebBotAuth && runState.storyboardRequiresRequestSigner !== true) {
     const next2 = getNextStepPreview(step.id, allSteps, context, runState.runnerVars);
     const detail = `Agent declared request_signing.required_for includes "${effectiveStep.task}" and rejected the unsigned request with request_signature_required; storyboard "${storyboardId}" does not require request_signer.`;
     return {
@@ -7721,6 +7768,8 @@ function selectProtectedToolTarget(tools) {
 function sessionControlMechanismFor(auth) {
   if (auth === "none") return "any";
   switch (auth.type) {
+    case "web_bot_auth":
+      throw new Error("web_bot_auth is not supported by session probes");
     case "oauth_bearer":
       return "oauth_bearer";
     case "basic":
@@ -7746,6 +7795,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
       )
     };
   }
+  if (typeof step.auth === "object" && step.auth.type === "web_bot_auth") {
+    return { kind: "error", error: "web_bot_auth is not supported by MCP session probes; select an AdCP tool step" };
+  }
   const signatureBound = signatureBoundTools(options);
   const candidates = protectedToolCandidates(options.agentTools);
   if (signatureBound === "unparseable") {
@@ -7805,7 +7857,7 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   };
 }
 function authHeadersForStep(directive, options) {
-  if (directive === "none") return {};
+  if (directive === "none" || directive.type === "web_bot_auth") return {};
   if (directive.type === "basic") return basicAuthHeadersForStep(directive, options);
   let value;
   if ("value" in directive && directive.value) {
@@ -7853,7 +7905,7 @@ function isCredentialHeaderName(name) {
   if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
   return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders, signedFetch) {
   const runSecrets = runCredentialValues(options);
   const headers = {};
   for (const [name, value] of Object.entries(options.headers ?? {})) {
@@ -7884,6 +7936,7 @@ function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
     test_kit: void 0,
     _client: void 0,
     functional_request_signing: void 0,
+    ...signedFetch && { transport: { ...options.transport, trustedFetchFn: signedFetch } },
     headers: Object.keys(headers).length > 0 ? headers : void 0
   });
 }

package/dist/lib/testing/storyboard/types.d.mts

@@ -704,6 +704,10 @@ export interface ContextInput {
 export type StepAuthDirective = 
 /** Strip transport credentials entirely. The step MUST hit the agent unauthenticated. */
 'none' | {
+    type: 'web_bot_auth';
+    /** Name in the runner's runtime-only `web_bot_auth.identities` map. */
+    identity: string;
+} | {
     type: 'api_key';
     /** Literal Bearer value sent as `Authorization: Bearer <value>`. */
     value?: string;
@@ -838,6 +842,11 @@ export interface StoryboardStep {
      * seller; schema validation remains enabled for `payload_well_formed`.
      */
     negative_path?: 'schema_invalid' | 'payload_well_formed';
+    /** Opt a schema-valid semantic rejection probe into normal request enrichment.
+     * Explicit fixture values remain authoritative. Invalid-input probes must
+     * retain the default, which sends the authored request without enrichment.
+     */
+    enrich_request?: true;
     /**
      * Per-step invariant opt-out. See `StepInvariantsObject`. Use when a
      * specific step deliberately trips a default invariant (e.g. a
@@ -1694,6 +1703,15 @@ export interface PrepareStoryboardFixturesOptions extends StoryboardRunOptions {
     prepared_fixtures_preparation_authorizer?: PreparedFixturesPreparationAuthorizer;
 }
 export interface StoryboardRunOptions extends TestOptions {
+    /** Runtime signing keys; storyboard YAML contains only identity names. */
+    web_bot_auth?: {
+        identities: Record<string, {
+            origin: string;
+            key: import('../../signing/web-bot-auth.mjs').WebBotSigningKey;
+        }>;
+        /** Sign this public HTTPS endpoint, delivering to the loopback agent URL. */
+        publicUrl?: string;
+    };
     /** Compliance cache root for bundle-scoped fixtures and test vectors. */
     complianceDir?: string;
     /**

package/dist/lib/testing/storyboard/types.d.ts

@@ -704,6 +704,10 @@ export interface ContextInput {
 export type StepAuthDirective = 
 /** Strip transport credentials entirely. The step MUST hit the agent unauthenticated. */
 'none' | {
+    type: 'web_bot_auth';
+    /** Name in the runner's runtime-only `web_bot_auth.identities` map. */
+    identity: string;
+} | {
     type: 'api_key';
     /** Literal Bearer value sent as `Authorization: Bearer <value>`. */
     value?: string;
@@ -838,6 +842,11 @@ export interface StoryboardStep {
      * seller; schema validation remains enabled for `payload_well_formed`.
      */
     negative_path?: 'schema_invalid' | 'payload_well_formed';
+    /** Opt a schema-valid semantic rejection probe into normal request enrichment.
+     * Explicit fixture values remain authoritative. Invalid-input probes must
+     * retain the default, which sends the authored request without enrichment.
+     */
+    enrich_request?: true;
     /**
      * Per-step invariant opt-out. See `StepInvariantsObject`. Use when a
      * specific step deliberately trips a default invariant (e.g. a
@@ -1694,6 +1703,15 @@ export interface PrepareStoryboardFixturesOptions extends StoryboardRunOptions {
     prepared_fixtures_preparation_authorizer?: PreparedFixturesPreparationAuthorizer;
 }
 export interface StoryboardRunOptions extends TestOptions {
+    /** Runtime signing keys; storyboard YAML contains only identity names. */
+    web_bot_auth?: {
+        identities: Record<string, {
+            origin: string;
+            key: import('../../signing/web-bot-auth').WebBotSigningKey;
+        }>;
+        /** Sign this public HTTPS endpoint, delivering to the loopback agent URL. */
+        publicUrl?: string;
+    };
     /** Compliance cache root for bundle-scoped fixtures and test vectors. */
     complianceDir?: string;
     /**

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.2";
+export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.4";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.2";
+export declare const RUNNER_CAPABILITY_VERSION = "17.0.0-beta.4";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/web-bot-auth.d.mts

@@ -0,0 +1,10 @@
+import { type WebBotSigningKey, type WebBotSigningOptions } from '../../signing/web-bot-auth.mjs';
+/** Sign the public HTTPS target while the official transport delivers to loopback. */
+export declare function createStoryboardWebBotAuthFetch(upstream: typeof fetch, key: WebBotSigningKey, options: WebBotSigningOptions & {
+    /** Pin the destination origin for direct HTTPS delivery. */
+    agentUrl?: string;
+    target?: {
+        publicUrl: string;
+        loopbackUrl: string;
+    };
+}): typeof fetch;

package/dist/lib/testing/storyboard/web-bot-auth.d.ts

@@ -0,0 +1,10 @@
+import { type WebBotSigningKey, type WebBotSigningOptions } from '../../signing/web-bot-auth';
+/** Sign the public HTTPS target while the official transport delivers to loopback. */
+export declare function createStoryboardWebBotAuthFetch(upstream: typeof fetch, key: WebBotSigningKey, options: WebBotSigningOptions & {
+    /** Pin the destination origin for direct HTTPS delivery. */
+    agentUrl?: string;
+    target?: {
+        publicUrl: string;
+        loopbackUrl: string;
+    };
+}): typeof fetch;

package/dist/lib/testing/storyboard/web-bot-auth.js

@@ -0,0 +1,80 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var web_bot_auth_exports = {};
+__export(web_bot_auth_exports, {
+  createStoryboardWebBotAuthFetch: () => createStoryboardWebBotAuthFetch
+});
+module.exports = __toCommonJS(web_bot_auth_exports);
+var import_web_bot_auth = require('../../signing/web-bot-auth.js');
+function createStoryboardWebBotAuthFetch(upstream, key, options) {
+  const deliver = async (input, init) => {
+    const response = await upstream(input, { ...init, redirect: "manual" });
+    if ([301, 302, 303, 307, 308].includes(response.status) && response.headers.has("location")) {
+      await response.body?.cancel();
+      throw new TypeError("Web Bot Auth storyboard requests do not follow HTTP redirects");
+    }
+    return response;
+  };
+  if (!options.target) {
+    if (!options.agentUrl) throw new TypeError("Direct Web Bot Auth storyboard signing requires agentUrl");
+    const agentUrl = new URL(options.agentUrl);
+    if (agentUrl.protocol !== "https:" || agentUrl.username || agentUrl.password || agentUrl.hash)
+      throw new TypeError(
+        "Direct Web Bot Auth storyboard signing requires an HTTPS agentUrl without credentials or fragments"
+      );
+    const signed2 = (0, import_web_bot_auth.createWebBotAuthFetch)(deliver, key, options);
+    return (input, init) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      if (new URL(url).origin !== agentUrl.origin)
+        return Promise.reject(new TypeError("Web Bot Auth storyboard refused a different agent origin"));
+      return signed2(input, init);
+    };
+  }
+  const publicUrl = new URL(options.target.publicUrl);
+  const localUrl = new URL(options.target.loopbackUrl);
+  if (publicUrl.protocol !== "https:" || publicUrl.username || publicUrl.password || publicUrl.hash || publicUrl.search || !["http:", "https:"].includes(localUrl.protocol) || !["localhost", "127.0.0.1", "[::1]"].includes(localUrl.hostname) || localUrl.username || localUrl.password || localUrl.hash || localUrl.search)
+    throw new TypeError(
+      "Web Bot Auth test delivery requires a public HTTPS URL and a loopback URL without credentials, query or fragment"
+    );
+  const signed = (0, import_web_bot_auth.createWebBotAuthFetch)(
+    async (input, init) => {
+      const target = new URL(String(input));
+      if (target.origin !== publicUrl.origin || target.pathname !== publicUrl.pathname)
+        throw new TypeError("Web Bot Auth test delivery refused a different public endpoint");
+      const destination = new URL(localUrl);
+      destination.search = target.search;
+      return deliver(destination.href, init);
+    },
+    key,
+    options
+  );
+  return async (input, init) => {
+    if (input instanceof Request) throw new TypeError("Web Bot Auth test delivery requires a URL and init");
+    const source = new URL(String(input));
+    if (source.origin !== localUrl.origin || source.pathname !== localUrl.pathname)
+      throw new TypeError("Web Bot Auth test delivery refused a different loopback endpoint");
+    const target = new URL(publicUrl);
+    target.search = source.search;
+    return signed(target.href, init);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createStoryboardWebBotAuthFetch
+});

package/dist/lib/testing/storyboard/web-bot-auth.mjs

@@ -0,0 +1,56 @@
+import { createWebBotAuthFetch } from "../../signing/web-bot-auth.mjs";
+function createStoryboardWebBotAuthFetch(upstream, key, options) {
+  const deliver = async (input, init) => {
+    const response = await upstream(input, { ...init, redirect: "manual" });
+    if ([301, 302, 303, 307, 308].includes(response.status) && response.headers.has("location")) {
+      await response.body?.cancel();
+      throw new TypeError("Web Bot Auth storyboard requests do not follow HTTP redirects");
+    }
+    return response;
+  };
+  if (!options.target) {
+    if (!options.agentUrl) throw new TypeError("Direct Web Bot Auth storyboard signing requires agentUrl");
+    const agentUrl = new URL(options.agentUrl);
+    if (agentUrl.protocol !== "https:" || agentUrl.username || agentUrl.password || agentUrl.hash)
+      throw new TypeError(
+        "Direct Web Bot Auth storyboard signing requires an HTTPS agentUrl without credentials or fragments"
+      );
+    const signed2 = createWebBotAuthFetch(deliver, key, options);
+    return (input, init) => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      if (new URL(url).origin !== agentUrl.origin)
+        return Promise.reject(new TypeError("Web Bot Auth storyboard refused a different agent origin"));
+      return signed2(input, init);
+    };
+  }
+  const publicUrl = new URL(options.target.publicUrl);
+  const localUrl = new URL(options.target.loopbackUrl);
+  if (publicUrl.protocol !== "https:" || publicUrl.username || publicUrl.password || publicUrl.hash || publicUrl.search || !["http:", "https:"].includes(localUrl.protocol) || !["localhost", "127.0.0.1", "[::1]"].includes(localUrl.hostname) || localUrl.username || localUrl.password || localUrl.hash || localUrl.search)
+    throw new TypeError(
+      "Web Bot Auth test delivery requires a public HTTPS URL and a loopback URL without credentials, query or fragment"
+    );
+  const signed = createWebBotAuthFetch(
+    async (input, init) => {
+      const target = new URL(String(input));
+      if (target.origin !== publicUrl.origin || target.pathname !== publicUrl.pathname)
+        throw new TypeError("Web Bot Auth test delivery refused a different public endpoint");
+      const destination = new URL(localUrl);
+      destination.search = target.search;
+      return deliver(destination.href, init);
+    },
+    key,
+    options
+  );
+  return async (input, init) => {
+    if (input instanceof Request) throw new TypeError("Web Bot Auth test delivery requires a URL and init");
+    const source = new URL(String(input));
+    if (source.origin !== localUrl.origin || source.pathname !== localUrl.pathname)
+      throw new TypeError("Web Bot Auth test delivery refused a different loopback endpoint");
+    const target = new URL(publicUrl);
+    target.search = source.search;
+    return signed(target.href, init);
+  };
+}
+export {
+  createStoryboardWebBotAuthFetch
+};

package/dist/lib/version.d.mts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "17.0.0-beta.2";
+export declare const LIBRARY_VERSION = "17.0.0-beta.4";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "17.0.0-beta.2";
+    readonly library: "17.0.0-beta.4";
     readonly adcp: "3.3.0-beta.0";
     readonly compatibleVersions: readonly ["v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.1.25", "3.1.26", "3.1.27", "3.1.28", "3.1.29", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4", "3.2.5", "3.2.6", "3.2.7", "3.3.0-beta.0", "3.3-beta.0"];
-    readonly generatedAt: "2026-10-27T06:33:58.733Z";
+    readonly generatedAt: "2026-10-28T18:30:58.178Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.d.ts

@@ -1,7 +1,7 @@
 /**
  * AdCP SDK library version
  */
-export declare const LIBRARY_VERSION = "17.0.0-beta.2";
+export declare const LIBRARY_VERSION = "17.0.0-beta.4";
 /**
  * AdCP specification version this library is built for
  */
@@ -33,10 +33,10 @@ export type AdcpVersion = (typeof COMPATIBLE_ADCP_VERSIONS)[number];
  * Full version information
  */
 export declare const VERSION_INFO: {
-    readonly library: "17.0.0-beta.2";
+    readonly library: "17.0.0-beta.4";
     readonly adcp: "3.3.0-beta.0";
     readonly compatibleVersions: readonly ["v3", "3.0.0", "3.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.5", "3.0.6", "3.0.7", "3.0.8", "3.0.9", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "3.0.16", "3.0.17", "3.0.18", "3.0.19", "3.0.20", "3.0.21", "3.0.22", "3.0.23", "3.0.24", "3.0.25", "3.1.0", "3.1", "3.1.1", "3.1.2", "3.1.3", "3.1.4", "3.1.5", "3.1.6", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.1.14", "3.1.15", "3.1.16", "3.1.17", "3.1.18", "3.1.19", "3.1.20", "3.1.21", "3.1.22", "3.1.23", "3.1.24", "3.1.25", "3.1.26", "3.1.27", "3.1.28", "3.1.29", "3.2.1", "3.2", "3.2.2", "3.2.3", "3.2.4", "3.2.5", "3.2.6", "3.2.7", "3.3.0-beta.0", "3.3-beta.0"];
-    readonly generatedAt: "2026-10-27T06:33:58.733Z";
+    readonly generatedAt: "2026-10-28T18:30:58.178Z";
 };
 /**
  * Get the AdCP specification version this library is built for

package/dist/lib/version.js

@@ -31,7 +31,7 @@ __export(version_exports, {
   toReleasePrecisionVersion: () => toReleasePrecisionVersion
 });
 module.exports = __toCommonJS(version_exports);
-const LIBRARY_VERSION = "17.0.0-beta.2";
+const LIBRARY_VERSION = "17.0.0-beta.4";
 const ADCP_VERSION = "3.3.0-beta.0";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -106,10 +106,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.3-beta.0"
 ];
 const VERSION_INFO = {
-  library: "17.0.0-beta.2",
+  library: "17.0.0-beta.4",
   adcp: "3.3.0-beta.0",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-27T06:33:58.733Z"
+  generatedAt: "2026-10-28T18:30:58.178Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/dist/lib/version.mjs

@@ -1,4 +1,4 @@
-const LIBRARY_VERSION = "17.0.0-beta.2";
+const LIBRARY_VERSION = "17.0.0-beta.4";
 const ADCP_VERSION = "3.3.0-beta.0";
 const ADCP_MAJOR_VERSION = 3;
 const COMPATIBLE_ADCP_VERSIONS = [
@@ -73,10 +73,10 @@ const COMPATIBLE_ADCP_VERSIONS = [
   "3.3-beta.0"
 ];
 const VERSION_INFO = {
-  library: "17.0.0-beta.2",
+  library: "17.0.0-beta.4",
   adcp: "3.3.0-beta.0",
   compatibleVersions: COMPATIBLE_ADCP_VERSIONS,
-  generatedAt: "2026-10-27T06:33:58.733Z"
+  generatedAt: "2026-10-28T18:30:58.178Z"
 };
 function getAdcpVersion() {
   return ADCP_VERSION;

package/docs/TYPE-SUMMARY.md

@@ -1,7 +1,7 @@
 # AdCP Type Summary
 
-> Generated at: 2026-10-27
-> @adcp/sdk v17.0.0-beta.2
+> Generated at: 2026-10-28
+> @adcp/sdk v17.0.0-beta.4
 
 Curated reference of the types that matter for using the AdCP client. For full generated types see `src/lib/types/tools.generated.ts` and `src/lib/types/core.generated.ts`.