@adcp/sdk 5.23.0

package/dist/lib/testing/storyboard/request-signing/grader.js

@@ -0,0 +1,517 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gradeRequestSigning = gradeRequestSigning;
+exports.gradeOneVector = gradeOneVector;
+const crypto_1 = require("crypto");
+const builder_1 = require("./builder");
+const probe_1 = require("./probe");
+const vector_loader_1 = require("./vector-loader");
+const test_kit_1 = require("./test-kit");
+const signing_1 = require("../../../signing");
+/**
+ * Grade an agent's RFC 9421 verifier against the 28 conformance vectors.
+ *
+ * Preconditions the caller owns:
+ *   - Agent advertises `request_signing.supported: true` in `get_adcp_capabilities`.
+ *   - Agent has pre-configured its verifier per `test-kits/signed-requests-runner.yaml`:
+ *     - Runner's signing keyids (`test-ed25519-2026`, `test-es256-2026`) accepted.
+ *     - `test-revoked-2026` pre-revoked.
+ *     - Per-keyid rate cap within grading_target_per_keyid_cap_requests.
+ *   - `agentUrl` targets a sandbox endpoint — the replay-window contract sends
+ *     a live valid request that will be accepted before the second (rejected)
+ *     copy fires.
+ */
+async function gradeRequestSigning(agentUrl, options = {}) {
+    const start = Date.now();
+    const loaded = (0, vector_loader_1.loadRequestSigningVectors)(options);
+    const contract = (0, test_kit_1.loadSignedRequestsRunnerContract)(options);
+    const probeOpts = {
+        allowPrivateIp: options.allowPrivateIp === true,
+        timeoutMs: options.timeoutMs,
+    };
+    const buildOpts = { baseUrl: agentUrl, transport: options.transport ?? 'raw' };
+    const positive = [];
+    for (const vector of loaded.positive) {
+        const skip = preflightSkip(vector, 'positive', contract, options);
+        if (skip) {
+            positive.push(skip);
+            continue;
+        }
+        const signed = (0, builder_1.buildPositiveRequest)(vector, loaded.keys, buildOpts);
+        const probed = await (0, probe_1.probeSignedRequest)(signed, probeOpts);
+        positive.push(gradePositive(vector, probed));
+    }
+    const negative = [];
+    for (const vector of loaded.negative) {
+        const skip = preflightSkip(vector, 'negative', contract, options);
+        if (skip) {
+            negative.push(skip);
+            continue;
+        }
+        negative.push(await gradeNegative(vector, loaded, contract, probeOpts, buildOpts, options));
+    }
+    const all = [...positive, ...negative];
+    const passed_count = all.filter(r => r.passed && !r.skipped).length;
+    const skipped_count = all.filter(r => r.skipped).length;
+    const failed_count = all.filter(r => !r.passed && !r.skipped).length;
+    const passed = failed_count === 0;
+    return {
+        agent_url: agentUrl,
+        harness_mode: 'black_box',
+        // Default to TRUE when no contract is loaded — we can't prove the endpoint
+        // is sandbox, so warn the operator that 016/020 could produce live side
+        // effects. Only FALSE when a contract is loaded AND declares sandbox.
+        live_endpoint_warning: !contract || contract.endpoint_scope !== 'sandbox',
+        contract_loaded: Boolean(contract),
+        positive,
+        negative,
+        passed,
+        passed_count,
+        failed_count,
+        skipped_count,
+        total_duration_ms: Date.now() - start,
+    };
+}
+// Positive vectors whose edge-case coverage survives only under raw transport
+// (per-operation endpoint URLs). Listed explicitly rather than heuristically
+// so a spec author adding a new canonicalization-edge vector has to opt into
+// the skip.
+const MCP_FLATTENED_VECTORS = new Set([
+    '005-default-port-stripped',
+    '006-dot-segment-path',
+    '007-query-byte-preserved',
+    '008-percent-encoded-path',
+]);
+// Vectors whose failure mode can't reach a live agent through HTTP. Document
+// why each entry can't be graded via probe so adding a new entry isn't a
+// silent coverage loss.
+const TRANSPORT_UNGRADABLE = {
+    // fetch() and the Node URL parser normalize U-labels to A-labels before
+    // the request leaves the client. A raw non-ASCII Host header reaches the
+    // agent as Punycode, defeating the parse-time check. Direct verifier
+    // tests exercise this edge.
+    '026-non-ascii-host': 'HTTP transport punycodes U-labels before the request leaves the client; verified at the library level.',
+};
+/**
+ * Centralized skip decisions. Checks (in order): onlyVectors filter,
+ * operator skipVectors, agent-capability-profile mismatch
+ * (`agentCapability` wired), transport-ungradable, MCP-mode URL-edge
+ * flattening, rate-abuse opt-out, stateful-contract missing, and the
+ * live-side-effect gate.
+ */
+function preflightSkip(vector, kind, contract, options) {
+    const expected_error_code = kind === 'negative' ? vector.expected_error_code : undefined;
+    const base = {
+        vector_id: vector.id,
+        kind,
+        passed: true, // skipped ≠ failed; overall pass/fail excludes skipped
+        http_status: 0,
+        probe_duration_ms: 0,
+        ...(expected_error_code ? { expected_error_code } : {}),
+    };
+    if (options.onlyVectors && !options.onlyVectors.includes(vector.id)) {
+        return { ...base, skipped: true, skip_reason: 'not_in_only_vectors' };
+    }
+    if (options.skipVectors?.includes(vector.id)) {
+        return { ...base, skipped: true, skip_reason: 'operator_skip' };
+    }
+    if (options.agentCapability) {
+        const mismatch = capabilityMismatch(vector.verifier_capability, options.agentCapability);
+        if (mismatch) {
+            // Surface the mismatch in the diagnostic so operators can audit
+            // which vectors were dodged. An agent that under-declares its
+            // capability (claims `required_for: []` while it actually
+            // enforces on multiple ops) would hide negative-vector failures
+            // here — the operator needs to see the skip count to catch that
+            // pattern. The caller inspects `report.skipped_count` plus the
+            // individual `skip_reason`/`diagnostic` pairs.
+            return {
+                ...base,
+                skipped: true,
+                skip_reason: 'capability_profile_mismatch',
+                diagnostic: mismatch,
+            };
+        }
+    }
+    if (kind === 'negative' && !options.agentCapability && options.agentContentDigestPolicy) {
+        const vectorCd = vector.verifier_capability.covers_content_digest;
+        if (vectorCd !== 'either' && vectorCd !== options.agentContentDigestPolicy) {
+            return {
+                ...base,
+                skipped: true,
+                skip_reason: 'capability_profile_mismatch',
+                diagnostic: `Vector asserts covers_content_digest='${vectorCd}' but agent declares '${options.agentContentDigestPolicy}'. ` +
+                    `The agent's policy is incompatible with the vector's expected verifier behavior.`,
+            };
+        }
+    }
+    const transportReason = TRANSPORT_UNGRADABLE[vector.id];
+    if (transportReason) {
+        return { ...base, skipped: true, skip_reason: 'transport_ungradable', diagnostic: transportReason };
+    }
+    // Canonicalization-edge positive vectors (005–008) bake their edge case
+    // into the vector URL path, query, or port. MCP mode flattens every vector
+    // to the same baseUrl (JSON-RPC single endpoint), so these vectors become
+    // indistinguishable from vector 001 — passing under MCP is not evidence
+    // the edge was tested. Skip with a distinct reason so the report doesn't
+    // claim coverage it didn't deliver.
+    if (kind === 'positive' && options.transport === 'mcp' && MCP_FLATTENED_VECTORS.has(vector.id)) {
+        return {
+            ...base,
+            skipped: true,
+            skip_reason: 'mcp_mode_flattens_url_edges',
+            diagnostic: `Vector ${vector.id} tests a URL-canonicalization edge (port/path/query/encoding) ` +
+                `that MCP mode neutralizes by routing every vector to the MCP endpoint. ` +
+                `Grade this edge with \`--transport raw\` against a per-operation AdCP agent.`,
+        };
+    }
+    if (kind === 'negative') {
+        const neg = vector;
+        if (neg.requires_contract === 'rate_abuse' && options.skipRateAbuse) {
+            return { ...base, skipped: true, skip_reason: 'rate_abuse_opt_out' };
+        }
+        if (neg.requires_contract && !contract) {
+            return {
+                ...base,
+                skipped: true,
+                skip_reason: 'missing_test_kit_contract',
+                diagnostic: 'Stateful vector requires `test-kits/signed-requests-runner.yaml` in the compliance cache. Run `npm run sync-schemas`.',
+            };
+        }
+        // Sandbox opt-in: vectors 016 (replay_window) and 020 (rate_abuse) produce
+        // live side effects on the agent. Refuse to run unless the contract says
+        // sandbox OR the operator explicitly accepts the side effects.
+        if ((neg.requires_contract === 'replay_window' || neg.requires_contract === 'rate_abuse') &&
+            !options.allowLiveSideEffects &&
+            contract?.endpoint_scope !== 'sandbox') {
+            return {
+                ...base,
+                skipped: true,
+                skip_reason: 'live_side_effect_opt_in_required',
+                diagnostic: `Vector ${vector.id} produces live agent-side effects. Pass allowLiveSideEffects: true ` +
+                    `(or point the grader at an endpoint whose signed-requests-runner contract declares ` +
+                    `endpoint_scope: sandbox) to run it.`,
+            };
+        }
+    }
+    return undefined;
+}
+/**
+ * Grade a single vector. Loads the vectors+keys+contract on every call; for
+ * the storyboard-runner dispatch path where the caller runs many vectors in
+ * sequence, prefer `gradeRequestSigning` which loads once.
+ */
+async function gradeOneVector(vectorId, kind, agentUrl, options = {}) {
+    const loaded = (0, vector_loader_1.loadRequestSigningVectors)(options);
+    const contract = (0, test_kit_1.loadSignedRequestsRunnerContract)(options);
+    const probeOpts = {
+        allowPrivateIp: options.allowPrivateIp === true,
+        timeoutMs: options.timeoutMs,
+    };
+    const buildOpts = { baseUrl: agentUrl, transport: options.transport ?? 'raw' };
+    const vector = kind === 'positive' ? loaded.positive.find(v => v.id === vectorId) : loaded.negative.find(v => v.id === vectorId);
+    if (!vector)
+        throw new Error(`Unknown ${kind} vector "${vectorId}"`);
+    const skip = preflightSkip(vector, kind, contract, options);
+    if (skip)
+        return skip;
+    if (kind === 'positive') {
+        const signed = (0, builder_1.buildPositiveRequest)(vector, loaded.keys, buildOpts);
+        const probe = await (0, probe_1.probeSignedRequest)(signed, probeOpts);
+        return gradePositive(vector, probe);
+    }
+    return gradeNegative(vector, loaded, contract, probeOpts, buildOpts, options);
+}
+// ── Phase helpers ─────────────────────────────────────────────
+function gradePositive(vector, probe) {
+    const accepted = probe.status >= 200 && probe.status < 300;
+    return {
+        vector_id: vector.id,
+        kind: 'positive',
+        passed: accepted && !probe.error,
+        http_status: probe.status,
+        diagnostic: accepted ? undefined : buildPositiveDiagnostic(vector, probe),
+        probe_duration_ms: probe.duration_ms,
+    };
+}
+function buildPositiveDiagnostic(vector, probe) {
+    if (probe.error)
+        return `probe error: ${probe.error}`;
+    const expected = 'a 2xx status';
+    const sigError = probe.wwwAuthenticateErrorCode;
+    if (sigError) {
+        return `expected ${expected}, got ${probe.status} with WWW-Authenticate error="${sigError}" — signer or agent-side JWKS likely mismatched. Vector: ${vector.name}`;
+    }
+    return `expected ${expected}, got ${probe.status}. Vector: ${vector.name}`;
+}
+async function gradeNegative(vector, loaded, contract, probeOpts, buildOpts, options) {
+    if (vector.jwks_override) {
+        return gradeJwksOverrideNegative(vector);
+    }
+    switch (vector.requires_contract) {
+        case 'replay_window':
+            return gradeReplayWindow(vector, loaded, probeOpts, buildOpts, options.replayProbePairs ?? 10);
+        case 'rate_abuse':
+            return gradeRateAbuse(vector, loaded, contract, probeOpts, buildOpts, options);
+        case 'revocation':
+        default:
+            return gradeStaticNegative(vector, loaded, probeOpts, buildOpts);
+    }
+}
+/**
+ * Grade vectors that ship an inline `jwks_override` against the library
+ * verifier directly. The agent's JWKS can't be mutated per-vector at probe
+ * time, so a black-box HTTP grade can't surface these failure modes.
+ * Grading the library verifier is the only path that exercises what the
+ * vector is testing — the inline JWK's kty/crv/alg consistency rules.
+ */
+async function gradeJwksOverrideNegative(vector) {
+    const override = vector.jwks_override;
+    const start = Date.now();
+    const jwks = new signing_1.StaticJwksResolver(override.keys);
+    const replayStore = new signing_1.InMemoryReplayStore();
+    const revocationStore = new signing_1.InMemoryRevocationStore();
+    const operation = new URL(vector.request.url).pathname.split('/').filter(Boolean).pop() ?? '';
+    try {
+        await (0, signing_1.verifyRequestSignature)(vector.request, {
+            capability: vector.verifier_capability,
+            jwks,
+            replayStore,
+            revocationStore,
+            now: () => vector.reference_now,
+            operation,
+        });
+        return {
+            vector_id: vector.id,
+            kind: 'negative',
+            passed: false,
+            http_status: 0,
+            expected_error_code: vector.expected_error_code,
+            diagnostic: `library verifier accepted a request expected to fail with error="${vector.expected_error_code}"`,
+            probe_duration_ms: Date.now() - start,
+        };
+    }
+    catch (err) {
+        if (err instanceof signing_1.RequestSignatureError) {
+            const passed = err.code === vector.expected_error_code;
+            return {
+                vector_id: vector.id,
+                kind: 'negative',
+                passed,
+                http_status: 0,
+                expected_error_code: vector.expected_error_code,
+                actual_error_code: err.code,
+                diagnostic: passed
+                    ? undefined
+                    : `library verifier rejected with error="${err.code}" but vector expects "${vector.expected_error_code}"`,
+                probe_duration_ms: Date.now() - start,
+            };
+        }
+        throw err;
+    }
+}
+function gradeStaticNegative(vector, loaded, probeOpts, buildOpts) {
+    const signed = (0, builder_1.buildNegativeRequest)(vector, loaded.keys, buildOpts);
+    return (0, probe_1.probeSignedRequest)(signed, probeOpts).then(probe => ({
+        vector_id: vector.id,
+        kind: 'negative',
+        passed: negativeAcceptedErrorCode(vector, probe),
+        http_status: probe.status,
+        expected_error_code: vector.expected_error_code,
+        actual_error_code: probe.wwwAuthenticateErrorCode,
+        diagnostic: buildNegativeDiagnostic(vector, probe),
+        probe_duration_ms: probe.duration_ms,
+    }));
+}
+async function gradeReplayWindow(vector, loaded, probeOpts, buildOpts, pairCount) {
+    // Run pairCount independent (probe1, probe2) pairs. Each pair uses a fresh
+    // nonce so pair N's probe1 doesn't consume pair N+1's replay-window slot.
+    // probeSignedRequest already closes its undici Agent on completion, so each
+    // call gets a new TCP connection — no keep-alive pinning to the same upstream.
+    let totalDurationMs = 0;
+    let rejectedCount = 0;
+    let lastSecondStatus = 0;
+    let lastSecondErrorCode;
+    for (let i = 0; i < pairCount; i++) {
+        const nonce = (0, crypto_1.randomBytes)(16).toString('base64url');
+        const signed = buildPositiveRequestFromNegative(vector, loaded, { ...buildOpts, nonce });
+        const first = await (0, probe_1.probeSignedRequest)(signed, probeOpts);
+        totalDurationMs += first.duration_ms;
+        if (first.status < 200 || first.status >= 300) {
+            return {
+                vector_id: vector.id,
+                kind: 'negative',
+                passed: false,
+                http_status: first.status,
+                expected_error_code: vector.expected_error_code,
+                actual_error_code: first.wwwAuthenticateErrorCode,
+                diagnostic: `replay_window contract: first submission MUST be accepted but agent returned ${first.status}` +
+                    (first.wwwAuthenticateErrorCode ? ` (error="${first.wwwAuthenticateErrorCode}")` : '') +
+                    '. Check runner JWKS registration with the agent.',
+                probe_duration_ms: totalDurationMs,
+                replay_pairs_tried: i + 1,
+                replay_pairs_rejected: rejectedCount,
+            };
+        }
+        const second = await (0, probe_1.probeSignedRequest)(signed, probeOpts);
+        totalDurationMs += second.duration_ms;
+        lastSecondStatus = second.status;
+        lastSecondErrorCode = second.wwwAuthenticateErrorCode;
+        if (negativeAcceptedErrorCode(vector, second)) {
+            rejectedCount++;
+        }
+    }
+    if (rejectedCount === pairCount) {
+        return {
+            vector_id: vector.id,
+            kind: 'negative',
+            passed: true,
+            http_status: lastSecondStatus,
+            expected_error_code: vector.expected_error_code,
+            actual_error_code: lastSecondErrorCode,
+            probe_duration_ms: totalDurationMs,
+            replay_pairs_tried: pairCount,
+            replay_pairs_rejected: pairCount,
+        };
+    }
+    return {
+        vector_id: vector.id,
+        kind: 'negative',
+        passed: false,
+        http_status: lastSecondStatus,
+        expected_error_code: vector.expected_error_code,
+        actual_error_code: lastSecondErrorCode,
+        diagnostic: buildReplayWindowFailDiagnostic(vector, rejectedCount, pairCount),
+        probe_duration_ms: totalDurationMs,
+        replay_pairs_tried: pairCount,
+        replay_pairs_rejected: rejectedCount,
+    };
+}
+function buildReplayWindowFailDiagnostic(vector, rejectedCount, pairCount) {
+    if (rejectedCount === 0) {
+        return (`expected 401 with error="${vector.expected_error_code}" on replayed nonce, but all ${pairCount} probe ` +
+            `pairs were accepted (got 200 on second submission every time). Verifier has no replay protection for this nonce. ` +
+            `If your verifier runs more than one process or machine instance, confirm the replay store is shared across ` +
+            `the pool — the default \`InMemoryReplayStore\` is per-process. For distributed deployments use ` +
+            `\`PostgresReplayStore\` from \`@adcp/sdk/signing/server\` or a Redis-backed \`ReplayStore\` ` +
+            `implementation. See https://github.com/adcontextprotocol/adcp-client/pull/1018`);
+    }
+    return (`${rejectedCount} of ${pairCount} probe pairs were correctly rejected; ` +
+        `${pairCount - rejectedCount} pair(s) had the second submission accepted. ` +
+        `This is the classic multi-instance \`InMemoryReplayStore\` pattern — the two probes in an ` +
+        `accepted pair landed on different load-balanced instances, each with its own per-process replay store. ` +
+        `For distributed deployments use \`PostgresReplayStore\` from \`@adcp/sdk/signing/server\` ` +
+        `or a Redis-backed \`ReplayStore\` implementation so all instances share one replay cache. ` +
+        `See https://github.com/adcontextprotocol/adcp-client/pull/1018`);
+}
+async function gradeRateAbuse(vector, loaded, contract, probeOpts, buildOpts, options) {
+    const cap = options.rateAbuseCap ?? contract.stateful_vector_contract.rate_abuse.grading_target_per_keyid_cap_requests;
+    // Fill the cap with cap distinct-nonce requests, then probe one more — that
+    // (cap+1)th request is what the vector expects to be rejected.
+    let durationMs = 0;
+    for (let i = 0; i < cap; i++) {
+        const nonce = (0, crypto_1.randomBytes)(16).toString('base64url');
+        const signed = (0, builder_1.buildNegativeRequest)(vector, loaded.keys, { nonce, ...buildOpts });
+        const probe = await (0, probe_1.probeSignedRequest)(signed, probeOpts);
+        durationMs += probe.duration_ms;
+    }
+    const finalNonce = (0, crypto_1.randomBytes)(16).toString('base64url');
+    const capPlusOne = (0, builder_1.buildNegativeRequest)(vector, loaded.keys, { nonce: finalNonce, ...buildOpts });
+    const probe = await (0, probe_1.probeSignedRequest)(capPlusOne, probeOpts);
+    durationMs += probe.duration_ms;
+    return {
+        vector_id: vector.id,
+        kind: 'negative',
+        passed: negativeAcceptedErrorCode(vector, probe),
+        http_status: probe.status,
+        expected_error_code: vector.expected_error_code,
+        actual_error_code: probe.wwwAuthenticateErrorCode,
+        diagnostic: buildNegativeDiagnostic(vector, probe),
+        probe_duration_ms: durationMs,
+    };
+}
+function buildPositiveRequestFromNegative(vector, loaded, options) {
+    // Vector 016 is structurally identical to positive/001 — sign it as a positive.
+    const pseudoPositive = {
+        kind: 'positive',
+        id: vector.id,
+        name: vector.name,
+        reference_now: vector.reference_now,
+        request: vector.request,
+        verifier_capability: vector.verifier_capability,
+        jwks_ref: vector.jwks_ref,
+        jwks_override: vector.jwks_override,
+    };
+    return (0, builder_1.buildPositiveRequest)(pseudoPositive, loaded.keys, options);
+}
+function negativeAcceptedErrorCode(vector, probe) {
+    return probe.status === 401 && probe.wwwAuthenticateErrorCode === vector.expected_error_code;
+}
+/**
+ * Compare a vector's `verifier_capability` fixture against the agent's
+ * declared capability profile. Returns a human-readable diagnostic when
+ * the two can't coexist — the vector asserts a policy the agent didn't
+ * advertise — or `undefined` when the vector is gradable under the
+ * agent's profile.
+ *
+ * Rules (all three must hold for a graded run):
+ *   - `covers_content_digest`: asymmetric. Vector-side `'either'` is
+ *     permissive (any agent policy can grade the vector). Agent-side
+ *     `'either'` is NOT permissive against a strict vector — an agent
+ *     that declares `'either'` accepts covered AND uncovered requests,
+ *     so it can't pass vectors 007 (`'required'`) or 018
+ *     (`'forbidden'`). Those auto-skip with `capability_profile_mismatch`.
+ *   - `required_for`: if the vector asserts a required_for operation,
+ *     the agent's `required_for` must include it. The reverse is fine
+ *     — an agent that requires MORE operations is still conformant
+ *     against a vector that asserts fewer.
+ *   - `supported`: must match. A vector with `supported: true` doesn't
+ *     grade against an agent that declares `supported: false` (the
+ *     conformance storyboard already skips such agents outright, but
+ *     defense-in-depth).
+ */
+function capabilityMismatch(vectorCap, agentCap) {
+    if (vectorCap.supported !== agentCap.supported) {
+        return (`Vector asserts supported=${vectorCap.supported} but agent declares supported=${agentCap.supported}. ` +
+            `Verify the agent's request_signing capability block.`);
+    }
+    // `covers_content_digest` asymmetry: vector-side `'either'` is
+    // permissive (any agent policy can grade the vector), but agent-side
+    // `'either'` is NOT permissive against a strict vector — an agent
+    // that declares `'either'` accepts requests with OR without
+    // Content-Digest, so vector 007's "MUST reject uncovered request"
+    // and vector 018's "MUST reject covered-when-forbidden" are
+    // structurally incompatible with the agent's stance. The check
+    // fires whenever the VECTOR is strict and the agent's declaration
+    // can't pass the vector's assertion.
+    if (vectorCap.covers_content_digest !== 'either' &&
+        vectorCap.covers_content_digest !== agentCap.covers_content_digest) {
+        return (`Vector asserts covers_content_digest='${vectorCap.covers_content_digest}' but agent declares '${agentCap.covers_content_digest}'. ` +
+            `The vector can't grade against this profile — its expected verifier behavior doesn't match what the agent implements.`);
+    }
+    // `required_for` on the vector: every op the vector expects to be
+    // required must also be required by the agent. Otherwise a negative
+    // vector (e.g., missing signature on `create_media_buy`) would test a
+    // rejection path the agent didn't opt into.
+    const vectorRequiredFor = vectorCap.required_for ?? [];
+    const agentRequiredForSet = new Set(agentCap.required_for ?? []);
+    const missingRequiredFor = vectorRequiredFor.filter(op => !agentRequiredForSet.has(op));
+    if (missingRequiredFor.length > 0) {
+        return (`Vector asserts required_for includes [${missingRequiredFor.join(', ')}] but agent's required_for does not. ` +
+            `Either add the operation to the agent's request_signing.required_for, or accept the skip.`);
+    }
+    return undefined;
+}
+function buildNegativeDiagnostic(vector, probe) {
+    if (probe.error)
+        return `probe error: ${probe.error}`;
+    if (probe.status === 401 && probe.wwwAuthenticateErrorCode === vector.expected_error_code) {
+        return undefined;
+    }
+    const actual = probe.wwwAuthenticateErrorCode ?? '(none)';
+    if (probe.status !== 401) {
+        return `expected 401 with error="${vector.expected_error_code}", got ${probe.status} (error="${actual}"). Vector: ${vector.name}`;
+    }
+    return `expected error="${vector.expected_error_code}", got error="${actual}". Check verifier step ordering — several vectors (015/017/020) depend on revocation/cap checks firing BEFORE crypto verify.`;
+}
+//# sourceMappingURL=grader.js.map

package/dist/lib/testing/storyboard/request-signing/grader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grader.js","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/grader.ts"],"names":[],"mappings":";;AA8KA,kDAwDC;AAmJD,wCA2BC;AApZD,mCAAqC;AACrC,uCAAkH;AAClH,mCAA+D;AAC/D,mDAAqF;AACrF,yCAAiG;AACjG,8CAO0B;AAqJ1B;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,UAAwB,EAAE;IACpF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,IAAA,yCAAyB,EAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAA,2CAAgC,EAAC,OAAO,CAAC,CAAC;IAE3D,MAAM,SAAS,GAAG;QAChB,cAAc,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;QAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IAEF,MAAM,SAAS,GAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;IAE7F,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,8BAAoB,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAkB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACrE,MAAM,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC;IAElC,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,WAAW;QACzB,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,qBAAqB,EAAE,CAAC,QAAQ,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS;QACzE,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC;QAClC,QAAQ;QACR,QAAQ;QACR,MAAM;QACN,YAAY;QACZ,YAAY;QACZ,aAAa;QACb,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KACtC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,YAAY;AACZ,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,2BAA2B;IAC3B,sBAAsB;IACtB,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC,CAAC;AAEH,6EAA6E;AAC7E,yEAAyE;AACzE,wBAAwB;AACxB,MAAM,oBAAoB,GAA2B;IACnD,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,4BAA4B;IAC5B,oBAAoB,EAClB,wGAAwG;CAC3G,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,MAAuC,EACvC,IAA6B,EAC7B,QAAkD,EAClD,OAAqB;IAErB,MAAM,mBAAmB,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAE,MAAyB,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7G,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,IAAI;QACJ,MAAM,EAAE,IAAI,EAAE,uDAAuD;QACrE,WAAW,EAAE,CAAC;QACd,iBAAiB,EAAE,CAAC;QACpB,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;IAEX,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACzF,IAAI,QAAQ,EAAE,CAAC;YACb,gEAAgE;YAChE,8DAA8D;YAC9D,0DAA0D;YAC1D,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,+CAA+C;YAC/C,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,6BAA6B;gBAC1C,UAAU,EAAE,QAAQ;aACrB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,wBAAwB,EAAE,CAAC;QACxF,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,qBAAqB,CAAC;QAClE,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,CAAC,wBAAwB,EAAE,CAAC;YAC3E,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,6BAA6B;gBAC1C,UAAU,EACR,yCAAyC,QAAQ,yBAAyB,OAAO,CAAC,wBAAwB,KAAK;oBAC/G,kFAAkF;aACrF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;IACtG,CAAC;IACD,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,oCAAoC;IACpC,IAAI,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/F,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,6BAA6B;YAC1C,UAAU,EACR,UAAU,MAAM,CAAC,EAAE,gEAAgE;gBACnF,yEAAyE;gBACzE,8EAA8E;SACjF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,MAAwB,CAAC;QACrC,IAAI,GAAG,CAAC,iBAAiB,KAAK,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACpE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;QACvE,CAAC;QACD,IAAI,GAAG,CAAC,iBAAiB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,2BAA2B;gBACxC,UAAU,EACR,uHAAuH;aAC1H,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,yEAAyE;QACzE,+DAA+D;QAC/D,IACE,CAAC,GAAG,CAAC,iBAAiB,KAAK,eAAe,IAAI,GAAG,CAAC,iBAAiB,KAAK,YAAY,CAAC;YACrF,CAAC,OAAO,CAAC,oBAAoB;YAC7B,QAAQ,EAAE,cAAc,KAAK,SAAS,EACtC,CAAC;YACD,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,kCAAkC;gBAC/C,UAAU,EACR,UAAU,MAAM,CAAC,EAAE,qEAAqE;oBACxF,qFAAqF;oBACrF,qCAAqC;aACxC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,IAA6B,EAC7B,QAAgB,EAChB,UAAwB,EAAE;IAE1B,MAAM,MAAM,GAAG,IAAA,yCAAyB,EAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAA,2CAAgC,EAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG;QAChB,cAAc,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;QAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;IACF,MAAM,SAAS,GAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;IAE7F,MAAM,MAAM,GACV,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACpH,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,YAAY,QAAQ,GAAG,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAA,8BAAoB,EAAC,MAAwB,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,IAAA,0BAAkB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,OAAO,aAAa,CAAC,MAAwB,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,aAAa,CAAC,MAAwB,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAClG,CAAC;AAED,iEAAiE;AAEjE,SAAS,aAAa,CAAC,MAAsB,EAAE,KAAkB;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;IAC3D,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK;QAChC,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC;QACzE,iBAAiB,EAAE,KAAK,CAAC,WAAW;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAsB,EAAE,KAAkB;IACzE,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,gBAAgB,KAAK,CAAC,KAAK,EAAE,CAAC;IACtD,MAAM,QAAQ,GAAG,cAAc,CAAC;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,wBAAwB,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,YAAY,QAAQ,SAAS,KAAK,CAAC,MAAM,iCAAiC,QAAQ,4DAA4D,MAAM,CAAC,IAAI,EAAE,CAAC;IACrK,CAAC;IACD,OAAO,YAAY,QAAQ,SAAS,KAAK,CAAC,MAAM,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAsB,EACtB,MAAoD,EACpD,QAAkD,EAClD,SAA0D,EAC1D,SAAuB,EACvB,OAAqB;IAErB,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,QAAQ,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACjC,KAAK,eAAe;YAClB,OAAO,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACjG,KAAK,YAAY;YACf,OAAO,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAClF,KAAK,YAAY,CAAC;QAClB;YACE,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CAAC,MAAsB;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAc,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,4BAAkB,CAAC,QAAQ,CAAC,IAAmC,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,IAAI,6BAAmB,EAAE,CAAC;IAC9C,MAAM,eAAe,GAAG,IAAI,iCAAuB,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9F,IAAI,CAAC;QACH,MAAM,IAAA,gCAAsB,EAAC,MAAM,CAAC,OAAO,EAAE;YAC3C,UAAU,EAAE,MAAM,CAAC,mBAAmB;YACtC,IAAI;YACJ,WAAW;YACX,eAAe;YACf,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa;YAC/B,SAAS;SACV,CAAC,CAAC;QACH,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,CAAC;YACd,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,UAAU,EAAE,oEAAoE,MAAM,CAAC,mBAAmB,GAAG;YAC7G,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SACtC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,+BAAqB,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,mBAAmB,CAAC;YACvD,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,IAAI,EAAE,UAAU;gBAChB,MAAM;gBACN,WAAW,EAAE,CAAC;gBACd,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,iBAAiB,EAAE,GAAG,CAAC,IAAI;gBAC3B,UAAU,EAAE,MAAM;oBAChB,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,yCAAyC,GAAG,CAAC,IAAI,yBAAyB,MAAM,CAAC,mBAAmB,GAAG;gBAC3G,iBAAiB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aACtC,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsB,EACtB,MAAoD,EACpD,SAA0D,EAC1D,SAAuB;IAEvB,MAAM,MAAM,GAAG,IAAA,8BAAoB,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpE,OAAO,IAAA,0BAAkB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1D,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,iBAAiB,EAAE,KAAK,CAAC,wBAAwB;QACjD,UAAU,EAAE,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC;QAClD,iBAAiB,EAAE,KAAK,CAAC,WAAW;KACrC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAsB,EACtB,MAAoD,EACpD,SAA0D,EAC1D,SAAuB,EACvB,SAAiB;IAEjB,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,mBAAuC,CAAC;IAE5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,gCAAgC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzF,MAAM,KAAK,GAAG,MAAM,IAAA,0BAAkB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,eAAe,IAAI,KAAK,CAAC,WAAW,CAAC;QAErC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC9C,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE,KAAK,CAAC,MAAM;gBACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;gBAC/C,iBAAiB,EAAE,KAAK,CAAC,wBAAwB;gBACjD,UAAU,EACR,gFAAgF,KAAK,CAAC,MAAM,EAAE;oBAC9F,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,wBAAwB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtF,kDAAkD;gBACpD,iBAAiB,EAAE,eAAe;gBAClC,kBAAkB,EAAE,CAAC,GAAG,CAAC;gBACzB,qBAAqB,EAAE,aAAa;aACrC,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,0BAAkB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC3D,eAAe,IAAI,MAAM,CAAC,WAAW,CAAC;QACtC,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;QACjC,mBAAmB,GAAG,MAAM,CAAC,wBAAwB,CAAC;QAEtD,IAAI,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,aAAa,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,gBAAgB;YAC7B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,iBAAiB,EAAE,mBAAmB;YACtC,iBAAiB,EAAE,eAAe;YAClC,kBAAkB,EAAE,SAAS;YAC7B,qBAAqB,EAAE,SAAS;SACjC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,gBAAgB;QAC7B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,iBAAiB,EAAE,mBAAmB;QACtC,UAAU,EAAE,+BAA+B,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC;QAC7E,iBAAiB,EAAE,eAAe;QAClC,kBAAkB,EAAE,SAAS;QAC7B,qBAAqB,EAAE,aAAa;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,MAAsB,EAAE,aAAqB,EAAE,SAAiB;IACvG,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CACL,4BAA4B,MAAM,CAAC,mBAAmB,gCAAgC,SAAS,SAAS;YACxG,mHAAmH;YACnH,6GAA6G;YAC7G,iGAAiG;YACjG,8FAA8F;YAC9F,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,CACL,GAAG,aAAa,OAAO,SAAS,wCAAwC;QACxE,GAAG,SAAS,GAAG,aAAa,+CAA+C;QAC3E,4FAA4F;QAC5F,yGAAyG;QACzG,4FAA4F;QAC5F,4FAA4F;QAC5F,gEAAgE,CACjE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAsB,EACtB,MAAoD,EACpD,QAAsC,EACtC,SAA0D,EAC1D,SAAuB,EACvB,OAAqB;IAErB,MAAM,GAAG,GACP,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,wBAAwB,CAAC,UAAU,CAAC,qCAAqC,CAAC;IAC7G,4EAA4E;IAC5E,+DAA+D;IAC/D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAA,8BAAoB,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,MAAM,IAAA,0BAAkB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,UAAU,IAAI,KAAK,CAAC,WAAW,CAAC;IAClC,CAAC;IACD,MAAM,UAAU,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAA,8BAAoB,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,MAAM,IAAA,0BAAkB,EAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC9D,UAAU,IAAI,KAAK,CAAC,WAAW,CAAC;IAChC,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,yBAAyB,CAAC,MAAM,EAAE,KAAK,CAAC;QAChD,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,iBAAiB,EAAE,KAAK,CAAC,wBAAwB;QACjD,UAAU,EAAE,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC;QAClD,iBAAiB,EAAE,UAAU;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,MAAsB,EACtB,MAAoD,EACpD,OAAyC;IAEzC,gFAAgF;IAChF,MAAM,cAAc,GAAmB;QACrC,IAAI,EAAE,UAAU;QAChB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;IACF,OAAO,IAAA,8BAAoB,EAAC,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAsB,EAAE,KAAkB;IAC3E,OAAO,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,wBAAwB,KAAK,MAAM,CAAC,mBAAmB,CAAC;AAC/F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,kBAAkB,CACzB,SAAoC,EACpC,QAAmC;IAEnC,IAAI,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO,CACL,4BAA4B,SAAS,CAAC,SAAS,iCAAiC,QAAQ,CAAC,SAAS,IAAI;YACtG,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,+DAA+D;IAC/D,qEAAqE;IACrE,kEAAkE;IAClE,4DAA4D;IAC5D,kEAAkE;IAClE,4DAA4D;IAC5D,+DAA+D;IAC/D,kEAAkE;IAClE,qCAAqC;IACrC,IACE,SAAS,CAAC,qBAAqB,KAAK,QAAQ;QAC5C,SAAS,CAAC,qBAAqB,KAAK,QAAQ,CAAC,qBAAqB,EAClE,CAAC;QACD,OAAO,CACL,yCAAyC,SAAS,CAAC,qBAAqB,yBAAyB,QAAQ,CAAC,qBAAqB,KAAK;YACpI,uHAAuH,CACxH,CAAC;IACJ,CAAC;IACD,kEAAkE;IAClE,oEAAoE;IACpE,sEAAsE;IACtE,4CAA4C;IAC5C,MAAM,iBAAiB,GAAG,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC;IACvD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CACL,yCAAyC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC;YAC7G,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAsB,EAAE,KAAkB;IACzE,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,gBAAgB,KAAK,CAAC,KAAK,EAAE,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,wBAAwB,KAAK,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,wBAAwB,IAAI,QAAQ,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACzB,OAAO,4BAA4B,MAAM,CAAC,mBAAmB,UAAU,KAAK,CAAC,MAAM,YAAY,MAAM,eAAe,MAAM,CAAC,IAAI,EAAE,CAAC;IACpI,CAAC;IACD,OAAO,mBAAmB,MAAM,CAAC,mBAAmB,iBAAiB,MAAM,8HAA8H,CAAC;AAC5M,CAAC"}

package/dist/lib/testing/storyboard/request-signing/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * RFC 9421 request-signing conformance grader.
+ *
+ * Tests any agent advertising `request_signing.supported: true` against the
+ * 28 conformance vectors shipped under
+ * `compliance/cache/{version}/test-vectors/request-signing/`. Grading is
+ * black-box and observable-behavior only — we construct signed HTTP requests
+ * (dynamically, using the test keypairs in keys.json) and compare the
+ * agent's responses to each vector's `expected_outcome`.
+ *
+ * @example
+ * ```ts
+ * import { gradeRequestSigning } from '@adcp/sdk/testing/storyboard/request-signing';
+ *
+ * const report = await gradeRequestSigning('https://sandbox.seller.com/adcp', {
+ *   skipRateAbuse: true, // skip the 101-request flood in routine runs
+ * });
+ * if (!report.passed) {
+ *   for (const r of [...report.positive, ...report.negative]) {
+ *     if (!r.passed && !r.skipped) console.log(`${r.vector_id}: ${r.diagnostic}`);
+ *   }
+ * }
+ * ```
+ *
+ * For storyboard-runner integration (synthesized per-vector steps dispatched
+ * through `runStoryboard` / `runStoryboardStep`), see
+ * `StoryboardRunOptions.request_signing` on the runner options.
+ */
+export { gradeRequestSigning, gradeOneVector, type GradeOptions, type GradeReport, type VectorGradeResult, } from './grader';
+export { synthesizeRequestSigningSteps, parseRequestSigningStepId, REQUEST_SIGNING_PROBE_TASK, POSITIVE_STEP_PREFIX, NEGATIVE_STEP_PREFIX, type SynthesizeOptions, } from './synthesize';
+export { probeRequestSigningVector } from './probe-dispatch';
+export type { NegativeVector, PositiveVector, TestKeypair, TestKeyset, VectorRequest, VerifierCapabilityFixture, Vector, ContractId, } from './types';
+export { CONTRACT_IDS } from './types';
+export { loadRequestSigningVectors, findKey, type LoadVectorsOptions, type LoadedVectors } from './vector-loader';
+export { buildPositiveRequest, buildNegativeRequest, listSupportedNegativeVectors, type BuildOptions, type SignedHttpRequest, } from './builder';
+export { loadSignedRequestsRunnerContract, type LoadTestKitOptions, type RateAbuseContract, type ReplayWindowContract, type RevocationContract, type RunnerSigningKey, type SignedRequestsRunnerContract, } from './test-kit';
+export { probeSignedRequest, extractSignatureErrorCode, type ProbeOptions, type ProbeResult } from './probe';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/testing/storyboard/request-signing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,UAAU,CAAC;AAMlB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAM7D,YAAY,EACV,cAAc,EACd,cAAc,EACd,WAAW,EACX,UAAU,EACV,aAAa,EACb,yBAAyB,EACzB,MAAM,EACN,UAAU,GACX,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAElH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,gCAAgC,EAChC,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,GAClC,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC"}

package/dist/lib/testing/storyboard/request-signing/index.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * RFC 9421 request-signing conformance grader.
+ *
+ * Tests any agent advertising `request_signing.supported: true` against the
+ * 28 conformance vectors shipped under
+ * `compliance/cache/{version}/test-vectors/request-signing/`. Grading is
+ * black-box and observable-behavior only — we construct signed HTTP requests
+ * (dynamically, using the test keypairs in keys.json) and compare the
+ * agent's responses to each vector's `expected_outcome`.
+ *
+ * @example
+ * ```ts
+ * import { gradeRequestSigning } from '@adcp/sdk/testing/storyboard/request-signing';
+ *
+ * const report = await gradeRequestSigning('https://sandbox.seller.com/adcp', {
+ *   skipRateAbuse: true, // skip the 101-request flood in routine runs
+ * });
+ * if (!report.passed) {
+ *   for (const r of [...report.positive, ...report.negative]) {
+ *     if (!r.passed && !r.skipped) console.log(`${r.vector_id}: ${r.diagnostic}`);
+ *   }
+ * }
+ * ```
+ *
+ * For storyboard-runner integration (synthesized per-vector steps dispatched
+ * through `runStoryboard` / `runStoryboardStep`), see
+ * `StoryboardRunOptions.request_signing` on the runner options.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractSignatureErrorCode = exports.probeSignedRequest = exports.loadSignedRequestsRunnerContract = exports.listSupportedNegativeVectors = exports.buildNegativeRequest = exports.buildPositiveRequest = exports.findKey = exports.loadRequestSigningVectors = exports.CONTRACT_IDS = exports.probeRequestSigningVector = exports.NEGATIVE_STEP_PREFIX = exports.POSITIVE_STEP_PREFIX = exports.REQUEST_SIGNING_PROBE_TASK = exports.parseRequestSigningStepId = exports.synthesizeRequestSigningSteps = exports.gradeOneVector = exports.gradeRequestSigning = void 0;
+// ── Public API ────────────────────────────────────────────────────
+// These are what 95% of consumers need. Start here.
+var grader_1 = require("./grader");
+Object.defineProperty(exports, "gradeRequestSigning", { enumerable: true, get: function () { return grader_1.gradeRequestSigning; } });
+Object.defineProperty(exports, "gradeOneVector", { enumerable: true, get: function () { return grader_1.gradeOneVector; } });
+// ── Storyboard-runner hooks ───────────────────────────────────────
+// Surfaces used internally by the runner; exported so external runners and
+// custom harnesses can wire them the same way.
+var synthesize_1 = require("./synthesize");
+Object.defineProperty(exports, "synthesizeRequestSigningSteps", { enumerable: true, get: function () { return synthesize_1.synthesizeRequestSigningSteps; } });
+Object.defineProperty(exports, "parseRequestSigningStepId", { enumerable: true, get: function () { return synthesize_1.parseRequestSigningStepId; } });
+Object.defineProperty(exports, "REQUEST_SIGNING_PROBE_TASK", { enumerable: true, get: function () { return synthesize_1.REQUEST_SIGNING_PROBE_TASK; } });
+Object.defineProperty(exports, "POSITIVE_STEP_PREFIX", { enumerable: true, get: function () { return synthesize_1.POSITIVE_STEP_PREFIX; } });
+Object.defineProperty(exports, "NEGATIVE_STEP_PREFIX", { enumerable: true, get: function () { return synthesize_1.NEGATIVE_STEP_PREFIX; } });
+var probe_dispatch_1 = require("./probe-dispatch");
+Object.defineProperty(exports, "probeRequestSigningVector", { enumerable: true, get: function () { return probe_dispatch_1.probeRequestSigningVector; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "CONTRACT_IDS", { enumerable: true, get: function () { return types_1.CONTRACT_IDS; } });
+var vector_loader_1 = require("./vector-loader");
+Object.defineProperty(exports, "loadRequestSigningVectors", { enumerable: true, get: function () { return vector_loader_1.loadRequestSigningVectors; } });
+Object.defineProperty(exports, "findKey", { enumerable: true, get: function () { return vector_loader_1.findKey; } });
+var builder_1 = require("./builder");
+Object.defineProperty(exports, "buildPositiveRequest", { enumerable: true, get: function () { return builder_1.buildPositiveRequest; } });
+Object.defineProperty(exports, "buildNegativeRequest", { enumerable: true, get: function () { return builder_1.buildNegativeRequest; } });
+Object.defineProperty(exports, "listSupportedNegativeVectors", { enumerable: true, get: function () { return builder_1.listSupportedNegativeVectors; } });
+var test_kit_1 = require("./test-kit");
+Object.defineProperty(exports, "loadSignedRequestsRunnerContract", { enumerable: true, get: function () { return test_kit_1.loadSignedRequestsRunnerContract; } });
+var probe_1 = require("./probe");
+Object.defineProperty(exports, "probeSignedRequest", { enumerable: true, get: function () { return probe_1.probeSignedRequest; } });
+Object.defineProperty(exports, "extractSignatureErrorCode", { enumerable: true, get: function () { return probe_1.extractSignatureErrorCode; } });
+//# sourceMappingURL=index.js.map