@adcp/sdk 5.23.0

package/dist/lib/testing/storyboard/request-signing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AAEH,qEAAqE;AACrE,oDAAoD;AAEpD,mCAMkB;AALhB,6GAAA,mBAAmB,OAAA;AACnB,wGAAA,cAAc,OAAA;AAMhB,qEAAqE;AACrE,2EAA2E;AAC3E,+CAA+C;AAE/C,2CAOsB;AANpB,2HAAA,6BAA6B,OAAA;AAC7B,uHAAA,yBAAyB,OAAA;AACzB,wHAAA,0BAA0B,OAAA;AAC1B,kHAAA,oBAAoB,OAAA;AACpB,kHAAA,oBAAoB,OAAA;AAItB,mDAA6D;AAApD,2HAAA,yBAAyB,OAAA;AAiBlC,iCAAuC;AAA9B,qGAAA,YAAY,OAAA;AAErB,iDAAkH;AAAzG,0HAAA,yBAAyB,OAAA;AAAE,wGAAA,OAAO,OAAA;AAE3C,qCAMmB;AALjB,+GAAA,oBAAoB,OAAA;AACpB,+GAAA,oBAAoB,OAAA;AACpB,uHAAA,4BAA4B,OAAA;AAK9B,uCAQoB;AAPlB,4HAAA,gCAAgC,OAAA;AASlC,iCAA6G;AAApG,2GAAA,kBAAkB,OAAA;AAAE,kHAAA,yBAAyB,OAAA"}

package/dist/lib/testing/storyboard/request-signing/probe-dispatch.d.ts

@@ -0,0 +1,10 @@
+import type { HttpProbeResult, StoryboardRunOptions } from '../types';
+/**
+ * Dispatch a synthesized request-signing step. The step ID encodes the vector
+ * (`positive-<id>` / `negative-<id>`); this helper decodes it, runs the
+ * grader's per-vector logic, and maps the `VectorGradeResult` to an
+ * `HttpProbeResult`-shaped return so the existing validation pipeline
+ * (`http_status`, `http_status_in`) works unchanged.
+ */
+export declare function probeRequestSigningVector(stepId: string, agentUrl: string, options: StoryboardRunOptions): Promise<HttpProbeResult>;
+//# sourceMappingURL=probe-dispatch.d.ts.map

package/dist/lib/testing/storyboard/request-signing/probe-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-dispatch.d.ts","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/probe-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAKtE;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA6D1B"}

package/dist/lib/testing/storyboard/request-signing/probe-dispatch.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.probeRequestSigningVector = probeRequestSigningVector;
+const grader_1 = require("./grader");
+const synthesize_1 = require("./synthesize");
+const vector_loader_1 = require("./vector-loader");
+/**
+ * Dispatch a synthesized request-signing step. The step ID encodes the vector
+ * (`positive-<id>` / `negative-<id>`); this helper decodes it, runs the
+ * grader's per-vector logic, and maps the `VectorGradeResult` to an
+ * `HttpProbeResult`-shaped return so the existing validation pipeline
+ * (`http_status`, `http_status_in`) works unchanged.
+ */
+async function probeRequestSigningVector(stepId, agentUrl, options) {
+    const parsed = (0, synthesize_1.parseRequestSigningStepId)(stepId);
+    if (!parsed) {
+        return {
+            url: agentUrl,
+            status: 0,
+            headers: {},
+            body: null,
+            error: `request_signing_probe: step id "${stepId}" does not match positive-/negative- prefix`,
+        };
+    }
+    const rsOpts = options.request_signing ?? {};
+    // Vector-id lookup so we skip by the vector's `requires_contract`, not by
+    // hardcoded vector id. Keeps the dispatch resilient to upstream renames.
+    if (parsed.kind === 'negative' && rsOpts.skipRateAbuse) {
+        try {
+            const loaded = (0, vector_loader_1.loadRequestSigningVectors)();
+            const vector = loaded.negative.find(v => v.id === parsed.vector_id);
+            if (vector?.requires_contract === 'rate_abuse') {
+                return skipProbe(agentUrl, `${parsed.vector_id} skipped via request_signing.skipRateAbuse`);
+            }
+        }
+        catch {
+            // fall through — surfaces as a grader error below
+        }
+    }
+    if (rsOpts.skipVectors?.includes(parsed.vector_id)) {
+        return skipProbe(agentUrl, `${parsed.vector_id} skipped via request_signing.skipVectors`);
+    }
+    try {
+        const result = await (0, grader_1.gradeOneVector)(parsed.vector_id, parsed.kind, agentUrl, {
+            allowPrivateIp: options.allow_http === true,
+            rateAbuseCap: rsOpts.rateAbuseCap,
+            allowLiveSideEffects: rsOpts.allowLiveSideEffects,
+            onlyVectors: rsOpts.onlyVectors,
+            skipVectors: rsOpts.skipVectors,
+            skipRateAbuse: rsOpts.skipRateAbuse,
+            ...(rsOpts.transport && { transport: rsOpts.transport }),
+        });
+        if (result.skipped) {
+            return skipProbe(agentUrl, result.skip_reason ?? 'grader_skipped');
+        }
+        const headers = {};
+        if (result.actual_error_code) {
+            headers['www-authenticate'] = `Signature error="${result.actual_error_code}"`;
+        }
+        return {
+            url: agentUrl,
+            status: result.http_status,
+            headers,
+            body: result.diagnostic ?? null,
+            error: result.passed ? undefined : (result.diagnostic ?? 'vector grade failed'),
+        };
+    }
+    catch (err) {
+        return {
+            url: agentUrl,
+            status: 0,
+            headers: {},
+            body: null,
+            error: `request_signing_probe threw: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+function skipProbe(url, reason) {
+    return { url, status: 0, headers: {}, body: null, skipped: true, skip_reason: reason };
+}
+//# sourceMappingURL=probe-dispatch.js.map

package/dist/lib/testing/storyboard/request-signing/probe-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-dispatch.js","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/probe-dispatch.ts"],"names":[],"mappings":";;AAYA,8DAiEC;AA5ED,qCAA0C;AAC1C,6CAAyD;AACzD,mDAA4D;AAE5D;;;;;;GAMG;AACI,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,QAAgB,EAChB,OAA6B;IAE7B,MAAM,MAAM,GAAG,IAAA,sCAAyB,EAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,mCAAmC,MAAM,6CAA6C;SAC9F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC7C,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAA,yCAAyB,GAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,MAAM,EAAE,iBAAiB,KAAK,YAAY,EAAE,CAAC;gBAC/C,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,4CAA4C,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,0CAA0C,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAc,EAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE;YAC3E,cAAc,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI;YAC3C,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,OAAO,CAAC,kBAAkB,CAAC,GAAG,oBAAoB,MAAM,CAAC,iBAAiB,GAAG,CAAC;QAChF,CAAC;QACD,OAAO;YACL,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;YAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,qBAAqB,CAAC;SAChF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,IAAI;YACV,KAAK,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,MAAc;IAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AACzF,CAAC"}

package/dist/lib/testing/storyboard/request-signing/probe.d.ts

@@ -0,0 +1,41 @@
+import type { SignedHttpRequest } from './builder';
+export interface ProbeOptions {
+    /** Allow http:// and private-IP destinations. Default false. */
+    allowPrivateIp?: boolean;
+    /** Per-call timeout override (ms). */
+    timeoutMs?: number;
+}
+export interface ProbeResult {
+    url: string;
+    status: number;
+    headers: Record<string, string>;
+    /** Error code extracted from `WWW-Authenticate: Signature error="<code>"`. */
+    wwwAuthenticateErrorCode?: string;
+    /** Truncated response body (first 64 KiB, JSON-parsed if applicable). */
+    body: unknown;
+    /** Network-level error; non-undefined means the request didn't complete. */
+    error?: string;
+    duration_ms: number;
+}
+/**
+ * Send a signed HTTP request to an AdCP agent and capture the response fields
+ * needed for conformance grading (status, WWW-Authenticate error code, body).
+ *
+ * Reuses the SSRF guards from the address classifiers — scheme check,
+ * `isAlwaysBlocked`, `isPrivateIp` — then pins the outbound connection to the
+ * pre-validated address via an undici dispatcher, defeating DNS rebinding.
+ * Bodies are capped at 64 KiB and parsed as JSON when content-type matches;
+ * otherwise returned as text. `redirect: 'manual'` is enforced so an agent
+ * that 301s can't smuggle the grader elsewhere.
+ */
+export declare function probeSignedRequest(signed: SignedHttpRequest, options?: ProbeOptions): Promise<ProbeResult>;
+/**
+ * Extract `error="<code>"` from a `WWW-Authenticate: Signature ...` header.
+ * Returns undefined when the header isn't a Signature challenge, the param
+ * is absent, or the extracted value isn't a well-formed spec error code
+ * (a token in `[a-z0-9_]+`). Sanitizing at source keeps downstream
+ * diagnostics / LLM-consumption paths safe from smuggled content in
+ * attacker-controlled header values.
+ */
+export declare function extractSignatureErrorCode(headerValue: string): string | undefined;
+//# sourceMappingURL=probe.d.ts.map

package/dist/lib/testing/storyboard/request-signing/probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.d.ts","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/probe.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAKnD,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,8EAA8E;IAC9E,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,yEAAyE;IACzE,IAAI,EAAE,OAAO,CAAC;IACd,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CA2IpH;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAgBjF"}

package/dist/lib/testing/storyboard/request-signing/probe.js

@@ -0,0 +1,220 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.probeSignedRequest = probeSignedRequest;
+exports.extractSignatureErrorCode = extractSignatureErrorCode;
+const promises_1 = require("dns/promises");
+const undici_1 = require("undici");
+const probes_1 = require("../probes");
+const DEFAULT_TIMEOUT_MS = 10_000;
+const MAX_BODY_BYTES = 64 * 1024;
+/**
+ * Send a signed HTTP request to an AdCP agent and capture the response fields
+ * needed for conformance grading (status, WWW-Authenticate error code, body).
+ *
+ * Reuses the SSRF guards from the address classifiers — scheme check,
+ * `isAlwaysBlocked`, `isPrivateIp` — then pins the outbound connection to the
+ * pre-validated address via an undici dispatcher, defeating DNS rebinding.
+ * Bodies are capped at 64 KiB and parsed as JSON when content-type matches;
+ * otherwise returned as text. `redirect: 'manual'` is enforced so an agent
+ * that 301s can't smuggle the grader elsewhere.
+ */
+async function probeSignedRequest(signed, options = {}) {
+    const start = Date.now();
+    const timeout = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const result = { url: signed.url, status: 0, headers: {}, body: null, duration_ms: 0 };
+    let parsed;
+    try {
+        parsed = new URL(signed.url);
+    }
+    catch {
+        result.error = `Invalid URL: ${signed.url}`;
+        result.duration_ms = Date.now() - start;
+        return result;
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        result.error = `Refusing to probe URL with unsupported scheme: ${parsed.protocol}`;
+        result.duration_ms = Date.now() - start;
+        return result;
+    }
+    if (parsed.protocol !== 'https:' && !options.allowPrivateIp) {
+        result.error = `Refusing to probe non-HTTPS URL: ${signed.url}`;
+        result.duration_ms = Date.now() - start;
+        return result;
+    }
+    // Strip URL brackets from IPv6 literals (`[::1]` → `::1`) before DNS lookup
+    // and address classification. `URL.hostname` wraps IPv6 in brackets; both
+    // `dns.lookup` and the address classifiers need the bare form.
+    const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
+    let addresses;
+    try {
+        addresses = await (0, promises_1.lookup)(hostname, { all: true });
+    }
+    catch (err) {
+        result.error = `DNS lookup failed for ${hostname}: ${err instanceof Error ? err.message : String(err)}`;
+        result.duration_ms = Date.now() - start;
+        return result;
+    }
+    if (addresses.length === 0) {
+        result.error = `DNS returned no addresses for ${hostname}`;
+        result.duration_ms = Date.now() - start;
+        return result;
+    }
+    for (const a of addresses) {
+        if ((0, probes_1.isAlwaysBlocked)(a.address)) {
+            result.error = `Refusing to probe always-blocked address ${a.address} for ${hostname}`;
+            result.duration_ms = Date.now() - start;
+            return result;
+        }
+    }
+    if (!options.allowPrivateIp) {
+        for (const a of addresses) {
+            if ((0, probes_1.isPrivateIp)(a.address)) {
+                result.error = `Refusing to probe private/loopback address ${a.address} for ${hostname}`;
+                result.duration_ms = Date.now() - start;
+                return result;
+            }
+        }
+    }
+    const pinned = addresses[0];
+    const pinnedFamily = pinned.family === 6 ? 6 : 4;
+    // undici calls lookup with { all: true } for HTTPS targets on Node 22+, which
+    // expects the array form of the callback. Handle both shapes so the pin works
+    // across Node versions.
+    const dispatcher = new undici_1.Agent({
+        connect: {
+            lookup: (_h, opts, cb) => {
+                if (opts?.all) {
+                    cb(null, [{ address: pinned.address, family: pinnedFamily }]);
+                }
+                else {
+                    cb(null, pinned.address, pinnedFamily);
+                }
+            },
+        },
+    });
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), timeout);
+    try {
+        const res = await (0, undici_1.fetch)(signed.url, {
+            method: signed.method,
+            redirect: 'manual',
+            signal: ac.signal,
+            headers: signed.headers,
+            body: signed.body,
+            dispatcher,
+        });
+        result.status = res.status;
+        const headers = {};
+        res.headers.forEach((v, k) => {
+            headers[k.toLowerCase()] = v;
+        });
+        result.headers = headers;
+        const wwwAuth = headers['www-authenticate'];
+        if (wwwAuth) {
+            result.wwwAuthenticateErrorCode = extractSignatureErrorCode(wwwAuth);
+        }
+        const reader = res.body?.getReader();
+        if (reader) {
+            const chunks = [];
+            let bytes = 0;
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                bytes += value.byteLength;
+                if (bytes > MAX_BODY_BYTES) {
+                    await reader.cancel();
+                    result.error = `Response body exceeded ${MAX_BODY_BYTES} bytes`;
+                    return result;
+                }
+                chunks.push(value);
+            }
+            const buf = Buffer.concat(chunks.map(c => Buffer.from(c.buffer, c.byteOffset, c.byteLength)));
+            const contentType = headers['content-type'] ?? '';
+            if (contentType.includes('application/json')) {
+                try {
+                    result.body = JSON.parse(buf.toString('utf8'));
+                }
+                catch {
+                    result.body = buf.toString('utf8');
+                }
+            }
+            else {
+                result.body = buf.toString('utf8');
+            }
+        }
+        return result;
+    }
+    catch (err) {
+        result.error = err instanceof Error ? err.message : String(err);
+        return result;
+    }
+    finally {
+        clearTimeout(timer);
+        result.duration_ms = Date.now() - start;
+        await dispatcher.close().catch(() => { });
+    }
+}
+/**
+ * Extract `error="<code>"` from a `WWW-Authenticate: Signature ...` header.
+ * Returns undefined when the header isn't a Signature challenge, the param
+ * is absent, or the extracted value isn't a well-formed spec error code
+ * (a token in `[a-z0-9_]+`). Sanitizing at source keeps downstream
+ * diagnostics / LLM-consumption paths safe from smuggled content in
+ * attacker-controlled header values.
+ */
+function extractSignatureErrorCode(headerValue) {
+    // `WWW-Authenticate` may carry multiple challenges concatenated with commas.
+    // We only grade Signature challenges; ignore Basic/Bearer/etc.
+    const challenges = splitChallenges(headerValue);
+    for (const challenge of challenges) {
+        if (!/^Signature\b/i.test(challenge))
+            continue;
+        const m = /\berror\s*=\s*"([^"]*)"/.exec(challenge);
+        if (!m)
+            continue;
+        const value = m[1];
+        // Spec error codes are `request_signature_*` — all lowercase-alnum +
+        // underscore. Reject anything else so quotes/newlines/HTML/LLM-poisoning
+        // content can't flow into diagnostic strings or rendered reports.
+        if (value && /^[a-z0-9_]+$/.test(value))
+            return value;
+        return undefined;
+    }
+    return undefined;
+}
+/**
+ * Split a `WWW-Authenticate` header into per-challenge chunks. RFC 7235 §4.1
+ * lets multiple challenges coexist separated by commas, and challenge params
+ * are `k="v"` where `v` can contain commas. Track quote state so an
+ * adversarial `error="foo, Bar baz"` doesn't spuriously split mid-value.
+ */
+function splitChallenges(headerValue) {
+    const parts = [];
+    let current = '';
+    let inQuotes = false;
+    for (let i = 0; i < headerValue.length; i++) {
+        const ch = headerValue[i];
+        if (ch === '"' && headerValue[i - 1] !== '\\') {
+            inQuotes = !inQuotes;
+            current += ch;
+            continue;
+        }
+        if (!inQuotes && ch === ',') {
+            // Look ahead for a scheme-like token (`<name><whitespace>`) — only
+            // then treat this comma as a challenge boundary; otherwise it's a
+            // param-list separator inside the current challenge.
+            const rest = headerValue.slice(i + 1);
+            if (/^\s*[A-Za-z][A-Za-z0-9-]*\s+/.test(rest)) {
+                parts.push(current.trim());
+                current = '';
+                continue;
+            }
+        }
+        current += ch;
+    }
+    if (current.trim().length > 0)
+        parts.push(current.trim());
+    return parts.filter(p => p.length > 0);
+}
+//# sourceMappingURL=probe.js.map

package/dist/lib/testing/storyboard/request-signing/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/probe.ts"],"names":[],"mappings":";;AAwCA,gDA2IC;AAUD,8DAgBC;AA5MD,2CAAmD;AACnD,mCAAqD;AACrD,sCAAyD;AAGzD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAsBjC;;;;;;;;;;GAUG;AACI,KAAK,UAAU,kBAAkB,CAAC,MAAyB,EAAE,UAAwB,EAAE;IAC5F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,MAAM,MAAM,GAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IAEpG,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,GAAG,gBAAgB,MAAM,CAAC,GAAG,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,CAAC,KAAK,GAAG,kDAAkD,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnF,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5D,MAAM,CAAC,KAAK,GAAG,oCAAoC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEzD,IAAI,SAAgD,CAAC;IACrD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,IAAA,iBAAS,EAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,GAAG,yBAAyB,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACxG,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,GAAG,iCAAiC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,IAAA,wBAAe,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,GAAG,4CAA4C,CAAC,CAAC,OAAO,QAAQ,QAAQ,EAAE,CAAC;YACvF,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACxC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,GAAG,8CAA8C,CAAC,CAAC,OAAO,QAAQ,QAAQ,EAAE,CAAC;gBACzF,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACxC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;IAC7B,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,8EAA8E;IAC9E,8EAA8E;IAC9E,wBAAwB;IACxB,MAAM,UAAU,GAAG,IAAI,cAAK,CAAC;QAC3B,OAAO,EAAE;YACP,MAAM,EAAE,CACN,EAAU,EACV,IAA+B,EAC/B,EAAmG,EACnG,EAAE;gBACF,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC;oBACd,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,cAAW,EAAC,MAAM,CAAC,GAAG,EAAE;YACxC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU;SACX,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC3B,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;QAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,wBAAwB,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QACrC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAiB,EAAE,CAAC;YAChC,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;oBAC3B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;oBACtB,MAAM,CAAC,KAAK,GAAG,0BAA0B,cAAc,QAAQ,CAAC;oBAChE,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC9F,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAClD,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACxC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,WAAmB;IAC3D,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAChD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,SAAS;QAC/C,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,qEAAqE;QACrE,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAC3B,IAAI,EAAE,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,OAAO,IAAI,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5B,mEAAmE;YACnE,kEAAkE;YAClE,qDAAqD;YACrD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3B,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/lib/testing/storyboard/request-signing/synthesize.d.ts

@@ -0,0 +1,28 @@
+import type { Storyboard } from '../types';
+import { type LoadVectorsOptions } from './vector-loader';
+export declare const REQUEST_SIGNING_PROBE_TASK = "request_signing_probe";
+export declare const POSITIVE_STEP_PREFIX = "positive-";
+export declare const NEGATIVE_STEP_PREFIX = "negative-";
+export interface SynthesizeOptions extends LoadVectorsOptions {
+    /** Vector IDs to omit (e.g., capability-profile mismatches). */
+    skipVectors?: string[];
+}
+/**
+ * Expand the `positive_vectors` and `negative_vectors` phases of the
+ * signed-requests specialism with one synthesized step per fixture. The YAML
+ * deliberately ships these phases with empty step lists — steps are generated
+ * from the cached test-vector fixtures so a runner can grade any advertising
+ * agent without duplicating fixture data in the spec.
+ *
+ * Returns the input storyboard unchanged if it isn't signed-requests.
+ */
+export declare function synthesizeRequestSigningSteps(storyboard: Storyboard, options?: SynthesizeOptions): Storyboard;
+/**
+ * Parse the synthesized step ID back into the vector id + kind so the probe
+ * dispatch can look up the fixture.
+ */
+export declare function parseRequestSigningStepId(stepId: string): {
+    kind: 'positive' | 'negative';
+    vector_id: string;
+} | undefined;
+//# sourceMappingURL=synthesize.d.ts.map

package/dist/lib/testing/storyboard/request-signing/synthesize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"synthesize.d.ts","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/synthesize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,UAAU,CAAC;AAC3D,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrF,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAClE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAChD,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,GAAE,iBAAsB,GAAG,UAAU,CAiBjH;AAoCD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GACb;IAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQlE"}

package/dist/lib/testing/storyboard/request-signing/synthesize.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NEGATIVE_STEP_PREFIX = exports.POSITIVE_STEP_PREFIX = exports.REQUEST_SIGNING_PROBE_TASK = void 0;
+exports.synthesizeRequestSigningSteps = synthesizeRequestSigningSteps;
+exports.parseRequestSigningStepId = parseRequestSigningStepId;
+const vector_loader_1 = require("./vector-loader");
+exports.REQUEST_SIGNING_PROBE_TASK = 'request_signing_probe';
+exports.POSITIVE_STEP_PREFIX = 'positive-';
+exports.NEGATIVE_STEP_PREFIX = 'negative-';
+/**
+ * Expand the `positive_vectors` and `negative_vectors` phases of the
+ * signed-requests specialism with one synthesized step per fixture. The YAML
+ * deliberately ships these phases with empty step lists — steps are generated
+ * from the cached test-vector fixtures so a runner can grade any advertising
+ * agent without duplicating fixture data in the spec.
+ *
+ * Returns the input storyboard unchanged if it isn't signed-requests.
+ */
+function synthesizeRequestSigningSteps(storyboard, options = {}) {
+    if (storyboard.id !== 'signed_requests')
+        return storyboard;
+    const loaded = (0, vector_loader_1.loadRequestSigningVectors)(options);
+    const skip = new Set(options.skipVectors ?? []);
+    const phases = storyboard.phases.map(phase => {
+        if (phase.id === 'positive_vectors') {
+            return { ...phase, steps: loaded.positive.filter(v => !skip.has(v.id)).map(synthesizePositiveStep) };
+        }
+        if (phase.id === 'negative_vectors') {
+            return { ...phase, steps: loaded.negative.filter(v => !skip.has(v.id)).map(synthesizeNegativeStep) };
+        }
+        return phase;
+    });
+    return { ...storyboard, phases };
+}
+function synthesizePositiveStep(vector) {
+    return {
+        id: `${exports.POSITIVE_STEP_PREFIX}${vector.id}`,
+        title: `Positive: ${vector.name}`,
+        task: exports.REQUEST_SIGNING_PROBE_TASK,
+        narrative: `Sign vector ${vector.id} per its component list and send to the agent; accept on 2xx.`,
+        validations: [
+            {
+                check: 'http_status_in',
+                allowed_values: [200, 201, 202, 203, 204],
+                description: `Agent accepts positive vector ${vector.id}`,
+            },
+        ],
+    };
+}
+function synthesizeNegativeStep(vector) {
+    return {
+        id: `${exports.NEGATIVE_STEP_PREFIX}${vector.id}`,
+        title: `Negative: ${vector.name}`,
+        task: exports.REQUEST_SIGNING_PROBE_TASK,
+        narrative: `Build vector ${vector.id} with its documented mutation and send to the agent; ` +
+            `expect 401 with WWW-Authenticate: Signature error="${vector.expected_error_code}".`,
+        validations: [
+            {
+                check: 'http_status',
+                value: 401,
+                description: `Rejection status for ${vector.id}`,
+            },
+        ],
+    };
+}
+/**
+ * Parse the synthesized step ID back into the vector id + kind so the probe
+ * dispatch can look up the fixture.
+ */
+function parseRequestSigningStepId(stepId) {
+    if (stepId.startsWith(exports.POSITIVE_STEP_PREFIX)) {
+        return { kind: 'positive', vector_id: stepId.slice(exports.POSITIVE_STEP_PREFIX.length) };
+    }
+    if (stepId.startsWith(exports.NEGATIVE_STEP_PREFIX)) {
+        return { kind: 'negative', vector_id: stepId.slice(exports.NEGATIVE_STEP_PREFIX.length) };
+    }
+    return undefined;
+}
+//# sourceMappingURL=synthesize.js.map

package/dist/lib/testing/storyboard/request-signing/synthesize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"synthesize.js","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/synthesize.ts"],"names":[],"mappings":";;;AAsBA,sEAiBC;AAwCD,8DAUC;AAxFD,mDAAqF;AAGxE,QAAA,0BAA0B,GAAG,uBAAuB,CAAC;AACrD,QAAA,oBAAoB,GAAG,WAAW,CAAC;AACnC,QAAA,oBAAoB,GAAG,WAAW,CAAC;AAOhD;;;;;;;;GAQG;AACH,SAAgB,6BAA6B,CAAC,UAAsB,EAAE,UAA6B,EAAE;IACnG,IAAI,UAAU,CAAC,EAAE,KAAK,iBAAiB;QAAE,OAAO,UAAU,CAAC;IAE3D,MAAM,MAAM,GAAG,IAAA,yCAAyB,EAAC,OAAO,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAC3C,IAAI,KAAK,CAAC,EAAE,KAAK,kBAAkB,EAAE,CAAC;YACpC,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvG,CAAC;QACD,IAAI,KAAK,CAAC,EAAE,KAAK,kBAAkB,EAAE,CAAC;YACpC,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAsB;IACpD,OAAO;QACL,EAAE,EAAE,GAAG,4BAAoB,GAAG,MAAM,CAAC,EAAE,EAAE;QACzC,KAAK,EAAE,aAAa,MAAM,CAAC,IAAI,EAAE;QACjC,IAAI,EAAE,kCAA0B;QAChC,SAAS,EAAE,eAAe,MAAM,CAAC,EAAE,+DAA+D;QAClG,WAAW,EAAE;YACX;gBACE,KAAK,EAAE,gBAAgB;gBACvB,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;gBACzC,WAAW,EAAE,iCAAiC,MAAM,CAAC,EAAE,EAAE;aAC1D;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAsB;IACpD,OAAO;QACL,EAAE,EAAE,GAAG,4BAAoB,GAAG,MAAM,CAAC,EAAE,EAAE;QACzC,KAAK,EAAE,aAAa,MAAM,CAAC,IAAI,EAAE;QACjC,IAAI,EAAE,kCAA0B;QAChC,SAAS,EACP,gBAAgB,MAAM,CAAC,EAAE,uDAAuD;YAChF,sDAAsD,MAAM,CAAC,mBAAmB,IAAI;QACtF,WAAW,EAAE;YACX;gBACE,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,GAAG;gBACV,WAAW,EAAE,wBAAwB,MAAM,CAAC,EAAE,EAAE;aACjD;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,MAAc;IAEd,IAAI,MAAM,CAAC,UAAU,CAAC,4BAAoB,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,4BAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,4BAAoB,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,4BAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/testing/storyboard/request-signing/test-kit.d.ts

@@ -0,0 +1,42 @@
+export interface RunnerSigningKey {
+    keyid: string;
+    alg: 'ed25519' | 'ecdsa-p256-sha256';
+}
+export interface ReplayWindowContract {
+    vector_id: string;
+    black_box_behavior: 'repeat_request';
+    max_interval_seconds: number;
+    min_replay_ttl_seconds: number;
+}
+export interface RevocationContract {
+    vector_id: string;
+    pre_revoked_keyid: string;
+}
+export interface RateAbuseContract {
+    vector_id: string;
+    grading_target_per_keyid_cap_requests: number;
+    production_min_per_keyid_cap_requests: number;
+    window_seconds: number;
+}
+export interface SignedRequestsRunnerContract {
+    id: string;
+    endpoint_scope: 'sandbox' | string;
+    harness_mode: 'black_box' | 'white_box';
+    runner_signing_keys: RunnerSigningKey[];
+    stateful_vector_contract: {
+        replay_window: ReplayWindowContract;
+        revocation: RevocationContract;
+        rate_abuse: RateAbuseContract;
+    };
+}
+export interface LoadTestKitOptions {
+    complianceDir?: string;
+    version?: string;
+}
+/**
+ * Load and parse `test-kits/signed-requests-runner.yaml` from the compliance
+ * cache. Returns undefined when the file is absent (upstream pre-adcp#2353
+ * caches, or a sync in progress) — callers must decide how to degrade.
+ */
+export declare function loadSignedRequestsRunnerContract(options?: LoadTestKitOptions): SignedRequestsRunnerContract | undefined;
+//# sourceMappingURL=test-kit.d.ts.map

package/dist/lib/testing/storyboard/request-signing/test-kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-kit.d.ts","sourceRoot":"","sources":["../../../../../src/lib/testing/storyboard/request-signing/test-kit.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,SAAS,GAAG,mBAAmB,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,gBAAgB,CAAC;IACrC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC,EAAE,MAAM,CAAC;IAC9C,qCAAqC,EAAE,MAAM,CAAC;IAC9C,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,SAAS,GAAG,MAAM,CAAC;IACnC,YAAY,EAAE,WAAW,GAAG,WAAW,CAAC;IACxC,mBAAmB,EAAE,gBAAgB,EAAE,CAAC;IACxC,wBAAwB,EAAE;QACxB,aAAa,EAAE,oBAAoB,CAAC;QACpC,UAAU,EAAE,kBAAkB,CAAC;QAC/B,UAAU,EAAE,iBAAiB,CAAC;KAC/B,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,kBAAuB,GAC/B,4BAA4B,GAAG,SAAS,CAY1C"}

package/dist/lib/testing/storyboard/request-signing/test-kit.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadSignedRequestsRunnerContract = loadSignedRequestsRunnerContract;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const yaml_1 = require("yaml");
+const compliance_1 = require("../compliance");
+/**
+ * Load and parse `test-kits/signed-requests-runner.yaml` from the compliance
+ * cache. Returns undefined when the file is absent (upstream pre-adcp#2353
+ * caches, or a sync in progress) — callers must decide how to degrade.
+ */
+function loadSignedRequestsRunnerContract(options = {}) {
+    const cacheDir = (0, compliance_1.getComplianceCacheDir)(options);
+    const path = (0, path_1.join)(cacheDir, 'test-kits', 'signed-requests-runner.yaml');
+    if (!(0, fs_1.existsSync)(path))
+        return undefined;
+    const raw = (0, yaml_1.parse)((0, fs_1.readFileSync)(path, 'utf-8'));
+    return {
+        id: assertString(raw.id, 'id'),
+        endpoint_scope: assertString(raw.endpoint_scope, 'endpoint_scope'),
+        harness_mode: parseHarnessMode(raw.harness_mode),
+        runner_signing_keys: parseSigningKeys(raw.runner_signing_keys),
+        stateful_vector_contract: parseStatefulContracts(raw.stateful_vector_contract),
+    };
+}
+function parseHarnessMode(raw) {
+    const s = assertString(raw, 'harness_mode');
+    if (s !== 'black_box' && s !== 'white_box') {
+        throw new Error(`test-kit harness_mode must be "black_box" or "white_box", got "${s}"`);
+    }
+    return s;
+}
+function parseSigningKeys(raw) {
+    if (!Array.isArray(raw))
+        throw new Error('runner_signing_keys must be an array');
+    return raw.map((entry, i) => {
+        const r = entry;
+        const alg = assertString(r.alg, `runner_signing_keys[${i}].alg`);
+        if (alg !== 'ed25519' && alg !== 'ecdsa-p256-sha256') {
+            throw new Error(`runner_signing_keys[${i}].alg: unsupported "${alg}"`);
+        }
+        return { keyid: assertString(r.keyid, `runner_signing_keys[${i}].keyid`), alg };
+    });
+}
+function parseStatefulContracts(raw) {
+    if (!raw || typeof raw !== 'object') {
+        throw new Error('stateful_vector_contract block missing');
+    }
+    const r = raw;
+    return {
+        replay_window: parseReplay(r.replay_window),
+        revocation: parseRevocation(r.revocation),
+        rate_abuse: parseRateAbuse(r.rate_abuse),
+    };
+}
+function parseReplay(raw) {
+    const r = asObject(raw, 'stateful_vector_contract.replay_window');
+    const behavior = assertString(r.black_box_behavior, 'replay_window.black_box_behavior');
+    if (behavior !== 'repeat_request') {
+        throw new Error(`replay_window.black_box_behavior must be "repeat_request", got "${behavior}"`);
+    }
+    return {
+        vector_id: assertString(r.vector_id, 'replay_window.vector_id'),
+        black_box_behavior: 'repeat_request',
+        max_interval_seconds: assertNumber(r.max_interval_seconds, 'replay_window.max_interval_seconds'),
+        min_replay_ttl_seconds: assertNumber(r.min_replay_ttl_seconds, 'replay_window.min_replay_ttl_seconds'),
+    };
+}
+function parseRevocation(raw) {
+    const r = asObject(raw, 'stateful_vector_contract.revocation');
+    return {
+        vector_id: assertString(r.vector_id, 'revocation.vector_id'),
+        pre_revoked_keyid: assertString(r.pre_revoked_keyid, 'revocation.pre_revoked_keyid'),
+    };
+}
+function parseRateAbuse(raw) {
+    const r = asObject(raw, 'stateful_vector_contract.rate_abuse');
+    return {
+        vector_id: assertString(r.vector_id, 'rate_abuse.vector_id'),
+        grading_target_per_keyid_cap_requests: assertNumber(r.grading_target_per_keyid_cap_requests, 'rate_abuse.grading_target_per_keyid_cap_requests'),
+        production_min_per_keyid_cap_requests: assertNumber(r.production_min_per_keyid_cap_requests, 'rate_abuse.production_min_per_keyid_cap_requests'),
+        window_seconds: assertNumber(r.window_seconds, 'rate_abuse.window_seconds'),
+    };
+}
+function asObject(raw, where) {
+    if (!raw || typeof raw !== 'object')
+        throw new Error(`${where} missing or not an object`);
+    return raw;
+}
+function assertString(v, where) {
+    if (typeof v !== 'string')
+        throw new Error(`${where} must be string`);
+    return v;
+}
+function assertNumber(v, where) {
+    if (typeof v !== 'number')
+        throw new Error(`${where} must be number`);
+    return v;
+}
+//# sourceMappingURL=test-kit.js.map