fix(testing): storyboard request-builders emit spec shapes for log_event + create_media_buy (#793)

[bokelley]

Summary

Fixes #793 — two storyboard REQUEST_BUILDERS in src/lib/testing/storyboard/request-builder.ts emit non-spec payloads. Framework-dispatch agents running zod at the MCP boundary reject them with -32602 invalid_type; legacy-dispatch permissively lets them through. Surfaced while diagnosing adcontextprotocol/adcp#2872.

Bug A — log_event

• Fallback emitted timestamp (spec: event_time) and value: { amount, currency } (spec: custom_data.{value,currency} per core/event.json + core/event-custom-data.json).
• Builder never consulted step.sample_request, so storyboards (sales_catalog_driven, sales_social) that author spec-conformant events with event_time / content_ids / siblings were silently discarded.

Fix: honor step.sample_request first (same convention as sync_catalogs, report_usage, update_media_buy, sync_creatives); correct the synthetic fallback's field names.

Bug B — create_media_buy

• Builder always emitted packages: [pkg] regardless of how many packages the storyboard's sample_request authored. Multi-package storyboards (sales_non_guaranteed) lost packages[1+], leaving context_outputs like second_package_id unresolved — the next step (update_media_buy using $context.second_package_id) was then skipped with "unresolved context variables from prior steps". Reproduced under both framework and legacy dispatch.

Fix: emit every authored package. First package still receives context-derived product_id / pricing_option_id (so single-package storyboards against arbitrary sellers keep working); additional packages pass through with context injection only, preserving per-package product_id, bid_price, pricing_option_id, and creative_assignments.

Tests

Four new regression tests in test/lib/request-builder.test.js:

• create_media_buy emits every package when sample_request authors multiple.
• create_media_buy injects context into additional packages.
• log_event fallback uses spec field names (event_time, custom_data).
• log_event honors step.sample_request with context injection.

All 37 request-builder tests and 1396 storyboard-completeness tests pass.

Deeper structural issues (filing as follow-ups)

Expert review (code-reviewer + ad-tech-protocol-expert) flagged a broader structural issue and several additional spec-violating builders that are out of scope for this PR:

• Structural: the runner's default is inverted. REQUEST_BUILDERS entries take precedence over sample_request unless the builder explicitly opts in with if (step.sample_request) return injectContext(...) — a pattern that's now duplicated in ~12 builders. The correct default is "sample_request is authoritative; builder fills discovery-derived identifiers." Will file as a separate refactor.
• Additional spec violations verified against schemas/cache/latest/:
  • si_get_offering emits context as a string, but core/context.json is an object ref.
  • si_initiate_session stuffs the intent string into context; schema requires intent + identity per si-identity.json.
  • sync_governance emits credentials: "test-governance-token" (21 chars) but schema requires minLength: 32; also never honors step.sample_request.
  • sync_event_sources, sync_audiences (narrow delegation), list_content_standards, sync_accounts — same "ignores sample_request" class as Bug A.

Both experts also suggested a schema-driven invariant test that round-trips every builder's output through the generated Zod schema. Worth adding alongside the structural refactor.

Test plan

• node --test test/lib/request-builder.test.js — 37 pass
• node --test test/lib/storyboard-completeness.test.js — 1396 pass
• npm run build — clean
• tsc --noEmit — clean
• CI green on this PR

🤖 Generated with Claude Code