@adcp/sdk 14.0.0-rc.37 → 14.0.0-rc.39

package/dist/lib/testing/storyboard/probes.js

@@ -19,7 +19,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var probes_exports = {};
 __export(probes_exports, {
   PROBE_TASKS: () => PROBE_TASKS,
-  SsrfRefusedError: () => import_net.SsrfRefusedError,
+  SsrfRefusedError: () => import_net2.SsrfRefusedError,
+  __probeFetchWithBudgetForTest: () => __probeFetchWithBudgetForTest,
   fetchProbe: () => fetchProbe,
   generateRandomInvalidApiKey: () => generateRandomInvalidApiKey,
   generateRandomInvalidJwt: () => generateRandomInvalidJwt,
@@ -28,12 +29,20 @@ __export(probes_exports, {
   probeOauthAuthServerMetadata: () => probeOauthAuthServerMetadata,
   probeProtectedResourceMetadata: () => probeProtectedResourceMetadata,
   rawA2aProbe: () => rawA2aProbe,
-  rawMcpProbe: () => rawMcpProbe
+  rawMcpProbe: () => rawMcpProbe,
+  rawMcpSessionProbe: () => rawMcpSessionProbe
 });
 module.exports = __toCommonJS(probes_exports);
 var import_crypto = require("crypto");
+var import_client = require("@modelcontextprotocol/sdk/client/index.js");
+var import_streamableHttp = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
 var import_types = require("@modelcontextprotocol/sdk/types.js");
 var import_net = require('../../net/index.js');
+var import_rawResponseCapture = require('../../protocols/rawResponseCapture.js');
+var import_session_termination = require('../../protocols/session-termination.js');
+var import_net2 = require('../../net/index.js');
+var import_types2 = require('./types.js');
+var import_test_kit = require('./test-kit.js');
 const PROBE_TASKS = /* @__PURE__ */ new Set([
   "protected_resource_metadata",
   "oauth_auth_server_metadata",
@@ -46,7 +55,10 @@ const PROBE_TASKS = /* @__PURE__ */ new Set([
   "trusted_match_missing_auth_context_probe",
   "trusted_match_invalid_auth_context_probe",
   "trusted_match_missing_auth_identity_probe",
-  "trusted_match_invalid_auth_identity_probe"
+  "trusted_match_invalid_auth_identity_probe",
+  // Runner-selected fallback when the agent advertises no allowlisted probe
+  // tool. Dispatched as a complete MCP session lifecycle, never as a tool call.
+  import_types2.MCP_SESSION_PROBE_TASK
 ]);
 async function probeProtectedResourceMetadata(agentUrl, options = {}) {
   const u = new URL(agentUrl);
@@ -86,7 +98,7 @@ async function probeOauthAuthServerMetadata(priorProbe, options = {}) {
 }
 async function fetchProbe(url, options = {}) {
   try {
-    const res = await (0, import_net.ssrfSafeFetch)(url, {
+    const res = await (0, import_net2.ssrfSafeFetch)(url, {
       method: "GET",
       headers: { accept: "application/json" },
       allowPrivateIp: options.allowPrivateIp ?? false,
@@ -97,7 +109,7 @@ async function fetchProbe(url, options = {}) {
       url,
       status: res.status,
       headers: res.headers,
-      body: (0, import_net.decodeBodyAsJsonOrText)(res.body, res.headers["content-type"])
+      body: (0, import_net2.decodeBodyAsJsonOrText)(res.body, res.headers["content-type"])
     };
   } catch (err) {
     return {
@@ -140,7 +152,7 @@ async function postRawMcpJsonRpc(options) {
   } = options;
   const httpResult = { url: agentUrl, status: 0, headers: {}, body: null };
   try {
-    const res = await (0, import_net.ssrfSafeFetch)(agentUrl, {
+    const res = await (0, import_net2.ssrfSafeFetch)(agentUrl, {
       method: "POST",
       headers: {
         "content-type": "application/json",
@@ -336,6 +348,664 @@ async function rawMcpProbe(options) {
   }
   return { httpResult, taskResult: taskResultFromRpc(httpResult, parsed) };
 }
+const SESSION_PROBE_CLIENT_INFO = { name: "AdCP Storyboard MCP Session Probe", version: "1.0.0" };
+function httpProbeResultFromCapture(capture) {
+  const headers = Object.fromEntries(
+    Object.entries(capture.headers).map(([name, value]) => [name.toLowerCase(), value])
+  );
+  return {
+    url: capture.url,
+    status: capture.status,
+    headers,
+    body: decodeCapturedBody(capture.body, headers["content-type"])
+  };
+}
+function decodeCapturedBody(body, contentType) {
+  if (body.length === 0) return null;
+  if (contentType?.toLowerCase().includes("text/event-stream")) {
+    const dataLines = body.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice("data:".length).trim()).filter((payload) => payload.length > 0);
+    for (const payload of dataLines.reverse()) {
+      try {
+        return JSON.parse(payload);
+      } catch {
+      }
+    }
+    return body;
+  }
+  if (contentType?.toLowerCase().includes("json")) {
+    try {
+      return JSON.parse(body);
+    } catch {
+      return body;
+    }
+  }
+  return body;
+}
+function negotiatedVersionFromCaptures(captures) {
+  for (const capture of captures) {
+    if (capture.requestJsonRpcMethod !== "initialize") continue;
+    const body = decodeCapturedBody(capture.body, findHeader(capture.headers, "content-type"));
+    const version = body?.result?.protocolVersion;
+    if (typeof version === "string" && import_types.SUPPORTED_PROTOCOL_VERSIONS.includes(version)) return version;
+  }
+  return void 0;
+}
+function findHeader(headers, name) {
+  return Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+}
+function sessionIdFromCaptures(captures) {
+  for (const capture of captures) {
+    if (capture.requestJsonRpcMethod !== "initialize") continue;
+    const value = findHeader(capture.headers, "mcp-session-id");
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return void 0;
+}
+function gradedCapture(captures) {
+  const graded = captures.filter(
+    (capture) => capture.method !== "DELETE" && capture.method !== "GET" && capture.requestJsonRpcMethod !== "tools/list"
+  );
+  const toolCalls = graded.filter((capture) => capture.requestJsonRpcMethod === "tools/call");
+  if (toolCalls.length > 0) return toolCalls[toolCalls.length - 1];
+  return graded.length > 0 ? graded[graded.length - 1] : void 0;
+}
+const ADCP_AUTH_REJECTION_CODES = [
+  "AUTH_MISSING",
+  "AUTH_INVALID",
+  // Deprecated in AdCP 3.x but retained by the error-code enum as a
+  // backward-compatible alias for the two above, so an agent still emitting it
+  // is making an authentication statement.
+  "AUTH_REQUIRED"
+];
+const ADCP_SCHEMA_REJECTION_CODES = ["INVALID_REQUEST"];
+const ADCP_ERROR_CODE_FIELDS = /* @__PURE__ */ new Set(["code", "error_code", "errorCode"]);
+function adcpErrorCodesIn(toolResult) {
+  const result = toolResult;
+  const roots = [result?.structuredContent, result].filter(
+    (root) => root !== null && typeof root === "object"
+  );
+  const envelopes = [];
+  for (const root of roots) {
+    if (root.error !== void 0) envelopes.push(root.error);
+    if (Array.isArray(root.errors)) envelopes.push(...root.errors);
+  }
+  const found = [];
+  for (const envelope of envelopes) {
+    if (envelope === null || typeof envelope !== "object") continue;
+    for (const [key, entry] of Object.entries(envelope)) {
+      if (!ADCP_ERROR_CODE_FIELDS.has(key) || typeof entry !== "string") continue;
+      const code = entry.trim().toUpperCase();
+      if (ADCP_AUTH_REJECTION_CODES.includes(code) || ADCP_SCHEMA_REJECTION_CODES.includes(code)) found.push(code);
+    }
+  }
+  return found;
+}
+function isUnsupportedProtocolVersion(error) {
+  return error instanceof Error && error.message.startsWith("Server's protocol version is not supported");
+}
+const AUTH_REJECTION_STATUSES = /* @__PURE__ */ new Set([401, 403]);
+function fourHundredIsAuthRejection(evidence, codes) {
+  if (findHeader(evidence.headers, "www-authenticate") !== void 0) return true;
+  return codes.some((code) => ADCP_AUTH_REJECTION_CODES.includes(code));
+}
+function sdkRejectionDetail(error) {
+  if (error instanceof ProbeResponseTooLargeError) return "response exceeded the probe body cap";
+  if (error instanceof ProbeAmplificationError) return `exceeded the probe ${error.kind} budget`;
+  const cause = error?.cause;
+  if (cause instanceof ProbeResponseTooLargeError) return "response exceeded the probe body cap";
+  if (cause instanceof ProbeAmplificationError) return `exceeded the probe ${cause.kind} budget`;
+  if (error instanceof import_streamableHttp.StreamableHTTPError && typeof error.code === "number") {
+    return `HTTP ${error.code}`;
+  }
+  if (error instanceof import_types.McpError) {
+    return error.code === import_types.ErrorCode.RequestTimeout ? "request timed out" : `JSON-RPC error code ${error.code}`;
+  }
+  if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
+    return "request aborted";
+  }
+  return "protocol error";
+}
+function transportErrorEvidence(agentUrl, detail) {
+  return { url: agentUrl, status: 0, headers: {}, body: null, error: detail };
+}
+function wrapProbeFetch(upstream, options) {
+  const { maxResponseBytes, budget, timeoutMs, signal } = options;
+  const wrapped = async (input, init) => {
+    if (budget.requestsRemaining <= 0) {
+      throw new ProbeAmplificationError("request", MCP_SESSION_PROBE_MAX_REQUESTS);
+    }
+    budget.requestsRemaining -= 1;
+    if (budget.bytesRemaining <= 0) throw new ProbeAmplificationError("byte", MCP_SESSION_PROBE_MAX_TOTAL_BYTES);
+    const msLeft = budget.deadlineAt - Date.now();
+    if (msLeft <= 0) throw new ProbeAmplificationError("deadline", MCP_SESSION_PROBE_WALK_TIMEOUT_MS);
+    const capAbort = new AbortController();
+    const signals = [capAbort.signal];
+    if (signal) signals.push(signal);
+    if (init?.signal) signals.push(init.signal);
+    if (timeoutMs !== void 0) signals.push(AbortSignal.timeout(timeoutMs));
+    signals.push(AbortSignal.timeout(msLeft));
+    const composed = AbortSignal.any(signals);
+    const headers = new Headers(init?.headers);
+    if (!headers.has("accept-encoding")) headers.set("accept-encoding", "identity");
+    const response = await upstream(input, {
+      ...init ?? {},
+      headers,
+      redirect: "manual",
+      signal: composed
+    });
+    return capResponseBody(response, maxResponseBytes, capAbort, options.onCapExceeded, (read) => {
+      budget.bytesRemaining -= read;
+      if (budget.bytesRemaining <= 0) {
+        capAbort.abort(new ProbeAmplificationError("byte", MCP_SESSION_PROBE_MAX_TOTAL_BYTES));
+        options.onCapExceeded?.();
+        return false;
+      }
+      return true;
+    });
+  };
+  return wrapped;
+}
+function capResponseBody(response, maxBytes, capAbort, onCapExceeded, countBytes) {
+  const declared = response.headers.get("content-length");
+  if (declared !== null && /^\d+$/.test(declared.trim()) && Number(declared.trim()) > maxBytes) {
+    response.body?.cancel().catch(() => {
+    });
+    onCapExceeded?.();
+    throw new ProbeResponseTooLargeError(maxBytes);
+  }
+  if (!response.body) return response;
+  let seen = 0;
+  const counter = new TransformStream({
+    transform(chunk, controller) {
+      seen += chunk.byteLength;
+      if (countBytes?.(chunk.byteLength) === false) {
+        controller.error(new ProbeAmplificationError("byte", maxBytes));
+        return;
+      }
+      if (seen > maxBytes) {
+        const tooLarge = new ProbeResponseTooLargeError(maxBytes);
+        controller.error(tooLarge);
+        capAbort.abort(tooLarge);
+        onCapExceeded?.();
+        return;
+      }
+      controller.enqueue(chunk);
+    }
+  });
+  return new Response(response.body.pipeThrough(counter), {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+const PROBE_TASK_ALLOWLIST_HINT = import_test_kit.PROBE_TASK_ALLOWLIST_SUMMARY;
+function fenceAgentText(value, maxLength = 96) {
+  const clipped = value.length > maxLength ? `${value.slice(0, maxLength)}\u2026` : value;
+  return clipped.replace(
+    /[\u0000-\u001f\u007f-\u009f]/g,
+    (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`
+  );
+}
+class ProbeResponseTooLargeError extends Error {
+  constructor(maxBytes) {
+    super(`MCP session probe response exceeded ${maxBytes} bytes`);
+    this.name = "ProbeResponseTooLargeError";
+  }
+}
+function __probeFetchWithBudgetForTest(upstream, budget) {
+  return wrapProbeFetch(upstream, { maxResponseBytes: MCP_SESSION_PROBE_MAX_RESPONSE_BYTES, budget });
+}
+class ProbeAmplificationError extends Error {
+  constructor(kind, limit) {
+    super(`MCP session probe exceeded its ${kind} budget (${limit})`);
+    this.kind = kind;
+    this.name = "ProbeAmplificationError";
+  }
+  kind;
+}
+const MCP_SESSION_PROBE_MAX_REQUESTS = 28;
+const MCP_SESSION_PROBE_MAX_CANDIDATES = 3;
+const MCP_SESSION_PROBE_WALK_TIMEOUT_MS = 25e3;
+const NO_RECONNECTION = {
+  maxReconnectionDelay: 0,
+  initialReconnectionDelay: 0,
+  reconnectionDelayGrowFactor: 1,
+  maxRetries: 0
+};
+const SESSION_TERMINATION_TIMEOUT_MS = 2e3;
+const MCP_SESSION_PROBE_MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+function createSessionProbeBudget() {
+  return {
+    requestsRemaining: MCP_SESSION_PROBE_MAX_REQUESTS,
+    bytesRemaining: MCP_SESSION_PROBE_MAX_TOTAL_BYTES,
+    deadlineAt: Date.now() + MCP_SESSION_PROBE_WALK_TIMEOUT_MS
+  };
+}
+function budgetExhausted(budget) {
+  return budget.requestsRemaining <= 0 || budget.bytesRemaining <= 0 || Date.now() >= budget.deadlineAt;
+}
+const MCP_SESSION_PROBE_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+const CAPTURE_CEILINGS = {
+  maxCaptures: MCP_SESSION_PROBE_MAX_REQUESTS,
+  maxTotalBodyBytes: MCP_SESSION_PROBE_MAX_TOTAL_BYTES,
+  // Matched to this probe's own response cap. The recorder's 1 MiB default
+  // truncates mid-body and flags `bodyTruncated`, which for a 1-4 MiB reply
+  // the probe deliberately allows would hand the grader a body that is no
+  // longer parseable JSON — a legitimate large `list_creatives` page would
+  // read as a malformed response instead of an acceptance.
+  maxBodyBytes: MCP_SESSION_PROBE_MAX_RESPONSE_BYTES
+};
+async function runMcpSessionLifecycle(options) {
+  const { agentUrl, headers, toolName, allowPrivateIp, budget, fetchFn, signal, timeoutMs } = options;
+  let closeOnCapExceeded = () => {
+  };
+  const transportFetch = (0, import_rawResponseCapture.wrapFetchWithCapture)(
+    wrapProbeFetch(
+      (0, import_net.createAgentTransportFetch)(agentUrl, {
+        allowPrivateIp,
+        ...fetchFn ? { trustedFetchFn: fetchFn } : {}
+      }),
+      {
+        maxResponseBytes: MCP_SESSION_PROBE_MAX_RESPONSE_BYTES,
+        budget,
+        ...timeoutMs !== void 0 ? { timeoutMs } : {},
+        ...signal ? { signal } : {},
+        onCapExceeded: () => closeOnCapExceeded()
+      }
+    )
+  );
+  const client = new import_client.Client(SESSION_PROBE_CLIENT_INFO, { capabilities: {} });
+  const transport = new import_streamableHttp.StreamableHTTPClientTransport(new URL(agentUrl), {
+    requestInit: {
+      headers,
+      redirect: "manual",
+      // Run cancellation reaches the socket, not just the SDK's request timer.
+      ...signal ? { signal } : {}
+    },
+    fetch: transportFetch,
+    // A conformance probe never wants a resumed stream: an agent answering
+    // `retry: 0` would otherwise have the SDK reconnect in a tight loop.
+    reconnectionOptions: NO_RECONNECTION
+  });
+  closeOnCapExceeded = () => void transport.close().catch(() => {
+  });
+  const requestOptions = {
+    ...signal ? { signal } : {},
+    ...timeoutMs !== void 0 ? { timeout: timeoutMs } : {}
+  };
+  let captures = [];
+  let capturesOverflowed;
+  let thrown;
+  let toolResult;
+  try {
+    const run = await (0, import_rawResponseCapture.withRawResponseCapture)(async () => {
+      try {
+        await client.connect(transport, requestOptions);
+        return await client.callTool({ name: toolName, arguments: {} }, void 0, requestOptions);
+      } finally {
+        await client.close().catch(() => {
+        });
+      }
+    }, CAPTURE_CEILINGS);
+    captures = run.captures;
+    capturesOverflowed = run.overflowed;
+    toolResult = run.result;
+  } catch (err) {
+    thrown = err;
+    captures = (0, import_rawResponseCapture.getCapturesFromError)(err) ?? [];
+    capturesOverflowed = (0, import_rawResponseCapture.getCaptureOverflowFromError)(err);
+  }
+  const issuedSessionId = transport.sessionId ?? sessionIdFromCaptures(captures);
+  if (issuedSessionId !== void 0) {
+    const terminator = new import_streamableHttp.StreamableHTTPClientTransport(new URL(agentUrl), {
+      requestInit: { headers, redirect: "manual" },
+      fetch: wrapProbeFetch(
+        (0, import_net.createAgentTransportFetch)(agentUrl, {
+          allowPrivateIp,
+          ...fetchFn ? { trustedFetchFn: fetchFn } : {}
+        }),
+        {
+          maxResponseBytes: MCP_SESSION_PROBE_MAX_RESPONSE_BYTES,
+          // Teardown gets its own small budget, not the probe's: an exhausted
+          // walk must still be able to close the session it opened.
+          budget: {
+            requestsRemaining: 2,
+            bytesRemaining: MCP_SESSION_PROBE_MAX_TOTAL_BYTES,
+            deadlineAt: Date.now() + SESSION_TERMINATION_TIMEOUT_MS
+          },
+          timeoutMs: SESSION_TERMINATION_TIMEOUT_MS
+        }
+      ),
+      sessionId: issuedSessionId,
+      reconnectionOptions: NO_RECONNECTION
+    });
+    const negotiated = transport.protocolVersion ?? negotiatedVersionFromCaptures(captures);
+    if (negotiated !== void 0) terminator.setProtocolVersion(negotiated);
+    await (0, import_session_termination.terminateSessionBestEffort)(terminator);
+  }
+  if (capturesOverflowed !== void 0) {
+    const detail2 = `capture ${capturesOverflowed} ceiling exceeded`;
+    return {
+      verdict: "unusable",
+      accepted: false,
+      stage: "initialize",
+      detail: detail2,
+      evidence: transportErrorEvidence(agentUrl, detail2)
+    };
+  }
+  const graded = gradedCapture(captures);
+  if (graded === void 0) {
+    const detail2 = thrown === void 0 ? "no HTTP exchange observed" : sdkRejectionDetail(thrown);
+    return {
+      verdict: "unusable",
+      accepted: false,
+      stage: "initialize",
+      detail: detail2,
+      evidence: transportErrorEvidence(agentUrl, detail2)
+    };
+  }
+  const stage = graded.requestJsonRpcMethod === "tools/call" ? "tools/call" : "initialize";
+  const evidence = httpProbeResultFromCapture(graded);
+  if (thrown === void 0) {
+    if (toolResult?.isError === true) {
+      const codes = adcpErrorCodesIn(toolResult);
+      const authCode = codes.find((code) => ADCP_AUTH_REJECTION_CODES.includes(code));
+      if (authCode !== void 0) {
+        return { verdict: "auth_rejected", accepted: false, stage, detail: `operation-level ${authCode}`, evidence };
+      }
+      if (codes.some((code) => ADCP_SCHEMA_REJECTION_CODES.includes(code))) {
+        return {
+          verdict: "schema_or_param",
+          accepted: false,
+          stage,
+          detail: "operation-level INVALID_REQUEST",
+          evidence
+        };
+      }
+      return {
+        verdict: "unusable",
+        accepted: false,
+        stage,
+        detail: "tool reported isError with no AdCP error code",
+        evidence
+      };
+    }
+    return { verdict: "accepted", accepted: true, stage, detail: `HTTP ${graded.status}`, evidence };
+  }
+  if (isUnsupportedProtocolVersion(thrown)) {
+    return {
+      verdict: "unusable",
+      accepted: false,
+      protocolIncompatible: true,
+      stage: "initialize",
+      detail: `agent negotiated a protocolVersion this SDK does not implement (supports ${import_types.SUPPORTED_PROTOCOL_VERSIONS.length} versions)`,
+      evidence
+    };
+  }
+  const detail = sdkRejectionDetail(thrown);
+  const bodyCodes = adcpErrorCodesIn(decodeCapturedBody(graded.body, findHeader(graded.headers, "content-type")));
+  const invalidParams = detail === `JSON-RPC error code ${import_types.ErrorCode.InvalidParams}`;
+  const schemaCode = bodyCodes.some((code) => ADCP_SCHEMA_REJECTION_CODES.includes(code));
+  if (invalidParams || schemaCode) {
+    return {
+      verdict: "schema_or_param",
+      accepted: false,
+      stage,
+      detail: invalidParams ? "JSON-RPC InvalidParams (-32602)" : "operation-level INVALID_REQUEST",
+      evidence
+    };
+  }
+  if (AUTH_REJECTION_STATUSES.has(graded.status)) {
+    return { verdict: "auth_rejected", accepted: false, stage, detail: `HTTP ${graded.status}`, evidence };
+  }
+  if (graded.status === 400) {
+    if (fourHundredIsAuthRejection(evidence, bodyCodes)) {
+      return { verdict: "auth_rejected", accepted: false, stage, detail: "HTTP 400 with an auth challenge", evidence };
+    }
+    return {
+      verdict: "schema_or_param",
+      accepted: false,
+      stage,
+      detail: "HTTP 400 with no authentication evidence",
+      evidence
+    };
+  }
+  if (graded.status >= 400) {
+    return { verdict: "unusable", accepted: false, stage, detail: `HTTP ${graded.status}`, evidence };
+  }
+  return { verdict: "unusable", accepted: false, stage, detail, evidence };
+}
+const CREDENTIAL_HEADER_NAMES = /* @__PURE__ */ new Set(["authorization", "x-adcp-auth", "x-api-key"]);
+function sentCredentialValues(...headerSets) {
+  const values = /* @__PURE__ */ new Set();
+  const add = (value) => {
+    if (typeof value === "string" && value.length > 0) values.add(value);
+  };
+  for (const headers of headerSets) {
+    for (const [name, raw] of Object.entries(headers ?? {})) {
+      if (!CREDENTIAL_HEADER_NAMES.has(name.toLowerCase())) continue;
+      if (typeof raw !== "string" || raw.length === 0) continue;
+      add(raw);
+      const spaceAt = raw.indexOf(" ");
+      if (spaceAt <= 0) continue;
+      const scheme = raw.slice(0, spaceAt).toLowerCase();
+      const credential = raw.slice(spaceAt + 1);
+      add(credential);
+      if (scheme !== "basic") continue;
+      const decoded = decodeBase64Utf8(credential);
+      if (decoded === void 0) continue;
+      add(decoded);
+      const colonAt = decoded.indexOf(":");
+      if (colonAt >= 0) add(decoded.slice(colonAt + 1));
+    }
+  }
+  return [...values].filter((value) => value.trim().length > 0);
+}
+function decodeBase64Utf8(value) {
+  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(value) || value.length === 0) return void 0;
+  try {
+    const decoded = Buffer.from(value, "base64").toString("utf8");
+    return decoded.includes("\uFFFD") ? void 0 : decoded;
+  } catch {
+    return void 0;
+  }
+}
+function redactCredentialValuesInText(text, secrets) {
+  let out = text;
+  for (const secret of secrets) {
+    if (!secret) continue;
+    out = out.split(secret).join("[REDACTED_CREDENTIAL]");
+  }
+  return out;
+}
+function redactCredentialValuesDeep(value, secrets, depth = 0) {
+  if (secrets.length === 0) return value;
+  if (depth > MAX_REDACTION_DEPTH) return REDACTION_DEPTH_PLACEHOLDER;
+  if (typeof value === "string") return redactCredentialValuesInText(value, secrets);
+  if (Array.isArray(value)) {
+    const kept = value.slice(0, MAX_REDACTION_ENTRIES).map((entry) => redactCredentialValuesDeep(entry, secrets, depth + 1));
+    return value.length > MAX_REDACTION_ENTRIES ? [...kept, REDACTION_SIZE_PLACEHOLDER] : kept;
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    const entries = Object.entries(value);
+    for (const [key, entry] of entries.slice(0, MAX_REDACTION_ENTRIES)) {
+      Object.defineProperty(out, redactCredentialValuesInText(key, secrets), {
+        value: redactCredentialValuesDeep(entry, secrets, depth + 1),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+    if (entries.length > MAX_REDACTION_ENTRIES) {
+      Object.defineProperty(out, "__redacted__", {
+        value: REDACTION_SIZE_PLACEHOLDER,
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+    return out;
+  }
+  return value;
+}
+const MAX_REDACTION_DEPTH = 24;
+const MAX_REDACTION_ENTRIES = 512;
+const REDACTION_DEPTH_PLACEHOLDER = "[REDACTED_UNSCANNABLE_DEPTH]";
+const REDACTION_SIZE_PLACEHOLDER = "[REDACTED_UNSCANNABLE_SIZE]";
+function redactCredentialsFromEvidence(httpResult, secrets) {
+  if (secrets.length === 0) return httpResult;
+  const headers = {};
+  for (const [name, value] of Object.entries(httpResult.headers)) {
+    headers[name] = redactCredentialValuesInText(value, secrets);
+  }
+  return {
+    ...httpResult,
+    headers,
+    body: redactCredentialValuesDeep(httpResult.body, secrets),
+    ...httpResult.error !== void 0 ? { error: redactCredentialValuesInText(httpResult.error, secrets) } : {}
+  };
+}
+async function rawMcpSessionProbe(options) {
+  const { agentUrl, headers = {}, control, allowPrivateIp = false, fetchFn, signal, timeoutMs } = options;
+  const requested = typeof options.toolName === "string" ? [options.toolName] : [...options.toolName];
+  if (requested.length === 0) return noTargetProbe(agentUrl);
+  const candidates = requested.slice(0, MCP_SESSION_PROBE_MAX_CANDIDATES);
+  const budget = createSessionProbeBudget();
+  const base = { agentUrl, allowPrivateIp, budget, fetchFn, signal, timeoutMs };
+  let graded;
+  let toolName = candidates[0];
+  for (const candidate of candidates) {
+    toolName = candidate;
+    graded = await runMcpSessionLifecycle({ ...base, toolName: candidate, headers });
+    if (graded.verdict !== "schema_or_param") break;
+    if (budgetExhausted(budget)) break;
+  }
+  const lifecycle = { ...base, toolName };
+  const secrets = [
+    ...sentCredentialValues(headers, control.kind === "credential" ? control.headers : void 0),
+    ...(options.redactValues ?? []).filter((value) => value.trim().length > 0)
+  ];
+  graded = { ...graded, evidence: redactCredentialsFromEvidence(graded.evidence, secrets) };
+  const conclusive = {
+    httpResult: graded.evidence,
+    taskResult: taskResultFromEvidence(graded),
+    stage: graded.stage,
+    detail: graded.detail,
+    gradedTool: toolName
+  };
+  if (control.kind === "probe_is_valid_credential") {
+    if (graded.verdict === "accepted") return conclusive;
+    if (graded.protocolIncompatible) return protocolIncompatibleProbe(graded, toolName);
+    if (graded.verdict === "schema_or_param") return schemaOrParamProbe(graded, toolName);
+    if (graded.verdict === "unusable") return malformedResponseProbe(graded, toolName);
+    return refusedSessionProbe(
+      graded,
+      `the run's valid credential was refused on the selected protected tool "${fenceAgentText(toolName)}" (rejected at ${graded.stage}: ${graded.detail}), so there is no successful protected call to certify`,
+      "Confirm the credential is current and that the agent accepts it on that tool.",
+      toolName
+    );
+  }
+  if (graded.verdict === "accepted") {
+    return refusedSessionProbe(
+      graded,
+      `the credential state under test received a successful payload from the protected tool "${fenceAgentText(toolName)}" (accepted at ${graded.stage}: ${graded.detail}), so the agent served tenant-scoped data to credentials it was expected to refuse`,
+      "Enforce credential validation on that tool before treating this path as conformant.",
+      toolName
+    );
+  }
+  if (graded.protocolIncompatible) return protocolIncompatibleProbe(graded, toolName);
+  if (graded.verdict === "schema_or_param") return schemaOrParamProbe(graded, toolName);
+  if (graded.verdict === "unusable") return malformedResponseProbe(graded, toolName);
+  if (control.kind === "unavailable") {
+    return inconclusiveSessionProbe(graded, control.reason, control.remedy, toolName);
+  }
+  const acceptance = await runMcpSessionLifecycle({ ...lifecycle, headers: control.headers });
+  if (acceptance.verdict === "accepted" || acceptance.verdict === "schema_or_param") return conclusive;
+  if (acceptance.protocolIncompatible) return protocolIncompatibleProbe(graded, toolName, acceptance);
+  if (acceptance.verdict === "auth_rejected") {
+    return inconclusiveSessionProbe(
+      graded,
+      `the run's valid credential was also refused on "${fenceAgentText(toolName)}" (rejected at ${acceptance.stage}: ${acceptance.detail})`,
+      "Check that the credential is current and that it is accepted on that tool.",
+      toolName
+    );
+  }
+  return inconclusiveSessionProbe(
+    graded,
+    `the control call on "${fenceAgentText(toolName)}" did not produce a usable answer (${acceptance.stage}: ${acceptance.detail})`,
+    "Check that the agent URL is reachable and that the tool answers a credentialed call.",
+    toolName
+  );
+}
+function noTargetProbe(agentUrl) {
+  const message = `MCP session probe could not run: no protected tool was supplied to grade, so nothing was learned about this agent's credentials. Pass at least one canonical AdCP read task as \`toolName\`.`;
+  const evidence = transportErrorEvidence(agentUrl, "no candidate target supplied");
+  return {
+    httpResult: { ...evidence, error: message },
+    taskResult: failedTaskResult(message),
+    stage: "initialize",
+    detail: "no candidate target supplied",
+    gradedTool: ""
+  };
+}
+function taskResultFromEvidence(graded) {
+  if (graded.accepted) {
+    return { success: true, data: graded.evidence.body, _extraction_path: "structured_content" };
+  }
+  return { success: false, data: void 0, error: graded.detail, _extraction_path: "error" };
+}
+function protocolIncompatibleProbe(graded, gradedTool, attempt = graded) {
+  return sessionProbeError(
+    graded,
+    `MCP session probe could not run: ${attempt.detail} at ${attempt.stage}. This is a protocol compatibility problem, not an authentication result \u2014 nothing was learned about this agent's credentials. Upgrade the SDK to one that implements the agent's MCP wire version, then re-run.`,
+    gradedTool
+  );
+}
+function schemaOrParamProbe(graded, toolName) {
+  return sessionProbeError(
+    graded,
+    `MCP session auth probe is inconclusive: the agent refused the shape of the call to "${fenceAgentText(toolName)}" (${graded.detail}) rather than answering it, so nothing was learned about this agent's credentials. Advertise one auth-required, read-only tool that accepts an empty request body (${PROBE_TASK_ALLOWLIST_HINT}) so the probe has a parameter-free protected target.`,
+    toolName
+  );
+}
+function malformedResponseProbe(graded, gradedTool) {
+  if (graded.detail === "request timed out" || graded.detail === "request aborted") {
+    return sessionProbeError(
+      graded,
+      `MCP session probe could not run: the agent answered ${graded.stage} with HTTP ${graded.evidence.status} but never delivered a usable response to that request (${graded.detail}). This is not an authentication result \u2014 nothing was learned about this agent's credentials.`,
+      gradedTool
+    );
+  }
+  return sessionProbeError(
+    graded,
+    `MCP session probe could not run: the agent answered ${graded.stage} with HTTP ${graded.evidence.status} but a body the official MCP client rejected (${graded.detail}). This is a response-shape problem, not an authentication result \u2014 nothing was learned about this agent's credentials. Return a conformant result for that operation, then re-run.`,
+    gradedTool
+  );
+}
+function inconclusiveSessionProbe(graded, reason, remedy, gradedTool) {
+  return sessionProbeError(
+    graded,
+    `MCP session auth probe is inconclusive: ${reason}, so this step's response is not evidence that the agent validates credentials. ${remedy}`,
+    gradedTool
+  );
+}
+function refusedSessionProbe(graded, reason, remedy, gradedTool) {
+  return sessionProbeError(
+    graded,
+    `MCP session auth probe refuses this as auth evidence: ${reason}. ${remedy}`,
+    gradedTool
+  );
+}
+function sessionProbeError(graded, message, gradedTool) {
+  return {
+    httpResult: { ...graded.evidence, error: message },
+    taskResult: failedTaskResult(message),
+    stage: graded.stage,
+    detail: graded.detail,
+    gradedTool
+  };
+}
 async function rawA2aProbe(options) {
   const { agentUrl, method, params, headers = {}, allowPrivateIp = false } = options;
   const body = JSON.stringify({
@@ -346,7 +1016,7 @@ async function rawA2aProbe(options) {
   });
   const httpResult = { url: agentUrl, status: 0, headers: {}, body: null };
   try {
-    const res = await (0, import_net.ssrfSafeFetch)(agentUrl, {
+    const res = await (0, import_net2.ssrfSafeFetch)(agentUrl, {
       method: "POST",
       headers: {
         "content-type": "application/json",
@@ -407,12 +1077,13 @@ async function rawA2aProbe(options) {
     return { httpResult };
   }
 }
-const isAlwaysBlocked = import_net.isAlwaysBlocked;
-const isPrivateIp = import_net.isPrivateIp;
+const isAlwaysBlocked = import_net2.isAlwaysBlocked;
+const isPrivateIp = import_net2.isPrivateIp;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   PROBE_TASKS,
   SsrfRefusedError,
+  __probeFetchWithBudgetForTest,
   fetchProbe,
   generateRandomInvalidApiKey,
   generateRandomInvalidJwt,
@@ -421,5 +1092,6 @@ const isPrivateIp = import_net.isPrivateIp;
   probeOauthAuthServerMetadata,
   probeProtectedResourceMetadata,
   rawA2aProbe,
-  rawMcpProbe
+  rawMcpProbe,
+  rawMcpSessionProbe
 });