@adcp/sdk 14.0.0-rc.38 → 14.0.0-rc.39

package/dist/lib/testing/storyboard/seeding.d.mts

@@ -81,5 +81,8 @@ export interface ControllerSeedingResult {
  * not applicable (opt-out, no declaration, empty fixtures) so the runner can
  * treat a no-op identically to a non-seeding storyboard.
  */
-export declare function runControllerSeeding(client: TestClient, storyboard: Storyboard, options: StoryboardRunOptions, context: StoryboardContext, discoveryClient?: TestClient): Promise<ControllerSeedingResult | null>;
+export declare function runControllerSeeding(client: TestClient, storyboard: Storyboard, options: StoryboardRunOptions, context: StoryboardContext, discoveryClient?: TestClient, resolveFixtureAgent?: (task: 'comply_test_controller' | 'get_products') => {
+    client: TestClient;
+    options: StoryboardRunOptions;
+}): Promise<ControllerSeedingResult | null>;
 export {};

package/dist/lib/testing/storyboard/seeding.d.ts

@@ -81,5 +81,8 @@ export interface ControllerSeedingResult {
  * not applicable (opt-out, no declaration, empty fixtures) so the runner can
  * treat a no-op identically to a non-seeding storyboard.
  */
-export declare function runControllerSeeding(client: TestClient, storyboard: Storyboard, options: StoryboardRunOptions, context: StoryboardContext, discoveryClient?: TestClient): Promise<ControllerSeedingResult | null>;
+export declare function runControllerSeeding(client: TestClient, storyboard: Storyboard, options: StoryboardRunOptions, context: StoryboardContext, discoveryClient?: TestClient, resolveFixtureAgent?: (task: 'comply_test_controller' | 'get_products') => {
+    client: TestClient;
+    options: StoryboardRunOptions;
+}): Promise<ControllerSeedingResult | null>;
 export {};

package/dist/lib/testing/storyboard/seeding.js

@@ -205,17 +205,26 @@ function seedFixtureFromFields(fields) {
   }
   return fields;
 }
-async function runControllerSeeding(client, storyboard, options, context, discoveryClient = client) {
+async function runControllerSeeding(client, storyboard, options, context, discoveryClient = client, resolveFixtureAgent) {
   if (options.skip_controller_seeding === true) return null;
   const calls = buildSeedCalls(storyboard.fixtures);
   if (calls.length === 0) return null;
   if (storyboard.fixture_resolution !== void 0) {
     const resolutionCalls = storyboard.prerequisites?.controller_seeding === true ? calls : calls.filter((call) => call.scenario === "seed_product" || call.scenario === "seed_pricing_option");
     if (resolutionCalls.length === 0) return null;
-    return runDeclaredFixtureResolution(client, discoveryClient, storyboard, options, context, resolutionCalls);
+    return runDeclaredFixtureResolution(
+      client,
+      discoveryClient,
+      storyboard,
+      options,
+      context,
+      resolutionCalls,
+      resolveFixtureAgent
+    );
   }
   if (storyboard.prerequisites?.controller_seeding !== true) return null;
-  if (options.agentTools && !options.agentTools.includes("comply_test_controller")) {
+  const controllerRouteTools = resolveFixtureAgent ? resolveFixtureAgent("comply_test_controller").options.agentTools : options.agentTools;
+  if (controllerRouteTools && !controllerRouteTools.includes("comply_test_controller")) {
     return buildMissingControllerResult(storyboard, calls, context);
   }
   const start = Date.now();
@@ -295,7 +304,7 @@ async function runControllerSeeding(client, storyboard, options, context, discov
     failedCount
   };
 }
-async function runDeclaredFixtureResolution(seedClient, discoveryClient, storyboard, options, context, calls) {
+async function runDeclaredFixtureResolution(seedClient, discoveryClient, storyboard, options, context, calls, resolveFixtureAgent) {
   const start = Date.now();
   const authoringErrorResult = buildAuthoringErrorResult(storyboard, calls, context, start);
   if (authoringErrorResult) return authoringErrorResult;
@@ -324,18 +333,40 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
   const claimedPricingOptions = /* @__PURE__ */ new Map();
   const productStatuses = /* @__PURE__ */ new Map();
   const seedContext = { correlation_id: `${storyboardCorrelationPrefix(storyboard)}--__seeding__` };
-  const controllerMissing = options.agentTools?.includes("comply_test_controller") === false;
-  let advertisedScenarios = controllerMissing ? /* @__PURE__ */ new Set() : controllerScenarioSetFromOptions(options);
-  let scenarioLookupAttempted = advertisedScenarios !== null;
+  let seedOptions = options;
+  let discoveryOptions = options;
+  let seedPrepared = false;
+  let discoveryPrepared = false;
+  const controller = { missing: false, scenarios: null };
+  const prepareSeedAgent = async () => {
+    if (seedPrepared) return;
+    const selected = resolveFixtureAgent?.("comply_test_controller");
+    if (selected) {
+      seedClient = selected.client;
+      seedOptions = selected.options;
+    }
+    controller.missing = seedOptions.agentTools?.includes("comply_test_controller") === false;
+    controller.scenarios = controller.missing ? /* @__PURE__ */ new Set() : controllerScenarioSetFromOptions(seedOptions);
+    if (!controller.missing && !controller.scenarios) {
+      controller.scenarios = await fetchControllerScenarioSet(seedClient, seedOptions, seedContext);
+    }
+    seedPrepared = true;
+  };
+  const prepareDiscoveryAgent = () => {
+    if (discoveryPrepared) return;
+    const selected = resolveFixtureAgent?.("get_products");
+    if (selected) {
+      discoveryClient = selected.client;
+      discoveryOptions = selected.options;
+    }
+    discoveryPrepared = true;
+  };
   const legacyCalls = calls.filter((call) => resolutionSpecForCall(call, specByKey) === void 0);
   if (legacyCalls.length > 0) {
-    if (controllerMissing) return buildMissingControllerResult(storyboard, legacyCalls, context);
-    if (!advertisedScenarios) {
-      advertisedScenarios = await fetchControllerScenarioSet(seedClient, options, seedContext);
-      scenarioLookupAttempted = true;
-    }
-    if (advertisedScenarios) {
-      const unsupported = legacyCalls.find((call) => !call.authoring_error && !advertisedScenarios.has(call.scenario));
+    await prepareSeedAgent();
+    if (controller.missing) return buildMissingControllerResult(storyboard, legacyCalls, context);
+    if (controller.scenarios) {
+      const unsupported = legacyCalls.find((call) => !call.authoring_error && !controller.scenarios.has(call.scenario));
       if (unsupported) {
         return buildUnsupportedSeedResult(
           storyboard,
@@ -351,18 +382,16 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
     const spec = resolutionSpecForCall(call, specByKey);
     return !spec || spec.strategies.includes("seed");
   });
-  if (needsSeedStrategy && !controllerMissing && !advertisedScenarios && !scenarioLookupAttempted) {
-    advertisedScenarios = await fetchControllerScenarioSet(seedClient, options, seedContext);
-  }
+  if (!resolveFixtureAgent && needsSeedStrategy && !seedPrepared) await prepareSeedAgent();
   let catalogPromise;
-  const catalog = () => catalogPromise ??= discoverProductCatalog(discoveryClient, options, context);
+  const catalog = () => catalogPromise ??= discoverProductCatalog(discoveryClient, discoveryOptions, context);
   let passedCount = 0;
   let failedCount = 0;
   let fixtureUnsatisfied = false;
   for (const call of orderedCalls) {
     const spec = resolutionSpecForCall(call, specByKey);
     if (!spec) {
-      const legacy = await executeLegacySeedCall(seedClient, storyboard, call, options, context, seedContext);
+      const legacy = await executeLegacySeedCall(seedClient, storyboard, call, seedOptions, context, seedContext);
       if (legacy.step.skip_reason === "fixture_unsatisfied") {
         return buildUnsupportedSeedResult(storyboard, legacyCalls, context, call.scenario, legacy.step.skip?.detail);
       }
@@ -386,12 +415,13 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
     }
     for (const strategy of parentUnavailable ? [] : spec.strategies) {
       if (strategy === "seed") {
-        const advertised = advertisedScenarios?.has(call.scenario);
-        if (controllerMissing || advertised === false) {
+        await prepareSeedAgent();
+        const advertised = controller.scenarios?.has(call.scenario);
+        if (controller.missing || advertised === false) {
           attempts.push({
             strategy,
             disposition: "unavailable",
-            detail: controllerMissing ? "comply_test_controller is not advertised" : `list_scenarios did not advertise ${call.scenario}`
+            detail: controller.missing ? "comply_test_controller is not advertised" : `list_scenarios did not advertise ${call.scenario}`
           });
           continue;
         }
@@ -409,7 +439,7 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
               params: isPlainRecord(controllerRequest.params) ? controllerRequest.params : call.params,
               context: seedContext
             },
-            options
+            seedOptions
           );
           const data = raw.data;
           if (raw.success && data?.success === true) {
@@ -449,7 +479,8 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
         }
       }
       if (strategy === "discover") {
-        if (options.agentTools && !options.agentTools.includes("get_products")) {
+        prepareDiscoveryAgent();
+        if (discoveryOptions.agentTools && !discoveryOptions.agentTools.includes("get_products")) {
           attempts.push({
             strategy,
             disposition: "unavailable",

package/dist/lib/testing/storyboard/seeding.mjs

@@ -185,17 +185,26 @@ function seedFixtureFromFields(fields) {
   }
   return fields;
 }
-async function runControllerSeeding(client, storyboard, options, context, discoveryClient = client) {
+async function runControllerSeeding(client, storyboard, options, context, discoveryClient = client, resolveFixtureAgent) {
   if (options.skip_controller_seeding === true) return null;
   const calls = buildSeedCalls(storyboard.fixtures);
   if (calls.length === 0) return null;
   if (storyboard.fixture_resolution !== void 0) {
     const resolutionCalls = storyboard.prerequisites?.controller_seeding === true ? calls : calls.filter((call) => call.scenario === "seed_product" || call.scenario === "seed_pricing_option");
     if (resolutionCalls.length === 0) return null;
-    return runDeclaredFixtureResolution(client, discoveryClient, storyboard, options, context, resolutionCalls);
+    return runDeclaredFixtureResolution(
+      client,
+      discoveryClient,
+      storyboard,
+      options,
+      context,
+      resolutionCalls,
+      resolveFixtureAgent
+    );
   }
   if (storyboard.prerequisites?.controller_seeding !== true) return null;
-  if (options.agentTools && !options.agentTools.includes("comply_test_controller")) {
+  const controllerRouteTools = resolveFixtureAgent ? resolveFixtureAgent("comply_test_controller").options.agentTools : options.agentTools;
+  if (controllerRouteTools && !controllerRouteTools.includes("comply_test_controller")) {
     return buildMissingControllerResult(storyboard, calls, context);
   }
   const start = Date.now();
@@ -275,7 +284,7 @@ async function runControllerSeeding(client, storyboard, options, context, discov
     failedCount
   };
 }
-async function runDeclaredFixtureResolution(seedClient, discoveryClient, storyboard, options, context, calls) {
+async function runDeclaredFixtureResolution(seedClient, discoveryClient, storyboard, options, context, calls, resolveFixtureAgent) {
   const start = Date.now();
   const authoringErrorResult = buildAuthoringErrorResult(storyboard, calls, context, start);
   if (authoringErrorResult) return authoringErrorResult;
@@ -304,18 +313,40 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
   const claimedPricingOptions = /* @__PURE__ */ new Map();
   const productStatuses = /* @__PURE__ */ new Map();
   const seedContext = { correlation_id: `${storyboardCorrelationPrefix(storyboard)}--__seeding__` };
-  const controllerMissing = options.agentTools?.includes("comply_test_controller") === false;
-  let advertisedScenarios = controllerMissing ? /* @__PURE__ */ new Set() : controllerScenarioSetFromOptions(options);
-  let scenarioLookupAttempted = advertisedScenarios !== null;
+  let seedOptions = options;
+  let discoveryOptions = options;
+  let seedPrepared = false;
+  let discoveryPrepared = false;
+  const controller = { missing: false, scenarios: null };
+  const prepareSeedAgent = async () => {
+    if (seedPrepared) return;
+    const selected = resolveFixtureAgent?.("comply_test_controller");
+    if (selected) {
+      seedClient = selected.client;
+      seedOptions = selected.options;
+    }
+    controller.missing = seedOptions.agentTools?.includes("comply_test_controller") === false;
+    controller.scenarios = controller.missing ? /* @__PURE__ */ new Set() : controllerScenarioSetFromOptions(seedOptions);
+    if (!controller.missing && !controller.scenarios) {
+      controller.scenarios = await fetchControllerScenarioSet(seedClient, seedOptions, seedContext);
+    }
+    seedPrepared = true;
+  };
+  const prepareDiscoveryAgent = () => {
+    if (discoveryPrepared) return;
+    const selected = resolveFixtureAgent?.("get_products");
+    if (selected) {
+      discoveryClient = selected.client;
+      discoveryOptions = selected.options;
+    }
+    discoveryPrepared = true;
+  };
   const legacyCalls = calls.filter((call) => resolutionSpecForCall(call, specByKey) === void 0);
   if (legacyCalls.length > 0) {
-    if (controllerMissing) return buildMissingControllerResult(storyboard, legacyCalls, context);
-    if (!advertisedScenarios) {
-      advertisedScenarios = await fetchControllerScenarioSet(seedClient, options, seedContext);
-      scenarioLookupAttempted = true;
-    }
-    if (advertisedScenarios) {
-      const unsupported = legacyCalls.find((call) => !call.authoring_error && !advertisedScenarios.has(call.scenario));
+    await prepareSeedAgent();
+    if (controller.missing) return buildMissingControllerResult(storyboard, legacyCalls, context);
+    if (controller.scenarios) {
+      const unsupported = legacyCalls.find((call) => !call.authoring_error && !controller.scenarios.has(call.scenario));
       if (unsupported) {
         return buildUnsupportedSeedResult(
           storyboard,
@@ -331,18 +362,16 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
     const spec = resolutionSpecForCall(call, specByKey);
     return !spec || spec.strategies.includes("seed");
   });
-  if (needsSeedStrategy && !controllerMissing && !advertisedScenarios && !scenarioLookupAttempted) {
-    advertisedScenarios = await fetchControllerScenarioSet(seedClient, options, seedContext);
-  }
+  if (!resolveFixtureAgent && needsSeedStrategy && !seedPrepared) await prepareSeedAgent();
   let catalogPromise;
-  const catalog = () => catalogPromise ??= discoverProductCatalog(discoveryClient, options, context);
+  const catalog = () => catalogPromise ??= discoverProductCatalog(discoveryClient, discoveryOptions, context);
   let passedCount = 0;
   let failedCount = 0;
   let fixtureUnsatisfied = false;
   for (const call of orderedCalls) {
     const spec = resolutionSpecForCall(call, specByKey);
     if (!spec) {
-      const legacy = await executeLegacySeedCall(seedClient, storyboard, call, options, context, seedContext);
+      const legacy = await executeLegacySeedCall(seedClient, storyboard, call, seedOptions, context, seedContext);
       if (legacy.step.skip_reason === "fixture_unsatisfied") {
         return buildUnsupportedSeedResult(storyboard, legacyCalls, context, call.scenario, legacy.step.skip?.detail);
       }
@@ -366,12 +395,13 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
     }
     for (const strategy of parentUnavailable ? [] : spec.strategies) {
       if (strategy === "seed") {
-        const advertised = advertisedScenarios?.has(call.scenario);
-        if (controllerMissing || advertised === false) {
+        await prepareSeedAgent();
+        const advertised = controller.scenarios?.has(call.scenario);
+        if (controller.missing || advertised === false) {
           attempts.push({
             strategy,
             disposition: "unavailable",
-            detail: controllerMissing ? "comply_test_controller is not advertised" : `list_scenarios did not advertise ${call.scenario}`
+            detail: controller.missing ? "comply_test_controller is not advertised" : `list_scenarios did not advertise ${call.scenario}`
           });
           continue;
         }
@@ -389,7 +419,7 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
               params: isPlainRecord(controllerRequest.params) ? controllerRequest.params : call.params,
               context: seedContext
             },
-            options
+            seedOptions
           );
           const data = raw.data;
           if (raw.success && data?.success === true) {
@@ -429,7 +459,8 @@ async function runDeclaredFixtureResolution(seedClient, discoveryClient, storybo
         }
       }
       if (strategy === "discover") {
-        if (options.agentTools && !options.agentTools.includes("get_products")) {
+        prepareDiscoveryAgent();
+        if (discoveryOptions.agentTools && !discoveryOptions.agentTools.includes("get_products")) {
           attempts.push({
             strategy,
             disposition: "unavailable",

package/dist/lib/testing/storyboard/test-kit.d.mts

@@ -15,6 +15,17 @@
  *      a task with required parameters would make the security_baseline
  *      runner misreport "agent failed auth" when the root cause is that
  *      schema validation rejected the probe before the auth layer ran.
+ *
+ * An agent that advertises none of the allowlist can still have its auth
+ * verified: {@link selectProbeTask} falls back to the MCP session probe, which
+ * calls a *canonical* AdCP read task the agent does advertise. An agent whose
+ * whole surface is its own invented tool names has nothing the runner will
+ * trust as a protected AdCP operation, and is reported
+ * `session_probe_ungradable` with a remedy rather than certified. That sentinel
+ * is intentionally absent from {@link PROBE_TASK_ALLOWLIST} so a kit cannot
+ * name it via `probe_task`; the runner resolves it, or a storyboard may name it
+ * directly, and either way `planMcpSessionSentinel` grades it honestly — and
+ * only on an explicit `protocol: 'mcp'`.
  */
 import type { TestOptions } from '../types.mjs';
 /**
@@ -34,10 +45,33 @@ export declare const PROBE_TASK_ALLOWLIST: readonly string[];
 /**
  * Select an advertised auth probe without dispatching an inapplicable tool.
  * The configured task is a preference, not permission to call a tool the
- * agent did not advertise. Returns undefined when the agent has no safe,
- * empty-body read probe (currently true for SI-only agents).
+ * agent did not advertise.
+ *
+ * Resolution order:
+ *   1. Discovery unavailable (`advertisedTools === undefined`) → the caller's
+ *      preference, unchanged. The runner has no tool list to vet it against.
+ *   2. The preference, when it is allowlisted AND advertised.
+ *   3. The first allowlisted task the agent advertises.
+ *   4. **MCP only**: the {@link MCP_SESSION_PROBE_TASK} sentinel
+ *      (adcp-client#2940). An agent whose entire read surface sits outside the
+ *      allowlist may still expose a canonical protected read
+ *      (`get_principal`, `list_tasks`, …), and the sentinel drives a complete
+ *      session lifecycle (`initialize` → `notifications/initialized` →
+ *      `tools/call`) against one — so `security_baseline` can verify a
+ *      correctly configured agent instead of reporting
+ *      `auth_mechanism_verified: []`. The chosen tool is called with empty
+ *      arguments; when the agent refuses that shape the probe reports
+ *      *inconclusive* rather than guessing, which is the hazard the allowlist
+ *      exists to avoid.
+ *   5. Anything other than an explicit `protocol: 'mcp'` → `undefined`
+ *      (unchanged). A2A's `message/send` requires `params.message` and has no
+ *      equivalent parameter-free protected operation, and an unset protocol
+ *      means the caller never declared a transport — neither is a safe place
+ *      to substitute an MCP probe.
  */
-export declare function selectProbeTask(preferred: string | undefined, advertisedTools: readonly string[] | undefined): string | undefined;
+export declare function selectProbeTask(preferred: string | undefined, advertisedTools: readonly string[] | undefined, options?: {
+    protocol?: 'mcp' | 'a2a';
+}): string | undefined;
 /**
  * Raised when a test kit violates the schema invariants above. Carries the
  * field name so upstream loaders can render a YAML-friendly error.

package/dist/lib/testing/storyboard/test-kit.d.ts

@@ -15,6 +15,17 @@
  *      a task with required parameters would make the security_baseline
  *      runner misreport "agent failed auth" when the root cause is that
  *      schema validation rejected the probe before the auth layer ran.
+ *
+ * An agent that advertises none of the allowlist can still have its auth
+ * verified: {@link selectProbeTask} falls back to the MCP session probe, which
+ * calls a *canonical* AdCP read task the agent does advertise. An agent whose
+ * whole surface is its own invented tool names has nothing the runner will
+ * trust as a protected AdCP operation, and is reported
+ * `session_probe_ungradable` with a remedy rather than certified. That sentinel
+ * is intentionally absent from {@link PROBE_TASK_ALLOWLIST} so a kit cannot
+ * name it via `probe_task`; the runner resolves it, or a storyboard may name it
+ * directly, and either way `planMcpSessionSentinel` grades it honestly — and
+ * only on an explicit `protocol: 'mcp'`.
  */
 import type { TestOptions } from '../types';
 /**
@@ -34,10 +45,33 @@ export declare const PROBE_TASK_ALLOWLIST: readonly string[];
 /**
  * Select an advertised auth probe without dispatching an inapplicable tool.
  * The configured task is a preference, not permission to call a tool the
- * agent did not advertise. Returns undefined when the agent has no safe,
- * empty-body read probe (currently true for SI-only agents).
+ * agent did not advertise.
+ *
+ * Resolution order:
+ *   1. Discovery unavailable (`advertisedTools === undefined`) → the caller's
+ *      preference, unchanged. The runner has no tool list to vet it against.
+ *   2. The preference, when it is allowlisted AND advertised.
+ *   3. The first allowlisted task the agent advertises.
+ *   4. **MCP only**: the {@link MCP_SESSION_PROBE_TASK} sentinel
+ *      (adcp-client#2940). An agent whose entire read surface sits outside the
+ *      allowlist may still expose a canonical protected read
+ *      (`get_principal`, `list_tasks`, …), and the sentinel drives a complete
+ *      session lifecycle (`initialize` → `notifications/initialized` →
+ *      `tools/call`) against one — so `security_baseline` can verify a
+ *      correctly configured agent instead of reporting
+ *      `auth_mechanism_verified: []`. The chosen tool is called with empty
+ *      arguments; when the agent refuses that shape the probe reports
+ *      *inconclusive* rather than guessing, which is the hazard the allowlist
+ *      exists to avoid.
+ *   5. Anything other than an explicit `protocol: 'mcp'` → `undefined`
+ *      (unchanged). A2A's `message/send` requires `params.message` and has no
+ *      equivalent parameter-free protected operation, and an unset protocol
+ *      means the caller never declared a transport — neither is a safe place
+ *      to substitute an MCP probe.
  */
-export declare function selectProbeTask(preferred: string | undefined, advertisedTools: readonly string[] | undefined): string | undefined;
+export declare function selectProbeTask(preferred: string | undefined, advertisedTools: readonly string[] | undefined, options?: {
+    protocol?: 'mcp' | 'a2a';
+}): string | undefined;
 /**
  * Raised when a test kit violates the schema invariants above. Carries the
  * field name so upstream loaders can render a YAML-friendly error.

package/dist/lib/testing/storyboard/test-kit.js

@@ -19,12 +19,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var test_kit_exports = {};
 __export(test_kit_exports, {
   PROBE_TASK_ALLOWLIST: () => PROBE_TASK_ALLOWLIST,
+  PROBE_TASK_ALLOWLIST_SUMMARY: () => PROBE_TASK_ALLOWLIST_SUMMARY,
   TestKitValidationError: () => TestKitValidationError,
   resolveDeclaredTestKit: () => resolveDeclaredTestKit,
   selectProbeTask: () => selectProbeTask,
   validateTestKit: () => validateTestKit
 });
 module.exports = __toCommonJS(test_kit_exports);
+var import_types = require('./types.js');
 var import_node_fs = require("node:fs");
 var import_node_path = require("node:path");
 var import_yaml = require("yaml");
@@ -39,11 +41,14 @@ const PROBE_TASK_ALLOWLIST = Object.freeze([
   "list_content_standards",
   "list_accounts"
 ]);
-function selectProbeTask(preferred, advertisedTools) {
+const PROBE_TASK_ALLOWLIST_SUMMARY = PROBE_TASK_ALLOWLIST.join(", ");
+function selectProbeTask(preferred, advertisedTools, options = {}) {
   if (!advertisedTools) return preferred;
   const advertised = new Set(advertisedTools);
   if (preferred && PROBE_TASK_ALLOWLIST.includes(preferred) && advertised.has(preferred)) return preferred;
-  return PROBE_TASK_ALLOWLIST.find((task) => advertised.has(task));
+  const advertisedProbe = PROBE_TASK_ALLOWLIST.find((task) => advertised.has(task));
+  if (advertisedProbe !== void 0) return advertisedProbe;
+  return options.protocol === "mcp" ? import_types.MCP_SESSION_PROBE_TASK : void 0;
 }
 class TestKitValidationError extends Error {
   field;
@@ -171,6 +176,7 @@ function resolveDeclaredTestKit(storyboard, options) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   PROBE_TASK_ALLOWLIST,
+  PROBE_TASK_ALLOWLIST_SUMMARY,
   TestKitValidationError,
   resolveDeclaredTestKit,
   selectProbeTask,

package/dist/lib/testing/storyboard/test-kit.mjs

@@ -1,3 +1,4 @@
+import { MCP_SESSION_PROBE_TASK } from "./types.mjs";
 import { readFileSync, realpathSync, statSync } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { parse } from "yaml";
@@ -12,11 +13,14 @@ const PROBE_TASK_ALLOWLIST = Object.freeze([
   "list_content_standards",
   "list_accounts"
 ]);
-function selectProbeTask(preferred, advertisedTools) {
+const PROBE_TASK_ALLOWLIST_SUMMARY = PROBE_TASK_ALLOWLIST.join(", ");
+function selectProbeTask(preferred, advertisedTools, options = {}) {
   if (!advertisedTools) return preferred;
   const advertised = new Set(advertisedTools);
   if (preferred && PROBE_TASK_ALLOWLIST.includes(preferred) && advertised.has(preferred)) return preferred;
-  return PROBE_TASK_ALLOWLIST.find((task) => advertised.has(task));
+  const advertisedProbe = PROBE_TASK_ALLOWLIST.find((task) => advertised.has(task));
+  if (advertisedProbe !== void 0) return advertisedProbe;
+  return options.protocol === "mcp" ? MCP_SESSION_PROBE_TASK : void 0;
 }
 class TestKitValidationError extends Error {
   field;
@@ -143,6 +147,7 @@ function resolveDeclaredTestKit(storyboard, options) {
 }
 export {
   PROBE_TASK_ALLOWLIST,
+  PROBE_TASK_ALLOWLIST_SUMMARY,
   TestKitValidationError,
   resolveDeclaredTestKit,
   selectProbeTask,