@adcp/sdk 15.8.1 → 16.0.0-beta.1

package/dist/lib/testing/client.js

@@ -28,14 +28,17 @@ __export(client_exports, {
   getOrCreateClient: () => getOrCreateClient,
   getOrCreateClientResolution: () => getOrCreateClientResolution,
   getOrDiscoverProfile: () => getOrDiscoverProfile,
+  hasTestClientScope: () => hasTestClientScope,
   resolveAccount: () => resolveAccount,
   resolveAuthPrincipal: () => resolveAuthPrincipal,
   resolveBrand: () => resolveBrand,
   runStep: () => runStep,
+  seedAuthRejectedTestClientProfile: () => seedAuthRejectedTestClientProfile,
   seedTestClientSigningCapability: () => seedTestClientSigningCapability,
   setAgentTesterLogger: () => setAgentTesterLogger,
   testClientWireAdcpVersion: () => testClientWireAdcpVersion,
-  validateResponseSchema: () => validateResponseSchema
+  validateResponseSchema: () => validateResponseSchema,
+  withTestClientScope: () => withTestClientScope
 });
 module.exports = __toCommonJS(client_exports);
 var import_ADCPMultiAgentClient = require('../core/ADCPMultiAgentClient.js');
@@ -48,13 +51,36 @@ var import_capabilities = require('../utils/capabilities.js');
 var import_probe_policy = require('../utils/probe-policy.js');
 var import_ssrf_fetch = require('../net/ssrf-fetch.js');
 var import_version = require('../version.js');
+var import_protocols = require('../protocols/index.js');
 var import_node_crypto = require("node:crypto");
+var import_node_async_hooks = require("node:async_hooks");
 var import_client_hooks = require('../validation/client-hooks.js');
 var import_error_extraction = require('../utils/error-extraction.js');
 var import_client = require('../signing/client.js');
 var import_storage_registry = require('../auth/oauth/storage-registry.js');
 const TEST_CLIENT_VERSION_OPTIONS = /* @__PURE__ */ Symbol("adcp.testClientVersionOptions");
 const TEST_CLIENT_SCOPE_SALT = (0, import_node_crypto.randomBytes)(32);
+const testClientScope = new import_node_async_hooks.AsyncLocalStorage();
+async function withTestClientScope(fn) {
+  const scope = {
+    clients: [],
+    profiles: /* @__PURE__ */ new WeakMap(),
+    profileScopes: /* @__PURE__ */ new WeakMap(),
+    authRejectedProfiles: /* @__PURE__ */ new WeakSet(),
+    active: true
+  };
+  return testClientScope.run(scope, async () => {
+    try {
+      return await fn();
+    } finally {
+      scope.active = false;
+      scope.clients.length = 0;
+    }
+  });
+}
+function hasTestClientScope() {
+  return testClientScope.getStore()?.active === true;
+}
 function resolveAuthPrincipal(options) {
   if (!options.auth) return void 0;
   switch (options.auth.type) {
@@ -95,6 +121,7 @@ function getLogger() {
 }
 function createTestClient(agentUrl, protocol = "mcp", options = {}) {
   options = withTestKitAuthDefaults(options);
+  const transport = (0, import_protocols.normalizeTransportOptions)(options.transport);
   const policy = (0, import_probe_policy.classifyProbeUrl)(agentUrl);
   if (!policy.allowed) {
     const hostname = new URL(agentUrl).hostname.replace(/^\[|\]$/g, "");
@@ -115,11 +142,20 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
     protocol
   };
   if (options.headers && Object.keys(options.headers).length > 0) {
-    agentConfig.headers = { ...options.headers };
+    agentConfig.headers = normalizeTestClientHeaders(options.headers);
+    for (const name of ["Authorization", "User-Agent", "Content-Type"]) {
+      const lower = name.toLowerCase();
+      const value = agentConfig.headers[lower];
+      if (value !== void 0) {
+        delete agentConfig.headers[lower];
+        agentConfig.headers[name] = value;
+      }
+    }
   }
   if (options.auth) {
     if (options.auth.type === "basic") {
       const encoded = Buffer.from(`${options.auth.username}:${options.auth.password}`).toString("base64");
+      if (agentConfig.headers) delete agentConfig.headers.authorization;
       agentConfig.headers = { ...agentConfig.headers, Authorization: `Basic ${encoded}` };
     } else if (options.auth.type === "oauth") {
       agentConfig.oauth_tokens = options.auth.tokens;
@@ -135,6 +171,7 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
   if (options.functional_request_signing) {
     agentConfig.request_signing = options.functional_request_signing;
   }
+  const scope = testClientScope.getStore();
   const multiClient = new import_ADCPMultiAgentClient.ADCPMultiAgentClient([agentConfig], {
     headers,
     validation: {
@@ -145,7 +182,10 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
     ...options.wireAdcpVersion !== void 0 && { wireAdcpVersion: options.wireAdcpVersion },
     ...options.versionEnvelope !== void 0 && { versionEnvelope: options.versionEnvelope },
     ...options.userAgent && { userAgent: options.userAgent },
-    ...options.transport && { transport: options.transport }
+    ...transport && { transport },
+    ...scope?.active && {
+      _reuseConfiguredDiscovery: () => scope.active && testClientScope.getStore() === scope
+    }
   });
   const client = multiClient.agent("test");
   const authMode = authReuseMode(options);
@@ -163,20 +203,21 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
       ...requestScopeMode !== void 0 && { requestScopeMode },
       ...requestSigningMode !== void 0 && { requestSigningMode },
       ...options.auth?.type === "oauth" && options.auth.storage && { oauthStorage: options.auth.storage },
-      ...options.transport?.trustedFetchFn && { fetchFn: options.transport.trustedFetchFn },
-      ...options.transport?.allowPrivateIp !== void 0 && { allowPrivateIp: options.transport.allowPrivateIp },
-      ...options.transport?.maxResponseBytes !== void 0 && {
-        maxResponseBytes: options.transport.maxResponseBytes
+      ...transport?.trustedFetchFn && { fetchFn: transport.trustedFetchFn },
+      ...transport?.allowPrivateIp !== void 0 && { allowPrivateIp: transport.allowPrivateIp },
+      ...transport?.maxResponseBytes !== void 0 && {
+        maxResponseBytes: transport.maxResponseBytes
       },
-      ...options.transport?.requestTimeoutMs !== void 0 && {
-        requestTimeoutMs: options.transport.requestTimeoutMs
+      ...transport?.requestTimeoutMs !== void 0 && {
+        requestTimeoutMs: transport.requestTimeoutMs
       },
-      ...options.transport?.legacyCompat?.enabled !== void 0 && {
-        legacyCompatEnabled: options.transport.legacyCompat.enabled
+      ...transport?.legacyCompat?.enabled !== void 0 && {
+        legacyCompatEnabled: transport.legacyCompat.enabled
       }
     },
     enumerable: false
   });
+  if (hasTestClientScope()) testClientScope.getStore().clients.push(client);
   return client;
 }
 function getOrCreateClient(agentUrl, options) {
@@ -187,6 +228,8 @@ function getOrCreateClientResolution(agentUrl, options) {
   if (shared && isExecutableTestClient(shared) && testClientMatchesVersionOptions(shared, agentUrl, options)) {
     return { client: shared, reusedShared: true };
   }
+  const pooled = testClientScope.getStore()?.clients.find((client) => testClientMatchesVersionOptions(client, agentUrl, options));
+  if (pooled) return { client: pooled, reusedShared: true };
   return { client: createTestClient(agentUrl, options.protocol || "mcp", options), reusedShared: false };
 }
 function isExecutableTestClient(client) {
@@ -197,6 +240,7 @@ function isExecutableTestClient(client) {
 }
 function testClientMatchesVersionOptions(client, agentUrl, options) {
   const effectiveOptions = withTestKitAuthDefaults(options);
+  const expectedTransport = (0, import_protocols.normalizeTransportOptions)(effectiveOptions.transport);
   const meta = client[TEST_CLIENT_VERSION_OPTIONS];
   const expectedAuthMode = authReuseMode(effectiveOptions);
   const expectedRequestScopeMode = requestScopeReuseMode(effectiveOptions);
@@ -208,7 +252,7 @@ function testClientMatchesVersionOptions(client, agentUrl, options) {
   const expectedAdcpVersion = effectiveOptions.adcpVersion ?? import_version.ADCP_VERSION;
   const expectedWireAdcpVersion = effectiveOptions.wireAdcpVersion;
   const expectedVersionEnvelope = effectiveOptions.versionEnvelope ?? "auto";
-  return meta.agentUrl === agentUrl && meta.protocol === (effectiveOptions.protocol ?? "mcp") && meta.adcpVersion === expectedAdcpVersion && meta.wireAdcpVersion === expectedWireAdcpVersion && meta.versionEnvelope === expectedVersionEnvelope && meta.strictResponseSchemaValidation === (effectiveOptions.strictResponseSchemaValidation !== false) && meta.authMode === expectedAuthMode && meta.requestScopeMode === expectedRequestScopeMode && meta.requestSigningMode === expectedRequestSigningMode && meta.oauthStorage === expectedOAuthStorage && meta.fetchFn === effectiveOptions.transport?.trustedFetchFn && meta.allowPrivateIp === effectiveOptions.transport?.allowPrivateIp && meta.maxResponseBytes === effectiveOptions.transport?.maxResponseBytes && meta.requestTimeoutMs === effectiveOptions.transport?.requestTimeoutMs && meta.legacyCompatEnabled === effectiveOptions.transport?.legacyCompat?.enabled;
+  return meta.agentUrl === agentUrl && meta.protocol === (effectiveOptions.protocol ?? "mcp") && meta.adcpVersion === expectedAdcpVersion && meta.wireAdcpVersion === expectedWireAdcpVersion && meta.versionEnvelope === expectedVersionEnvelope && meta.strictResponseSchemaValidation === (effectiveOptions.strictResponseSchemaValidation !== false) && meta.authMode === expectedAuthMode && meta.requestScopeMode === expectedRequestScopeMode && meta.requestSigningMode === expectedRequestSigningMode && meta.oauthStorage === expectedOAuthStorage && meta.fetchFn === expectedTransport?.trustedFetchFn && meta.allowPrivateIp === expectedTransport?.allowPrivateIp && meta.maxResponseBytes === expectedTransport?.maxResponseBytes && meta.requestTimeoutMs === expectedTransport?.requestTimeoutMs && meta.legacyCompatEnabled === expectedTransport?.legacyCompat?.enabled;
 }
 function withTestKitAuthDefaults(options) {
   if (options.auth) return options;
@@ -239,9 +283,16 @@ function withTestKitAuthDefaults(options) {
 function authReuseMode(options) {
   return options.auth?.type;
 }
+function normalizeTestClientHeaders(headers) {
+  const normalized = {};
+  new Headers(headers).forEach((value, name) => {
+    normalized[name] = value;
+  });
+  return normalized;
+}
 function requestScopeReuseMode(options) {
   const headers = options.headers ? Object.fromEntries(
-    Object.entries(options.headers).map(([name, value]) => [name.toLowerCase(), value]).sort(([a], [b]) => a.localeCompare(b))
+    Object.entries(normalizeTestClientHeaders(options.headers)).sort(([a], [b]) => a.localeCompare(b))
   ) : void 0;
   if (!options.auth && !headers && !options.test_session_id && !options.userAgent) return void 0;
   const auth = options.auth?.type === "oauth" ? { ...options.auth, storage: void 0 } : options.auth;
@@ -264,11 +315,13 @@ function requestSigningReuseMode(config) {
     algorithm: config.provider.algorithm,
     keyid: config.provider.keyid,
     adcpUse: config.provider.adcpUse,
-    fingerprint: config.provider.fingerprint
+    fingerprint: config.provider.fingerprint,
+    publicKey: config.public_key
   } : { algorithm: config.alg, keyid: config.kid, privateKey: config.private_key };
   const fingerprint = (0, import_node_crypto.createHmac)("sha256", "").update(
     JSON.stringify({
       identity,
+      profile: config.profile ?? "rfc9421",
       agentUrl: config.agent_url,
       jwksUri: config.jwks_uri,
       signSupported: config.sign_supported === true,
@@ -277,17 +330,79 @@ function requestSigningReuseMode(config) {
   ).digest("hex").slice(0, 16);
   return `${kind}:${fingerprint}`;
 }
-async function getOrDiscoverProfile(client, options) {
-  if (options._profile) {
-    seedTestClientSigningCapability(client, options._profile, options.adcpVersion);
+async function getOrDiscoverProfile(client, options, schemaAdcpVersion) {
+  const scope = testClientScope.getStore();
+  const profileBinding = options._profile ? scope?.profileScopes.get(client)?.get(options._profile) : void 0;
+  schemaAdcpVersion ??= profileBinding?.schemaAdcpVersion ?? options.adcpVersion;
+  options.signal?.throwIfAborted();
+  const scopeKey = scope?.active ? client.getCapabilityEvidenceScope().scopeKey : void 0;
+  if (options._profile && (!scope?.active || scope.authRejectedProfiles.has(options._profile) || !options._profile.capabilities_probe_error && options._client === client && profileBinding?.scopeKey === scopeKey)) {
+    seedTestClientSigningCapability(client, options._profile, schemaAdcpVersion);
     return {
       profile: options._profile,
       step: { step: "Discover agent capabilities", passed: true, duration_ms: 0 }
     };
   }
-  return discoverAgentProfile(client, options.signal, options.adcpVersion);
+  if (!scope?.active) return discoverAgentProfile(client, options.signal, schemaAdcpVersion);
+  const key = `${scopeKey}:${schemaAdcpVersion ?? client.getAdcpVersion()}`;
+  let profiles = scope.profiles.get(client);
+  if (!profiles) {
+    profiles = /* @__PURE__ */ new Map();
+    scope.profiles.set(client, profiles);
+  }
+  let discovery = profiles.get(key);
+  if (discovery?.failed && discovery.pass !== options._discoveryPass) {
+    profiles.delete(key);
+    discovery = void 0;
+  }
+  if (!discovery) {
+    const evict = () => {
+      if (profiles.get(key) === discovery) profiles.delete(key);
+    };
+    const promise = discoverAgentProfile(client, options.signal, schemaAdcpVersion).then(
+      (result) => {
+        if (options.signal?.aborted) {
+          evict();
+        } else if (!result.step.passed || result.profile.capabilities_probe_error) {
+          if (options._discoveryPass && discovery) discovery.failed = true;
+          else evict();
+        }
+        return result;
+      },
+      (error) => {
+        evict();
+        throw error;
+      }
+    );
+    discovery = { promise, signal: options.signal, pass: options._discoveryPass };
+    profiles.set(key, discovery);
+  }
+  try {
+    const result = await raceWithSignal(discovery.promise, options.signal);
+    if (!discovery.signal?.aborted || options.signal?.aborted) return result;
+  } catch (error) {
+    if (!discovery.signal?.aborted || options.signal?.aborted) throw error;
+  }
+  if (profiles.get(key) === discovery) profiles.delete(key);
+  return getOrDiscoverProfile(client, options, schemaAdcpVersion);
+}
+function seedAuthRejectedTestClientProfile(client, profile, adcpVersion) {
+  const scope = testClientScope.getStore();
+  if (scope?.active && profile.tools.length === 0 && profile.raw_capabilities === void 0) {
+    scope.authRejectedProfiles.add(profile);
+  }
+  seedTestClientSigningCapability(client, profile, adcpVersion);
 }
 function seedTestClientSigningCapability(client, profile, adcpVersion) {
+  const scope = testClientScope.getStore();
+  if (scope?.active) {
+    let profiles = scope.profileScopes.get(client);
+    if (!profiles) {
+      profiles = /* @__PURE__ */ new WeakMap();
+      scope.profileScopes.set(client, profiles);
+    }
+    profiles.set(profile, { scopeKey: client.getCapabilityEvidenceScope().scopeKey, schemaAdcpVersion: adcpVersion });
+  }
   const raw = profile.raw_capabilities;
   if (!raw || typeof raw !== "object") return;
   const clientAccess = client;
@@ -379,6 +494,7 @@ function describeVersionUnsupported(result, requestedVersion) {
   return `VERSION_UNSUPPORTED: ${requestedText}${supportedText}`;
 }
 async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
+  const scopeKey = hasTestClientScope() ? client.getCapabilityEvidenceScope().scopeKey : void 0;
   const {
     result: agentInfo,
     step,
@@ -448,7 +564,9 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
       profile.capabilities_probe_error = err?.message || String(err);
     }
   }
-  seedTestClientSigningCapability(client, profile, schemaAdcpVersion);
+  if (scopeKey === void 0 || scopeKey === client.getCapabilityEvidenceScope().scopeKey) {
+    seedTestClientSigningCapability(client, profile, schemaAdcpVersion);
+  }
   return { profile, step, ...caughtError !== void 0 && { caughtError } };
 }
 async function discoverAgentCapabilities(client, profile, options) {
@@ -759,12 +877,15 @@ function zodCodeToKeyword(code) {
   getOrCreateClient,
   getOrCreateClientResolution,
   getOrDiscoverProfile,
+  hasTestClientScope,
   resolveAccount,
   resolveAuthPrincipal,
   resolveBrand,
   runStep,
+  seedAuthRejectedTestClientProfile,
   seedTestClientSigningCapability,
   setAgentTesterLogger,
   testClientWireAdcpVersion,
-  validateResponseSchema
+  validateResponseSchema,
+  withTestClientScope
 });

package/dist/lib/testing/client.mjs

@@ -8,13 +8,36 @@ import { parseCapabilitiesResponse } from "../utils/capabilities.mjs";
 import { classifyProbeUrl } from "../utils/probe-policy.mjs";
 import { SsrfRefusedError } from "../net/ssrf-fetch.mjs";
 import { ADCP_VERSION, toReleasePrecisionVersion } from "../version.mjs";
+import { normalizeTransportOptions } from "../protocols/index.mjs";
 import { createHmac, hkdfSync, randomBytes } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { validateIncomingResponse } from "../validation/client-hooks.mjs";
 import { extractVersionUnsupportedDetails } from "../utils/error-extraction.mjs";
 import { buildAgentSigningContext } from "../signing/client.mjs";
 import { bindAgentStorage } from "../auth/oauth/storage-registry.mjs";
 const TEST_CLIENT_VERSION_OPTIONS = /* @__PURE__ */ Symbol("adcp.testClientVersionOptions");
 const TEST_CLIENT_SCOPE_SALT = randomBytes(32);
+const testClientScope = new AsyncLocalStorage();
+async function withTestClientScope(fn) {
+  const scope = {
+    clients: [],
+    profiles: /* @__PURE__ */ new WeakMap(),
+    profileScopes: /* @__PURE__ */ new WeakMap(),
+    authRejectedProfiles: /* @__PURE__ */ new WeakSet(),
+    active: true
+  };
+  return testClientScope.run(scope, async () => {
+    try {
+      return await fn();
+    } finally {
+      scope.active = false;
+      scope.clients.length = 0;
+    }
+  });
+}
+function hasTestClientScope() {
+  return testClientScope.getStore()?.active === true;
+}
 function resolveAuthPrincipal(options) {
   if (!options.auth) return void 0;
   switch (options.auth.type) {
@@ -55,6 +78,7 @@ function getLogger() {
 }
 function createTestClient(agentUrl, protocol = "mcp", options = {}) {
   options = withTestKitAuthDefaults(options);
+  const transport = normalizeTransportOptions(options.transport);
   const policy = classifyProbeUrl(agentUrl);
   if (!policy.allowed) {
     const hostname = new URL(agentUrl).hostname.replace(/^\[|\]$/g, "");
@@ -75,11 +99,20 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
     protocol
   };
   if (options.headers && Object.keys(options.headers).length > 0) {
-    agentConfig.headers = { ...options.headers };
+    agentConfig.headers = normalizeTestClientHeaders(options.headers);
+    for (const name of ["Authorization", "User-Agent", "Content-Type"]) {
+      const lower = name.toLowerCase();
+      const value = agentConfig.headers[lower];
+      if (value !== void 0) {
+        delete agentConfig.headers[lower];
+        agentConfig.headers[name] = value;
+      }
+    }
   }
   if (options.auth) {
     if (options.auth.type === "basic") {
       const encoded = Buffer.from(`${options.auth.username}:${options.auth.password}`).toString("base64");
+      if (agentConfig.headers) delete agentConfig.headers.authorization;
       agentConfig.headers = { ...agentConfig.headers, Authorization: `Basic ${encoded}` };
     } else if (options.auth.type === "oauth") {
       agentConfig.oauth_tokens = options.auth.tokens;
@@ -95,6 +128,7 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
   if (options.functional_request_signing) {
     agentConfig.request_signing = options.functional_request_signing;
   }
+  const scope = testClientScope.getStore();
   const multiClient = new ADCPMultiAgentClient([agentConfig], {
     headers,
     validation: {
@@ -105,7 +139,10 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
     ...options.wireAdcpVersion !== void 0 && { wireAdcpVersion: options.wireAdcpVersion },
     ...options.versionEnvelope !== void 0 && { versionEnvelope: options.versionEnvelope },
     ...options.userAgent && { userAgent: options.userAgent },
-    ...options.transport && { transport: options.transport }
+    ...transport && { transport },
+    ...scope?.active && {
+      _reuseConfiguredDiscovery: () => scope.active && testClientScope.getStore() === scope
+    }
   });
   const client = multiClient.agent("test");
   const authMode = authReuseMode(options);
@@ -123,20 +160,21 @@ function createTestClient(agentUrl, protocol = "mcp", options = {}) {
       ...requestScopeMode !== void 0 && { requestScopeMode },
       ...requestSigningMode !== void 0 && { requestSigningMode },
       ...options.auth?.type === "oauth" && options.auth.storage && { oauthStorage: options.auth.storage },
-      ...options.transport?.trustedFetchFn && { fetchFn: options.transport.trustedFetchFn },
-      ...options.transport?.allowPrivateIp !== void 0 && { allowPrivateIp: options.transport.allowPrivateIp },
-      ...options.transport?.maxResponseBytes !== void 0 && {
-        maxResponseBytes: options.transport.maxResponseBytes
+      ...transport?.trustedFetchFn && { fetchFn: transport.trustedFetchFn },
+      ...transport?.allowPrivateIp !== void 0 && { allowPrivateIp: transport.allowPrivateIp },
+      ...transport?.maxResponseBytes !== void 0 && {
+        maxResponseBytes: transport.maxResponseBytes
       },
-      ...options.transport?.requestTimeoutMs !== void 0 && {
-        requestTimeoutMs: options.transport.requestTimeoutMs
+      ...transport?.requestTimeoutMs !== void 0 && {
+        requestTimeoutMs: transport.requestTimeoutMs
       },
-      ...options.transport?.legacyCompat?.enabled !== void 0 && {
-        legacyCompatEnabled: options.transport.legacyCompat.enabled
+      ...transport?.legacyCompat?.enabled !== void 0 && {
+        legacyCompatEnabled: transport.legacyCompat.enabled
       }
     },
     enumerable: false
   });
+  if (hasTestClientScope()) testClientScope.getStore().clients.push(client);
   return client;
 }
 function getOrCreateClient(agentUrl, options) {
@@ -147,6 +185,8 @@ function getOrCreateClientResolution(agentUrl, options) {
   if (shared && isExecutableTestClient(shared) && testClientMatchesVersionOptions(shared, agentUrl, options)) {
     return { client: shared, reusedShared: true };
   }
+  const pooled = testClientScope.getStore()?.clients.find((client) => testClientMatchesVersionOptions(client, agentUrl, options));
+  if (pooled) return { client: pooled, reusedShared: true };
   return { client: createTestClient(agentUrl, options.protocol || "mcp", options), reusedShared: false };
 }
 function isExecutableTestClient(client) {
@@ -157,6 +197,7 @@ function isExecutableTestClient(client) {
 }
 function testClientMatchesVersionOptions(client, agentUrl, options) {
   const effectiveOptions = withTestKitAuthDefaults(options);
+  const expectedTransport = normalizeTransportOptions(effectiveOptions.transport);
   const meta = client[TEST_CLIENT_VERSION_OPTIONS];
   const expectedAuthMode = authReuseMode(effectiveOptions);
   const expectedRequestScopeMode = requestScopeReuseMode(effectiveOptions);
@@ -168,7 +209,7 @@ function testClientMatchesVersionOptions(client, agentUrl, options) {
   const expectedAdcpVersion = effectiveOptions.adcpVersion ?? ADCP_VERSION;
   const expectedWireAdcpVersion = effectiveOptions.wireAdcpVersion;
   const expectedVersionEnvelope = effectiveOptions.versionEnvelope ?? "auto";
-  return meta.agentUrl === agentUrl && meta.protocol === (effectiveOptions.protocol ?? "mcp") && meta.adcpVersion === expectedAdcpVersion && meta.wireAdcpVersion === expectedWireAdcpVersion && meta.versionEnvelope === expectedVersionEnvelope && meta.strictResponseSchemaValidation === (effectiveOptions.strictResponseSchemaValidation !== false) && meta.authMode === expectedAuthMode && meta.requestScopeMode === expectedRequestScopeMode && meta.requestSigningMode === expectedRequestSigningMode && meta.oauthStorage === expectedOAuthStorage && meta.fetchFn === effectiveOptions.transport?.trustedFetchFn && meta.allowPrivateIp === effectiveOptions.transport?.allowPrivateIp && meta.maxResponseBytes === effectiveOptions.transport?.maxResponseBytes && meta.requestTimeoutMs === effectiveOptions.transport?.requestTimeoutMs && meta.legacyCompatEnabled === effectiveOptions.transport?.legacyCompat?.enabled;
+  return meta.agentUrl === agentUrl && meta.protocol === (effectiveOptions.protocol ?? "mcp") && meta.adcpVersion === expectedAdcpVersion && meta.wireAdcpVersion === expectedWireAdcpVersion && meta.versionEnvelope === expectedVersionEnvelope && meta.strictResponseSchemaValidation === (effectiveOptions.strictResponseSchemaValidation !== false) && meta.authMode === expectedAuthMode && meta.requestScopeMode === expectedRequestScopeMode && meta.requestSigningMode === expectedRequestSigningMode && meta.oauthStorage === expectedOAuthStorage && meta.fetchFn === expectedTransport?.trustedFetchFn && meta.allowPrivateIp === expectedTransport?.allowPrivateIp && meta.maxResponseBytes === expectedTransport?.maxResponseBytes && meta.requestTimeoutMs === expectedTransport?.requestTimeoutMs && meta.legacyCompatEnabled === expectedTransport?.legacyCompat?.enabled;
 }
 function withTestKitAuthDefaults(options) {
   if (options.auth) return options;
@@ -199,9 +240,16 @@ function withTestKitAuthDefaults(options) {
 function authReuseMode(options) {
   return options.auth?.type;
 }
+function normalizeTestClientHeaders(headers) {
+  const normalized = {};
+  new Headers(headers).forEach((value, name) => {
+    normalized[name] = value;
+  });
+  return normalized;
+}
 function requestScopeReuseMode(options) {
   const headers = options.headers ? Object.fromEntries(
-    Object.entries(options.headers).map(([name, value]) => [name.toLowerCase(), value]).sort(([a], [b]) => a.localeCompare(b))
+    Object.entries(normalizeTestClientHeaders(options.headers)).sort(([a], [b]) => a.localeCompare(b))
   ) : void 0;
   if (!options.auth && !headers && !options.test_session_id && !options.userAgent) return void 0;
   const auth = options.auth?.type === "oauth" ? { ...options.auth, storage: void 0 } : options.auth;
@@ -224,11 +272,13 @@ function requestSigningReuseMode(config) {
     algorithm: config.provider.algorithm,
     keyid: config.provider.keyid,
     adcpUse: config.provider.adcpUse,
-    fingerprint: config.provider.fingerprint
+    fingerprint: config.provider.fingerprint,
+    publicKey: config.public_key
   } : { algorithm: config.alg, keyid: config.kid, privateKey: config.private_key };
   const fingerprint = createHmac("sha256", "").update(
     JSON.stringify({
       identity,
+      profile: config.profile ?? "rfc9421",
       agentUrl: config.agent_url,
       jwksUri: config.jwks_uri,
       signSupported: config.sign_supported === true,
@@ -237,17 +287,79 @@ function requestSigningReuseMode(config) {
   ).digest("hex").slice(0, 16);
   return `${kind}:${fingerprint}`;
 }
-async function getOrDiscoverProfile(client, options) {
-  if (options._profile) {
-    seedTestClientSigningCapability(client, options._profile, options.adcpVersion);
+async function getOrDiscoverProfile(client, options, schemaAdcpVersion) {
+  const scope = testClientScope.getStore();
+  const profileBinding = options._profile ? scope?.profileScopes.get(client)?.get(options._profile) : void 0;
+  schemaAdcpVersion ??= profileBinding?.schemaAdcpVersion ?? options.adcpVersion;
+  options.signal?.throwIfAborted();
+  const scopeKey = scope?.active ? client.getCapabilityEvidenceScope().scopeKey : void 0;
+  if (options._profile && (!scope?.active || scope.authRejectedProfiles.has(options._profile) || !options._profile.capabilities_probe_error && options._client === client && profileBinding?.scopeKey === scopeKey)) {
+    seedTestClientSigningCapability(client, options._profile, schemaAdcpVersion);
     return {
       profile: options._profile,
       step: { step: "Discover agent capabilities", passed: true, duration_ms: 0 }
     };
   }
-  return discoverAgentProfile(client, options.signal, options.adcpVersion);
+  if (!scope?.active) return discoverAgentProfile(client, options.signal, schemaAdcpVersion);
+  const key = `${scopeKey}:${schemaAdcpVersion ?? client.getAdcpVersion()}`;
+  let profiles = scope.profiles.get(client);
+  if (!profiles) {
+    profiles = /* @__PURE__ */ new Map();
+    scope.profiles.set(client, profiles);
+  }
+  let discovery = profiles.get(key);
+  if (discovery?.failed && discovery.pass !== options._discoveryPass) {
+    profiles.delete(key);
+    discovery = void 0;
+  }
+  if (!discovery) {
+    const evict = () => {
+      if (profiles.get(key) === discovery) profiles.delete(key);
+    };
+    const promise = discoverAgentProfile(client, options.signal, schemaAdcpVersion).then(
+      (result) => {
+        if (options.signal?.aborted) {
+          evict();
+        } else if (!result.step.passed || result.profile.capabilities_probe_error) {
+          if (options._discoveryPass && discovery) discovery.failed = true;
+          else evict();
+        }
+        return result;
+      },
+      (error) => {
+        evict();
+        throw error;
+      }
+    );
+    discovery = { promise, signal: options.signal, pass: options._discoveryPass };
+    profiles.set(key, discovery);
+  }
+  try {
+    const result = await raceWithSignal(discovery.promise, options.signal);
+    if (!discovery.signal?.aborted || options.signal?.aborted) return result;
+  } catch (error) {
+    if (!discovery.signal?.aborted || options.signal?.aborted) throw error;
+  }
+  if (profiles.get(key) === discovery) profiles.delete(key);
+  return getOrDiscoverProfile(client, options, schemaAdcpVersion);
+}
+function seedAuthRejectedTestClientProfile(client, profile, adcpVersion) {
+  const scope = testClientScope.getStore();
+  if (scope?.active && profile.tools.length === 0 && profile.raw_capabilities === void 0) {
+    scope.authRejectedProfiles.add(profile);
+  }
+  seedTestClientSigningCapability(client, profile, adcpVersion);
 }
 function seedTestClientSigningCapability(client, profile, adcpVersion) {
+  const scope = testClientScope.getStore();
+  if (scope?.active) {
+    let profiles = scope.profileScopes.get(client);
+    if (!profiles) {
+      profiles = /* @__PURE__ */ new WeakMap();
+      scope.profileScopes.set(client, profiles);
+    }
+    profiles.set(profile, { scopeKey: client.getCapabilityEvidenceScope().scopeKey, schemaAdcpVersion: adcpVersion });
+  }
   const raw = profile.raw_capabilities;
   if (!raw || typeof raw !== "object") return;
   const clientAccess = client;
@@ -339,6 +451,7 @@ function describeVersionUnsupported(result, requestedVersion) {
   return `VERSION_UNSUPPORTED: ${requestedText}${supportedText}`;
 }
 async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
+  const scopeKey = hasTestClientScope() ? client.getCapabilityEvidenceScope().scopeKey : void 0;
   const {
     result: agentInfo,
     step,
@@ -408,7 +521,9 @@ async function discoverAgentProfile(client, signal, schemaAdcpVersion) {
       profile.capabilities_probe_error = err?.message || String(err);
     }
   }
-  seedTestClientSigningCapability(client, profile, schemaAdcpVersion);
+  if (scopeKey === void 0 || scopeKey === client.getCapabilityEvidenceScope().scopeKey) {
+    seedTestClientSigningCapability(client, profile, schemaAdcpVersion);
+  }
   return { profile, step, ...caughtError !== void 0 && { caughtError } };
 }
 async function discoverAgentCapabilities(client, profile, options) {
@@ -718,12 +833,15 @@ export {
   getOrCreateClient,
   getOrCreateClientResolution,
   getOrDiscoverProfile,
+  hasTestClientScope,
   resolveAccount,
   resolveAuthPrincipal,
   resolveBrand,
   runStep,
+  seedAuthRejectedTestClientProfile,
   seedTestClientSigningCapability,
   setAgentTesterLogger,
   testClientWireAdcpVersion,
-  validateResponseSchema
+  validateResponseSchema,
+  withTestClientScope
 };