@adcp/sdk 15.9.2 → 15.9.4

package/dist/lib/server/wire-spec-fields.generated.mjs

@@ -1,160 +1,160 @@
 const WIRE_SPEC_FIELDS = Object.freeze({
-  /** schemas/cache/3.2.4/brand/acquire-rights-request.json */
+  /** schemas/cache/3.2.5/brand/acquire-rights-request.json */
   AcquireRightsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "buyer", "campaign", "context", "ext", "governance_context", "idempotency_key", "pricing_option_id", "push_notification_config", "revocation_webhook", "rights_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/signals/activate-signal-request.json */
+  /** schemas/cache/3.2.5/signals/activate-signal-request.json */
   ActivateSignalRequest: Object.freeze({
     fields: Object.freeze(["account", "action", "adcp_major_version", "adcp_version", "context", "destinations", "ext", "governance_context", "idempotency_key", "pricing_option_id", "signal_agent_segment_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/build-creative-request.json */
+  /** schemas/cache/3.2.5/media-buy/build-creative-request.json */
   BuildCreativeRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "brand", "concept_id", "config", "context", "creative_id", "creative_manifest", "creative_representation_set", "evaluator", "ext", "governance_context", "idempotency_key", "include_preview", "item_limit", "keep_mode", "macro_values", "max_creatives", "max_spend", "max_variants", "media_buy_id", "message", "mode", "package_id", "preview_inputs", "preview_output_format", "preview_quality", "push_notification_config", "quality", "refine_from_build_variant_id", "representation_destination", "representation_selection_strategy", "selection_strategy", "signal_conditions", "target_capability_id", "target_capability_ids", "target_format_id", "target_format_ids", "transformer_id", "variant_axis"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/content-standards/calibrate-content-request.json */
+  /** schemas/cache/3.2.5/content-standards/calibrate-content-request.json */
   CalibrateContentRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "artifact", "context", "ext", "idempotency_key", "standards_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/collection/create-collection-list-request.json */
+  /** schemas/cache/3.2.5/collection/create-collection-list-request.json */
   CreateCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_collections", "brand", "context", "description", "ext", "filters", "idempotency_key", "name"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/content-standards/create-content-standards-request.json */
+  /** schemas/cache/3.2.5/content-standards/create-content-standards-request.json */
   CreateContentStandardsRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "calibration_exemplars", "context", "ext", "idempotency_key", "policies", "registry_policy_ids", "scope"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/create-media-buy-request.json */
+  /** schemas/cache/3.2.5/media-buy/create-media-buy-request.json */
   CreateMediaBuyRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "advertiser_industry", "agency_estimate_number", "artifact_webhook", "bidding", "brand", "budget_allocation", "budget_cap_timezone", "context", "daily_budget_cap", "end_time", "ext", "frequency_cap", "governance_context", "idempotency_key", "invoice_recipient", "io_acceptance", "name", "opportunity", "pacing", "packages", "paused", "plan_id", "po_number", "proposal_id", "push_notification_config", "reporting_webhook", "start_time", "total_budget"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/property/create-property-list-request.json */
+  /** schemas/cache/3.2.5/property/create-property-list-request.json */
   CreatePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_properties", "brand", "context", "description", "ext", "filters", "idempotency_key", "name"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/collection/delete-collection-list-request.json */
+  /** schemas/cache/3.2.5/collection/delete-collection-list-request.json */
   DeleteCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "list_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/property/delete-property-list-request.json */
+  /** schemas/cache/3.2.5/property/delete-property-list-request.json */
   DeletePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "list_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/get-media-buy-delivery-request.json */
+  /** schemas/cache/3.2.5/media-buy/get-media-buy-delivery-request.json */
   GetMediaBuyDeliveryRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "attribution_window", "context", "end_date", "ext", "include_package_daily_breakdown", "include_window_breakdown", "media_buy_ids", "pagination", "reporting_dimensions", "reporting_revision_id", "requested_metrics", "start_date", "status_filter", "time_granularity"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/get-reporting-status-request.json */
+  /** schemas/cache/3.2.5/media-buy/get-reporting-status-request.json */
   GetReportingStatusRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "changes_after", "context", "delivery_config_ids", "ext", "feed_purposes", "finality", "health", "media_buy_ids", "pagination", "period", "reporting_revision_id", "view"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/log-event-request.json */
+  /** schemas/cache/3.2.5/media-buy/log-event-request.json */
   LogEventRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "event_source_id", "events", "ext", "idempotency_key", "test_event_code"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/provide-performance-feedback-request.json */
+  /** schemas/cache/3.2.5/media-buy/provide-performance-feedback-request.json */
   ProvidePerformanceFeedbackRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "as_of", "baseline", "context", "creative_id", "evidence", "evidence_ref", "ext", "feedback_source", "final", "idempotency_key", "measurement_period", "media_buy_id", "methodology", "methodology_version", "metric", "metric_type", "package_id", "performance_index", "producer", "study_ref", "supersedes_feedback_id", "vendor"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/governance/report-plan-outcome-request.json */
+  /** schemas/cache/3.2.5/governance/report-plan-outcome-request.json */
   ReportPlanOutcomeRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "check_id", "context", "delivery", "error", "ext", "governance_context", "idempotency_key", "outcome", "plan_id", "purchase_type", "seller_response"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/account/report-usage-request.json */
+  /** schemas/cache/3.2.5/account/report-usage-request.json */
   ReportUsageRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "reporting_period", "usage"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/sponsored-intelligence/si-initiate-session-request.json */
+  /** schemas/cache/3.2.5/sponsored-intelligence/si-initiate-session-request.json */
   SIInitiateSessionRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "identity", "intent", "media_buy_id", "offering_id", "offering_token", "placement", "sponsored_context_receipt", "supported_capabilities"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/sponsored-intelligence/si-send-message-request.json */
+  /** schemas/cache/3.2.5/sponsored-intelligence/si-send-message-request.json */
   SISendMessageRequest: Object.freeze({
     fields: Object.freeze(["action_response", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "message", "session_id", "sponsored_context_receipt"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/account/sync-accounts-request.json */
+  /** schemas/cache/3.2.5/account/sync-accounts-request.json */
   SyncAccountsRequest: Object.freeze({
     fields: Object.freeze(["accounts", "adcp_major_version", "adcp_version", "context", "delete_missing", "dry_run", "ext", "idempotency_key", "push_notification_config"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/sync-audiences-request.json */
+  /** schemas/cache/3.2.5/media-buy/sync-audiences-request.json */
   SyncAudiencesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "audiences", "context", "delete_missing", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/sync-catalogs-request.json */
+  /** schemas/cache/3.2.5/media-buy/sync-catalogs-request.json */
   SyncCatalogsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "catalog_ids", "catalogs", "context", "delete_missing", "dry_run", "ext", "idempotency_key", "item_availability_queries", "item_availability_updates", "push_notification_config", "validation_mode"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/creative/sync-creatives-request.json */
+  /** schemas/cache/3.2.5/creative/sync-creatives-request.json */
   SyncCreativesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "assignment_operations", "assignments", "context", "creative_ids", "creatives", "delete_missing", "dry_run", "ext", "idempotency_key", "push_notification_config", "validation_mode"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/sync-event-sources-request.json */
+  /** schemas/cache/3.2.5/media-buy/sync-event-sources-request.json */
   SyncEventSourcesRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "delete_missing", "event_sources", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/account/sync-governance-request.json */
+  /** schemas/cache/3.2.5/account/sync-governance-request.json */
   SyncGovernanceRequest: Object.freeze({
     fields: Object.freeze(["accounts", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/governance/sync-plans-request.json */
+  /** schemas/cache/3.2.5/governance/sync-plans-request.json */
   SyncPlansRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "plans"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/sync-reporting-receipts-request.json */
+  /** schemas/cache/3.2.5/media-buy/sync-reporting-receipts-request.json */
   SyncReportingReceiptsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "adjustment_receipts", "context", "ext", "idempotency_key", "receipts"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/sync-reporting-status-request.json */
+  /** schemas/cache/3.2.5/media-buy/sync-reporting-status-request.json */
   SyncReportingStatusRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "ext", "idempotency_key", "statuses"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/collection/update-collection-list-request.json */
+  /** schemas/cache/3.2.5/collection/update-collection-list-request.json */
   UpdateCollectionListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_collections", "brand", "context", "description", "ext", "filters", "idempotency_key", "list_id", "name", "webhook_url"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/content-standards/update-content-standards-request.json */
+  /** schemas/cache/3.2.5/content-standards/update-content-standards-request.json */
   UpdateContentStandardsRequest: Object.freeze({
     fields: Object.freeze(["adcp_major_version", "adcp_version", "calibration_exemplars", "context", "ext", "idempotency_key", "policies", "registry_policy_ids", "scope", "standards_id"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/media-buy/update-media-buy-request.json */
+  /** schemas/cache/3.2.5/media-buy/update-media-buy-request.json */
   UpdateMediaBuyRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "bidding", "budget_allocation", "budget_cap_timezone", "canceled", "cancellation_reason", "context", "daily_budget_cap", "end_time", "ext", "frequency_cap", "governance_context", "idempotency_key", "invoice_recipient", "media_buy_id", "name", "new_packages", "pacing", "packages", "paused", "push_notification_config", "reporting_webhook", "revision", "start_time", "total_budget"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/property/update-property-list-request.json */
+  /** schemas/cache/3.2.5/property/update-property-list-request.json */
   UpdatePropertyListRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "base_properties", "brand", "context", "description", "ext", "filters", "idempotency_key", "list_id", "name", "webhook_url"]),
     __type: null
   }),
-  /** schemas/cache/3.2.4/brand/update-rights-request.json */
+  /** schemas/cache/3.2.5/brand/update-rights-request.json */
   UpdateRightsRequest: Object.freeze({
     fields: Object.freeze(["account", "adcp_major_version", "adcp_version", "context", "end_date", "ext", "governance_context", "idempotency_key", "impression_cap", "paused", "pricing_option_id", "push_notification_config", "rights_id"]),
     __type: null

package/dist/lib/testing/storyboard/compliance.js

@@ -96,7 +96,17 @@ function readAdcpVersion() {
   return import_version.ADCP_VERSION;
 }
 function complianceMissingMessage(what, path) {
-  return `${what} not found at ${path}. The compliance cache ships with @adcp/sdk \u2014 run \`npm i @adcp/sdk@latest\` (or \`npx @adcp/sdk@latest \u2026\`) to pick up the current cache. If developing locally, run \`npm run sync-schemas\` to populate the cache.`;
+  const packaged = packagedComplianceVersions();
+  const available = packaged.length ? `Packaged compliance versions: ${packaged.join(", ")}. Exact patch versions are required \u2014 there is no '3.1'/'3.2' minor alias, so a removed version errors here rather than resolving to different bytes. ` : "";
+  return `${what} not found at ${path}. ` + available + `The compliance cache ships with @adcp/sdk \u2014 if this version should be present, run \`npm i @adcp/sdk@latest\` (or \`npx @adcp/sdk@latest \u2026\`). To grade against a version this install does not package, run \`npm run sync-schemas -- <version>\` in a repo checkout and pass \`--compliance-dir\`. If developing locally, run \`npm run sync-schemas\` to populate the cache.`;
+}
+function packagedComplianceVersions() {
+  try {
+    const root = (0, import_path.join)(getRepoRoot(), "compliance", "cache");
+    return (0, import_fs.readdirSync)(root, { withFileTypes: true }).filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && /^v?\d/.test(entry.name)).map((entry) => entry.name).sort((a, b) => b.localeCompare(a, void 0, { numeric: true }));
+  } catch {
+    return [];
+  }
 }
 function loadComplianceIndex(options = {}) {
   const dir = getComplianceCacheDir(options);

package/dist/lib/testing/storyboard/compliance.mjs

@@ -61,7 +61,17 @@ function readAdcpVersion() {
   return ADCP_VERSION;
 }
 function complianceMissingMessage(what, path) {
-  return `${what} not found at ${path}. The compliance cache ships with @adcp/sdk \u2014 run \`npm i @adcp/sdk@latest\` (or \`npx @adcp/sdk@latest \u2026\`) to pick up the current cache. If developing locally, run \`npm run sync-schemas\` to populate the cache.`;
+  const packaged = packagedComplianceVersions();
+  const available = packaged.length ? `Packaged compliance versions: ${packaged.join(", ")}. Exact patch versions are required \u2014 there is no '3.1'/'3.2' minor alias, so a removed version errors here rather than resolving to different bytes. ` : "";
+  return `${what} not found at ${path}. ` + available + `The compliance cache ships with @adcp/sdk \u2014 if this version should be present, run \`npm i @adcp/sdk@latest\` (or \`npx @adcp/sdk@latest \u2026\`). To grade against a version this install does not package, run \`npm run sync-schemas -- <version>\` in a repo checkout and pass \`--compliance-dir\`. If developing locally, run \`npm run sync-schemas\` to populate the cache.`;
+}
+function packagedComplianceVersions() {
+  try {
+    const root = join(getRepoRoot(), "compliance", "cache");
+    return readdirSync(root, { withFileTypes: true }).filter((entry) => (entry.isDirectory() || entry.isSymbolicLink()) && /^v?\d/.test(entry.name)).map((entry) => entry.name).sort((a, b) => b.localeCompare(a, void 0, { numeric: true }));
+  } catch {
+    return [];
+  }
 }
 function loadComplianceIndex(options = {}) {
   const dir = getComplianceCacheDir(options);

package/dist/lib/testing/storyboard/junit.js

@@ -82,8 +82,9 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     const suiteGroup = options.suite_groups?.[sb.storyboard_id];
     const suiteClassname = suiteGroup ? `${suiteGroup}.${sb.storyboard_id}` : sb.storyboard_id;
     const suiteCases = [];
-    let suiteFailures = sb.failed_count;
+    let suiteFailures = 0;
     let representedSkipped = 0;
+    let suiteSkipped = 0;
     const passPhases = sb.passes?.length ? sb.passes.map((pass) => ({ label: `Pass ${pass.pass_index} \u203A `, phases: pass.phases })) : [{ label: "", phases: sb.phases }];
     for (const pass of passPhases) {
       for (const phase of pass.phases) {
@@ -93,6 +94,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
           const time = ((step.duration_ms || 0) / 1e3).toFixed(3);
           if (step.skipped) {
             representedSkipped += 1;
+            suiteSkipped += 1;
             totalSkipped += 1;
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -102,7 +104,6 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
             continue;
           }
           if (!step.passed) {
-            totalFailures += 1;
             const failureDetails = [
               step.error,
               ...step.validations.filter((v) => !v.passed).map(
@@ -114,6 +115,17 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
               // report body.
               ...hintLines(step.hints)
             ].filter(Boolean).join("\n");
+            if (step.counts_toward_failure === false) {
+              suiteCases.push(
+                `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
+      <system-out>${xmlEscape(`Optional phase failure; excluded from storyboard verdict.
+${failureDetails}`)}</system-out>
+    </testcase>`
+              );
+              continue;
+            }
+            totalFailures += 1;
+            suiteFailures += 1;
             const message = step.error || firstHintMessage(step) || "validation failed";
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -136,6 +148,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     if (hasStoryboardFixtureSkip) {
       totalTests += 1;
       totalSkipped += 1;
+      suiteSkipped += 1;
       suiteCases.push(
         `    <testcase classname="${xmlEscape(suiteClassname)}" name="Fixture resolution" time="0.000">
       <skipped message="${xmlEscape(fixtureGap.detail)}"/>
@@ -159,7 +172,7 @@ ${assertion.error}` : ""}`;
     totalDuration += sb.total_duration_ms || 0;
     const suiteTests = suiteCases.length;
     suites.push(
-      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${sb.skipped_count}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
+      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${suiteSkipped}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
 ` + suiteCases.join("\n") + `
   </testsuite>`
     );

package/dist/lib/testing/storyboard/junit.mjs

@@ -58,8 +58,9 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     const suiteGroup = options.suite_groups?.[sb.storyboard_id];
     const suiteClassname = suiteGroup ? `${suiteGroup}.${sb.storyboard_id}` : sb.storyboard_id;
     const suiteCases = [];
-    let suiteFailures = sb.failed_count;
+    let suiteFailures = 0;
     let representedSkipped = 0;
+    let suiteSkipped = 0;
     const passPhases = sb.passes?.length ? sb.passes.map((pass) => ({ label: `Pass ${pass.pass_index} \u203A `, phases: pass.phases })) : [{ label: "", phases: sb.phases }];
     for (const pass of passPhases) {
       for (const phase of pass.phases) {
@@ -69,6 +70,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
           const time = ((step.duration_ms || 0) / 1e3).toFixed(3);
           if (step.skipped) {
             representedSkipped += 1;
+            suiteSkipped += 1;
             totalSkipped += 1;
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -78,7 +80,6 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
             continue;
           }
           if (!step.passed) {
-            totalFailures += 1;
             const failureDetails = [
               step.error,
               ...step.validations.filter((v) => !v.passed).map(
@@ -90,6 +91,17 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
               // report body.
               ...hintLines(step.hints)
             ].filter(Boolean).join("\n");
+            if (step.counts_toward_failure === false) {
+              suiteCases.push(
+                `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
+      <system-out>${xmlEscape(`Optional phase failure; excluded from storyboard verdict.
+${failureDetails}`)}</system-out>
+    </testcase>`
+              );
+              continue;
+            }
+            totalFailures += 1;
+            suiteFailures += 1;
             const message = step.error || firstHintMessage(step) || "validation failed";
             suiteCases.push(
               `    <testcase classname="${xmlEscape(suiteClassname)}" name="${xmlEscape(name)}" time="${time}">
@@ -112,6 +124,7 @@ function formatStoryboardResultsAsJUnit(results, options = {}) {
     if (hasStoryboardFixtureSkip) {
       totalTests += 1;
       totalSkipped += 1;
+      suiteSkipped += 1;
       suiteCases.push(
         `    <testcase classname="${xmlEscape(suiteClassname)}" name="Fixture resolution" time="0.000">
       <skipped message="${xmlEscape(fixtureGap.detail)}"/>
@@ -135,7 +148,7 @@ ${assertion.error}` : ""}`;
     totalDuration += sb.total_duration_ms || 0;
     const suiteTests = suiteCases.length;
     suites.push(
-      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${sb.skipped_count}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
+      `  <testsuite name="${xmlEscape(suiteGroup ? `${suiteGroup} \u203A ${sb.storyboard_title}` : sb.storyboard_title)}"${suiteGroup ? ` package="${xmlEscape(`adcp.${suiteGroup}`)}"` : ""} tests="${suiteTests}" failures="${suiteFailures}" skipped="${suiteSkipped}" time="${((sb.total_duration_ms || 0) / 1e3).toFixed(3)}" timestamp="${sb.tested_at || (/* @__PURE__ */ new Date()).toISOString()}">
 ` + suiteCases.join("\n") + `
   </testsuite>`
     );

package/dist/lib/testing/storyboard/runner.js

@@ -548,6 +548,7 @@ function applyBranchSetGrading(phases, phaseResults, branchSetByPhaseId, contrib
       step.skip = { reason: "peer_branch_taken", detail };
       delete step.error;
       delete step.adcp_error;
+      delete step.counts_toward_failure;
       skippedDelta++;
       regraded = true;
     }
@@ -2646,6 +2647,8 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         if (!phase.optional || (routingContext ? routedOauthPresent.has(assignment.instanceIndex) : presenceDetected)) {
           failedCount++;
           countedAsFailed.add(result2);
+        } else if (!result2.validations.some((validation) => validation.check === "assertion" && !validation.passed)) {
+          result2.counts_toward_failure = false;
         }
         if (step.stateful) {
           phaseStatefulCascades.set(phase.id, null);
@@ -3657,9 +3660,20 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && (0, import_idempotency.requestUsesIdempotency)(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
+  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
+  let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    if (useSdkAuthOverride) {
+      if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
+      authOverrideClient = createAuthOverrideClient(
+        runState.agentUrl,
+        options.protocol ?? "mcp",
+        options,
+        rawProbeHeaders
+      );
+    }
   } catch (err) {
     return {
       step_id: step.id,
@@ -3674,7 +3688,8 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
       extraction: { path: "none" }
     };
   }
-  const useRawProbe = rawProbeHeaders !== void 0;
+  const useRawProbe = rawProbeHeaders !== void 0 && !useSdkAuthOverride;
+  const stepClient = () => authOverrideClient ?? client;
   let taskResult;
   let stepResult;
   let caughtError;
@@ -3758,7 +3773,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     const started = Date.now();
     try {
       if (options.protocol === "a2a") {
-        const probeClient = createA2AAuthOverrideClient(runState.agentUrl, options, rawProbeHeaders ?? {});
+        const probeClient = createAuthOverrideClient(runState.agentUrl, "a2a", options, rawProbeHeaders ?? {});
         const captured = await (0, import_rawResponseCapture.withRawResponseCapture)(
           () => (0, import_client.runStep)(
             step.title,
@@ -3853,7 +3868,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     let a2aCaptures;
     if (step.parallel_dispatch) {
       const started = Date.now();
-      crossResponses = await (0, import_parallel_dispatch.runParallelDispatches)(client, effectiveStep.task, request, {
+      crossResponses = await (0, import_parallel_dispatch.runParallelDispatches)(stepClient(), effectiveStep.task, request, {
         spec: step.parallel_dispatch,
         keyMinter: import_idempotency.generateIdempotencyKey,
         correlationPrefix: step.id,
@@ -3890,7 +3905,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
         };
       }
     } else {
-      const dispatch = () => (0, import_task_map.executeStoryboardTask)(client, effectiveStep.task, request, {
+      const dispatch = () => (0, import_task_map.executeStoryboardTask)(stepClient(), effectiveStep.task, request, {
         skipIdempotencyAutoInject: testsIdempotencyKeyOmission,
         skipAccountValidation: testsMissingAccount,
         skipRequestValidation: testsSchemaInvalidRequest,
@@ -5699,8 +5714,10 @@ function defaultAuthHeadersForRawProbe(options) {
 }
 function sessionProbeRoutingHeaders(options) {
   const headers = {};
+  const runSecrets = runCredentialValues(options);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (!SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase())) continue;
+    if (runSecrets.some((secret) => value.includes(secret))) continue;
     try {
       assertSafeAuthHeaderPart(value, `options.headers.${name}`);
     } catch {
@@ -5725,35 +5742,62 @@ function setHeaderIfAbsent(headers, name, value, label) {
 }
 function runCredentialValues(options) {
   const values = [];
+  const pushHeaderToken = (value) => {
+    values.push(value, value.replace(/^[\t ]+|[\t ]+$/g, ""));
+  };
+  const pushUserPass = (userpass) => {
+    values.push(userpass, Buffer.from(userpass).toString("base64"));
+    const separator = userpass.indexOf(":");
+    if (separator >= 0) values.push(userpass.slice(separator + 1));
+  };
   const auth = options.auth;
-  if (auth?.type === "bearer" && typeof auth.token === "string") values.push(auth.token);
+  if (auth?.type === "bearer" && typeof auth.token === "string") pushHeaderToken(auth.token);
   if (auth?.type === "basic") {
     if (typeof auth.password === "string") values.push(auth.password);
     if (typeof auth.username === "string" && typeof auth.password === "string") {
-      values.push(`${auth.username}:${auth.password}`);
+      pushUserPass(`${auth.username}:${auth.password}`);
     }
   }
   if (auth?.type === "oauth" || auth?.type === "oauth_client_credentials") {
     const token = auth.tokens?.access_token;
-    if (typeof token === "string") values.push(token);
+    if (typeof token === "string") pushHeaderToken(token);
   }
   const kit = options.test_kit?.auth;
-  if (typeof kit?.api_key === "string") values.push(kit.api_key);
+  if (typeof kit?.api_key === "string") pushHeaderToken(kit.api_key);
   const basic = kit?.basic;
   if (typeof basic?.password === "string") values.push(basic.password);
   if (typeof basic?.username === "string" && typeof basic?.password === "string") {
-    values.push(`${basic.username}:${basic.password}`);
+    pushUserPass(`${basic.username}:${basic.password}`);
   }
-  if (typeof basic?.credentials === "string") values.push(basic.credentials);
+  if (typeof basic?.credentials === "string") pushUserPass(basic.credentials);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (typeof value !== "string" || value.length === 0) continue;
-    if (AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) || isCredentialHeaderName(name)) values.push(value);
+    if (!AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) && !isCredentialHeaderName(name)) continue;
+    pushHeaderToken(value);
+    const scheme = /^(Bearer|Basic|Token|ApiKey)\s+(.+)$/i.exec(value.trim());
+    if (scheme?.[1] !== void 0 && scheme[2] !== void 0) {
+      const payload = scheme[2].trim();
+      values.push(payload);
+      if (/^Basic$/i.test(scheme[1]) && /^[A-Za-z0-9+/]+={0,2}$/.test(payload)) {
+        const bytes = Buffer.from(payload, "base64");
+        const decoded = bytes.toString("utf8");
+        if (bytes.toString("base64").replace(/=+$/, "") === payload.replace(/=+$/, "") && Buffer.from(decoded, "utf8").equals(bytes) && !/[\x00-\x1f\x7f]/.test(decoded) && decoded.includes(":")) {
+          pushUserPass(decoded);
+        }
+      }
+    }
   }
   return values.filter((value) => value.trim().length > 0);
 }
 const SESSION_PROBE_ROUTING_HEADERS = /* @__PURE__ */ new Set([
   "x-tenant-id",
   "x-tenant",
+  // AdCP's own tenant-routing header (`src/lib/testing/types.ts` names it as
+  // the canonical example). Omitting it meant a run that routes on it had the
+  // header classified as unknown: dropped from session probes, and — once the
+  // isolated-client value test landed — silently strippable on a credential
+  // collision, which reroutes the step to another tenant.
+  "x-adcp-tenant",
   "x-account",
   "x-account-id",
   "x-routing-key",
@@ -5772,16 +5816,17 @@ function unroutableProbeHeader(options) {
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     const lower = name.toLowerCase();
     if (SESSION_PROBE_ROUTING_HEADERS.has(lower)) {
+      if (runSecrets.some((secret) => value.includes(secret))) return { name, reason: "credential_collision" };
       try {
         assertSafeAuthHeaderPart(value, `options.headers.${name}`);
       } catch {
-        return name;
+        return { name, reason: "malformed" };
       }
       continue;
     }
     if (AUTH_OVERRIDE_HEADER_NAMES.has(lower)) continue;
     if (runSecrets.some((secret) => value.includes(secret))) continue;
-    return name;
+    return { name, reason: "unknown" };
   }
   return void 0;
 }
@@ -6015,11 +6060,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   }
   const unroutable = unroutableProbeHeader(options);
   if (unroutable !== void 0) {
-    return {
-      kind: "skip",
-      reason: "session_probe_ungradable",
-      detail: `The runner cannot classify run header "${escapeControlChars(unroutable.slice(0, 64))}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`
-    };
+    const name = escapeControlChars(unroutable.name.slice(0, 64));
+    const detail = unroutable.reason === "credential_collision" ? `Routing header "${name}" has a value containing a credential this run holds. Nothing was graded: forwarding it could authenticate the unauthenticated probe, and dropping it could change tenants. Choose a routing value or suite credential that does not collide.` : unroutable.reason === "malformed" ? `Routing header "${name}" contains invalid header characters. Nothing was graded because dropping it could change tenants. Correct this run header before retrying the probe.` : `The runner cannot classify run header "${name}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`;
+    return { kind: "skip", reason: "session_probe_ungradable", detail };
   }
   const routing = sessionProbeRoutingHeaders(options);
   let headers;
@@ -6052,6 +6095,11 @@ function authHeadersForStep(directive, options) {
   if ("value" in directive && directive.value) {
     value = directive.value;
   } else if ("from_test_kit" in directive && directive.from_test_kit) {
+    if (typeof directive.from_test_kit === "string") {
+      throw new Error(
+        "Named test-kit API-key paths are not supported; use from_test_kit: true only for the primary key."
+      );
+    }
     value = options.test_kit?.auth?.api_key;
     if (!value) {
       throw new Error(
@@ -6068,6 +6116,13 @@ function authHeadersForStep(directive, options) {
   }
   return { authorization: `Bearer ${value}` };
 }
+const HTTP_PROBE_ONLY_CHECKS = /* @__PURE__ */ new Set([
+  "http_status",
+  "http_status_in",
+  "probe_passed",
+  "on_401_require_header",
+  "resource_equals_agent_url"
+]);
 const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "authorization",
   "proxy-authorization",
@@ -6076,14 +6131,28 @@ const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-api-key"
 ]);
 const AUTH_OVERRIDE_CREDENTIAL_HEADER_RE = /(^|[-_])(auth(?:entication|orization)?|credentials?|secrets?|tokens?|keys?|api[-_]?keys?|access[-_]?keys?|private[-_]?keys?|password|passwd|signatures?|cert(?:ificate)?s?)([-_]|$)/i;
+const AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE = /(auth(?:entication|orization)?|credentials?|secrets?|tokens?|passwords?|passwd|signatures?|certificates?|bearer|(?:api|access|private|session|auth|secret|client|app|master|signing|shared|subscription)keys?|(?:client|tls|ssl)certs?)$/i;
 function isCredentialHeaderName(name) {
   const normalized = name.toLowerCase();
-  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized);
+  if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
+  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
-  const headers = Object.fromEntries(
-    Object.entries(options.headers ?? {}).filter(([name]) => !isCredentialHeaderName(name))
-  );
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+  const runSecrets = runCredentialValues(options);
+  const headers = {};
+  for (const [name, value] of Object.entries(options.headers ?? {})) {
+    const isRouting = SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase());
+    if (!isRouting && isCredentialHeaderName(name)) continue;
+    if (typeof value === "string" && runSecrets.some((secret) => value.includes(secret))) {
+      if (isRouting) {
+        throw new Error(
+          `options.headers.${name} is a routing header but its value contains a credential this run holds; an isolated step cannot both route correctly and withhold the suite principal. Choose a routing value or suite credential that does not collide.`
+        );
+      }
+      continue;
+    }
+    headers[name] = value;
+  }
   let auth;
   for (const [name, value] of Object.entries(authHeaders)) {
     if (name.toLowerCase() === "authorization" && value.startsWith("Bearer ")) {
@@ -6092,9 +6161,9 @@ function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
       headers[name] = value;
     }
   }
-  return (0, import_client.createTestClient)(agentUrl, "a2a", {
+  return (0, import_client.createTestClient)(agentUrl, protocol, {
     ...options,
-    protocol: "a2a",
+    protocol,
     auth,
     test_kit: void 0,
     _client: void 0,