@adcp/sdk 16.0.0-beta.3 → 16.0.0-beta.4

package/dist/lib/testing/storyboard/request-signing/builder.js

@@ -24,6 +24,7 @@ __export(builder_exports, {
 });
 module.exports = __toCommonJS(builder_exports);
 var import_crypto = require("crypto");
+var import_structured_headers = require("structured-headers");
 var import_crypto2 = require('../../../signing/crypto.js');
 var import_signing = require('../../../signing/index.js');
 var import_vector_loader = require('./vector-loader.js');
@@ -561,15 +562,15 @@ function refreshContentDigest(shaped, vector, shape) {
   });
 }
 function formatParamsWithOmissions(components, params, override) {
-  const componentList = components.map((c) => `"${c}"`).join(" ");
-  const pairs = [];
-  pairs.push(`created=${params.created}`);
-  if (!override.omitExpires) pairs.push(`expires=${params.expires}`);
-  if (!override.omitNonce) pairs.push(`nonce="${params.nonce}"`);
-  pairs.push(`keyid="${params.keyid}"`);
-  pairs.push(`alg="${params.alg}"`);
-  pairs.push(`tag="${params.tag}"`);
-  return `(${componentList});${pairs.join(";")}`;
+  const omitted = /* @__PURE__ */ new Set([
+    ...override.omitExpires ? ["expires"] : [],
+    ...override.omitNonce ? ["nonce"] : []
+  ]);
+  const pairs = /* @__PURE__ */ new Map();
+  for (const key of ["created", "expires", "nonce", "keyid", "alg", "tag"]) {
+    if (!omitted.has(key) && params[key] !== void 0) pairs.set(key, params[key]);
+  }
+  return (0, import_structured_headers.serializeInnerList)([components.map((c) => [c, /* @__PURE__ */ new Map()]), pairs]);
 }
 function produceSignature(key, data) {
   return (0, import_crypto2.signWithPrivateJwk)(key.alg, key.privateKey, data);

package/dist/lib/testing/storyboard/request-signing/builder.mjs

@@ -1,4 +1,5 @@
 import { createHash, randomBytes, randomUUID } from "crypto";
+import { serializeInnerList } from "structured-headers";
 import { signWithPrivateJwk } from "../../../signing/crypto.mjs";
 import {
   buildSignatureBase,
@@ -544,15 +545,15 @@ function refreshContentDigest(shaped, vector, shape) {
   });
 }
 function formatParamsWithOmissions(components, params, override) {
-  const componentList = components.map((c) => `"${c}"`).join(" ");
-  const pairs = [];
-  pairs.push(`created=${params.created}`);
-  if (!override.omitExpires) pairs.push(`expires=${params.expires}`);
-  if (!override.omitNonce) pairs.push(`nonce="${params.nonce}"`);
-  pairs.push(`keyid="${params.keyid}"`);
-  pairs.push(`alg="${params.alg}"`);
-  pairs.push(`tag="${params.tag}"`);
-  return `(${componentList});${pairs.join(";")}`;
+  const omitted = /* @__PURE__ */ new Set([
+    ...override.omitExpires ? ["expires"] : [],
+    ...override.omitNonce ? ["nonce"] : []
+  ]);
+  const pairs = /* @__PURE__ */ new Map();
+  for (const key of ["created", "expires", "nonce", "keyid", "alg", "tag"]) {
+    if (!omitted.has(key) && params[key] !== void 0) pairs.set(key, params[key]);
+  }
+  return serializeInnerList([components.map((c) => [c, /* @__PURE__ */ new Map()]), pairs]);
 }
 function produceSignature(key, data) {
   return signWithPrivateJwk(key.alg, key.privateKey, data);

package/dist/lib/testing/storyboard/runner.js

@@ -548,6 +548,7 @@ function applyBranchSetGrading(phases, phaseResults, branchSetByPhaseId, contrib
       step.skip = { reason: "peer_branch_taken", detail };
       delete step.error;
       delete step.adcp_error;
+      delete step.counts_toward_failure;
       skippedDelta++;
       regraded = true;
     }
@@ -2661,6 +2662,8 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         if (!phase.optional || (routingContext ? routedOauthPresent.has(assignment.instanceIndex) : presenceDetected)) {
           failedCount++;
           countedAsFailed.add(result2);
+        } else if (!result2.validations.some((validation) => validation.check === "assertion" && !validation.passed)) {
+          result2.counts_toward_failure = false;
         }
         if (step.stateful) {
           phaseStatefulCascades.set(phase.id, null);
@@ -3672,9 +3675,20 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && (0, import_idempotency.requestUsesIdempotency)(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
+  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
+  let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    if (useSdkAuthOverride) {
+      if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
+      authOverrideClient = createAuthOverrideClient(
+        runState.agentUrl,
+        options.protocol ?? "mcp",
+        options,
+        rawProbeHeaders
+      );
+    }
   } catch (err) {
     return {
       step_id: step.id,
@@ -3689,7 +3703,8 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
       extraction: { path: "none" }
     };
   }
-  const useRawProbe = rawProbeHeaders !== void 0;
+  const useRawProbe = rawProbeHeaders !== void 0 && !useSdkAuthOverride;
+  const stepClient = () => authOverrideClient ?? client;
   let taskResult;
   let stepResult;
   let caughtError;
@@ -3773,7 +3788,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     const started = Date.now();
     try {
       if (options.protocol === "a2a") {
-        const probeClient = createA2AAuthOverrideClient(runState.agentUrl, options, rawProbeHeaders ?? {});
+        const probeClient = createAuthOverrideClient(runState.agentUrl, "a2a", options, rawProbeHeaders ?? {});
         const captured = await (0, import_rawResponseCapture.withRawResponseCapture)(
           () => (0, import_client.runStep)(
             step.title,
@@ -3868,7 +3883,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     let a2aCaptures;
     if (step.parallel_dispatch) {
       const started = Date.now();
-      crossResponses = await (0, import_parallel_dispatch.runParallelDispatches)(client, effectiveStep.task, request, {
+      crossResponses = await (0, import_parallel_dispatch.runParallelDispatches)(stepClient(), effectiveStep.task, request, {
         spec: step.parallel_dispatch,
         keyMinter: import_idempotency.generateIdempotencyKey,
         correlationPrefix: step.id,
@@ -3905,7 +3920,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
         };
       }
     } else {
-      const dispatch = () => (0, import_task_map.executeStoryboardTask)(client, effectiveStep.task, request, {
+      const dispatch = () => (0, import_task_map.executeStoryboardTask)(stepClient(), effectiveStep.task, request, {
         skipIdempotencyAutoInject: testsIdempotencyKeyOmission,
         skipAccountValidation: testsMissingAccount,
         skipRequestValidation: testsSchemaInvalidRequest,
@@ -5714,8 +5729,10 @@ function defaultAuthHeadersForRawProbe(options) {
 }
 function sessionProbeRoutingHeaders(options) {
   const headers = {};
+  const runSecrets = runCredentialValues(options);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (!SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase())) continue;
+    if (runSecrets.some((secret) => value.includes(secret))) continue;
     try {
       assertSafeAuthHeaderPart(value, `options.headers.${name}`);
     } catch {
@@ -5740,35 +5757,62 @@ function setHeaderIfAbsent(headers, name, value, label) {
 }
 function runCredentialValues(options) {
   const values = [];
+  const pushHeaderToken = (value) => {
+    values.push(value, value.replace(/^[\t ]+|[\t ]+$/g, ""));
+  };
+  const pushUserPass = (userpass) => {
+    values.push(userpass, Buffer.from(userpass).toString("base64"));
+    const separator = userpass.indexOf(":");
+    if (separator >= 0) values.push(userpass.slice(separator + 1));
+  };
   const auth = options.auth;
-  if (auth?.type === "bearer" && typeof auth.token === "string") values.push(auth.token);
+  if (auth?.type === "bearer" && typeof auth.token === "string") pushHeaderToken(auth.token);
   if (auth?.type === "basic") {
     if (typeof auth.password === "string") values.push(auth.password);
     if (typeof auth.username === "string" && typeof auth.password === "string") {
-      values.push(`${auth.username}:${auth.password}`);
+      pushUserPass(`${auth.username}:${auth.password}`);
     }
   }
   if (auth?.type === "oauth" || auth?.type === "oauth_client_credentials") {
     const token = auth.tokens?.access_token;
-    if (typeof token === "string") values.push(token);
+    if (typeof token === "string") pushHeaderToken(token);
   }
   const kit = options.test_kit?.auth;
-  if (typeof kit?.api_key === "string") values.push(kit.api_key);
+  if (typeof kit?.api_key === "string") pushHeaderToken(kit.api_key);
   const basic = kit?.basic;
   if (typeof basic?.password === "string") values.push(basic.password);
   if (typeof basic?.username === "string" && typeof basic?.password === "string") {
-    values.push(`${basic.username}:${basic.password}`);
+    pushUserPass(`${basic.username}:${basic.password}`);
   }
-  if (typeof basic?.credentials === "string") values.push(basic.credentials);
+  if (typeof basic?.credentials === "string") pushUserPass(basic.credentials);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (typeof value !== "string" || value.length === 0) continue;
-    if (AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) || isCredentialHeaderName(name)) values.push(value);
+    if (!AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) && !isCredentialHeaderName(name)) continue;
+    pushHeaderToken(value);
+    const scheme = /^(Bearer|Basic|Token|ApiKey)\s+(.+)$/i.exec(value.trim());
+    if (scheme?.[1] !== void 0 && scheme[2] !== void 0) {
+      const payload = scheme[2].trim();
+      values.push(payload);
+      if (/^Basic$/i.test(scheme[1]) && /^[A-Za-z0-9+/]+={0,2}$/.test(payload)) {
+        const bytes = Buffer.from(payload, "base64");
+        const decoded = bytes.toString("utf8");
+        if (bytes.toString("base64").replace(/=+$/, "") === payload.replace(/=+$/, "") && Buffer.from(decoded, "utf8").equals(bytes) && !/[\x00-\x1f\x7f]/.test(decoded) && decoded.includes(":")) {
+          pushUserPass(decoded);
+        }
+      }
+    }
   }
   return values.filter((value) => value.trim().length > 0);
 }
 const SESSION_PROBE_ROUTING_HEADERS = /* @__PURE__ */ new Set([
   "x-tenant-id",
   "x-tenant",
+  // AdCP's own tenant-routing header (`src/lib/testing/types.ts` names it as
+  // the canonical example). Omitting it meant a run that routes on it had the
+  // header classified as unknown: dropped from session probes, and — once the
+  // isolated-client value test landed — silently strippable on a credential
+  // collision, which reroutes the step to another tenant.
+  "x-adcp-tenant",
   "x-account",
   "x-account-id",
   "x-routing-key",
@@ -5787,16 +5831,17 @@ function unroutableProbeHeader(options) {
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     const lower = name.toLowerCase();
     if (SESSION_PROBE_ROUTING_HEADERS.has(lower)) {
+      if (runSecrets.some((secret) => value.includes(secret))) return { name, reason: "credential_collision" };
       try {
         assertSafeAuthHeaderPart(value, `options.headers.${name}`);
       } catch {
-        return name;
+        return { name, reason: "malformed" };
       }
       continue;
     }
     if (AUTH_OVERRIDE_HEADER_NAMES.has(lower)) continue;
     if (runSecrets.some((secret) => value.includes(secret))) continue;
-    return name;
+    return { name, reason: "unknown" };
   }
   return void 0;
 }
@@ -6030,11 +6075,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   }
   const unroutable = unroutableProbeHeader(options);
   if (unroutable !== void 0) {
-    return {
-      kind: "skip",
-      reason: "session_probe_ungradable",
-      detail: `The runner cannot classify run header "${escapeControlChars(unroutable.slice(0, 64))}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`
-    };
+    const name = escapeControlChars(unroutable.name.slice(0, 64));
+    const detail = unroutable.reason === "credential_collision" ? `Routing header "${name}" has a value containing a credential this run holds. Nothing was graded: forwarding it could authenticate the unauthenticated probe, and dropping it could change tenants. Choose a routing value or suite credential that does not collide.` : unroutable.reason === "malformed" ? `Routing header "${name}" contains invalid header characters. Nothing was graded because dropping it could change tenants. Correct this run header before retrying the probe.` : `The runner cannot classify run header "${name}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`;
+    return { kind: "skip", reason: "session_probe_ungradable", detail };
   }
   const routing = sessionProbeRoutingHeaders(options);
   let headers;
@@ -6067,6 +6110,11 @@ function authHeadersForStep(directive, options) {
   if ("value" in directive && directive.value) {
     value = directive.value;
   } else if ("from_test_kit" in directive && directive.from_test_kit) {
+    if (typeof directive.from_test_kit === "string") {
+      throw new Error(
+        "Named test-kit API-key paths are not supported; use from_test_kit: true only for the primary key."
+      );
+    }
     value = options.test_kit?.auth?.api_key;
     if (!value) {
       throw new Error(
@@ -6083,6 +6131,13 @@ function authHeadersForStep(directive, options) {
   }
   return { authorization: `Bearer ${value}` };
 }
+const HTTP_PROBE_ONLY_CHECKS = /* @__PURE__ */ new Set([
+  "http_status",
+  "http_status_in",
+  "probe_passed",
+  "on_401_require_header",
+  "resource_equals_agent_url"
+]);
 const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "authorization",
   "proxy-authorization",
@@ -6091,14 +6146,28 @@ const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-api-key"
 ]);
 const AUTH_OVERRIDE_CREDENTIAL_HEADER_RE = /(^|[-_])(auth(?:entication|orization)?|credentials?|secrets?|tokens?|keys?|api[-_]?keys?|access[-_]?keys?|private[-_]?keys?|password|passwd|signatures?|cert(?:ificate)?s?)([-_]|$)/i;
+const AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE = /(auth(?:entication|orization)?|credentials?|secrets?|tokens?|passwords?|passwd|signatures?|certificates?|bearer|(?:api|access|private|session|auth|secret|client|app|master|signing|shared|subscription)keys?|(?:client|tls|ssl)certs?)$/i;
 function isCredentialHeaderName(name) {
   const normalized = name.toLowerCase();
-  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized);
+  if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
+  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
-  const headers = Object.fromEntries(
-    Object.entries(options.headers ?? {}).filter(([name]) => !isCredentialHeaderName(name))
-  );
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+  const runSecrets = runCredentialValues(options);
+  const headers = {};
+  for (const [name, value] of Object.entries(options.headers ?? {})) {
+    const isRouting = SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase());
+    if (!isRouting && isCredentialHeaderName(name)) continue;
+    if (typeof value === "string" && runSecrets.some((secret) => value.includes(secret))) {
+      if (isRouting) {
+        throw new Error(
+          `options.headers.${name} is a routing header but its value contains a credential this run holds; an isolated step cannot both route correctly and withhold the suite principal. Choose a routing value or suite credential that does not collide.`
+        );
+      }
+      continue;
+    }
+    headers[name] = value;
+  }
   let auth;
   for (const [name, value] of Object.entries(authHeaders)) {
     if (name.toLowerCase() === "authorization" && value.startsWith("Bearer ")) {
@@ -6107,9 +6176,9 @@ function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
       headers[name] = value;
     }
   }
-  return (0, import_client.createTestClient)(agentUrl, "a2a", {
+  return (0, import_client.createTestClient)(agentUrl, protocol, {
     ...options,
-    protocol: "a2a",
+    protocol,
     auth,
     test_kit: void 0,
     _client: void 0,

package/dist/lib/testing/storyboard/runner.mjs

@@ -571,6 +571,7 @@ function applyBranchSetGrading(phases, phaseResults, branchSetByPhaseId, contrib
       step.skip = { reason: "peer_branch_taken", detail };
       delete step.error;
       delete step.adcp_error;
+      delete step.counts_toward_failure;
       skippedDelta++;
       regraded = true;
     }
@@ -2684,6 +2685,8 @@ async function executeStoryboardPass(agentUrls, storyboard, options, dispatchOff
         if (!phase.optional || (routingContext ? routedOauthPresent.has(assignment.instanceIndex) : presenceDetected)) {
           failedCount++;
           countedAsFailed.add(result2);
+        } else if (!result2.validations.some((validation) => validation.check === "assertion" && !validation.passed)) {
+          result2.counts_toward_failure = false;
         }
         if (step.stateful) {
           phaseStatefulCascades.set(phase.id, null);
@@ -3695,9 +3698,20 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
   const testsIdempotencyKeyOmission = (step.omit_idempotency_key === true || governedRequest && (typeof request.idempotency_key !== "string" || request.idempotency_key.length === 0)) && requestUsesIdempotency(effectiveStep.task, request);
   const testsMissingAccount = effectiveStep.task === "create_media_buy" && (step.omit_account === true || governedRequest && !Object.prototype.hasOwnProperty.call(request, "account"));
   const testsSchemaInvalidRequest = step.expect_error === true && step.negative_path !== "payload_well_formed";
+  const useSdkAuthOverride = typeof step.auth === "object" && step.auth.type === "api_key" && step.auth.from_test_kit === true && step.auth.value_strategy === void 0 && step.expect_error !== true && !(step.validations ?? []).some((validation) => HTTP_PROBE_ONLY_CHECKS.has(validation.check));
   let rawProbeHeaders;
+  let authOverrideClient;
   try {
     rawProbeHeaders = step.auth !== void 0 ? authHeadersForStep(step.auth, options) : void 0;
+    if (useSdkAuthOverride) {
+      if (rawProbeHeaders === void 0) throw new Error("Step auth override credentials were not resolved");
+      authOverrideClient = createAuthOverrideClient(
+        runState.agentUrl,
+        options.protocol ?? "mcp",
+        options,
+        rawProbeHeaders
+      );
+    }
   } catch (err) {
     return {
       step_id: step.id,
@@ -3712,7 +3726,8 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
       extraction: { path: "none" }
     };
   }
-  const useRawProbe = rawProbeHeaders !== void 0;
+  const useRawProbe = rawProbeHeaders !== void 0 && !useSdkAuthOverride;
+  const stepClient = () => authOverrideClient ?? client;
   let taskResult;
   let stepResult;
   let caughtError;
@@ -3796,7 +3811,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     const started = Date.now();
     try {
       if (options.protocol === "a2a") {
-        const probeClient = createA2AAuthOverrideClient(runState.agentUrl, options, rawProbeHeaders ?? {});
+        const probeClient = createAuthOverrideClient(runState.agentUrl, "a2a", options, rawProbeHeaders ?? {});
         const captured = await withRawResponseCapture(
           () => runStep(
             step.title,
@@ -3891,7 +3906,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
     let a2aCaptures;
     if (step.parallel_dispatch) {
       const started = Date.now();
-      crossResponses = await runParallelDispatches(client, effectiveStep.task, request, {
+      crossResponses = await runParallelDispatches(stepClient(), effectiveStep.task, request, {
         spec: step.parallel_dispatch,
         keyMinter: generateIdempotencyKey,
         correlationPrefix: step.id,
@@ -3928,7 +3943,7 @@ async function executeStep(client, step, storyboardId, phaseId, context, allStep
         };
       }
     } else {
-      const dispatch = () => executeStoryboardTask(client, effectiveStep.task, request, {
+      const dispatch = () => executeStoryboardTask(stepClient(), effectiveStep.task, request, {
         skipIdempotencyAutoInject: testsIdempotencyKeyOmission,
         skipAccountValidation: testsMissingAccount,
         skipRequestValidation: testsSchemaInvalidRequest,
@@ -5737,8 +5752,10 @@ function defaultAuthHeadersForRawProbe(options) {
 }
 function sessionProbeRoutingHeaders(options) {
   const headers = {};
+  const runSecrets = runCredentialValues(options);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (!SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase())) continue;
+    if (runSecrets.some((secret) => value.includes(secret))) continue;
     try {
       assertSafeAuthHeaderPart(value, `options.headers.${name}`);
     } catch {
@@ -5763,35 +5780,62 @@ function setHeaderIfAbsent(headers, name, value, label) {
 }
 function runCredentialValues(options) {
   const values = [];
+  const pushHeaderToken = (value) => {
+    values.push(value, value.replace(/^[\t ]+|[\t ]+$/g, ""));
+  };
+  const pushUserPass = (userpass) => {
+    values.push(userpass, Buffer.from(userpass).toString("base64"));
+    const separator = userpass.indexOf(":");
+    if (separator >= 0) values.push(userpass.slice(separator + 1));
+  };
   const auth = options.auth;
-  if (auth?.type === "bearer" && typeof auth.token === "string") values.push(auth.token);
+  if (auth?.type === "bearer" && typeof auth.token === "string") pushHeaderToken(auth.token);
   if (auth?.type === "basic") {
     if (typeof auth.password === "string") values.push(auth.password);
     if (typeof auth.username === "string" && typeof auth.password === "string") {
-      values.push(`${auth.username}:${auth.password}`);
+      pushUserPass(`${auth.username}:${auth.password}`);
     }
   }
   if (auth?.type === "oauth" || auth?.type === "oauth_client_credentials") {
     const token = auth.tokens?.access_token;
-    if (typeof token === "string") values.push(token);
+    if (typeof token === "string") pushHeaderToken(token);
   }
   const kit = options.test_kit?.auth;
-  if (typeof kit?.api_key === "string") values.push(kit.api_key);
+  if (typeof kit?.api_key === "string") pushHeaderToken(kit.api_key);
   const basic = kit?.basic;
   if (typeof basic?.password === "string") values.push(basic.password);
   if (typeof basic?.username === "string" && typeof basic?.password === "string") {
-    values.push(`${basic.username}:${basic.password}`);
+    pushUserPass(`${basic.username}:${basic.password}`);
   }
-  if (typeof basic?.credentials === "string") values.push(basic.credentials);
+  if (typeof basic?.credentials === "string") pushUserPass(basic.credentials);
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     if (typeof value !== "string" || value.length === 0) continue;
-    if (AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) || isCredentialHeaderName(name)) values.push(value);
+    if (!AUTH_OVERRIDE_HEADER_NAMES.has(name.toLowerCase()) && !isCredentialHeaderName(name)) continue;
+    pushHeaderToken(value);
+    const scheme = /^(Bearer|Basic|Token|ApiKey)\s+(.+)$/i.exec(value.trim());
+    if (scheme?.[1] !== void 0 && scheme[2] !== void 0) {
+      const payload = scheme[2].trim();
+      values.push(payload);
+      if (/^Basic$/i.test(scheme[1]) && /^[A-Za-z0-9+/]+={0,2}$/.test(payload)) {
+        const bytes = Buffer.from(payload, "base64");
+        const decoded = bytes.toString("utf8");
+        if (bytes.toString("base64").replace(/=+$/, "") === payload.replace(/=+$/, "") && Buffer.from(decoded, "utf8").equals(bytes) && !/[\x00-\x1f\x7f]/.test(decoded) && decoded.includes(":")) {
+          pushUserPass(decoded);
+        }
+      }
+    }
   }
   return values.filter((value) => value.trim().length > 0);
 }
 const SESSION_PROBE_ROUTING_HEADERS = /* @__PURE__ */ new Set([
   "x-tenant-id",
   "x-tenant",
+  // AdCP's own tenant-routing header (`src/lib/testing/types.ts` names it as
+  // the canonical example). Omitting it meant a run that routes on it had the
+  // header classified as unknown: dropped from session probes, and — once the
+  // isolated-client value test landed — silently strippable on a credential
+  // collision, which reroutes the step to another tenant.
+  "x-adcp-tenant",
   "x-account",
   "x-account-id",
   "x-routing-key",
@@ -5810,16 +5854,17 @@ function unroutableProbeHeader(options) {
   for (const [name, value] of Object.entries(options.headers ?? {})) {
     const lower = name.toLowerCase();
     if (SESSION_PROBE_ROUTING_HEADERS.has(lower)) {
+      if (runSecrets.some((secret) => value.includes(secret))) return { name, reason: "credential_collision" };
       try {
         assertSafeAuthHeaderPart(value, `options.headers.${name}`);
       } catch {
-        return name;
+        return { name, reason: "malformed" };
       }
       continue;
     }
     if (AUTH_OVERRIDE_HEADER_NAMES.has(lower)) continue;
     if (runSecrets.some((secret) => value.includes(secret))) continue;
-    return name;
+    return { name, reason: "unknown" };
   }
   return void 0;
 }
@@ -6053,11 +6098,9 @@ function planMcpSessionSentinel(step, options, client, agentUrl) {
   }
   const unroutable = unroutableProbeHeader(options);
   if (unroutable !== void 0) {
-    return {
-      kind: "skip",
-      reason: "session_probe_ungradable",
-      detail: `The runner cannot classify run header "${escapeControlChars(unroutable.slice(0, 64))}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`
-    };
+    const name = escapeControlChars(unroutable.name.slice(0, 64));
+    const detail = unroutable.reason === "credential_collision" ? `Routing header "${name}" has a value containing a credential this run holds. Nothing was graded: forwarding it could authenticate the unauthenticated probe, and dropping it could change tenants. Choose a routing value or suite credential that does not collide.` : unroutable.reason === "malformed" ? `Routing header "${name}" contains invalid header characters. Nothing was graded because dropping it could change tenants. Correct this run header before retrying the probe.` : `The runner cannot classify run header "${name}", and both answers are unsafe \u2014 forwarding it could make the unauthenticated probe authenticated, dropping it could send the probe to a different tenant than the rest of this run. Nothing was graded, and this is a property of the run, not of the agent. Three ways forward: rename it to a recognised routing header (${[...SESSION_PROBE_ROUTING_HEADERS].join(", ")}); drop it from this run if the probe does not need it; or, if it carries a credential, move that into \`options.auth\` / \`test_kit.auth\` where the runner owns it.`;
+    return { kind: "skip", reason: "session_probe_ungradable", detail };
   }
   const routing = sessionProbeRoutingHeaders(options);
   let headers;
@@ -6090,6 +6133,11 @@ function authHeadersForStep(directive, options) {
   if ("value" in directive && directive.value) {
     value = directive.value;
   } else if ("from_test_kit" in directive && directive.from_test_kit) {
+    if (typeof directive.from_test_kit === "string") {
+      throw new Error(
+        "Named test-kit API-key paths are not supported; use from_test_kit: true only for the primary key."
+      );
+    }
     value = options.test_kit?.auth?.api_key;
     if (!value) {
       throw new Error(
@@ -6106,6 +6154,13 @@ function authHeadersForStep(directive, options) {
   }
   return { authorization: `Bearer ${value}` };
 }
+const HTTP_PROBE_ONLY_CHECKS = /* @__PURE__ */ new Set([
+  "http_status",
+  "http_status_in",
+  "probe_passed",
+  "on_401_require_header",
+  "resource_equals_agent_url"
+]);
 const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "authorization",
   "proxy-authorization",
@@ -6114,14 +6169,28 @@ const AUTH_OVERRIDE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "x-api-key"
 ]);
 const AUTH_OVERRIDE_CREDENTIAL_HEADER_RE = /(^|[-_])(auth(?:entication|orization)?|credentials?|secrets?|tokens?|keys?|api[-_]?keys?|access[-_]?keys?|private[-_]?keys?|password|passwd|signatures?|cert(?:ificate)?s?)([-_]|$)/i;
+const AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE = /(auth(?:entication|orization)?|credentials?|secrets?|tokens?|passwords?|passwd|signatures?|certificates?|bearer|(?:api|access|private|session|auth|secret|client|app|master|signing|shared|subscription)keys?|(?:client|tls|ssl)certs?)$/i;
 function isCredentialHeaderName(name) {
   const normalized = name.toLowerCase();
-  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized);
+  if (SESSION_PROBE_ROUTING_HEADERS.has(normalized)) return false;
+  return AUTH_OVERRIDE_HEADER_NAMES.has(normalized) || AUTH_OVERRIDE_CREDENTIAL_HEADER_RE.test(normalized) || AUTH_OVERRIDE_COMPACT_CREDENTIAL_RE.test(normalized.replace(/[-_]/g, ""));
 }
-function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
-  const headers = Object.fromEntries(
-    Object.entries(options.headers ?? {}).filter(([name]) => !isCredentialHeaderName(name))
-  );
+function createAuthOverrideClient(agentUrl, protocol, options, authHeaders) {
+  const runSecrets = runCredentialValues(options);
+  const headers = {};
+  for (const [name, value] of Object.entries(options.headers ?? {})) {
+    const isRouting = SESSION_PROBE_ROUTING_HEADERS.has(name.toLowerCase());
+    if (!isRouting && isCredentialHeaderName(name)) continue;
+    if (typeof value === "string" && runSecrets.some((secret) => value.includes(secret))) {
+      if (isRouting) {
+        throw new Error(
+          `options.headers.${name} is a routing header but its value contains a credential this run holds; an isolated step cannot both route correctly and withhold the suite principal. Choose a routing value or suite credential that does not collide.`
+        );
+      }
+      continue;
+    }
+    headers[name] = value;
+  }
   let auth;
   for (const [name, value] of Object.entries(authHeaders)) {
     if (name.toLowerCase() === "authorization" && value.startsWith("Bearer ")) {
@@ -6130,9 +6199,9 @@ function createA2AAuthOverrideClient(agentUrl, options, authHeaders) {
       headers[name] = value;
     }
   }
-  return createTestClient(agentUrl, "a2a", {
+  return createTestClient(agentUrl, protocol, {
     ...options,
-    protocol: "a2a",
+    protocol,
     auth,
     test_kit: void 0,
     _client: void 0,

package/dist/lib/testing/storyboard/types.d.mts

@@ -2395,6 +2395,12 @@ export interface StoryboardStepResult {
     title: string;
     task: string;
     passed: boolean;
+    /**
+     * False when a failed step is diagnostic only and does not count toward
+     * the storyboard verdict (for example, an optional discovery phase).
+     * Absent on ordinary failures, including mandatory OAuth and invariant checks.
+     */
+    counts_toward_failure?: boolean;
     /** True when the step was not executed */
     skipped?: boolean;
     /**

package/dist/lib/testing/storyboard/types.d.ts

@@ -2395,6 +2395,12 @@ export interface StoryboardStepResult {
     title: string;
     task: string;
     passed: boolean;
+    /**
+     * False when a failed step is diagnostic only and does not count toward
+     * the storyboard verdict (for example, an optional discovery phase).
+     * Absent on ordinary failures, including mandatory OAuth and invariant checks.
+     */
+    counts_toward_failure?: boolean;
     /** True when the step was not executed */
     skipped?: boolean;
     /**

package/dist/lib/testing/storyboard/validations.d.mts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.3";
+export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.4";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**

package/dist/lib/testing/storyboard/validations.d.ts

@@ -197,7 +197,7 @@ export interface UpstreamTrafficQueryResult {
  */
 export declare function runValidations(validations: StoryboardValidation[], context: ValidationContext): ValidationResult[];
 /** Capability semver emitted in run summaries and used for advisory expiry. */
-export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.3";
+export declare const RUNNER_CAPABILITY_VERSION = "16.0.0-beta.4";
 /** True when a failed validation contributes to the owning step's grade. */
 export declare function validationFailsStep(result: ValidationResult): boolean;
 /**