@aexhq/sdk 0.46.5-canary → 0.51.0

package/dist/_contracts/sdk-secrets.d.ts

@@ -1,67 +0,0 @@
-import { Transform } from "node:stream";
-export type PublicSafeStructuralReason = "forbidden_field_name" | "uninspectable_value";
-export type PublicSafeSecretReason = "bearer_token" | "provider_key" | "signed_url" | "object_store_key" | "vault_id" | "private_resource_handle" | "high_entropy_token";
-export interface PublicSafeFinding<Reason extends string> {
-    readonly path: string;
-    readonly reason: Reason | PublicSafeStructuralReason;
-    readonly valueLength?: number;
-}
-export interface PublicSafeStringPattern<Reason extends string> {
-    readonly reason: Reason;
-    readonly regex: RegExp;
-    readonly accept?: (match: string) => boolean;
-}
-export interface PublicSafePatternMatch<Reason extends string> {
-    readonly reason: Reason;
-    readonly path: string;
-    readonly value: string;
-    readonly match: string;
-}
-export interface PublicSafeScannerConfig<Reason extends string> {
-    readonly patterns: readonly PublicSafeStringPattern<Reason>[];
-    readonly isForbiddenFieldName: (key: string, path: string) => boolean;
-    readonly isPatternExempt?: (match: PublicSafePatternMatch<Reason>) => boolean;
-    readonly maxDepth?: number;
-    readonly maxVisitedValues?: number;
-}
-/** The only bare content identity the platform mints. */
-export declare function isPlatformContentDigest(candidate: string): boolean;
-export declare function looksHighEntropySecret(value: string): boolean;
-export declare function publicSafeCharClassCount(value: string): number;
-export declare function publicSafeShannonBits(value: string): number;
-export declare const PUBLIC_SAFE_SECRET_PATTERNS: readonly PublicSafeStringPattern<Exclude<PublicSafeSecretReason, "private_resource_handle">>[];
-/** Extra entropy policy for consumers whose identifier slots admit `_`. */
-export declare function underscoredHighEntropyPattern(): PublicSafeStringPattern<"high_entropy_token">;
-export declare function privateResourceHandlePattern(keywords: readonly string[], separators?: "_:-" | "_:"): PublicSafeStringPattern<"private_resource_handle">;
-export declare function createForbiddenFieldNamePredicate(names: readonly string[]): (key: string, path: string) => boolean;
-export declare function scanPublicSafePayload<Reason extends string>(input: unknown, config: PublicSafeScannerConfig<Reason>): readonly PublicSafeFinding<Reason>[];
-export declare class SecretString {
-    #private;
-    constructor(value: string, label?: string);
-    unwrap(): string;
-    toString(): string;
-    toJSON(): string;
-}
-export declare function redactSecrets<T>(value: T): T;
-/**
- * Redact every secret-shaped run in `input`.
- *
- * `known` is an OPTIONAL belt-and-suspenders set of literal values to also mask
- * (e.g. creds the caller happens to have loaded). Correctness does NOT depend on
- * it — every shape above is caught with or without seeding — but masking known
- * values first removes any residual substring of a value the shapes split.
- */
-export declare function redactString(input: string, known?: Iterable<string>): string;
-export declare function containsSecretLikeValue(input: string): boolean;
-/**
- * A line-buffered `Transform` that redacts secrets BEFORE bytes touch disk or
- * console. Pipe a child process's stdout/stderr through it
- * (`child.stdout.pipe(createRedactingStream()).pipe(process.stdout)`) so a
- * secret can never be written and "cleaned up after"; the secret you didn't
- * recognise is the one already on disk.
- *
- * Buffers by line so a secret split across a chunk boundary is still redacted:
- * a partial trailing line is held until the next chunk (or `flush`) completes
- * it. `known` is forwarded to `redactString` for optional value seeding.
- */
-export declare function createRedactingStream(known?: Iterable<string>): Transform;

package/dist/_contracts/sdk-secrets.js

@@ -1,427 +0,0 @@
-import { Transform } from "node:stream";
-const DEFAULT_MAX_DEPTH = 64;
-const DEFAULT_MAX_VISITED_VALUES = 100_000;
-const ENTROPY_BITS_PER_CHAR = 3.0;
-const MIN_CHAR_CLASSES = 2;
-const HIGH_ENTROPY_NO_DIGIT_MIN_LEN = 40;
-/** The only bare content identity the platform mints. */
-export function isPlatformContentDigest(candidate) {
-    return /^[0-9a-f]{64}$/.test(candidate);
-}
-export function looksHighEntropySecret(value) {
-    return value.split("-").some(isOpaqueSecretRun);
-}
-export function publicSafeCharClassCount(value) {
-    let count = 0;
-    if (/[a-z]/.test(value))
-        count++;
-    if (/[A-Z]/.test(value))
-        count++;
-    if (/[0-9]/.test(value))
-        count++;
-    return count;
-}
-export function publicSafeShannonBits(value) {
-    if (value.length === 0)
-        return 0;
-    const counts = new Map();
-    for (const char of value) {
-        counts.set(char, (counts.get(char) ?? 0) + 1);
-    }
-    let bits = 0;
-    for (const count of counts.values()) {
-        const probability = count / value.length;
-        bits -= probability * Math.log2(probability);
-    }
-    return bits;
-}
-function isOpaqueSecretRun(value) {
-    if (publicSafeCharClassCount(value) < MIN_CHAR_CLASSES)
-        return false;
-    if (publicSafeShannonBits(value) < ENTROPY_BITS_PER_CHAR)
-        return false;
-    return /[0-9]/.test(value) || value.length >= HIGH_ENTROPY_NO_DIGIT_MIN_LEN;
-}
-export const PUBLIC_SAFE_SECRET_PATTERNS = Object.freeze([
-    Object.freeze({
-        reason: "bearer_token",
-        regex: /\b(Bearer)\s+[A-Za-z0-9._~+/=-]{8,}/i
-    }),
-    Object.freeze({
-        reason: "provider_key",
-        regex: /\b(?:sk-[A-Za-z0-9_-]{16,}|xox[baprs]-[A-Za-z0-9-]{8,}|AIza[A-Za-z0-9_-]{8,})/i
-    }),
-    Object.freeze({
-        reason: "signed_url",
-        regex: /\bhttps?:\/\/[^\s"'<>]*(?:X-Amz-Signature|X-Amz-Credential|X-Amz-Algorithm|AWSAccessKeyId|X-Goog-Signature|X-Goog-Credential|[?&]sig=)[^\s"'<>]*/i
-    }),
-    Object.freeze({
-        reason: "object_store_key",
-        regex: /(^|[\s"'`])(?:sessions|assets)\/[^?<#\s"'`]+/i
-    }),
-    Object.freeze({
-        reason: "vault_id",
-        regex: /\b(?:vault|vlt|secret)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i
-    }),
-    Object.freeze({
-        reason: "high_entropy_token",
-        regex: /\b[A-Za-z0-9-]{40,}\b/,
-        accept: looksHighEntropySecret
-    })
-]);
-/** Extra entropy policy for consumers whose identifier slots admit `_`. */
-export function underscoredHighEntropyPattern() {
-    return Object.freeze({
-        reason: "high_entropy_token",
-        regex: /\b[A-Za-z0-9-]{3,}_[A-Za-z0-9_-]{36,}\b/,
-        accept: (match) => looksHighEntropySecret(match.replaceAll("_", "-"))
-    });
-}
-export function privateResourceHandlePattern(keywords, separators = "_:-") {
-    const source = keywords.map(escapePublicSafeRegex).join("|");
-    return Object.freeze({
-        reason: "private_resource_handle",
-        regex: new RegExp(`\\b(?:${source})[${separators}][A-Za-z0-9][A-Za-z0-9_-]{7,}\\b`, "i"),
-        accept: isMintedResourceHandle
-    });
-}
-function isMintedResourceHandle(match) {
-    const separatorIndex = match.search(/[_:-]/);
-    return separatorIndex >= 0 && /\d/.test(match.slice(separatorIndex + 1));
-}
-function escapePublicSafeRegex(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-export function createForbiddenFieldNamePredicate(names) {
-    const normalized = new Set(names.map((name) => name.toLowerCase()));
-    return (key) => normalized.has(key.toLowerCase());
-}
-export function scanPublicSafePayload(input, config) {
-    const findings = [];
-    const seen = new WeakSet();
-    const stack = [
-        { value: input, path: "$", depth: 0 }
-    ];
-    const maxDepth = config.maxDepth ?? DEFAULT_MAX_DEPTH;
-    const maxVisitedValues = config.maxVisitedValues ?? DEFAULT_MAX_VISITED_VALUES;
-    let visited = 0;
-    while (stack.length > 0) {
-        const current = stack.pop();
-        visited++;
-        if (visited > maxVisitedValues || current.depth > maxDepth) {
-            findings.push(freezePublicSafeFinding({ path: current.path, reason: "uninspectable_value" }));
-            continue;
-        }
-        if (typeof current.value === "string") {
-            scanPublicSafeString(current.value, current.path, config, findings);
-            continue;
-        }
-        if (current.value === null || typeof current.value !== "object")
-            continue;
-        if (seen.has(current.value)) {
-            findings.push(freezePublicSafeFinding({ path: current.path, reason: "uninspectable_value" }));
-            continue;
-        }
-        seen.add(current.value);
-        let keys;
-        try {
-            keys = Object.keys(current.value);
-        }
-        catch {
-            findings.push(freezePublicSafeFinding({ path: current.path, reason: "uninspectable_value" }));
-            continue;
-        }
-        const children = [];
-        for (const key of keys) {
-            const childPath = Array.isArray(current.value) && /^\d+$/.test(key)
-                ? `${current.path}[${key}]`
-                : `${current.path}.${key}`;
-            let forbidden = false;
-            try {
-                forbidden = config.isForbiddenFieldName(key, childPath);
-            }
-            catch {
-                findings.push(freezePublicSafeFinding({ path: childPath, reason: "uninspectable_value" }));
-            }
-            if (forbidden) {
-                findings.push(freezePublicSafeFinding({ path: childPath, reason: "forbidden_field_name" }));
-            }
-            let descriptor;
-            try {
-                descriptor = Object.getOwnPropertyDescriptor(current.value, key);
-            }
-            catch {
-                findings.push(freezePublicSafeFinding({ path: childPath, reason: "uninspectable_value" }));
-                continue;
-            }
-            if (!descriptor || !("value" in descriptor)) {
-                findings.push(freezePublicSafeFinding({ path: childPath, reason: "uninspectable_value" }));
-                continue;
-            }
-            children.push({ value: descriptor.value, path: childPath, depth: current.depth + 1 });
-        }
-        for (let index = children.length - 1; index >= 0; index--)
-            stack.push(children[index]);
-    }
-    return Object.freeze(findings);
-}
-function scanPublicSafeString(value, path, config, findings) {
-    for (const pattern of config.patterns) {
-        let matches;
-        try {
-            matches = matchingPublicSafeSequences(pattern, value);
-        }
-        catch {
-            findings.push(freezePublicSafeFinding({ path, reason: "uninspectable_value" }));
-            continue;
-        }
-        for (const match of matches) {
-            let exempt = false;
-            try {
-                exempt = config.isPatternExempt?.({ reason: pattern.reason, path, value, match }) ?? false;
-            }
-            catch {
-                findings.push(freezePublicSafeFinding({ path, reason: "uninspectable_value" }));
-                break;
-            }
-            if (!exempt) {
-                findings.push(freezePublicSafeFinding({ path, reason: pattern.reason, valueLength: value.length }));
-                break;
-            }
-        }
-    }
-}
-function matchingPublicSafeSequences(pattern, value) {
-    const flags = pattern.regex.flags.includes("g") ? pattern.regex.flags : `${pattern.regex.flags}g`;
-    const regex = new RegExp(pattern.regex.source, flags);
-    const matches = [];
-    let match;
-    while ((match = regex.exec(value)) !== null) {
-        if (!pattern.accept || pattern.accept(match[0]))
-            matches.push(match[0]);
-        if (match.index === regex.lastIndex)
-            regex.lastIndex++;
-    }
-    return matches;
-}
-function freezePublicSafeFinding(finding) {
-    return Object.freeze(finding);
-}
-/**
- * Value-AGNOSTIC secret patterns: each matches a SHAPE, not a known value.
- * Correctness must not depend on seeding the redactor with the literal
- * secret — the two real leaks this project hit were a database password that
- * survived a naive `sed` mask (as a substring) and an Anthropic key surfaced in
- * a deploy CLI's describe output that the harness NEVER loaded. A value-seeded
- * redactor is blind to both; these patterns catch them by form.
- *
- * Ordering matters: structured shapes (connection strings, auth headers, JWT)
- * come BEFORE the generic key/entropy catch-alls so the more descriptive
- * `[REDACTED …]` label wins on overlapping matches.
- */
-const SECRET_PATTERNS = [
-    // postgres / postgresql connection strings — redact the whole URI so the
-    // embedded password can never survive as a substring (the `sed`-mask leak).
-    /\bpostgres(?:ql)?:\/\/[^\s"']+/gi,
-    // aex workspace / proxy tokens: apt_… / ant_….
-    /\b(?:apt|ant)_[A-Za-z0-9_-]{16,}/g,
-    // aex self-describing workspace API key (one-time reveal from createWorkspace /
-    // createApiKey): aex_<plane>_<region>_<workspaceId>_<secret>_<crc>. Anchored on
-    // the full 6-part shape so the whole key masks as one label (the entropy
-    // catch-all would otherwise redact only its dense segments, leaving the
-    // `aex_<plane>_<region>_` prefix behind). Never matches `api.aex.dev`.
-    /\baex_(?:dev|prd)_[a-z0-9]+_[a-z0-9]+_[A-Za-z0-9]+_[a-z0-9]+/gi,
-    // aex account PAT (control-plane): aexu_<opaque>. Distinct prefix from the
-    // workspace-key family so a PAT masks by shape even when short.
-    /\baexu_[A-Za-z0-9_-]{16,}/g,
-    // AWS access key id + secret access key shapes.
-    /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
-    /\baws_secret_access_key["'\s:=]+[A-Za-z0-9/+=]{40}/gi,
-    // JWT-shaped: header.payload.signature, each base64url, header starts `eyJ`.
-    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
-    // Keyword-introduced secret assignments (bearer/token/api_key/…).
-    /(?:bearer|token|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret)["'\s:=]+[A-Za-z0-9_\-./+=]{12,}/gi
-];
-const SDK_SHARED_SECRET_PATTERNS = PUBLIC_SAFE_SECRET_PATTERNS.filter((pattern) => pattern.reason === "bearer_token" ||
-    pattern.reason === "provider_key" ||
-    pattern.reason === "signed_url");
-const REDACTED = "[REDACTED]";
-/**
- * Generic high-entropy token catch-all, applied AFTER the named patterns.
- * Catches the secret nobody recognised: any long base64url/hex-ish run that is
- * BOTH high-entropy AND character-class-diverse.
- *
- * The candidate run deliberately EXCLUDES `_`: secrets are contiguous opaque
- * runs, whereas `SCREAMING_SNAKE_CASE` env names and `snake_case` identifiers
- * are `_`-separated words — excluding `_` breaks those into sub-24 fragments so
- * they are never eaten. The
- * class-diversity gate (≥2 of lower/upper/digit) then keeps the remaining
- * single-class runs (all-lowercase module paths like `internal/modules/esm`)
- * while still catching mixed-case/alnum secret blobs. Entropy alone cannot
- * separate these — `the_quick…` (4.16) out-scores a real key prefix.
- */
-const HIGH_ENTROPY_CANDIDATE = /[A-Za-z0-9+/=-]{24,}/g;
-/**
- * A mixed-case run with no digit and < this length is treated as a benign
- * identifier, not a secret. Real opaque secrets are alnum-mixed (carry a
- * digit) or very long; digit-free camelCase identifiers like
- * `asyncEntryPointWithESMLoader` / `getReadableStreamController` (which
- * appear in stack traces the diagnostic bundle captures) are 24–39 chars and
- * digit-free — eating them would gut debuggability. The length escape hatch
- * still catches the rare long digit-free secret.
- */
-/**
- * Canonical aex session-id hex: exactly 32 lowercase hex chars directly preceded
- * by `ses_`. The HIGH_ENTROPY_CANDIDATE class excludes `_`, so the candidate
- * candidate for a session id is the bare hex — dense enough to trip the entropy gate.
- * Masking it destroys the ONE identifier every error message needs for
- * traceability (`cancel via aex.sessions.open("ses_[REDACTED]")` is useless
- * guidance). A session id is not a credential: it grants nothing without the
- * bearer token. Mirrors the platform-side redactor's canonical-id exemption.
- */
-function isCanonicalSessionIdHex(input, matchStart, match) {
-    if (!/^[0-9a-f]{32}$/.test(match))
-        return false;
-    return input.slice(Math.max(0, matchStart - 4), matchStart) === "ses_";
-}
-export class SecretString {
-    #value;
-    constructor(value, label = "secret") {
-        if (!value) {
-            throw new Error(`${label} is required`);
-        }
-        this.#value = value;
-    }
-    unwrap() {
-        return this.#value;
-    }
-    toString() {
-        return REDACTED;
-    }
-    toJSON() {
-        return REDACTED;
-    }
-}
-export function redactSecrets(value) {
-    if (typeof value === "string") {
-        return redactString(value);
-    }
-    if (Array.isArray(value)) {
-        return value.map((item) => redactSecrets(item));
-    }
-    if (value && typeof value === "object") {
-        const out = {};
-        for (const [key, item] of Object.entries(value)) {
-            if (isSecretKey(key)) {
-                out[key] = REDACTED;
-            }
-            else {
-                out[key] = redactSecrets(item);
-            }
-        }
-        return out;
-    }
-    return value;
-}
-/**
- * Redact every secret-shaped run in `input`.
- *
- * `known` is an OPTIONAL belt-and-suspenders set of literal values to also mask
- * (e.g. creds the caller happens to have loaded). Correctness does NOT depend on
- * it — every shape above is caught with or without seeding — but masking known
- * values first removes any residual substring of a value the shapes split.
- */
-export function redactString(input, known = []) {
-    let out = input;
-    for (const value of known) {
-        if (value && value.length >= 4) {
-            out = out.split(value).join(REDACTED);
-        }
-    }
-    out = SDK_SHARED_SECRET_PATTERNS.reduce((current, pattern) => current.replace(new RegExp(pattern.regex.source, pattern.regex.flags.includes("g")
-        ? pattern.regex.flags
-        : `${pattern.regex.flags}g`), (match, captured) => typeof captured === "string" ? `${captured} ${REDACTED}` : REDACTED), out);
-    out = SECRET_PATTERNS.reduce((current, pattern) => current.replace(pattern, (match, captured) => typeof captured === "string" ? `${captured} ${REDACTED}` : REDACTED), out);
-    return out.replace(HIGH_ENTROPY_CANDIDATE, (match, offset, whole) => !isCanonicalSessionIdHex(whole, offset, match) &&
-        !isPlatformContentDigest(match) &&
-        looksHighEntropySecret(match)
-        ? REDACTED
-        : match);
-}
-export function containsSecretLikeValue(input) {
-    if ([...SECRET_PATTERNS, ...SDK_SHARED_SECRET_PATTERNS.map((pattern) => pattern.regex)].some((pattern) => {
-        pattern.lastIndex = 0;
-        return pattern.test(input);
-    })) {
-        return true;
-    }
-    HIGH_ENTROPY_CANDIDATE.lastIndex = 0;
-    let candidate;
-    while ((candidate = HIGH_ENTROPY_CANDIDATE.exec(input)) !== null) {
-        if (isCanonicalSessionIdHex(input, candidate.index, candidate[0])) {
-            continue;
-        }
-        if (isPlatformContentDigest(candidate[0])) {
-            continue;
-        }
-        if (looksHighEntropySecret(candidate[0])) {
-            return true;
-        }
-    }
-    return false;
-}
-/**
- * A line-buffered `Transform` that redacts secrets BEFORE bytes touch disk or
- * console. Pipe a child process's stdout/stderr through it
- * (`child.stdout.pipe(createRedactingStream()).pipe(process.stdout)`) so a
- * secret can never be written and "cleaned up after"; the secret you didn't
- * recognise is the one already on disk.
- *
- * Buffers by line so a secret split across a chunk boundary is still redacted:
- * a partial trailing line is held until the next chunk (or `flush`) completes
- * it. `known` is forwarded to `redactString` for optional value seeding.
- */
-export function createRedactingStream(known = []) {
-    const knownValues = [...known];
-    let carry = "";
-    return new Transform({
-        transform(chunk, _encoding, callback) {
-            carry += chunk.toString();
-            const lastNewline = carry.lastIndexOf("\n");
-            if (lastNewline === -1) {
-                callback();
-                return;
-            }
-            const ready = carry.slice(0, lastNewline + 1);
-            carry = carry.slice(lastNewline + 1);
-            callback(null, redactString(ready, knownValues));
-        },
-        flush(callback) {
-            if (carry === "") {
-                callback();
-                return;
-            }
-            const tail = carry;
-            carry = "";
-            callback(null, redactString(tail, knownValues));
-        }
-    });
-}
-/**
- * Wire keys that contain a secret-looking word but name a QUANTITY, not a
- * credential. Same argument as the canonical-session-id exemption above: masking
- * them destroys the one number the message exists to carry, and the value grants
- * nothing to whoever reads it.
- *
- * `llm_token_usd` is the free model-usage allowance dimension. It is the field a
- * `402 insufficient_credits` body is read for — "$0.00 of $2.00 left this month"
- * — and the substring `token` in a dimension name is a coincidence of the
- * metering vocabulary, not a credential. The name is fixed by the hosted
- * allowance schema, so it cannot be spelled around on the client.
- */
-const NON_SECRET_KEYS = new Set(["llm_token_usd"]);
-function isSecretKey(key) {
-    if (NON_SECRET_KEYS.has(key))
-        return false;
-    return /(?:api[_-]?key|authorization|token|secret|password|credential)/i.test(key);
-}

package/dist/_contracts/session-archive.d.ts

@@ -1,16 +0,0 @@
-import type { AexEvent } from "./event-envelope.js";
-import { type SessionRecordArchiveEntryForRedactionV1, type SessionRecordArtifactSummaryV1, type SessionRecordDownloadErrorV1 } from "./session-record.js";
-import type { Session } from "./runtime-types.js";
-export interface SessionArchiveEntry extends SessionRecordArchiveEntryForRedactionV1 {
-    readonly path: string;
-    readonly bytes: Uint8Array;
-}
-export interface CollectedSessionArchiveArtifacts {
-    readonly entries: readonly SessionArchiveEntry[];
-    readonly captured: readonly SessionRecordArtifactSummaryV1[];
-    readonly errors: readonly SessionRecordDownloadErrorV1[];
-}
-export declare function buildSessionArchive(sessionId: string, session: Session, events: readonly AexEvent[], files: CollectedSessionArchiveArtifacts): Uint8Array;
-export declare function buildSessionFilesArchive(sessionId: string, files: CollectedSessionArchiveArtifacts): Uint8Array;
-export declare function buildSessionEventsArchive(sessionId: string, events: readonly AexEvent[]): Uint8Array;
-export declare function buildSessionMetadataArchive(sessionId: string, session: Session): Uint8Array;

package/dist/_contracts/session-archive.js

@@ -1,92 +0,0 @@
-import { strToU8, zipSync } from "fflate";
-import { isRecord } from "./value-guards.js";
-import { assertSessionRecordArchivePublicSafeV1, buildSessionRecordDownloadManifestV1 } from "./session-record.js";
-export function buildSessionArchive(sessionId, session, events, files) {
-    const submissionSnapshot = extractSubmissionSnapshot(session);
-    const costTelemetry = extractCostTelemetry(session);
-    const manifest = buildSessionRecordDownloadManifestV1({
-        sessionId,
-        sessionFiles: files.captured,
-        errors: files.errors,
-        typedEventCount: events.length,
-        ...(submissionSnapshot ? { submission: { status: "present" } } : {}),
-        ...(costTelemetry ? { cost: { status: "present" } } : {})
-    });
-    return zipEntries([
-        jsonEntry("metadata/session.json", session),
-        ...(submissionSnapshot ? [jsonEntry("metadata/submission.json", submissionSnapshot)] : []),
-        ...(costTelemetry ? [jsonEntry("metadata/cost.json", costTelemetry)] : []),
-        jsonlEntry("events/events.jsonl", events),
-        ...files.entries,
-        jsonEntry("manifest.json", manifest)
-    ]);
-}
-export function buildSessionFilesArchive(sessionId, files) {
-    return zipEntries([
-        ...files.entries,
-        jsonEntry("manifest.json", {
-            sessionId,
-            namespace: "files",
-            files: files.captured,
-            errors: files.errors
-        })
-    ]);
-}
-export function buildSessionEventsArchive(sessionId, events) {
-    return zipEntries([
-        jsonlEntry("events.jsonl", events),
-        jsonEntry("manifest.json", {
-            sessionId,
-            namespace: "events",
-            files: [{ path: "events.jsonl", role: "typed_events", status: "present", recordCount: events.length }],
-            errors: []
-        })
-    ]);
-}
-export function buildSessionMetadataArchive(sessionId, session) {
-    return zipEntries([
-        jsonEntry("session.json", session),
-        jsonEntry("manifest.json", {
-            sessionId,
-            namespace: "metadata",
-            files: [{ path: "session.json", role: "session_metadata", status: "present" }],
-            errors: []
-        })
-    ]);
-}
-function zipEntries(entries) {
-    assertSessionRecordArchivePublicSafeV1(entries);
-    const files = {};
-    for (const entry of entries) {
-        files[entry.path] = [entry.bytes, { mtime: ZIP_EPOCH }];
-    }
-    return zipSync(files);
-}
-/** Fixed ZIP timestamp: session archives must not depend on the wall clock. */
-const ZIP_EPOCH = new Date(Date.UTC(1980, 0, 1));
-function jsonEntry(path, value) {
-    return {
-        path,
-        bytes: strToU8(JSON.stringify(value, null, 2)),
-        contentType: "application/json; charset=utf-8"
-    };
-}
-function jsonlEntry(path, events) {
-    return {
-        path,
-        bytes: strToU8(events.map((event) => JSON.stringify(event)).join("\n")),
-        contentType: "application/jsonl; charset=utf-8"
-    };
-}
-function extractSubmissionSnapshot(session) {
-    const raw = session.submission;
-    if (!isRecord(raw) || raw.kind !== "submission" || !isRecord(raw.submission)) {
-        return undefined;
-    }
-    return {
-        submission: raw.submission
-    };
-}
-function extractCostTelemetry(session) {
-    return session.costTelemetry;
-}