@automatalabs/acp-agents 0.21.1 → 0.22.0

package/dist/acp-client.d.ts

@@ -7,6 +7,7 @@ import { type AcpEventSink } from "./events.js";
 import { type ElicitationResolver, type PermissionResolver, type ToolPolicy } from "./permissions.js";
 import { UsageAccumulator } from "./usage.js";
 import { type ClientHandlers } from "./client-handlers.js";
+import { type AuthStore, type BackendAuthMachine, type ConnectionAuthStamp } from "./auth/auth-store.js";
 interface RawResultSuccess {
     type: string;
     subtype: string;
@@ -99,6 +100,17 @@ export interface PooledConnectionDeps {
     /** Initialize-time elicitation advertisement; fixed per connection, so it is driven by the
      *  runner-wide resolver rather than session-scoped responders attached later. */
     advertiseElicitation?: boolean;
+    /** Initialize-time client auth advertisement (§1.2); fixed per connection like elicitation.
+     *  Undefined (the default) omits the `auth` capability entirely — the default-OFF baseline. */
+    authCapabilities?: {
+        terminal?: boolean;
+        gateway?: boolean;
+    };
+    /** The runner's single auth store (§2). When present, this connection reconciles to the current
+     *  intent at the end of `initialize` (replay for in-process creds), overlays the spawn env with
+     *  collected `env_var` values, and carries a generation stamp the pool gates selection on.
+     *  Undefined => no auth wiring, byte-identical to the pre-auth baseline (default-OFF). */
+    authStore?: AuthStore;
     /** Client-side ACP fs/terminal handlers advertised once and routed by sessionId. */
     clientHandlers?: ClientHandlers;
 }
@@ -109,6 +121,8 @@ export interface PooledConnectionDeps {
  */
 export declare class PooledConnection {
     readonly backendId: BackendId;
+    /** Process-unique connection id, used only to tag `BackendAuthMachine` events (§2.3). */
+    readonly id: string;
     /** The held ACP connection (fluent client() app); session/* calls go through its
      *  `agent` ClientContext via the typed wrappers below. */
     private readonly connection;
@@ -119,6 +133,14 @@ export declare class PooledConnection {
     private readonly onEvent;
     private readonly clientHandlers;
     private readonly advertiseElicitation;
+    private readonly authCapabilities;
+    private readonly authStore;
+    /** Which intent-generation THIS process reflects (§2.4). Starts at -1/false so a connection with
+     *  no applied intent is stale against a machine that has ever advanced past generation 0. */
+    authStamp: ConnectionAuthStamp;
+    /** Set by the pool when a busy stale connection must be recycled once it drains (§2.6). While set,
+     *  the connection is never handed a new session and is disposed-and-dropped on release. */
+    recyclePending: boolean;
     /** Set true at the start of dispose() so the graceful-shutdown death is NOT reported as a crash. */
     private disposing;
     /** Resolves once `initialize` completed (or rejects if the process died first). */
@@ -151,6 +173,35 @@ export declare class PooledConnection {
     /** Mark this connection dead exactly once, then ask the pool to evict it. Idempotent. */
     private die;
     private stderrSuffix;
+    /** Resolve this connection's `BackendAuthMachine` from the runner's store, or undefined when no
+     *  store is wired (default-OFF) — the machine is keyed by the backend's poolKey (§2.3). */
+    private authMachine;
+    /** The client `auth` advertisement for THIS connection (§1.2), refined per-backend by the pure-data
+     *  `AuthProfile.clientAuthCapabilities` (§3.1). When the host advertised nothing (default-OFF) the
+     *  key is omitted verbatim — no profile is consulted, so behavior stays byte-identical. When the
+     *  host opted in, the backend's profile maps the host affordances (`onAuth` ⇐ gateway desired,
+     *  `terminal` ⇐ host TTY) onto the method TYPES this backend can actually service (e.g. codex never
+     *  advertises terminal; opencode never advertises gateway). A custom backend has NO profile → the
+     *  host's advertisement passes through unchanged (conformance-by-absence, §3.5). */
+    private effectiveAuthCapabilities;
+    /** Mark this connection current against `generation` (nothing more to apply). */
+    private stampApplied;
+    /** true iff the current intent is an in-process (gateway) cred, so an idle connection can be
+     *  re-primed with an authenticate RPC replay instead of being recycled (§2.6). */
+    canLiveReapply(machine: BackendAuthMachine): boolean;
+    /** Reconcile this connection to the current intent at the end of `initialize` (§2.5). For an
+     *  in-process cred, replay `authenticate({methodId,_meta})`; for disk/spawn-env a fresh process
+     *  already carries the credential, so only stamp it current. */
+    private applyAuthIntent;
+    /** Idle in-process connection: re-send `authenticate` and re-stamp so the next session opens under
+     *  the current gateway cred without a process recycle (§2.6). Returns true iff a re-apply ran. */
+    reapplyAuthIfStale(machine: BackendAuthMachine): Promise<boolean>;
+    /** Fire-and-forget idle live re-apply (§2.6). Any failure disposes the connection so the pool
+     *  respawns a fresh process rather than serving a session under a failed replay. */
+    scheduleReapply(machine: BackendAuthMachine): void;
+    /** Mark a BUSY stale connection for recycle once it drains (§2.6): finish in-flight prompts under
+     *  the auth they started with, then dispose-and-drop on release. */
+    markForRecycleWhenIdle(_machine: BackendAuthMachine): void;
     /** Race a wire call against process death so a crash surfaces a clear error instead of hanging
      *  on a JSON-RPC response that will never come. */
     race<T>(op: Promise<T>): Promise<T>;

package/dist/acp-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acp-client.d.ts","sourceRoot":"","sources":["../src/acp-client.ts"],"names":[],"mappings":"AAwBA,OAAO,EAOL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAQf,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,+BAA+B,EACpC,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAGlC,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAG5B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAG1B,KAAK,aAAa,EAClB,KAAK,cAAc,EAMnB,KAAK,aAAa,EAClB,KAAK,cAAc,EAMnB,KAAK,yBAAyB,EAG9B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAGxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAO5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAIL,KAAK,cAAc,EAEpB,MAAM,sBAAsB,CAAC;AA0B9B,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAcD;8FAC8F;AAC9F,cAAM,YAAY;IAed,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,UAAU;IAC3B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB;IAChD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;IAEvB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAtBnC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAM;IACnC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAM;IAC3C,QAAQ,CAAC,KAAK,mBAA0B;IACxC,QAAQ,CAAC,kBAAkB,gBAAqB,yBAAyB,KAAK,IAAI,EAAI;IACtF,QAAQ,CAAC,mBAAmB,gBAAqB,yBAAyB,KAAK,IAAI,EAAI;IACvF,QAAQ,CAAC,iBAAiB,cAAqB;IAC/C,QAAQ,CAAC,gBAAgB,cAA8B;IACvD,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC/C,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,OAAO,CAAC,cAAc,CAAK;IAE3B;6EACyE;gBAE9D,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,EAClB,kBAAkB,CAAC,EAAE,kBAAkB,YAAA,EACvC,mBAAmB,CAAC,EAAE,mBAAmB,YAAA,EACzC,KAAK,CAAC,EAAE,MAAM,YAAA,EACd,KAAK,CAAC,EAAE,MAAM,YAAA,EACvB,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,EACtB,YAAY,GAAE,SAAS,MAAM,EAAO,EAC5B,gBAAgB,UAAO;IAK1C;;;2DAGuD;IACvD,SAAS,IAAI,IAAI;IAWjB,eAAe,IAAI,MAAM;IAIzB,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,GAAG,IAAI;IA2CxD,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI;IAM5D;mFAC+E;IAC/E,wBAAwB,IAAI,IAAI;IAIhC;8DAC0D;IAC1D,yBAAyB,IAAI,IAAI;CAGlC;AA4iBD,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB;mFAC+E;IAC/E,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;4FACwF;IACxF,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B;;4FAEwF;IACxF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;oGACgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;oGACgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C;;iFAE6E;IAC7E,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,6FAA6F;IAC7F,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,+FAA+F;IAC/F,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C;qFACiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oFAAoF;IACpF,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAWD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B;8DAC0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAE9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAU;IAC/C,oGAAoG;IACpG,OAAO,CAAC,SAAS,CAAS;IAC1B,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,UAAU,CAAoB;IAEtC,kGAAkG;IAClG,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,UAAU,CAAM;IAExB,OAAO;IAyGP;kDAC8C;IAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,GAAG,gBAAgB;IAI7E,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED;6FACyF;IACzF,IAAI,YAAY,IAAI,sBAAsB,GAAG,SAAS,CAErD;IAED;4FACwF;IACxF,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9F,OAAO,CAAC,yBAAyB;IAuBjC,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,wBAAwB;IAehC,OAAO,CAAC,2BAA2B;IAanC,yFAAyF;IACzF,OAAO,CAAC,GAAG;IAgBX,OAAO,CAAC,YAAY;IAKpB;uDACmD;IAC7C,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAS3B,UAAU;IAwDxB;;;;OAIG;IACG,WAAW,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IAWlE;2CACuC;IACjC,mBAAmB,CACvB,OAAO,EAAE,CAAC,UAAU,EAAE,gBAAgB,KAAK,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,GACxF,OAAO,CAAC,aAAa,CAAC;YAYX,gBAAgB;IAmC9B,gGAAgG;IAChG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IAI/E,4DAA4D;IAC5D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IAIjF,OAAO,CAAC,eAAe;YAST,eAAe;IA0D7B,qFAAqF;IAC/E,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAM/F,uFAAuF;IACjF,aAAa,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjF,4FAA4F;IACtF,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAK1C,sGAAsG;IAChG,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAatG,+FAA+F;IACzF,aAAa,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAclG,8FAA8F;IACxF,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAcnG,kGAAkG;IAC5F,eAAe,CAAC,OAAO,EAAE,sBAAsB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAgB/G,gFAAgF;IAC1E,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAWpF,sEAAsE;IACtE,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAIvD,iFAAiF;IACjF,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,8BAA8B,CAAC;IAIvG,wEAAwE;IACxE,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAI/E;;;4DAGwD;IACxD,OAAO,CAAC,MAAM,SAAS,kBAAkB,EACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAC1C,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,CAAC,QAAQ,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO,EAC1C,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,QAAQ,CAAC;IAMpB;kGAC8F;IAC9F,MAAM,CAAC,MAAM,SAAS,uBAAuB,EAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,+BAA+B,CAAC,MAAM,CAAC,GAC9C,OAAO,CAAC,IAAI,CAAC;IAChB,MAAM,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxE,+FAA+F;IACzF,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrD;;;;OAIG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxE,gGAAgG;IAChG,OAAO,IAAI,IAAI;IASf,8FAA8F;IACxF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA+B/B;AAID;;;;GAIG;AACH,qBAAa,aAAc,YAAW,gBAAgB;IAMlD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IATvB,OAAO,CAAC,aAAa,CAAwB;IAC7C,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,QAAQ,CAAS;gBAGN,MAAM,EAAE,gBAAgB,EAChC,SAAS,EAAE,MAAM,EACT,KAAK,EAAE,YAAY,EACpC,aAAa,EAAE,mBAAmB,EAAE,EACnB,IAAI,EAAE,iBAAiB;IAa1C,0FAA0F;IAC1F,IAAI,KAAK,IAAI,gBAAgB,CAE5B;IAED,6EAA6E;IAC7E,IAAI,OAAO,IAAI,iBAAiB,EAAE,CAEjC;IAED,kEAAkE;IAClE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,0FAA0F;IAC1F,IAAI,KAAK,IAAI,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAE/C;IAED,sFAAsF;IACtF,IAAI,YAAY,IAAI,sBAAsB,GAAG,SAAS,CAErD;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,WAAW,CACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAgBjF;;;;;;;OAOG;YACW,mBAAmB;IAoDjC;;6EAEyE;YAC3D,iBAAiB;IAS/B,oFAAoF;IAC9E,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B5C,yEAAyE;IACnE,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;IAoB7G,2DAA2D;IAC3D,eAAe,IAAI,MAAM;IAIzB,qFAAqF;IACrF,mBAAmB,IAAI,OAAO;IAI9B,gGAAgG;IAC1F,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B;;sFAEkF;IAC5E,OAAO,CAAC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAOnE"}
+{"version":3,"file":"acp-client.d.ts","sourceRoot":"","sources":["../src/acp-client.ts"],"names":[],"mappings":"AAwBA,OAAO,EAOL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,UAAU,EAQf,KAAK,yBAAyB,EAC9B,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,+BAA+B,EACpC,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAGlC,KAAK,oBAAoB,EAEzB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAG5B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAG1B,KAAK,aAAa,EAClB,KAAK,cAAc,EAMnB,KAAK,aAAa,EAClB,KAAK,cAAc,EAMnB,KAAK,yBAAyB,EAG9B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EAGxB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAO5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAIL,KAAK,cAAc,EAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AA0B9B,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAiBD;8FAC8F;AAC9F,cAAM,YAAY;IAed,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,QAAQ,CAAC,MAAM,EAAE,UAAU;IAC3B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB;IAChD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM;IAEvB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAtBnC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAM;IACnC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAM;IAC3C,QAAQ,CAAC,KAAK,mBAA0B;IACxC,QAAQ,CAAC,kBAAkB,gBAAqB,yBAAyB,KAAK,IAAI,EAAI;IACtF,QAAQ,CAAC,mBAAmB,gBAAqB,yBAAyB,KAAK,IAAI,EAAI;IACvF,QAAQ,CAAC,iBAAiB,cAAqB;IAC/C,QAAQ,CAAC,gBAAgB,cAA8B;IACvD,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC/C,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,OAAO,CAAC,cAAc,CAAK;IAE3B;6EACyE;gBAE9D,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,UAAU,EAClB,kBAAkB,CAAC,EAAE,kBAAkB,YAAA,EACvC,mBAAmB,CAAC,EAAE,mBAAmB,YAAA,EACzC,KAAK,CAAC,EAAE,MAAM,YAAA,EACd,KAAK,CAAC,EAAE,MAAM,YAAA,EACvB,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,EACtB,YAAY,GAAE,SAAS,MAAM,EAAO,EAC5B,gBAAgB,UAAO;IAK1C;;;2DAGuD;IACvD,SAAS,IAAI,IAAI;IAWjB,eAAe,IAAI,MAAM;IAIzB,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,GAAG,IAAI;IA2CxD,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI;IAM5D;mFAC+E;IAC/E,wBAAwB,IAAI,IAAI;IAIhC;8DAC0D;IAC1D,yBAAyB,IAAI,IAAI;CAGlC;AA4iBD,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB;mFAC+E;IAC/E,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;4FACwF;IACxF,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B;;4FAEwF;IACxF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;oGACgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;oGACgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,qFAAqF;AACrF,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C;;iFAE6E;IAC7E,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,6FAA6F;IAC7F,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,+FAA+F;IAC/F,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C;qFACiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;mGAC+F;IAC/F,gBAAgB,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7D;;;8FAG0F;IAC1F,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,oFAAoF;IACpF,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAWD;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAsC;IACzD;8DAC0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAE9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;IAC5D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAU;IAC/C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwD;IACzF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD;iGAC6F;IAC7F,SAAS,EAAE,mBAAmB,CAAyE;IACvG;+FAC2F;IAC3F,cAAc,UAAS;IACvB,oGAAoG;IACpG,OAAO,CAAC,SAAS,CAAS;IAC1B,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,UAAU,CAAoB;IAEtC,kGAAkG;IAClG,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,UAAU,CAAM;IAExB,OAAO;IAkHP;kDAC8C;IAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,GAAG,gBAAgB;IAI7E,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED,IAAI,cAAc,IAAI,MAAM,CAE3B;IAED;6FACyF;IACzF,IAAI,YAAY,IAAI,sBAAsB,GAAG,SAAS,CAErD;IAED;4FACwF;IACxF,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9F,OAAO,CAAC,yBAAyB;IAuBjC,OAAO,CAAC,kBAAkB;IAgB1B,OAAO,CAAC,wBAAwB;IAehC,OAAO,CAAC,2BAA2B;IAanC,yFAAyF;IACzF,OAAO,CAAC,GAAG;IAkBX,OAAO,CAAC,YAAY;IAOpB;+FAC2F;IAC3F,OAAO,CAAC,WAAW;IAInB;;;;;;wFAMoF;IACpF,OAAO,CAAC,yBAAyB;IAQjC,iFAAiF;IACjF,OAAO,CAAC,YAAY;IAIpB;sFACkF;IAClF,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO;IAIpD;;oEAEgE;YAClD,eAAe;IAyB7B;sGACkG;IAC5F,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOvE;wFACoF;IACpF,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI;IAOlD;wEACoE;IACpE,sBAAsB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAI1D;uDACmD;IAC7C,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAS3B,UAAU;IAmExB;;;;OAIG;IACG,WAAW,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IAWlE;2CACuC;IACjC,mBAAmB,CACvB,OAAO,EAAE,CAAC,UAAU,EAAE,gBAAgB,KAAK,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,GACxF,OAAO,CAAC,aAAa,CAAC;YAYX,gBAAgB;IAmC9B,gGAAgG;IAChG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IAI/E,4DAA4D;IAC5D,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IAIjF,OAAO,CAAC,eAAe;YAST,eAAe;IA0D7B,qFAAqF;IAC/E,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAM/F,uFAAuF;IACjF,aAAa,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjF,4FAA4F;IACtF,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAK1C,sGAAsG;IAChG,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAatG,+FAA+F;IACzF,aAAa,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAclG,8FAA8F;IACxF,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAcnG,kGAAkG;IAC5F,eAAe,CAAC,OAAO,EAAE,sBAAsB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAgB/G,gFAAgF;IAC1E,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAWpF,sEAAsE;IACtE,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAIvD,iFAAiF;IACjF,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,8BAA8B,CAAC;IAIvG,wEAAwE;IACxE,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAI/E;;;4DAGwD;IACxD,OAAO,CAAC,MAAM,SAAS,kBAAkB,EACvC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAC1C,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,CAAC,QAAQ,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO,EAC1C,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,QAAQ,CAAC;IAMpB;kGAC8F;IAC9F,MAAM,CAAC,MAAM,SAAS,uBAAuB,EAC3C,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,+BAA+B,CAAC,MAAM,CAAC,GAC9C,OAAO,CAAC,IAAI,CAAC;IAChB,MAAM,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxE,+FAA+F;IACzF,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWrD;;;;OAIG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BxE,gGAAgG;IAChG,OAAO,IAAI,IAAI;IASf,8FAA8F;IACxF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA+B/B;AAID;;;;GAIG;AACH,qBAAa,aAAc,YAAW,gBAAgB;IAMlD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,IAAI;IATvB,OAAO,CAAC,aAAa,CAAwB;IAC7C,OAAO,CAAC,WAAW,CAA2B;IAC9C,OAAO,CAAC,QAAQ,CAAS;gBAGN,MAAM,EAAE,gBAAgB,EAChC,SAAS,EAAE,MAAM,EACT,KAAK,EAAE,YAAY,EACpC,aAAa,EAAE,mBAAmB,EAAE,EACnB,IAAI,EAAE,iBAAiB;IAa1C,0FAA0F;IAC1F,IAAI,KAAK,IAAI,gBAAgB,CAE5B;IAED,6EAA6E;IAC7E,IAAI,OAAO,IAAI,iBAAiB,EAAE,CAEjC;IAED,kEAAkE;IAClE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,0FAA0F;IAC1F,IAAI,KAAK,IAAI,gBAAgB,GAAG,IAAI,GAAG,SAAS,CAE/C;IAED,sFAAsF;IACtF,IAAI,YAAY,IAAI,sBAAsB,GAAG,SAAS,CAErD;IAED;;;;;;;;;;;;;;;;;OAiBG;IACG,WAAW,CACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAgBjF;;;;;;;OAOG;YACW,mBAAmB;IAoDjC;;6EAEyE;YAC3D,iBAAiB;IAS/B,oFAAoF;IAC9E,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8B5C,yEAAyE;IACnE,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;IAoB7G,2DAA2D;IAC3D,eAAe,IAAI,MAAM;IAIzB,qFAAqF;IACrF,mBAAmB,IAAI,OAAO;IAI9B,gGAAgG;IAC1F,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B;;sFAEkF;IAC5E,OAAO,CAAC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAOnE"}

package/dist/acp-client.js

@@ -29,6 +29,7 @@ import { emitSessionUpdate } from "./events.js";
 import { decidePermission, } from "./permissions.js";
 import { UsageAccumulator } from "./usage.js";
 import { clientCapabilitiesFor, hasFullMcpHandlers, } from "./client-handlers.js";
+import { redactSecrets, } from "./auth/auth-store.js";
 /** A benign client identity. NOT JetBrains/IntelliJ 2026.1 — that exact identity makes
  *  codex-acp disable session config options (our model/effort routing channel). */
 const CLIENT_INFO = {
@@ -51,6 +52,8 @@ const GUARDED_STATEFUL_REQUESTS = new Map([
         "no driven wrapper yet; raw forked sessions cannot be routed (permissions auto-cancel)",
     ],
 ]);
+/** Monotonic seq for process-unique PooledConnection ids (auth-machine event tagging, §2.3). */
+let nextConnectionSeq = 0;
 const parseConnectMcpRequest = (params) => params;
 const parseMessageMcpRequest = (params) => params;
 const parseMessageMcpNotification = (params) => params;
@@ -633,6 +636,8 @@ function toolNameFromMeta(meta) {
  */
 export class PooledConnection {
     backendId;
+    /** Process-unique connection id, used only to tag `BackendAuthMachine` events (§2.3). */
+    id = `conn-${(nextConnectionSeq += 1)}`;
     /** The held ACP connection (fluent client() app); session/* calls go through its
      *  `agent` ClientContext via the typed wrappers below. */
     connection;
@@ -643,6 +648,14 @@ export class PooledConnection {
     onEvent;
     clientHandlers;
     advertiseElicitation;
+    authCapabilities;
+    authStore;
+    /** Which intent-generation THIS process reflects (§2.4). Starts at -1/false so a connection with
+     *  no applied intent is stale against a machine that has ever advanced past generation 0. */
+    authStamp = { appliedGeneration: -1, applied: false, trippedAuthRequired: false };
+    /** Set by the pool when a busy stale connection must be recycled once it drains (§2.6). While set,
+     *  the connection is never handed a new session and is disposed-and-dropped on release. */
+    recyclePending = false;
     /** Set true at the start of dispose() so the graceful-shutdown death is NOT reported as a crash. */
     disposing = false;
     /** Resolves once `initialize` completed (or rejects if the process died first). */
@@ -663,11 +676,20 @@ export class PooledConnection {
         this.onEvent = deps.onEvent;
         this.clientHandlers = deps.clientHandlers;
         this.advertiseElicitation = deps.advertiseElicitation ?? Boolean(deps.elicitationResolver);
+        this.authCapabilities = deps.authCapabilities;
+        this.authStore = deps.authStore;
         this.client = new MultiplexClient(this.backendId, this.onEvent, deps.clientHandlers, deps.permissionResolver, deps.elicitationResolver);
         const { command, args, env } = backend.spawnConfig();
+        // Spawn-env auth overlay (§2.8): host-collected `env_var` values (and, for a profiled backend,
+        // its `spawnAuthEnv` contribution) stacked ABOVE the backend's own env. Undefined when nothing is
+        // held — byte-identical to today. Passed straight to spawn; never logged (§2.14, Principle 9).
+        const authOverlay = this.authStore?.spawnEnvFor(backend.poolKey ?? backend.id);
         // NOTE: deliberately NO `cwd` here. cwd is per-SESSION (session/new), so one pooled process
         // serves runs in different worktrees without losing isolation.
-        const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], env });
+        const child = spawn(command, args, {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: authOverlay ? { ...env, ...authOverlay } : env,
+        });
         this.child = child;
         if (!child.stdin || !child.stdout) {
             throw new Error(`Failed to spawn ACP agent (${backend.id}): missing stdio pipes`);
@@ -809,6 +831,8 @@ export class PooledConnection {
         this.client.settleAllPendingPermissions();
         this.client.settleAllPendingElicitations();
         this.client.disconnectAllMcpConnections();
+        // The dying connection's stamp is dropped with it; the machine's auth state is unchanged (§2.3).
+        this.authStore?.existing(this.backend.poolKey ?? this.backend.id)?.send({ t: "process_death", connectionId: this.id });
         // A crash (not a graceful dispose) is worth surfacing for observability; the engine still
         // handles it by retrying the run on a fresh process. Best-effort, after death is recorded.
         if (this.onEvent && !this.disposing) {
@@ -817,9 +841,91 @@ export class PooledConnection {
         this.onDead(this);
     }
     stderrSuffix() {
-        const tail = this.stderrTail.trim();
+        // Redact credential-shaped substrings before the tail can appear in any error suffix (§2.14):
+        // a spawned agent that echoes an injected env var to stderr must not leak it into an error.
+        const tail = redactSecrets(this.stderrTail).trim();
         return tail ? `\n${tail}` : "";
     }
+    /** Resolve this connection's `BackendAuthMachine` from the runner's store, or undefined when no
+     *  store is wired (default-OFF) — the machine is keyed by the backend's poolKey (§2.3). */
+    authMachine() {
+        return this.authStore?.machineFor(this.backend.poolKey ?? this.backend.id, this.backend.authProfile);
+    }
+    /** The client `auth` advertisement for THIS connection (§1.2), refined per-backend by the pure-data
+     *  `AuthProfile.clientAuthCapabilities` (§3.1). When the host advertised nothing (default-OFF) the
+     *  key is omitted verbatim — no profile is consulted, so behavior stays byte-identical. When the
+     *  host opted in, the backend's profile maps the host affordances (`onAuth` ⇐ gateway desired,
+     *  `terminal` ⇐ host TTY) onto the method TYPES this backend can actually service (e.g. codex never
+     *  advertises terminal; opencode never advertises gateway). A custom backend has NO profile → the
+     *  host's advertisement passes through unchanged (conformance-by-absence, §3.5). */
+    effectiveAuthCapabilities() {
+        const base = this.authCapabilities;
+        if (!base)
+            return undefined; // default-OFF: omit `auth` entirely (byte-identical baseline)
+        const profile = this.backend.authProfile;
+        if (!profile)
+            return base;
+        return profile.clientAuthCapabilities({ onAuth: Boolean(base.gateway), terminal: Boolean(base.terminal) });
+    }
+    /** Mark this connection current against `generation` (nothing more to apply). */
+    stampApplied(generation) {
+        this.authStamp = { appliedGeneration: generation, applied: true, trippedAuthRequired: false };
+    }
+    /** true iff the current intent is an in-process (gateway) cred, so an idle connection can be
+     *  re-primed with an authenticate RPC replay instead of being recycled (§2.6). */
+    canLiveReapply(machine) {
+        return machine.currentKlassIsInProcess();
+    }
+    /** Reconcile this connection to the current intent at the end of `initialize` (§2.5). For an
+     *  in-process cred, replay `authenticate({methodId,_meta})`; for disk/spawn-env a fresh process
+     *  already carries the credential, so only stamp it current. */
+    async applyAuthIntent(machine) {
+        if (machine.state !== "credentials_held" && machine.state !== "authenticated") {
+            this.stampApplied(machine.generation); // nothing to apply; mark current
+            return;
+        }
+        const intent = machine.intentView();
+        if (intent?.klass !== "in-process") {
+            // disk (native store) + spawn-env (env at spawn) need no RPC — a fresh process already has them.
+            this.stampApplied(machine.generation);
+            return;
+        }
+        const meta = machine.applyMeta();
+        try {
+            await this.rawAgentRequest(AGENT_METHODS.authenticate, {
+                methodId: intent.methodId,
+                ...(meta ? { _meta: meta } : {}),
+            });
+            this.stampApplied(machine.generation);
+            machine.send({ t: "apply_ok", connectionId: this.id, generation: machine.generation });
+        }
+        catch (err) {
+            machine.send({ t: "apply_failed", connectionId: this.id, generation: machine.generation, error: err });
+            throw err; // -> AUTH_REQUIRED via §1.5; connection unusable
+        }
+    }
+    /** Idle in-process connection: re-send `authenticate` and re-stamp so the next session opens under
+     *  the current gateway cred without a process recycle (§2.6). Returns true iff a re-apply ran. */
+    async reapplyAuthIfStale(machine) {
+        if (!machine.isStale(this.authStamp) || !this.canLiveReapply(machine))
+            return false;
+        await this.ready;
+        await this.applyAuthIntent(machine);
+        return true;
+    }
+    /** Fire-and-forget idle live re-apply (§2.6). Any failure disposes the connection so the pool
+     *  respawns a fresh process rather than serving a session under a failed replay. */
+    scheduleReapply(machine) {
+        void this.reapplyAuthIfStale(machine).catch(() => {
+            this.recyclePending = true;
+            void this.dispose();
+        });
+    }
+    /** Mark a BUSY stale connection for recycle once it drains (§2.6): finish in-flight prompts under
+     *  the auth they started with, then dispose-and-drop on release. */
+    markForRecycleWhenIdle(_machine) {
+        this.recyclePending = true;
+    }
     /** Race a wire call against process death so a crash surfaces a clear error instead of hanging
      *  on a JSON-RPC response that will never come. */
     async race(op) {
@@ -854,6 +960,8 @@ export class PooledConnection {
                     // this runner. Omitted flags are unsupported; false flags are never sent deliberately.
                     clientCapabilities: clientCapabilitiesFor(this.clientHandlers, {
                         elicitation: this.advertiseElicitation,
+                        // Per-backend profile refinement (§1.2/§3.1); undefined => no `auth` key emitted (default-OFF).
+                        auth: this.effectiveAuthCapabilities(),
                     }),
                     clientInfo: { ...CLIENT_INFO },
                 })),
@@ -872,6 +980,15 @@ export class PooledConnection {
                     `this client (protocol v${PROTOCOL_VERSION}) does not support — closing the connection.${this.stderrSuffix()}`, WorkflowErrorCode.SCRIPT_VALIDATION_ERROR, { recoverable: false });
             }
             this.negotiated = negotiated;
+            // Reconcile this connection to the current auth intent (§2.5). Runs identically on pooled,
+            // dedicated, and interactive connections — the intent is durable in the AuthStore, so a fresh
+            // process always re-primes an in-process (gateway) credential here, which is the direct fix
+            // for the dispose-after-authenticate bug (gap 3). Disk/spawn-env intents are only stamped.
+            const machine = this.authMachine();
+            if (machine) {
+                machine.send({ t: "initialize_ok", connectionId: this.id, advertised: negotiated.authMethods });
+                await this.applyAuthIntent(machine);
+            }
         }
         finally {
             clearTimeout(timer);
@@ -1108,6 +1225,14 @@ export class PooledConnection {
         this.client.unregister(sessionId);
         if (this._activeSessions > 0)
             this._activeSessions -= 1;
+        // Generation-gated recycle (§2.6): a stale connection marked for recycle while busy is
+        // disposed-and-dropped the moment it drains, instead of returning to the pool, so the next
+        // acquire lands on a fresh process that primes the current intent at initialize. dispose()
+        // drops it via the onDead path.
+        if (this.recyclePending && this._activeSessions === 0 && this._alive) {
+            void this.dispose();
+            return;
+        }
         // keepOpen: the caller intends to re-open this session later (session/load|resume), so the
         // agent-persisted session must be left untouched — skip the best-effort close entirely.
         if (keepOpen || !this.negotiated?.supportsClose || !this._alive)

package/dist/auth/auth-profiles.d.ts

@@ -0,0 +1,63 @@
+import type { AuthMethod } from "@agentclientprotocol/sdk";
+import type { ClientCapabilityOptions } from "../client-handlers.js";
+import type { AuthMethodDescriptor, AuthResolution } from "./auth-types.js";
+import type { AuthIntent } from "./auth-store.js";
+/** The spawnable interactive login a host runs in a TTY. Identical to the `launch` member of the
+ *  `terminal` `AuthMethodDescriptor` (§1.3). */
+export interface TerminalLaunch {
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+    label?: string;
+}
+/** Per-agent adapter (§3.1). Every field is DATA/ENRICHMENT only — none gates the base flow. A backend
+ *  with NO profile runs the base flow verbatim (conformance-by-absence). Built-in profiles are wired
+ *  onto their backend in PR7; `custom.ts` leaves `Backend.authProfile` undefined. */
+export interface AuthProfile {
+    readonly backendId: string;
+    /** Which auth method TYPES to advertise for this backend, given host affordances. Refines the
+     *  runner default derivation in §1.2; still connection-lifetime-fixed. `host.onAuth` = the host can
+     *  complete an in-process (gateway) auth; `host.terminal` = the host has a real TTY. */
+    clientAuthCapabilities(host: {
+        onAuth: boolean;
+        terminal: boolean;
+    }): ClientCapabilityOptions["auth"];
+    /** Enrich/label the base descriptor for one advertised method. MUST delegate type dispatch to the
+     *  §1.3 `buildAuthDescriptors` dispatcher (it receives the already-dispatched `base`); may only
+     *  override name/description/label. */
+    describe(method: AuthMethod, base: AuthMethodDescriptor): AuthMethodDescriptor;
+    /** Terminal launch override; base falls back to §1.3's launch-resolution order. */
+    terminalLaunch?(method: Extract<AuthMethod, {
+        type: "terminal";
+    }>): TerminalLaunch;
+    /** Wrap a `{outcome:"meta"}` resolution into the agent's expected authenticate `_meta`. */
+    buildMeta?(method: AuthMethod, resolution: Extract<AuthResolution, {
+        outcome: "meta";
+    }>): Record<string, unknown>;
+    /** OPTIONAL spawn-env overlay contributed regardless of `klass` (§2.8, Principle 9). Codex only —
+     *  the `DEFAULT_AUTH_REQUEST` lever channel. Secret; consumed inside `AuthStore.spawnEnvFor`, never
+     *  logged. */
+    spawnAuthEnv?(intent: AuthIntent): Record<string, string> | undefined;
+}
+/** Claude Code — `@agentclientprotocol/claude-agent-acp` 0.57.0 (§3.2). Reveals its `terminal` login
+ *  methods on `auth.terminal===true` OR `_meta["terminal-auth"]===true`, and its `gateway`/
+ *  `gateway-bedrock` `agent`-type methods on `auth._meta.gateway===true`, so terminal follows the
+ *  host TTY and gateway follows an `onAuth` resolver. `describe`/`buildMeta` are client-side identity:
+ *  the base dispatcher already produces the correct descriptor and the gateway payload passes through
+ *  unchanged. No `spawnAuthEnv` — Claude has no `DEFAULT_AUTH_REQUEST`-style pre-auth channel and is
+ *  consumed client-side only (§3.2 spawn-time). */
+export declare const claudeAuthProfile: AuthProfile;
+/** Codex — `@automatalabs/codex-acp` 1.4.x, our fork (§3.3). Advertises no `terminal` method (its
+ *  `api-key` reads env internally and `chat-gpt`/`gateway` are `agent`-type), so terminal is always
+ *  false; `gateway` follows an `onAuth` resolver. The `spawnAuthEnv` lever emits `DEFAULT_AUTH_REQUEST`
+ *  for `api-key`/`gateway` intents so a freshly recycled process pre-authenticates before its first
+ *  gated request — layered on top of the universal replay (§2.5), never replacing it and never
+ *  required for correctness (§2.8/§3.3). */
+export declare const codexAuthProfile: AuthProfile;
+/** OpenCode — `opencode-ai` 1.17.14 (§3.4). Advertises exactly one `opencode-login` method that is
+ *  semantically terminal (it carries a `_meta["terminal-auth"]` launch hint when the host has a TTY),
+ *  and no gateway/`env_var`/logout auth surface. So terminal follows the host TTY and gateway is
+ *  always false. `describe` is client-side identity; no `buildMeta` (no meta method) and no
+ *  `spawnAuthEnv` (no `DEFAULT_AUTH_REQUEST` analog; §3.4 spawn-time). */
+export declare const opencodeAuthProfile: AuthProfile;
+//# sourceMappingURL=auth-profiles.d.ts.map

package/dist/auth/auth-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-profiles.d.ts","sourceRoot":"","sources":["../../src/auth/auth-profiles.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;gDACgD;AAChD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;qFAEqF;AACrF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;4FAEwF;IACxF,sBAAsB,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACtG;;2CAEuC;IACvC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IAC/E,mFAAmF;IACnF,cAAc,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC,GAAG,cAAc,CAAC;IACnF,2FAA2F;IAC3F,SAAS,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,cAAc,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClH;;kBAEc;IACd,YAAY,CAAC,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;CACvE;AAED;;;;;;mDAMmD;AACnD,eAAO,MAAM,iBAAiB,EAAE,WAK/B,CAAC;AAEF;;;;;4CAK4C;AAC5C,eAAO,MAAM,gBAAgB,EAAE,WAc9B,CAAC;AAEF;;;;0EAI0E;AAC1E,eAAO,MAAM,mBAAmB,EAAE,WAIjC,CAAC"}

package/dist/auth/auth-profiles.js

@@ -0,0 +1,45 @@
+/** Claude Code — `@agentclientprotocol/claude-agent-acp` 0.57.0 (§3.2). Reveals its `terminal` login
+ *  methods on `auth.terminal===true` OR `_meta["terminal-auth"]===true`, and its `gateway`/
+ *  `gateway-bedrock` `agent`-type methods on `auth._meta.gateway===true`, so terminal follows the
+ *  host TTY and gateway follows an `onAuth` resolver. `describe`/`buildMeta` are client-side identity:
+ *  the base dispatcher already produces the correct descriptor and the gateway payload passes through
+ *  unchanged. No `spawnAuthEnv` — Claude has no `DEFAULT_AUTH_REQUEST`-style pre-auth channel and is
+ *  consumed client-side only (§3.2 spawn-time). */
+export const claudeAuthProfile = {
+    backendId: "claude",
+    clientAuthCapabilities: ({ onAuth, terminal }) => ({ terminal, gateway: onAuth }),
+    describe: (_method, base) => base,
+    buildMeta: (_method, resolution) => resolution.meta,
+};
+/** Codex — `@automatalabs/codex-acp` 1.4.x, our fork (§3.3). Advertises no `terminal` method (its
+ *  `api-key` reads env internally and `chat-gpt`/`gateway` are `agent`-type), so terminal is always
+ *  false; `gateway` follows an `onAuth` resolver. The `spawnAuthEnv` lever emits `DEFAULT_AUTH_REQUEST`
+ *  for `api-key`/`gateway` intents so a freshly recycled process pre-authenticates before its first
+ *  gated request — layered on top of the universal replay (§2.5), never replacing it and never
+ *  required for correctness (§2.8/§3.3). */
+export const codexAuthProfile = {
+    backendId: "codex",
+    clientAuthCapabilities: ({ onAuth }) => ({ terminal: false, gateway: onAuth }),
+    describe: (_method, base) => base,
+    buildMeta: (_method, resolution) => resolution.meta,
+    spawnAuthEnv(intent) {
+        // Only api-key and gateway intents drive the codex pre-auth channel (§3.3). `authenticateMeta` is
+        // SECRET and undefined for the env-only api-key path — the base overlay injects that key's env.
+        if (intent.methodId !== "api-key" && intent.methodId !== "gateway")
+            return undefined;
+        const meta = intent.authenticateMeta;
+        return {
+            DEFAULT_AUTH_REQUEST: JSON.stringify({ methodId: intent.methodId, ...(meta ? { _meta: meta } : {}) }),
+        };
+    },
+};
+/** OpenCode — `opencode-ai` 1.17.14 (§3.4). Advertises exactly one `opencode-login` method that is
+ *  semantically terminal (it carries a `_meta["terminal-auth"]` launch hint when the host has a TTY),
+ *  and no gateway/`env_var`/logout auth surface. So terminal follows the host TTY and gateway is
+ *  always false. `describe` is client-side identity; no `buildMeta` (no meta method) and no
+ *  `spawnAuthEnv` (no `DEFAULT_AUTH_REQUEST` analog; §3.4 spawn-time). */
+export const opencodeAuthProfile = {
+    backendId: "opencode",
+    clientAuthCapabilities: ({ terminal }) => ({ terminal, gateway: false }),
+    describe: (_method, base) => base,
+};

package/dist/auth/auth-store.d.ts

@@ -0,0 +1,112 @@
+import type { AuthMethod } from "@agentclientprotocol/sdk";
+import type { AuthProfile } from "./auth-profiles.js";
+export type AuthMethodType = "agent" | "terminal" | "env_var";
+/** The three-value strategy that collapses onto the two credential classes (§2.1):
+ *   "disk"       -> disk-persisted; apply on a fresh connection = NOTHING.
+ *   "in-process" -> per-spawn via authenticate RPC replay (§2.5).
+ *   "spawn-env"  -> per-spawn via env injection + recycle (§2.8). */
+export type CredentialClass = "disk" | "in-process" | "spawn-env";
+/** Type-driven, agent-agnostic classification (§2.1). Keys ONLY on the method type + whether the
+ *  advertised `_meta` is gateway-shaped — never on an agent id. */
+export declare function classifyCredential(methodType: AuthMethodType, advertisedMeta: Record<string, unknown> | null | undefined): {
+    klass: CredentialClass;
+    diskBacked: boolean;
+};
+/** The host's completed auth choice, recorded as ONE immutable intent. This is the only place
+ *  credential material lives in the library — never written to a journal, emitted in an event, or
+ *  logged (§2.14). */
+export interface AuthIntent {
+    readonly backendId: string;
+    readonly poolKey: string;
+    readonly methodId: string;
+    readonly methodType: AuthMethodType;
+    readonly klass: CredentialClass;
+    /** SECRET. The `_meta` payload for the chosen method (e.g. claude `{ gateway: { baseUrl, headers } }`
+     *  or codex `{ "api-key": { apiKey } }`). Populated for BOTH in-process and disk intents; how it is
+     *  consumed depends on `klass`, not on whether it is set. */
+    readonly authenticateMeta?: Record<string, unknown>;
+    /** SECRET; spawn-env only. Env values injected at agent spawn. */
+    readonly envValues?: Record<string, string>;
+    /** klass === "disk": a fresh process re-reads the native store; survives cold resume (§2.13). */
+    readonly diskBacked: boolean;
+}
+/** The connection-level record of which intent-generation THIS process reflects (§2.4). */
+export interface ConnectionAuthStamp {
+    appliedGeneration: number;
+    applied: boolean;
+    trippedAuthRequired: boolean;
+}
+export type BackendAuthState = "unauthenticated" | "credentials_held" | "authenticated" | "auth_required";
+export type AuthEvent = {
+    t: "initialize_ok";
+    connectionId: string;
+    advertised: readonly AuthMethod[];
+} | {
+    t: "host_authenticate";
+    intent: AuthIntent;
+} | {
+    t: "apply_ok";
+    connectionId: string;
+    generation: number;
+} | {
+    t: "apply_failed";
+    connectionId: string;
+    generation: number;
+    error: unknown;
+} | {
+    t: "auth_required_tripped";
+    connectionId: string;
+    error: unknown;
+} | {
+    t: "logout";
+} | {
+    t: "process_death";
+    connectionId: string;
+};
+/** Redacted, secret-free projection of an intent — ids/types/klass only (§2.14). */
+export type RedactedIntent = Readonly<Omit<AuthIntent, "authenticateMeta" | "envValues">>;
+/** One state machine per `poolKey`, owned by the `AuthStore`. The single source of auth truth. */
+export declare class BackendAuthMachine {
+    private _state;
+    private _generation;
+    private _intent;
+    private _advertised;
+    get state(): BackendAuthState;
+    get generation(): number;
+    /** The advertised methods most recently observed at `initialize` (redaction source for status). */
+    get advertised(): readonly AuthMethod[];
+    get authenticated(): boolean;
+    /** Redacted view — ids/types/klass only, NEVER authenticateMeta/envValues. */
+    intentView(): RedactedIntent | undefined;
+    /** SECRET accessor — connection-internal only (used by applyAuthIntent, §2.5). */
+    applyMeta(): Record<string, unknown> | undefined;
+    /** SECRET accessor — pool/connection-internal only (used by spawnEnvFor, §2.8). */
+    spawnEnv(): Record<string, string> | undefined;
+    /** SECRET accessor — module-internal only (AuthStore.spawnEnvFor passes it to a profile). */
+    rawIntent(): AuthIntent | undefined;
+    /** Cold-resume re-arm predicate (§2.13): resumable iff creds are held/applied OR disk-backed. */
+    canResume(): boolean;
+    isStale(stamp: ConnectionAuthStamp): boolean;
+    /** true iff the current intent is an in-process (gateway) cred that can be live-re-applied on an
+     *  idle connection via an authenticate RPC replay, rather than requiring a process recycle. */
+    currentKlassIsInProcess(): boolean;
+    send(ev: AuthEvent): void;
+}
+/** The single per-runner auth store. Owns one `BackendAuthMachine` per `poolKey` and records the
+ *  (optional) per-backend `AuthProfile` so `spawnEnvFor` can consult it. */
+export declare class AuthStore {
+    private readonly machines;
+    private readonly profiles;
+    /** Get/create the machine for a `poolKey`, recording the backend's profile the first time. */
+    machineFor(poolKey: string, profile?: AuthProfile): BackendAuthMachine;
+    /** The machine for a `poolKey`, or undefined if none has been created yet (read-only lookup). */
+    existing(poolKey: string): BackendAuthMachine | undefined;
+    /** Every `poolKey` that has a machine (the touched backends). */
+    poolKeys(): string[];
+    /** The spawn-env overlay (§2.8): the machine's `env_var` collected values merged with the backend
+     *  profile's `spawnAuthEnv(intent)` contribution. Undefined when neither applies. Secret — passed
+     *  straight to `spawn`, never logged. */
+    spawnEnvFor(poolKey: string): Record<string, string> | undefined;
+}
+export declare function redactSecrets(text: string): string;
+//# sourceMappingURL=auth-store.d.ts.map

package/dist/auth/auth-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-store.d.ts","sourceRoot":"","sources":["../../src/auth/auth-store.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAE9D;;;qEAGqE;AACrE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,YAAY,GAAG,WAAW,CAAC;AAElE;mEACmE;AACnE,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,cAAc,EAC1B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACzD;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAWjD;AAED;;sBAEsB;AACtB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC;;iEAE6D;IAC7D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,iGAAiG;IACjG,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,eAAe,GAAG,eAAe,CAAC;AAE1G,MAAM,MAAM,SAAS,GACjB;IAAE,CAAC,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,GAC/E;IAAE,CAAC,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC9C;IAAE,CAAC,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,CAAC,EAAE,cAAc,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC/E;IAAE,CAAC,EAAE,uBAAuB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACpE;IAAE,CAAC,EAAE,QAAQ,CAAA;CAAE,GACf;IAAE,CAAC,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,GAAG,WAAW,CAAC,CAAC,CAAC;AAW1F,kGAAkG;AAClG,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,WAAW,CAA6B;IAEhD,IAAI,KAAK,IAAI,gBAAgB,CAE5B;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED,mGAAmG;IACnG,IAAI,UAAU,IAAI,SAAS,UAAU,EAAE,CAEtC;IAED,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED,8EAA8E;IAC9E,UAAU,IAAI,cAAc,GAAG,SAAS;IAMxC,kFAAkF;IAClF,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAIhD,mFAAmF;IACnF,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS;IAI9C,6FAA6F;IAC7F,SAAS,IAAI,UAAU,GAAG,SAAS;IAInC,iGAAiG;IACjG,SAAS,IAAI,OAAO;IAKpB,OAAO,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO;IAI5C;mGAC+F;IAC/F,uBAAuB,IAAI,OAAO;IAIlC,IAAI,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI;CAmC1B;AAED;4EAC4E;AAC5E,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyC;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8C;IAEvE,8FAA8F;IAC9F,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,kBAAkB;IAUtE,iGAAiG;IACjG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIzD,iEAAiE;IACjE,QAAQ,IAAI,MAAM,EAAE;IAIpB;;6CAEyC;IACzC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS;CAUjE;AAcD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAclD"}