@botiverse/oar 0.49.0 → 0.51.0

package/dist/shared/acp/resume-cwd.js

@@ -16,22 +16,43 @@ function real(dir) {
 function sameDirectory(left, right) {
     return path.resolve(left) === path.resolve(right) || real(left) === real(right);
 }
-/** Refuse a resume that names another directory than the one `session/list` says the session lives in: an `UnsupportedOptionError` on `cwd`. */
+/**
+ * Refuse a different cwd with UnsupportedOptionError. Return true when found,
+ * false only after a complete, well-formed list, null when absence is unknown.
+ * Listing failures propagate unchanged; they never prove a session missing.
+ */
 export async function refuseResumeElsewhere(process, sessionId, cwd, timeoutMs) {
     const method = methods.agent.session.list;
     let cursor = null;
+    const visited = new Set();
+    let complete = true;
     do {
         const params = cursor === null ? {} : { cursor };
         // oxlint-disable-next-line no-await-in-loop -- pages are sequential by construction.
         const page = asRecord(await withAcpDeadline(process, method, timeoutMs, (requestOptions) => process.connection.agent.request(method, params, requestOptions)));
-        const found = asRecordList(page?.sessions).find((session) => session.sessionId === sessionId);
+        const sessions = asRecordList(page?.sessions);
+        if (!Array.isArray(page?.sessions) || sessions.length !== page.sessions.length
+            || sessions.some((session) => typeof session.sessionId !== "string" || session.sessionId.length === 0)) {
+            complete = false;
+        }
+        const found = sessions.find((session) => session.sessionId === sessionId);
         if (found !== undefined) {
             if (typeof found.cwd === "string" && !sameDirectory(found.cwd, cwd)) {
                 throw new UnsupportedOptionError("cwd", `session ${sessionId} lives in ${found.cwd} and this runtime resumes it only there; the resume names ${cwd}`);
             }
-            return;
+            return true;
+        }
+        if (page?.nextCursor !== undefined && page.nextCursor !== null && typeof page.nextCursor !== "string") {
+            return null;
         }
         cursor = typeof page?.nextCursor === "string" && page.nextCursor !== "" ? page.nextCursor : null;
+        if (cursor !== null) {
+            if (visited.has(cursor)) {
+                return null;
+            }
+            visited.add(cursor);
+        }
     } while (cursor !== null);
+    return complete ? false : null;
 }
 //# sourceMappingURL=resume-cwd.js.map

package/dist/shared/acp/resume-cwd.js.map

@@ -1 +1 @@
-{"version":3,"file":"resume-cwd.js","sourceRoot":"","sources":["../../../src/shared/acp/resume-cwd.ts"],"names":[],"mappings":"AAAA,2HAA2H;AAC3H,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAmB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEzE,SAAS,IAAI,CAAC,GAAW;IACvB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,gJAAgJ;AAChJ,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAmB,EAAE,SAAiB,EAAE,GAAW,EAAE,SAAiB;IAChH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,GAAG,CAAC;QACF,MAAM,MAAM,GAAe,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7D,qFAAqF;QACrF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/J,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC9F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,WAAW,SAAS,aAAa,KAAK,CAAC,GAAG,6DAA6D,GAAG,EAAE,CAAC,CAAC;YACxJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACnG,CAAC,QAAQ,MAAM,KAAK,IAAI,EAAE;AAC5B,CAAC"}
+{"version":3,"file":"resume-cwd.js","sourceRoot":"","sources":["../../../src/shared/acp/resume-cwd.ts"],"names":[],"mappings":"AAAA,2HAA2H;AAC3H,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAmB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEzE,SAAS,IAAI,CAAC,GAAW;IACvB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,yDAAyD;AACzD,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAmB,EAAE,SAAiB,EAAE,GAAW,EAAE,SAAiB;IAChH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC;QACF,MAAM,MAAM,GAAe,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7D,qFAAqF;QACrF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;QAC/J,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;eACzE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACzG,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAC1E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,WAAW,SAAS,aAAa,KAAK,CAAC,GAAG,6DAA6D,GAAG,EAAE,CAAC,CAAC;YACxJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACvH,MAAM,GAAG,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QACjG,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,QAAQ,MAAM,KAAK,IAAI,EAAE;IAC1B,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/shared/acp/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/shared/acp/session.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAQV,YAAY,EACb,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAOtB,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AActD,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,YAAY,CAuInE"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/shared/acp/session.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAQV,YAAY,EACb,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAOtB,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AActD,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,YAAY,CAuInE"}

package/dist/shared/acp/session.js

@@ -1,7 +1,6 @@
 /* oxlint-disable import/max-dependencies -- Session assembly wires the environment, process, terminal host, recorder and control machinery. */
 import { sessionEnvironment } from "../environment.js";
-import { sealSession } from "../seal-session.js";
-import { createSessionKernel } from "../session-kernel.js";
+import { withSessionCredentials } from "../session-credentials.js";
 import { createAcpClientApp } from "./client-app.js";
 import { acpMcpOpenGuard, closeAcpSession, createUsageUpdateGate, openAcpSession, } from "./profile.js";
 import { acpLaunchArgs } from "./launch-args.js";
@@ -21,7 +20,7 @@ import { acpTakesImages, createAcpTurns } from "./turns.js";
  *   (turns.ts) or the process exit oar observed (`exited` response).
  */
 export function acpSession(profile) {
-    return async (installation, options) => {
+    return withSessionCredentials(async (installation, options, credentials) => {
         if (installation.via !== "executable") {
             throw new Error("ACP runtimes require an executable installation");
         }
@@ -29,7 +28,7 @@ export function acpSession(profile) {
         // SessionOptions.mcpServers go out in the open request (mcp-servers.ts):
         // a list with an empty or repeated name fails before anything starts,
         // and an open that fails reports no credential they carry.
-        const withoutCredentials = acpMcpOpenGuard(options.mcpServers);
+        const withoutCredentials = acpMcpOpenGuard(options.mcpServers, credentials.redact);
         const args = acpLaunchArgs(profile, options);
         const environment = sessionEnvironment(options.env);
         const terminalHost = createAcpTerminalHost(options.cwd, environment, {
@@ -54,7 +53,7 @@ export function acpSession(profile) {
             },
             extensionNotifications: profile.extensionNotifications ?? [],
         });
-        const runtime = startAcpProcess(installation.command, args, client, { cwd: options.cwd, env: environment });
+        const runtime = startAcpProcess(installation.command, args, client, { cwd: options.cwd, env: environment, redact: credentials.redact });
         const opened = await openAcpSession(runtime, profile, options, (step) => {
             recorder.step(step.method, step.response);
         }).catch(async (error) => {
@@ -63,7 +62,7 @@ export function acpSession(profile) {
             await terminalHost.dispose();
             throw withoutCredentials(error);
         });
-        const kernel = createSessionKernel(opened.sessionId);
+        const kernel = credentials.kernel(opened.sessionId);
         recorder.bind(kernel);
         let disposeRequest = null;
         const capabilities = { ...profile.capabilities, images: profile.capabilities.images ?? acpTakesImages(opened.initialized) };
@@ -101,7 +100,7 @@ export function acpSession(profile) {
                         : turns.steer(state, input, inputOptions, steerParams(input));
                 }),
             };
-        return sealSession({
+        return credentials.seal({
             id: kernel.sessionId,
             capabilities,
             prompt: (input, inputOptions) => control({ kind: "prompt", input, ...inputOptions }, (request) => (turns.active() === null ? turns.begin(request, input, inputOptions?.images) : { kind: "rejected", code: "busy", reason: "busy" })),
@@ -146,6 +145,6 @@ export function acpSession(profile) {
                 await terminalHost.dispose();
             },
         });
-    };
+    });
 }
 //# sourceMappingURL=session.js.map

package/dist/shared/acp/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/shared/acp/session.ts"],"names":[],"mappings":"AAAA,+IAA+I;AAC/I,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAavD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,cAAc,GAEf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI5D;;;;;;;;;;GAUG;AAEH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,OAAO,KAAK,EAAE,YAAmC,EAAE,OAAuB,EAAoB,EAAE;QAC9F,IAAI,YAAY,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;QACnC,yEAAyE;QACzE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YACnE,YAAY,EAAE,OAAO,CAAC,oBAAoB,KAAK,IAAI;SACpD,CAAC,CAAC;QACH,yEAAyE;QACzE,+CAA+C;QAC/C,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,EAAE;YAC9C,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE;gBACvB,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAChC,CAAC;YACD,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;gBAC5B,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,2BAA2B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;YAC9F,CAAC;YACD,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;YACD,QAAQ,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE;gBACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,IAAI,EAAE;SAC7D,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACtE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAChC,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,MAAM,CAAC;YACrB,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,cAAc,GAAyB,IAAI,CAAC;QAChD,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5H,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QACpF,8HAA8H;QAC9H,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAChC,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5B,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,EACnB,IAAiB,EACjB,MAAwE,EAChD,EAAE;YAC1B,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;gBACpD,MAAM,OAAO,CAAC,MAAM,CAAC;YACvB,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC;QAEF,+EAA+E;QAC/E,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAChC,MAAM,KAAK,GAAG,WAAW,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACA,KAAK,EAAE,CAAC,KAAa,EAAE,YAA2B,EAA0B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,EAAE,GAAyC,EAAE;oBAC3K,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,KAAK,KAAK,IAAI;wBACnB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE;wBACvF,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClE,CAAC,CAAC;aACH,CAAC;QAEJ,OAAO,WAAW,CAAC;YACjB,EAAE,EAAE,MAAM,CAAC,SAAS;YACpB,YAAY;YACZ,MAAM,EAAE,CAAC,KAAK,EAAE,YAA2B,EAA0B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,EAAE,CAAC,OAAO,EAAgB,EAAE,CACpJ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACrI,GAAG,KAAK;YACR,KAAK,EAAE,CAAC,KAAK,EAAE,YAA2B,EAA0B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/L,6GAA6G;YAC7G,QAAQ,EAAE,CAAC,OAAe,EAA0B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5H,KAAK,EAAE,GAA2B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAyC,EAAE;gBACzG,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtH,CAAC,CAAC;YACF,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;YACnE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;oBAC5B,OAAO,CAAC,yDAAyD;gBACnE,CAAC;gBACD,sEAAsE;gBACtE,6DAA6D;gBAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;gBAC3C,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClE,IAAI,IAAI,EAAE,CAAC;oBACT,iFAAiF;oBACjF,kEAAkE;oBAClE,kEAAkE;oBAClE,iEAAiE;oBACjE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBACxD,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACtC,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBACD,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC5C,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACnE,CAAC;gBACD,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,MAAM,CAAC;gBACrB,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;YAC/B,CAAC;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../src/shared/acp/session.ts"],"names":[],"mappings":"AAAA,+IAA+I;AAC/I,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAavD,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,cAAc,GAEf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI5D;;;;;;;;;;GAUG;AAEH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,OAAO,sBAAsB,CAAC,KAAK,EAAE,YAAmC,EAAE,OAAuB,EAAE,WAAW,EAAoB,EAAE;QAClI,IAAI,YAAY,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;QACnC,yEAAyE;QACzE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,kBAAkB,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE;YACnE,YAAY,EAAE,OAAO,CAAC,oBAAoB,KAAK,IAAI;SACpD,CAAC,CAAC;QACH,yEAAyE;QACzE,+CAA+C;QAC/C,MAAM,SAAS,GAAG,qBAAqB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,EAAE;YAC9C,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE;gBACvB,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAChC,CAAC;YACD,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;gBAC5B,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,2BAA2B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC;YAC9F,CAAC;YACD,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACzC,CAAC;YACD,QAAQ,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE;gBACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB,IAAI,EAAE;SAC7D,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACxI,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACtE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAChC,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,MAAM,CAAC;YACrB,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,cAAc,GAAyB,IAAI,CAAC;QAChD,MAAM,YAAY,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5H,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QACpF,8HAA8H;QAC9H,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAChC,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5B,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,0BAA0B;QAC1B,MAAM,OAAO,GAAG,KAAK,EACnB,IAAiB,EACjB,MAAwE,EAChD,EAAE;YAC1B,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;gBACpD,MAAM,OAAO,CAAC,MAAM,CAAC;YACvB,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC;QAEF,+EAA+E;QAC/E,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;QAChC,MAAM,KAAK,GAAG,WAAW,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACA,KAAK,EAAE,CAAC,KAAa,EAAE,YAA2B,EAA0B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,EAAE,GAAyC,EAAE;oBAC3K,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,KAAK,KAAK,IAAI;wBACnB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,+BAA+B,EAAE;wBACvF,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClE,CAAC,CAAC;aACH,CAAC;QAEJ,OAAO,WAAW,CAAC,IAAI,CAAC;YACtB,EAAE,EAAE,MAAM,CAAC,SAAS;YACpB,YAAY;YACZ,MAAM,EAAE,CAAC,KAAK,EAAE,YAA2B,EAA0B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,EAAE,CAAC,OAAO,EAAgB,EAAE,CACpJ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACrI,GAAG,KAAK;YACR,KAAK,EAAE,CAAC,KAAK,EAAE,YAA2B,EAA0B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/L,6GAA6G;YAC7G,QAAQ,EAAE,CAAC,OAAe,EAA0B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5H,KAAK,EAAE,GAA2B,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAyC,EAAE;gBACzG,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACtH,CAAC,CAAC;YACF,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;YACnE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;oBAC5B,OAAO,CAAC,yDAAyD;gBACnE,CAAC;gBACD,sEAAsE;gBACtE,6DAA6D;gBAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;gBAC3C,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAClE,IAAI,IAAI,EAAE,CAAC;oBACT,iFAAiF;oBACjF,kEAAkE;oBAClE,kEAAkE;oBAClE,iEAAiE;oBACjE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBACxD,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACtC,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBACD,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBAC5C,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACnE,CAAC;gBACD,OAAO,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,OAAO,CAAC,MAAM,CAAC;gBACrB,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC;YAC/B,CAAC;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/shared/credential-redactor.d.ts

@@ -0,0 +1,9 @@
+import type { SessionOptions } from "../contracts/session.js";
+export interface CredentialRedactor {
+    add(this: void, value: string | undefined): void;
+    redact(this: void, text: string): string;
+    redactValue<T>(this: void, value: T): T;
+}
+/** Explicit session credentials only; runtime-native keys can be added after SDK resolution. */
+export declare function sessionCredentialRedactor(options: Partial<SessionOptions>): CredentialRedactor;
+//# sourceMappingURL=credential-redactor.d.ts.map

package/dist/shared/credential-redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-redactor.d.ts","sourceRoot":"","sources":["../../src/shared/credential-redactor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAuB9D,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACzC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;CACzC;AAED,gGAAgG;AAChG,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAkC9F"}

package/dist/shared/credential-redactor.js

@@ -0,0 +1,75 @@
+import { redactText } from "./redact-text.js";
+const CREDENTIAL_WORDS = new Set(["KEY", "APIKEY", "TOKEN", "SECRET", "PASSWORD", "PASSWD", "PASSPHRASE", "CREDENTIAL", "CREDENTIALS", "COOKIE", "PWD"]);
+const AUTH_HEADERS = new Set(["AUTHORIZATION", "PROXY-AUTHORIZATION"]);
+const CREDENTIAL_NAMES = new Set(["PGPASSWORD"]);
+const CREDENTIAL_MIN_LENGTH = 8;
+const PATH_VALUE = /^(?:\/|~\/|[a-z]:\\)/iu;
+function credentialValue(value) {
+    return typeof value === "string" && value.length >= CREDENTIAL_MIN_LENGTH && !PATH_VALUE.test(value);
+}
+/** A connection string proves its password is a credential, regardless of the env name. */
+function urlCredentials(value) {
+    if (typeof value !== "string" || !/^[a-z][a-z\d+.-]*:\/\//iu.test(value) || !URL.canParse(value)) {
+        return [];
+    }
+    const parsed = new URL(value);
+    if (parsed.password === "") {
+        return [];
+    }
+    const passwords = [parsed.password];
+    try {
+        passwords.push(decodeURIComponent(parsed.password));
+    }
+    catch { /* Malformed percent escapes still leave the encoded password protected. */ }
+    return [value, ...passwords.filter((password) => password.length >= CREDENTIAL_MIN_LENGTH)];
+}
+/** Explicit session credentials only; runtime-native keys can be added after SDK resolution. */
+export function sessionCredentialRedactor(options) {
+    const known = new Set();
+    const add = (value) => { if (credentialValue(value)) {
+        known.add(value);
+    } };
+    const env = (entries) => {
+        for (const [name, value] of Object.entries(entries ?? {})) {
+            const upper = name.toUpperCase();
+            if (CREDENTIAL_WORDS.has(upper.split("_").at(-1) ?? "") || CREDENTIAL_NAMES.has(upper)) {
+                add(value);
+            }
+            for (const credential of urlCredentials(value)) {
+                known.add(credential);
+            }
+        }
+    };
+    env(options.env);
+    for (const server of options.mcpServers ?? []) {
+        if (!("type" in server)) {
+            env(server.env);
+            continue;
+        }
+        for (const [name, value] of Object.entries(server.headers ?? {})) {
+            const upper = name.toUpperCase();
+            const authorization = AUTH_HEADERS.has(upper);
+            if (authorization || CREDENTIAL_WORDS.has(upper.split("-").at(-1) ?? "")) {
+                add(value);
+            }
+            if (authorization) {
+                add(/^\s*\S+\s+(.+?)\s*$/u.exec(value)?.[1]);
+            }
+        }
+    }
+    let values = [...known].toSorted((left, right) => right.length - left.length);
+    const redact = (text) => values.reduce((result, value) => result.replaceAll(value, "[redacted]"), text);
+    return {
+        add(value) {
+            if (credentialValue(value) && !known.has(value)) {
+                known.add(value);
+                values = [...known].toSorted((left, right) => right.length - left.length);
+            }
+        },
+        redact,
+        // Most records contain no credentials. Avoid traversing at all without known
+        // values, and preserve the original object when the scan finds no match.
+        redactValue: (value) => values.length === 0 ? value : redactText(value, redact, (text) => values.some((knownValue) => text.includes(knownValue))),
+    };
+}
+//# sourceMappingURL=credential-redactor.js.map

package/dist/shared/credential-redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-redactor.js","sourceRoot":"","sources":["../../src/shared/credential-redactor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AACzJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC;AACvE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AACjD,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,SAAS,eAAe,CAAC,KAAgC;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvG,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,KAAgC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAChH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,2EAA2E,CAAC,CAAC;IAClJ,OAAO,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC;AAC9F,CAAC;AAQD,gGAAgG;AAChG,MAAM,UAAU,yBAAyB,CAAC,OAAgC;IACxE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,KAAgC,EAAQ,EAAE,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC;IAC9G,MAAM,GAAG,GAAG,CAAC,OAA8B,EAAQ,EAAE;QACnD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YACvG,KAAK,MAAM,UAAU,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC;IACF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,aAAa,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YACzF,IAAI,aAAa,EAAE,CAAC;gBAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;IACxH,OAAO;QACL,GAAG,CAAC,KAAK;YACP,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACjB,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QACD,MAAM;QACN,6EAA6E;QAC7E,yEAAyE;QACzE,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;KAClJ,CAAC;AACJ,CAAC"}

package/dist/shared/failure-class.d.ts

@@ -1,8 +1,7 @@
-import type { CredentialProblem, FailureClass } from "../contracts/session.js";
-/** A failed outcome's classification: the class, and the credential problem and HTTP status where the runtime said them. */
+import type { FailureClass } from "../contracts/session.js";
+/** A failed outcome's classification: the class, and the HTTP status where the runtime said it. */
 export interface Classified {
     readonly failure: FailureClass;
-    readonly credential?: CredentialProblem;
     readonly status?: number;
 }
 /**

package/dist/shared/failure-class.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"failure-class.d.ts","sourceRoot":"","sources":["../../src/shared/failure-class.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAW/E,4HAA4H;AAC5H,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAW9D;AA6BD,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAEtE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAQvE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CActE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CA2B5D"}
+{"version":3,"file":"failure-class.d.ts","sourceRoot":"","sources":["../../src/shared/failure-class.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAW5D,mGAAmG;AACnG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAW9D;AA6BD,gGAAgG;AAChG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAEtE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAQvE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CActE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CA2B5D"}

package/dist/shared/failure-class.js.map

@@ -1 +1 @@
-{"version":3,"file":"failure-class.js","sourceRoot":"","sources":["../../src/shared/failure-class.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAiBhD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG,CAAC,CAAC,OAAO,iBAAiB,CAAC;QACnC,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,CAAC;QACxB,KAAK,GAAG,CAAC,CAAC,OAAO,SAAS,CAAC;QAC3B,KAAK,GAAG,CAAC,CAAC,OAAO,mBAAmB,CAAC;QACrC,KAAK,GAAG,CAAC,CAAC,OAAO,cAAc,CAAC;QAChC,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,CAAC,CAAC,OAAO,YAAY,CAAC;QAC9B,OAAO,CAAC,CAAC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAoD;IACnE,eAAe,EAAE,MAAM;IACvB,eAAe,EAAE,mBAAmB;IACpC,mBAAmB,EAAE,cAAc;IACnC,kBAAkB,EAAE,OAAO;IAC3B,iCAAiC,EAAE,OAAO;IAC1C,mBAAmB,EAAE,OAAO;IAC5B,kBAAkB,EAAE,OAAO;IAC3B,wBAAwB,EAAE,SAAS;IACnC,uBAAuB,EAAE,iBAAiB;IAC1C,oBAAoB,EAAE,YAAY;IAClC,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,mBAAmB;IACpC,gBAAgB,EAAE,cAAc;IAChC,aAAa,EAAE,SAAS;IACxB,gBAAgB,EAAE,YAAY;IAC9B,SAAS,EAAE,UAAU;IACrB,YAAY,EAAE,UAAU;IACxB,qBAAqB,EAAE,iBAAiB;CACzC,CAAC;AAEF,gGAAgG;AAChG,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC3C,OAAO,kBAAkB,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,yHAAyH,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3I,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,iIAAiI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnJ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"failure-class.js","sourceRoot":"","sources":["../../src/shared/failure-class.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAgBhD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG,CAAC,CAAC,OAAO,iBAAiB,CAAC;QACnC,KAAK,GAAG,CAAC,CAAC,OAAO,MAAM,CAAC;QACxB,KAAK,GAAG,CAAC,CAAC,OAAO,SAAS,CAAC;QAC3B,KAAK,GAAG,CAAC,CAAC,OAAO,mBAAmB,CAAC;QACrC,KAAK,GAAG,CAAC,CAAC,OAAO,cAAc,CAAC;QAChC,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,CAAC,CAAC,OAAO,YAAY,CAAC;QAC9B,OAAO,CAAC,CAAC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAoD;IACnE,eAAe,EAAE,MAAM;IACvB,eAAe,EAAE,mBAAmB;IACpC,mBAAmB,EAAE,cAAc;IACnC,kBAAkB,EAAE,OAAO;IAC3B,iCAAiC,EAAE,OAAO;IAC1C,mBAAmB,EAAE,OAAO;IAC5B,kBAAkB,EAAE,OAAO;IAC3B,wBAAwB,EAAE,SAAS;IACnC,uBAAuB,EAAE,iBAAiB;IAC1C,oBAAoB,EAAE,YAAY;IAClC,oBAAoB,EAAE,MAAM;IAC5B,eAAe,EAAE,mBAAmB;IACpC,gBAAgB,EAAE,cAAc;IAChC,aAAa,EAAE,SAAS;IACxB,gBAAgB,EAAE,YAAY;IAC9B,SAAS,EAAE,UAAU;IACrB,YAAY,EAAE,UAAU;IACxB,qBAAqB,EAAE,iBAAiB;CACzC,CAAC;AAEF,gGAAgG;AAChG,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;QAC3C,OAAO,kBAAkB,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,yHAAyH,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3I,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,iIAAiI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnJ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/shared/mcp-servers.d.ts

@@ -16,12 +16,7 @@ export declare function givenMcpServers(servers: readonly McpServer[] | undefine
  * would silently replace the earlier one). The error names the value.
  */
 export declare function checkMcpServerNames(servers: readonly McpServer[]): void;
-/**
- * A redactor for text oar reports from a runtime that was given these
- * entries (an error message, a stderr tail): every `env` and `headers` value
- * of at least four characters becomes `[redacted]`. Identity when the
- * entries hold none.
- */
+/** The same credential-name, length and path rules used for retained session records. */
 export declare function mcpCredentialRedactor(servers: readonly McpServer[] | undefined): (text: string) => string;
 /**
  * `error` with its message and stack passed through `redact`, and so every

package/dist/shared/mcp-servers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-servers.d.ts","sourceRoot":"","sources":["../../src/shared/mcp-servers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAQzD,sFAAsF;AACtF,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC1E,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAE/D,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,IAAI,aAAa,CAE1E;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,SAAS,EAAE,GAAG,IAAI,CAWtG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAYvE;AAWD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAMzG;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAUrF"}
+{"version":3,"file":"mcp-servers.d.ts","sourceRoot":"","sources":["../../src/shared/mcp-servers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAQzD,sFAAsF;AACtF,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC1E,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAE/D,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,IAAI,aAAa,CAE1E;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAE5D;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,SAAS,EAAE,GAAG,IAAI,CAWtG;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAYvE;AAED,yFAAyF;AACzF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAEzG;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAUrF"}

package/dist/shared/mcp-servers.js

@@ -1,3 +1,4 @@
+import { sessionCredentialRedactor } from "./credential-redactor.js";
 import { UnsupportedOptionError } from "../contracts/errors.js";
 export function isHttpMcpServer(server) {
     return "type" in server;
@@ -37,25 +38,9 @@ export function checkMcpServerNames(servers) {
         seen.add(name);
     }
 }
-/** Shorter values cannot be a credential, and replacing them would garble the text around them (`code 1`). */
-const CREDENTIAL_MIN_LENGTH = 4;
-/** Every credential value in the entries: each `env` and `headers` value, longest first. */
-function credentialValues(servers) {
-    const values = servers.flatMap((server) => Object.values((isHttpMcpServer(server) ? server.headers : server.env) ?? {}));
-    return [...new Set(values.filter((value) => typeof value === "string" && value.length >= CREDENTIAL_MIN_LENGTH))].toSorted((left, right) => right.length - left.length);
-}
-/**
- * A redactor for text oar reports from a runtime that was given these
- * entries (an error message, a stderr tail): every `env` and `headers` value
- * of at least four characters becomes `[redacted]`. Identity when the
- * entries hold none.
- */
+/** The same credential-name, length and path rules used for retained session records. */
 export function mcpCredentialRedactor(servers) {
-    const values = credentialValues(servers ?? []);
-    if (values.length === 0) {
-        return (text) => text;
-    }
-    return (text) => values.reduce((redacted, value) => redacted.replaceAll(value, "[redacted]"), text);
+    return sessionCredentialRedactor({ mcpServers: servers ?? [] }).redact;
 }
 /**
  * `error` with its message and stack passed through `redact`, and so every

package/dist/shared/mcp-servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-servers.js","sourceRoot":"","sources":["../../src/shared/mcp-servers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAchE,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,MAAM,IAAI,MAAM,CAAC;AAC1B,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/F,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,OAAyC;IACvE,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,MAAM,IAAI,sBAAsB,CAAC,YAAY,EAAE,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,yEAAyE,CAAC,CAAC;gBAChL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC;AAED,8GAA8G;AAC9G,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,4FAA4F;AAC5F,SAAS,gBAAgB,CAAC,OAA6B;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1K,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAyC;IAC7E,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,MAAgC;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAS,CAAC;IAC9B,KAAK,IAAI,OAAO,GAAY,KAAK,EAAE,OAAO,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3G,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"mcp-servers.js","sourceRoot":"","sources":["../../src/shared/mcp-servers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAchE,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,MAAM,IAAI,MAAM,CAAC;AAC1B,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,MAAiB;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/F,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,OAAyC;IACvE,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,MAAM,IAAI,sBAAsB,CAAC,YAAY,EAAE,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,yEAAyE,CAAC,CAAC;gBAChL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CAAC,OAAyC;IAC7E,OAAO,yBAAyB,CAAC,EAAE,UAAU,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,MAAgC;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAS,CAAC;IAC9B,KAAK,IAAI,OAAO,GAAY,KAAK,EAAE,OAAO,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3G,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/shared/native-error.d.ts

@@ -0,0 +1,7 @@
+import { type JsonRecord } from "./json.js";
+/** Diagnostic context for a failed native call, also usable before a Session exists to hold records. */
+export declare function nativeErrorCause(method: string, native: JsonRecord, redact: (text: string) => string): {
+    readonly method: string;
+    readonly native: JsonRecord;
+};
+//# sourceMappingURL=native-error.d.ts.map

package/dist/shared/native-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-error.d.ts","sourceRoot":"","sources":["../../src/shared/native-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AActD,wGAAwG;AACxG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAE/J"}

package/dist/shared/native-error.js

@@ -0,0 +1,20 @@
+import { asRecord } from "./json.js";
+/** Only decoded protocol JSON, never an arbitrary Error, request parameters or spawn arguments. */
+function redactNative(value, redact) {
+    if (typeof value === "string") {
+        return redact(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactNative(entry, redact));
+    }
+    const record = asRecord(value);
+    return record === null ? value : redactRecord(record, redact);
+}
+function redactRecord(record, redact) {
+    return Object.fromEntries(Object.entries(record).map(([key, value]) => [redact(key), redactNative(value, redact)]));
+}
+/** Diagnostic context for a failed native call, also usable before a Session exists to hold records. */
+export function nativeErrorCause(method, native, redact) {
+    return { method, native: redactRecord(native, redact) };
+}
+//# sourceMappingURL=native-error.js.map

package/dist/shared/native-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-error.js","sourceRoot":"","sources":["../../src/shared/native-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAmB,MAAM,WAAW,CAAC;AAEtD,mGAAmG;AACnG,SAAS,YAAY,CAAC,KAAc,EAAE,MAAgC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAChG,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,MAAkB,EAAE,MAAgC;IACxE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAkB,EAAE,MAAgC;IACnG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/dist/shared/redact-text.d.ts

@@ -0,0 +1,3 @@
+/** Copy diagnostic data, including Error fields and cause chains, replacing known strings without mutating native inputs. */
+export declare function redactText<T>(value: T, redact: (text: string) => string, contains: (text: string) => boolean): T;
+//# sourceMappingURL=redact-text.d.ts.map

package/dist/shared/redact-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-text.d.ts","sourceRoot":"","sources":["../../src/shared/redact-text.ts"],"names":[],"mappings":"AACA,6HAA6H;AAC7H,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,CAAC,CA+ChH"}

package/dist/shared/redact-text.js

@@ -0,0 +1,71 @@
+/* oxlint-disable import/prefer-default-export -- Shared named helper. */
+/** Copy diagnostic data, including Error fields and cause chains, replacing known strings without mutating native inputs. */
+export function redactText(value, redact, contains) {
+    const scanned = new Set();
+    const matches = (entry) => {
+        if (typeof entry === "string") {
+            return contains(entry);
+        }
+        if (entry === null || typeof entry !== "object" || scanned.has(entry)) {
+            return false;
+        }
+        scanned.add(entry);
+        if (Array.isArray(entry)) {
+            return entry.some((item) => matches(item));
+        }
+        return Object.getOwnPropertyNames(entry).some((key) => {
+            if (contains(key)) {
+                return true;
+            }
+            const descriptor = Object.getOwnPropertyDescriptor(entry, key);
+            if (descriptor !== undefined && "value" in descriptor) {
+                return matches(descriptor.value);
+            }
+            return entry instanceof Error && key === "stack" && matches(entry.stack);
+        });
+    };
+    if (!matches(value)) {
+        return value;
+    }
+    const seen = new Map();
+    const copy = (entry) => {
+        if (typeof entry === "string") {
+            return redact(entry);
+        }
+        if (entry === null || typeof entry !== "object") {
+            return entry;
+        }
+        if (seen.has(entry)) {
+            return seen.get(entry);
+        }
+        if (Array.isArray(entry)) {
+            const result = [];
+            seen.set(entry, result);
+            for (const item of entry) {
+                result.push(copy(item));
+            }
+            return result;
+        }
+        // Keep native Error classes (notably RuntimeFailureError) and non-enumerable
+        // message/stack/cause, even for frozen SDK errors. Never unwrap spawn errors.
+        // oxlint-disable-next-line typescript/no-unsafe-assignment, typescript/no-unsafe-argument -- Object's reflection API is untyped; preserve the native Error brand and its class prototype.
+        const result = entry instanceof Error ? Object.setPrototypeOf(new Error(redact(entry.message)), Object.getPrototypeOf(entry)) : {};
+        seen.set(entry, result);
+        for (const key of Object.getOwnPropertyNames(entry)) {
+            const descriptor = Object.getOwnPropertyDescriptor(entry, key);
+            if (descriptor !== undefined && "value" in descriptor) {
+                Object.defineProperty(result, redact(key), { ...descriptor, value: copy(descriptor.value) });
+            }
+            else if (entry instanceof Error && key === "stack" && typeof entry.stack === "string") {
+                // Node 24 exposes the lazily computed stack as an accessor. Copy its
+                // redacted text, never a getter closing over the original Error.
+                Object.defineProperty(result, "stack", { value: redact(entry.stack), configurable: true, writable: true });
+            }
+        }
+        return result;
+    };
+    // Text leaves keep their types; only strings change, never the structure's kinds.
+    // oxlint-disable-next-line typescript/consistent-type-assertions, typescript/no-unsafe-type-assertion -- The recursive copy preserves scalar types, descriptors and array/object structure.
+    return copy(value);
+}
+//# sourceMappingURL=redact-text.js.map

package/dist/shared/redact-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-text.js","sourceRoot":"","sources":["../../src/shared/redact-text.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,6HAA6H;AAC7H,MAAM,UAAU,UAAU,CAAI,KAAQ,EAAE,MAAgC,EAAE,QAAmC;IAC3G,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,KAAc,EAAW,EAAE;QAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QACxF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QACzE,OAAO,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACpD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YACnC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;gBAAC,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAC5F,OAAO,KAAK,YAAY,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAW,EAAE;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAClE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAC,CAAC;YACtD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,6EAA6E;QAC7E,8EAA8E;QAC9E,0LAA0L;QAC1L,MAAM,MAAM,GAAW,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3I,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;gBACtD,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/F,CAAC;iBAAM,IAAI,KAAK,YAAY,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxF,qEAAqE;gBACrE,iEAAiE;gBACjE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7G,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,kFAAkF;IAClF,4LAA4L;IAC5L,OAAO,IAAI,CAAC,KAAK,CAAM,CAAC;AAC1B,CAAC"}

package/dist/shared/seal-session.js

@@ -81,7 +81,7 @@ export function sealSession(adapterSession) {
         model: () => modelOf(adapterSession.records(), adapterSession.id),
         effort: () => effortOf(adapterSession.records(), adapterSession.id),
         serviceTier: () => serviceTierOf(adapterSession.records(), adapterSession.id),
-        usage: () => usageOf(adapterSession.records(), adapterSession.id),
+        usage: () => usageOf(adapterSession.records(), adapterSession.id, adapterSession.graph()),
         contextUsage: () => contextUsageOf(adapterSession.records(), adapterSession.id),
         status: () => statusOf(adapterSession.records(), adapterSession.id),
         steerOrQueue,

package/dist/shared/seal-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"seal-session.js","sourceRoot":"","sources":["../../src/shared/seal-session.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,QAAQ,GAAG,CAAC,UAAwB,EAAE,EAAgB,EAAE;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAClE,IAAI,CAAC,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IAC1E,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AAEH,MAAM,UAAU,WAAW,CAAC,cAA8B;IACxD,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,OAAsB,EAA2B,EAAE,CACtF,gBAAgB,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,6EAA6E;IAC7E,0EAA0E;IAC1E,mCAAmC;IACnC,MAAM,WAAW,GAA+C,cAAc,CAAC;IAC/E,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,YAAY,KAAK,SAAS;QACtC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,EAAE,KAAa,EAAE,OAAsB,EAA2B,EAAE,CACzE,gBAAgB,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,KAAK,EAAE,KAAa,EAAE,OAAsB,EAA2B,EAAE,CACrF,gBAAgB,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,eAAe,KAAK,SAAS;QAC5C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,EAAE,OAAe,EAA2B,EAAE,CAAC,gBAAgB,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,KAAK,IAA6B,EAAE,CAAC,gBAAgB,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;IAClG,MAAM,YAAY,GAAG,KAAK,EAAE,KAAa,EAAE,OAAsB,EAA+B,EAAE;QAChG,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU;YAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;YACtC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvF,CAAC,CAAC;IACF,MAAM,MAAM,GAAY;QACtB,GAAG,WAAW;QACd,MAAM;QACN,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,KAAK;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,KAAK;QACL,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;YAC/C,MAAM,MAAM,GAAG,QAAQ,KAAK,KAAK;gBAC/B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,OAAO,cAAc,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACjE,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACnE,WAAW,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7E,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACjE,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACnE,YAAY;QACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1G,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"seal-session.js","sourceRoot":"","sources":["../../src/shared/seal-session.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,QAAQ,GAAG,CAAC,UAAwB,EAAE,EAAgB,EAAE;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAClE,IAAI,CAAC,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IAC1E,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AAEH,MAAM,UAAU,WAAW,CAAC,cAA8B;IACxD,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,OAAsB,EAA2B,EAAE,CACtF,gBAAgB,CAAC,MAAM,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,6EAA6E;IAC7E,0EAA0E;IAC1E,mCAAmC;IACnC,MAAM,WAAW,GAA+C,cAAc,CAAC;IAC/E,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,YAAY,KAAK,SAAS;QACtC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,EAAE,KAAa,EAAE,OAAsB,EAA2B,EAAE,CACzE,gBAAgB,CAAC,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,KAAK,EAAE,KAAa,EAAE,OAAsB,EAA2B,EAAE,CACrF,gBAAgB,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,eAAe,KAAK,SAAS;QAC5C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,EAAE,OAAe,EAA2B,EAAE,CAAC,gBAAgB,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,KAAK,IAA6B,EAAE,CAAC,gBAAgB,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;IAClG,MAAM,YAAY,GAAG,KAAK,EAAE,KAAa,EAAE,OAAsB,EAA+B,EAAE;QAChG,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU;YAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;YACtC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvF,CAAC,CAAC;IACF,MAAM,MAAM,GAAY;QACtB,GAAG,WAAW;QACd,MAAM;QACN,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACzC,KAAK;QACL,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,KAAK;QACL,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;YAC/C,MAAM,MAAM,GAAG,QAAQ,KAAK,KAAK;gBAC/B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,OAAO,cAAc,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACjE,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACnE,WAAW,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7E,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC;QACzF,YAAY,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC;QACnE,YAAY;QACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1G,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/shared/session-credentials.d.ts

@@ -0,0 +1,11 @@
+import type { AvailableInstallation } from "../contracts/installation.js";
+import type { AdapterSession, Session, SessionOptions, StartSession } from "../contracts/session.js";
+import { type CredentialRedactor } from "./credential-redactor.js";
+import { type SessionKernel } from "./session-kernel.js";
+export interface SessionCredentials extends CredentialRedactor {
+    kernel(id: string): SessionKernel;
+    seal(adapter: AdapterSession): Session;
+}
+/** Keep opening failures and later adapter errors under the same session credential rules as the record stream. */
+export declare function withSessionCredentials(open: (installation: AvailableInstallation, options: SessionOptions, credentials: SessionCredentials) => Promise<Session>): StartSession;
+//# sourceMappingURL=session-credentials.d.ts.map

package/dist/shared/session-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-credentials.d.ts","sourceRoot":"","sources":["../../src/shared/session-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrG,OAAO,EAA6B,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;CACxC;AA4BD,mHAAmH;AACnH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,qBAAqB,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,YAAY,CAM9K"}

package/dist/shared/session-credentials.js

@@ -0,0 +1,45 @@
+import { sessionCredentialRedactor } from "./credential-redactor.js";
+import { sealSession } from "./seal-session.js";
+import { createSessionKernel } from "./session-kernel.js";
+/** Credentials supplied for this session, plus native keys the adapter resolves. No inherited environment or credential-file scan. */
+function sessionCredentials(options) {
+    const { add, redact, redactValue } = sessionCredentialRedactor(options);
+    const guard = (method) => async (...args) => {
+        try {
+            return await method(...args);
+        }
+        catch (error) {
+            throw redactValue(error);
+        }
+    };
+    return {
+        add,
+        redact,
+        redactValue,
+        kernel: (id) => createSessionKernel(id, redactValue),
+        seal: (adapter) => sealSession({
+            ...adapter,
+            prompt: guard(adapter.prompt.bind(adapter)),
+            queue: guard(adapter.queue.bind(adapter)),
+            ...(adapter.steer === undefined ? {} : { steer: guard(adapter.steer.bind(adapter)) }),
+            ...(adapter.withdraw === undefined ? {} : { withdraw: guard(adapter.withdraw.bind(adapter)) }),
+            abort: guard(adapter.abort.bind(adapter)),
+            dispose: guard(adapter.dispose.bind(adapter)),
+            ...(adapter.contextBreakdown === undefined ? {} : { contextBreakdown: guard(adapter.contextBreakdown.bind(adapter)) }),
+            ...(adapter.resources === undefined ? {} : { resources: guard(adapter.resources.bind(adapter)) }),
+        }),
+    };
+}
+/** Keep opening failures and later adapter errors under the same session credential rules as the record stream. */
+export function withSessionCredentials(open) {
+    return async (installation, options) => {
+        const credentials = sessionCredentials(options);
+        try {
+            return await open(installation, options, credentials);
+        }
+        catch (error) {
+            throw credentials.redactValue(error);
+        }
+    };
+}
+//# sourceMappingURL=session-credentials.js.map

package/dist/shared/session-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-credentials.js","sourceRoot":"","sources":["../../src/shared/session-credentials.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAA2B,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAO9E,sIAAsI;AACtI,SAAS,kBAAkB,CAAC,OAAuB;IACjD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,CAAiC,MAA0C,EAAwC,EAAE,CACjI,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;QAChB,IAAI,CAAC;YAAC,OAAO,MAAM,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IACnF,CAAC,CAAC;IACJ,OAAO;QACL,GAAG;QACH,MAAM;QACN,WAAW;QACX,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,WAAW,CAAC;QACpD,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC;YAC7B,GAAG,OAAO;YACV,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3C,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC9F,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtH,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;SAClG,CAAC;KACH,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,sBAAsB,CAAC,IAAyH;IAC9J,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC;YAAC,OAAO,MAAM,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAAC,CAAC;QAC9D,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC"}

package/dist/shared/session-kernel.d.ts

@@ -75,5 +75,6 @@ export interface SessionKernel {
     /** Add a session node whose lineage is not (yet) known: an id seen on the wire without an explaining edge. Never fabricate the edge. */
     node(id: string): void;
 }
-export declare function createSessionKernel(sessionId?: string): SessionKernel;
+/** An optional session credential redactor runs before retention and observer delivery; native command inputs remain unchanged. */
+export declare function createSessionKernel(sessionId?: string, redact?: <T extends RawEvent>(record: T) => T): SessionKernel;
 //# sourceMappingURL=session-kernel.d.ts.map