@code-yeongyu/senpi 2026.11.6-1 → 2026.11.6-2

package/dist/cli/session-opening.js

@@ -1,5 +1,5 @@
 import chalk from "chalk";
-import { sessionHolderWarning } from "../core/foreign-session-holders.js";
+import { checkSessionHolders, describeSessionHolders, SESSION_HOLDER_LOOKUP_FAILED, sessionHolderWarning, stopSessionHolders, takeOverRefusal, } from "../core/foreign-session-holders.js";
 /** Warn after the runtime publishes its holder; an advisory lookup must not abort startup. */
 export async function prepareSessionOpening(manager, mode) {
     if (mode === "interactive") {
@@ -8,4 +8,50 @@ export async function prepareSessionOpening(manager, mode) {
             console.error(chalk.yellow(`Warning: ${warning}`));
     }
 }
+/**
+ * Exit code of a startup refused because another live process holds the session. The schedule runner reads it to
+ * leave the occurrence pending instead of failing it (senpi#5756).
+ */
+export const SESSION_HELD_EXIT_CODE = 76;
+const RETRY = "then open it again";
+/**
+ * Startup admission for a session another live process holds (senpi#5756, the startup path of #5744): opening it
+ * would start a second run of the same session. Without a person to ask it is refused with the holder named; on a
+ * terminal the person chooses to cancel or to take over (the holder is asked to exit first, as /resume does).
+ */
+export async function admitStartupSession(sessionFile, io) {
+    if (sessionFile === undefined)
+        return "open";
+    const check = await (io.lookup ?? checkSessionHolders)(sessionFile);
+    if ("lookupFailed" in check) {
+        io.err(chalk.yellow(`Warning: ${SESSION_HOLDER_LOOKUP_FAILED}`));
+        return "open";
+    }
+    const { holders } = check;
+    if (holders.length === 0)
+        return "open";
+    const held = `This session is open in another process (${describeSessionHolders(holders)}); opening it here would start a second run of the same session.`;
+    const refusal = takeOverRefusal(holders, RETRY);
+    if (!io.canAsk || refusal !== undefined) {
+        io.err(chalk.red(`Not opened: ${held} ${refusal ?? `Quit it there, ${RETRY}.`}`));
+        return "refused";
+    }
+    if (!(await io.confirm(`${held}\nTake over (stop it there)?`))) {
+        io.err(`Not opened: the session is open in another process (${describeSessionHolders(holders)}).`);
+        return "cancelled";
+    }
+    let stopped;
+    try {
+        stopped = await stopSessionHolders(sessionFile, holders);
+    }
+    catch (error) {
+        io.err(chalk.red(`Not opened: could not stop the other process (${error instanceof Error ? error.message : String(error)}).`));
+        return "refused";
+    }
+    if (!stopped) {
+        io.err(chalk.red(`Not opened: the session is still open in another process; quit it there, ${RETRY}.`));
+        return "refused";
+    }
+    return "open";
+}
 //# sourceMappingURL=session-opening.js.map

package/dist/core/agent-session-runtime.d.ts

@@ -143,6 +143,11 @@ export declare class AgentSessionRuntime {
     private syncFullAccessTrust;
     /** Settles when the rebuild that followed a Full-access trust change has finished. */
     get projectTrustChange(): Promise<void>;
+    /**
+     * Runs `task` after every trust change already started here and before any started later (senpi#6176), so an
+     * explicit trust decision and a Full access sync never read each other's saved value mid-change.
+     */
+    runInProjectTrustChangeOrder<T>(task: () => Promise<T>): Promise<T>;
     private _projectTrustChange;
     /** Failed trust rebuilds; kept across session replacement so the error stays visible. */
     private _trustChangeDiagnostics;
@@ -208,12 +213,19 @@ export declare class AgentSessionRuntime {
     importFromJsonl(inputPath: string, cwdOverride?: string): Promise<{
         cancelled: boolean;
     }>;
+    /**
+     * Abort the active run, waiting at most the #3711 quit budget. Arming the budget first makes this wait count
+     * against the same total the `session_shutdown` handlers share, so a turn held by an extension cannot delay quit
+     * past it.
+     */
+    private endActiveRunWithinQuitBudget;
     /**
      * `processExit`: the caller exits the process right after, so quit-time handlers share the total quit budget
      * (senpi#3711). An RPC host closing one session leaves it unset and keeps only the per-handler limits.
      */
     dispose(options?: {
         readonly processExit?: boolean;
+        readonly endActiveRun?: boolean;
     }): Promise<void>;
 }
 /**

package/dist/core/agent-session-runtime.js

@@ -157,6 +157,15 @@ export class AgentSessionRuntime {
     get projectTrustChange() {
         return this._projectTrustChange;
     }
+    /**
+     * Runs `task` after every trust change already started here and before any started later (senpi#6176), so an
+     * explicit trust decision and a Full access sync never read each other's saved value mid-change.
+     */
+    runInProjectTrustChangeOrder(task) {
+        const run = this._projectTrustChange.then(task);
+        this._projectTrustChange = run.then(() => undefined, () => undefined);
+        return run;
+    }
     /**
      * Gives this process's sessions their fallback policy (`set_retry_fallback`); later replacements
      * (switch, new, fork) keep it. Callers set it before the first turn: a chain never changes under a
@@ -516,11 +525,43 @@ export class AgentSessionRuntime {
         await this.finishSessionReplacement();
         return { cancelled: false };
     }
+    /**
+     * Abort the active run, waiting at most the #3711 quit budget. Arming the budget first makes this wait count
+     * against the same total the `session_shutdown` handlers share, so a turn held by an extension cannot delay quit
+     * past it.
+     */
+    async endActiveRunWithinQuitBudget(processExit) {
+        if (processExit)
+            this.session.extensionRunner.armProcessExitBudget();
+        const budgetMs = this.services.settingsManager.getSessionShutdownQuitBudgetMs();
+        if (budgetMs === 0) {
+            await this.session.abort();
+            return;
+        }
+        let timer;
+        try {
+            await Promise.race([
+                this.session.abort(),
+                new Promise((resolve) => {
+                    timer = setTimeout(resolve, budgetMs);
+                }),
+            ]);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+    }
     /**
      * `processExit`: the caller exits the process right after, so quit-time handlers share the total quit budget
      * (senpi#3711). An RPC host closing one session leaves it unset and keeps only the per-handler limits.
      */
     async dispose(options = {}) {
+        // A person quitting ends the active run first, as teardownCurrent() does (senpi#5753). Otherwise
+        // `session_shutdown` tears extension resources down under a running tool and the loop sends that failure
+        // to the model in one more request. Host closes keep their own bounded abort handling.
+        if (options.endActiveRun === true)
+            await this.endActiveRunWithinQuitBudget(options.processExit === true);
         await emitSessionShutdownEvent(this.session.extensionRunner, { type: "session_shutdown", reason: "quit" }, options);
         this.beforeSessionInvalidate?.();
         this.session.dispose();

package/dist/core/agent-session.js

@@ -18,6 +18,7 @@ import { rm } from "node:fs/promises";
 import { dirname } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { bindPipelineWitness } from "./execution/pipeline-witness.js";
+import { runExecuteToolOnHost } from "./execute-tool-on-host.js";
 import { carryPreflightFacts } from "./execution/preflight-carry.js";
 import { ProviderRetryWatchdogAbortError, prepareAgentToolCall, resolveToolNameAlias, runToolCall, } from "@earendil-works/pi-agent-core";
 import { localDeviceFiles } from "@earendil-works/pi-agent-core/node";
@@ -3859,31 +3860,21 @@ export class AgentSession {
         if (beforeResult?.block) {
             throw new ExecuteToolError("blocked", toolName, beforeResult.reason || "Tool execution was blocked", activeTools);
         }
-        let result;
-        let isError = false;
-        try {
-            result = await prepared.tool.execute(prepared.toolCall.id, prepared.args, options?.signal, options?.onUpdate);
-            isError = result.isError === true;
-        }
-        catch (err) {
-            result = {
-                content: [
-                    {
-                        type: "text",
-                        text: err instanceof Error ? err.message : String(err),
-                    },
-                ],
-                details: { isError: true },
-            };
-            isError = true;
-        }
-        const hookResult = await this._emitAfterToolCallHooks(prepared.toolCall, prepared.args, result, isError);
-        if (!hookResult) {
+        const { result, hook } = await runExecuteToolOnHost({
+            agent: this.agent,
+            afterHooks: (call, result, isError) => this._emitAfterToolCallHooks(call.toolCall, call.args, result, isError),
+        }, prepared, {
+            ...(options?.signal === undefined ? {} : { signal: options.signal }),
+            ...(options?.onUpdate === undefined
+                ? {}
+                : { onUpdate: options.onUpdate }),
+        });
+        if (!hook) {
             return result;
         }
         return {
-            content: hookResult.content ?? result.content,
-            details: (hookResult.details ?? result.details),
+            content: hook.content ?? result.content,
+            details: (hook.details ?? result.details),
             terminate: result.terminate,
         };
     }

package/dist/core/egress/api-table.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Per-api facts the custody route decision reads (custody design 2.3 and 5, row CK5).
+ *
+ * `capability` says where a call of this api can run; `fetchInjection` is "yes" only when every
+ * request of the api goes through the `fetch` the caller injects (otherwise the sealed route could
+ * not supply the key below the seam, so the call goes to a device); `sdkLogging` is the knob that
+ * turns the api's SDK logging off. An api missing from the table (an extension-registered one) is
+ * treated as an ambient-credential api with unknown fetch injection, which routes it to a device.
+ */
+import type { ProviderCapability } from "./classify.ts";
+export type FetchInjection = "yes" | "no" | "unknown";
+export type SdkLoggingKnob = {
+    readonly kind: "none";
+} | {
+    readonly kind: "client-option";
+    readonly option: "logLevel";
+    readonly off: "off";
+} | {
+    readonly kind: "unknown";
+};
+export interface ApiFacts {
+    readonly capability: ProviderCapability;
+    readonly fetchInjection: FetchInjection;
+    readonly sdkLogging: SdkLoggingKnob;
+}
+export declare const API_FACTS: {
+    readonly "openai-completions": {
+        readonly capability: "cloud";
+        readonly fetchInjection: "yes";
+        readonly sdkLogging: {
+            readonly kind: "client-option";
+            readonly option: "logLevel";
+            readonly off: "off";
+        };
+    };
+    readonly "openai-responses": {
+        readonly capability: "cloud";
+        readonly fetchInjection: "no";
+        readonly sdkLogging: {
+            readonly kind: "client-option";
+            readonly option: "logLevel";
+            readonly off: "off";
+        };
+    };
+    readonly "azure-openai-responses": {
+        readonly capability: "cloud";
+        readonly fetchInjection: "yes";
+        readonly sdkLogging: {
+            readonly kind: "client-option";
+            readonly option: "logLevel";
+            readonly off: "off";
+        };
+    };
+    readonly "openai-codex-responses": {
+        readonly capability: "cloud";
+        readonly fetchInjection: "no";
+        readonly sdkLogging: {
+            readonly kind: "none";
+        };
+    };
+    readonly "mistral-conversations": {
+        readonly capability: "cloud";
+        readonly fetchInjection: "yes";
+        readonly sdkLogging: {
+            readonly kind: "none";
+        };
+    };
+    readonly "anthropic-messages": {
+        readonly capability: "cloud";
+        readonly fetchInjection: "yes";
+        readonly sdkLogging: {
+            readonly kind: "client-option";
+            readonly option: "logLevel";
+            readonly off: "off";
+        };
+    };
+    readonly "pi-messages": {
+        readonly capability: "cloud";
+        readonly fetchInjection: "yes";
+        readonly sdkLogging: {
+            readonly kind: "none";
+        };
+    };
+    readonly "google-generative-ai": {
+        readonly capability: "cloud";
+        readonly fetchInjection: "no";
+        readonly sdkLogging: {
+            readonly kind: "none";
+        };
+    };
+    readonly "google-vertex": {
+        readonly capability: "ambient-credential";
+        readonly fetchInjection: "no";
+        readonly sdkLogging: {
+            readonly kind: "none";
+        };
+    };
+    readonly "bedrock-converse-stream": {
+        readonly capability: "ambient-credential";
+        readonly fetchInjection: "no";
+        readonly sdkLogging: {
+            readonly kind: "unknown";
+        };
+    };
+    readonly "devin-agent": {
+        readonly capability: "cloud";
+        readonly fetchInjection: "no";
+        readonly sdkLogging: {
+            readonly kind: "none";
+        };
+    };
+    readonly "cursor-agent": {
+        readonly capability: "callback-stream";
+        readonly fetchInjection: "no";
+        readonly sdkLogging: {
+            readonly kind: "none";
+        };
+    };
+};
+export declare function apiFacts(api: string | undefined): ApiFacts;
+//# sourceMappingURL=api-table.d.ts.map

package/dist/core/egress/api-table.js

@@ -0,0 +1,41 @@
+/**
+ * Per-api facts the custody route decision reads (custody design 2.3 and 5, row CK5).
+ *
+ * `capability` says where a call of this api can run; `fetchInjection` is "yes" only when every
+ * request of the api goes through the `fetch` the caller injects (otherwise the sealed route could
+ * not supply the key below the seam, so the call goes to a device); `sdkLogging` is the knob that
+ * turns the api's SDK logging off. An api missing from the table (an extension-registered one) is
+ * treated as an ambient-credential api with unknown fetch injection, which routes it to a device.
+ */
+const NO_SDK_LOGGER = { kind: "none" };
+const SDK_LOG_LEVEL_OFF = { kind: "client-option", option: "logLevel", off: "off" };
+export const API_FACTS = {
+    "openai-completions": { capability: "cloud", fetchInjection: "yes", sdkLogging: SDK_LOG_LEVEL_OFF },
+    "openai-responses": { capability: "cloud", fetchInjection: "no", sdkLogging: SDK_LOG_LEVEL_OFF },
+    "azure-openai-responses": { capability: "cloud", fetchInjection: "yes", sdkLogging: SDK_LOG_LEVEL_OFF },
+    "openai-codex-responses": { capability: "cloud", fetchInjection: "no", sdkLogging: NO_SDK_LOGGER },
+    "mistral-conversations": { capability: "cloud", fetchInjection: "yes", sdkLogging: NO_SDK_LOGGER },
+    "anthropic-messages": { capability: "cloud", fetchInjection: "yes", sdkLogging: SDK_LOG_LEVEL_OFF },
+    "pi-messages": { capability: "cloud", fetchInjection: "yes", sdkLogging: NO_SDK_LOGGER },
+    "google-generative-ai": { capability: "cloud", fetchInjection: "no", sdkLogging: NO_SDK_LOGGER },
+    "google-vertex": { capability: "ambient-credential", fetchInjection: "no", sdkLogging: NO_SDK_LOGGER },
+    "bedrock-converse-stream": {
+        capability: "ambient-credential",
+        fetchInjection: "no",
+        sdkLogging: { kind: "unknown" },
+    },
+    "devin-agent": { capability: "cloud", fetchInjection: "no", sdkLogging: NO_SDK_LOGGER },
+    "cursor-agent": { capability: "callback-stream", fetchInjection: "no", sdkLogging: NO_SDK_LOGGER },
+};
+const UNKNOWN_API = {
+    capability: "ambient-credential",
+    fetchInjection: "unknown",
+    sdkLogging: { kind: "unknown" },
+};
+function isTabledApi(api) {
+    return Object.hasOwn(API_FACTS, api);
+}
+export function apiFacts(api) {
+    return api !== undefined && isTabledApi(api) ? API_FACTS[api] : UNKNOWN_API;
+}
+//# sourceMappingURL=api-table.js.map

package/dist/core/egress/classify.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Field classification for the provider surface (custody design 5, row CK5).
+ *
+ * Every field a user can author in models.json, auth.json and the credential pool has exactly one
+ * class: "public" travels as plain config inside the encrypted account config; "sealed" is a secret
+ * value sealed per field and opened only for the request that uses it; "device-only" never leaves
+ * the owner device; "endpoint" is a URL split by `splitEndpoint`. A field with no entry here has no
+ * class, and the classification tests fail on it, so a new field cannot reach the brain unreviewed.
+ */
+/** "forces-device": a value present moves the whole provider to device custody (no sealed field kind exists for it). */
+export type FieldClass = "public" | "sealed" | "device-only" | "endpoint" | "forces-device";
+export type Custody = "sealed" | "device";
+export type ProviderCapability = "cloud" | "local-only" | "ambient-credential" | "callback-stream";
+/** models.json, keyed by schema path: `.` nests, `[]` is an array item, `.{key}` a record key, `.*` a record value. */
+export declare const MODELS_JSON_FIELD_CLASSES: Readonly<Record<string, FieldClass>>;
+/** Fields the runtime types add on top of the models.json schema (`model-config.ts`). */
+export declare const MODELS_JSON_TYPE_ONLY_FIELDS: Readonly<Record<string, FieldClass>>;
+export declare function classifyModelsJsonField(path: string): FieldClass | undefined;
+//# sourceMappingURL=classify.d.ts.map

package/dist/core/egress/classify.js

@@ -0,0 +1,197 @@
+/**
+ * Field classification for the provider surface (custody design 5, row CK5).
+ *
+ * Every field a user can author in models.json, auth.json and the credential pool has exactly one
+ * class: "public" travels as plain config inside the encrypted account config; "sealed" is a secret
+ * value sealed per field and opened only for the request that uses it; "device-only" never leaves
+ * the owner device; "endpoint" is a URL split by `splitEndpoint`. A field with no entry here has no
+ * class, and the classification tests fail on it, so a new field cannot reach the brain unreviewed.
+ */
+const COST = [
+    "input",
+    "output",
+    "cacheRead",
+    "cacheWrite",
+    "tiers[].inputTokensAbove",
+    "tiers[].input",
+    "tiers[].output",
+    "tiers[].cacheRead",
+    "tiers[].cacheWrite",
+];
+const PERCENTILES = ["", ".p50", ".p75", ".p90", ".p99"];
+const COMPAT = [
+    "supportsWebSearch",
+    "supportsStore",
+    "supportsDeveloperRole",
+    "supportsReasoningEffort",
+    "supportsUsageInStreaming",
+    "supportsFinishReason",
+    "maxTokensField",
+    "requiresToolResultName",
+    "requiresAssistantAfterToolResult",
+    "requiresThinkingAsText",
+    "requiresReasoningContentOnAssistantMessages",
+    "supportsDisabledThinking",
+    "thinkingFormat",
+    "chatTemplateKwargs.{key}",
+    "chatTemplateKwargs.*",
+    "chatTemplateKwargs.*.$var",
+    "chatTemplateKwargs.*.omitWhenOff",
+    "cacheControlFormat",
+    ...[
+        "allow_fallbacks",
+        "require_parameters",
+        "data_collection",
+        "zdr",
+        "enforce_distillable_text",
+        "order[]",
+        "only[]",
+        "ignore[]",
+        "quantizations[]",
+        "sort",
+        "sort.by",
+        "sort.partition",
+        ...["prompt", "completion", "image", "audio", "request"].map((part) => `max_price.${part}`),
+        ...PERCENTILES.map((suffix) => `preferred_min_throughput${suffix}`),
+        ...PERCENTILES.map((suffix) => `preferred_max_latency${suffix}`),
+    ].map((field) => `openRouterRouting.${field}`),
+    "vercelGatewayRouting.only[]",
+    "vercelGatewayRouting.order[]",
+    "zaiToolStream",
+    "supportsStrictMode",
+    "toolCallFormat",
+    "sendSessionAffinityHeaders",
+    "deferredToolsMode",
+    "sessionAffinityFormat",
+    "supportsLongCacheRetention",
+    "supportsForcedToolChoice",
+    "webSearchToolType",
+    "supportsWebSocket",
+    "supportsRemoteCompactionV2",
+    "supportsWebSearchPreview",
+    "supportsToolSearch",
+    "supportsEagerToolInputStreaming",
+    "supportsCacheControlOnTools",
+    "supportsTemperature",
+    "supportsToolChoice",
+    "forceAdaptiveThinking",
+    "allowEmptySignature",
+    "supportsToolReferences",
+    "allowedFallbackModels[].provider",
+    "allowedFallbackModels[].model",
+    ...COST.map((field) => `allowedFallbackModels[].cost.${field}`),
+];
+const THINKING_LEVEL_MAP = ["off", "minimal", "low", "medium", "high", "xhigh", "max"].map((level) => `thinkingLevelMap.${level}`);
+const INPUT_LIMITS = [
+    "maxRequestBytes",
+    "images.resize.maxWidth",
+    "images.resize.maxHeight",
+    "images.resize.maxBytes",
+    "images.resize.jpegQuality",
+    "images.maxPerMessage",
+    "images.maxPerRequest",
+].map((field) => `inputLimits.${field}`);
+const MODEL_DEFINITION = {
+    ...fields("public", [
+        "id",
+        "name",
+        "upstreamModelId",
+        "serviceTier",
+        "promptPreset",
+        "recoverTextToolCalls",
+        "api",
+        "reasoning",
+        ...THINKING_LEVEL_MAP,
+        "defaultThinkingLevel",
+        "input[]",
+        ...INPUT_LIMITS,
+        ...COST.map((field) => `cost.${field}`),
+        "promptCache.short",
+        "promptCache.long",
+        "contextWindow",
+        "maxTokens",
+        "cacheRetention",
+        ...COMPAT.map((field) => `compat.${field}`),
+        "headers.{key}",
+        "extraBody.{key}",
+    ]),
+    baseUrl: "endpoint",
+    "headers.*": "sealed",
+    "extraBody.*": "forces-device",
+};
+const MODEL_OVERRIDE = {
+    ...fields("public", [
+        "name",
+        "promptPreset",
+        "recoverTextToolCalls",
+        "reasoning",
+        ...THINKING_LEVEL_MAP,
+        "thinkingLevelMapMode",
+        "input[]",
+        ...INPUT_LIMITS,
+        ...COMPAT.map((field) => `compat.${field}`),
+        ...COST.map((field) => `cost.${field}`),
+        "promptCache.short",
+        "promptCache.long",
+        "contextWindow",
+        "maxTokens",
+        "cacheRetention",
+        "headers.{key}",
+        "extraBody.{key}",
+    ]),
+    "headers.*": "sealed",
+    "extraBody.*": "forces-device",
+};
+const PROVIDER = {
+    ...fields("public", [
+        "name",
+        "disabled",
+        "api",
+        "headers.{key}",
+        "extraBody.{key}",
+        "cacheRetention",
+        "authHeader",
+        "whitelist[]",
+        "blacklist[]",
+        "hideFreeModels",
+        ...COMPAT.map((field) => `compat.${field}`),
+        "credentials.rotation",
+        "credentials.affinity",
+        "credentials.accountStrategy",
+        "credentials.cooldownBaseMs",
+        "credentials.cooldownCapMs",
+        "credentials.slots.{key}",
+        "modelOverrides.{key}",
+    ]),
+    baseUrl: "endpoint",
+    apiKey: "sealed",
+    "headers.*": "sealed",
+    "extraBody.*": "forces-device",
+    "credentials.slots.*.value": "sealed",
+    "credentials.slots.*.env": "device-only",
+    ...prefixed("models[].", MODEL_DEFINITION),
+    ...prefixed("modelOverrides.*.", MODEL_OVERRIDE),
+};
+/** models.json, keyed by schema path: `.` nests, `[]` is an array item, `.{key}` a record key, `.*` a record value. */
+export const MODELS_JSON_FIELD_CLASSES = {
+    "disabledProviders[]": "public",
+    "providers.{key}": "public",
+    ...prefixed("providers.*.", PROVIDER),
+};
+/** Fields the runtime types add on top of the models.json schema (`model-config.ts`). */
+export const MODELS_JSON_TYPE_ONLY_FIELDS = {
+    "providers.*.models[].samplingParams.{key}": "public",
+    "providers.*.models[].samplingParams.*": "forces-device",
+    "providers.*.modelOverrides.*.samplingParams.{key}": "public",
+    "providers.*.modelOverrides.*.samplingParams.*": "forces-device",
+};
+export function classifyModelsJsonField(path) {
+    return MODELS_JSON_FIELD_CLASSES[path] ?? MODELS_JSON_TYPE_ONLY_FIELDS[path];
+}
+function fields(fieldClass, paths) {
+    return Object.fromEntries(paths.map((path) => [path, fieldClass]));
+}
+function prefixed(prefix, table) {
+    return Object.fromEntries(Object.entries(table).map(([path, fieldClass]) => [`${prefix}${path}`, fieldClass]));
+}
+//# sourceMappingURL=classify.js.map

package/dist/core/egress/credential-fields.d.ts

@@ -0,0 +1,18 @@
+import type { FieldClass } from "./classify.ts";
+export declare const CREDENTIAL_SLOT_FIELDS: {
+    readonly name: "public";
+    readonly displayName: "device-only";
+    readonly source: "public";
+    readonly key: "sealed";
+    readonly access: "sealed";
+    readonly refresh: "device-only";
+    readonly expires: "public";
+    readonly route: "public";
+    readonly env: "forces-device";
+};
+/** A stored credential key outside the declared fields (OAuth flows may add any) keeps the credential on the device. */
+export declare function classifyCredentialField(type: "api_key" | "oauth", key: string): FieldClass;
+export type CredentialDeviceReason = "env" | "undeclared-field";
+/** Why a stored auth.json credential must be used on the device; empty when sealed custody can compose its requests. */
+export declare function credentialDeviceReasons(credential: Readonly<Record<string, unknown>>): readonly CredentialDeviceReason[];
+//# sourceMappingURL=credential-fields.d.ts.map