@copilotkit/aimock 1.44.0 → 1.45.0

package/dist/record-sanitize.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-sanitize.cjs","names":[],"sources":["../src/record-sanitize.ts"],"sourcesContent":["/**\n * Shared record sanitizer (D10, S1-S7).\n *\n * The credential-key and URL rules were moved here from `live-sanitize.ts`,\n * which imports them back unchanged. `sanitizeRecording` applies the generic\n * record rules to any JSON value (for example an `mcpFakes` recording).\n */\n\nexport const CREDENTIAL_KEY =\n  /^(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|password|secret|token|sec-websocket-protocol)$/i;\nexport const REDACTED = \"[REDACTED]\";\nexport const MIN_SECRET_LENGTH = 8;\n\n/** Thrown when a recording cannot be made safe (S6). Never carries a value. */\nexport class RecordUnsafeError extends Error {\n  constructor(readonly reason: \"secret-in-path\" | \"secret-remains\") {\n    super(`unsafe recording: ${reason}`);\n    this.name = \"RecordUnsafeError\";\n  }\n}\n\nexport function decodeUrlComponent(value: string): string {\n  // Tolerate malformed escapes while exposing encoded secrets. Protect literal\n  // form separators so the entire component remains one value.\n  return new URLSearchParams(`value=${value.replace(/\\+/g, \"%2B\").replace(/&/g, \"%26\")}`).get(\n    \"value\",\n  )!;\n}\n\n/**\n * S3: scrub one absolute URL string; non-URLs unchanged. `onPathSecret` is\n * called (and must throw) when the decoded path contains a secret.\n */\nexport function scrubUrl(\n  value: string,\n  hasSecret: (s: string) => boolean,\n  onPathSecret: () => never,\n): string {\n  // Leave non-URLs and clean URLs byte-for-byte intact.\n  if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)) return value;\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return value;\n  }\n  // A path identifies the resource; changing it could change replay semantics.\n  if (hasSecret(decodeUrlComponent(url.pathname))) onPathSecret();\n  let changed = false;\n  if (url.username || url.password) {\n    url.username = \"\";\n    url.password = \"\";\n    changed = true;\n  }\n  for (const [key, val] of [...url.searchParams]) {\n    if (CREDENTIAL_KEY.test(key) || hasSecret(key) || hasSecret(val)) {\n      url.searchParams.delete(key);\n      changed = true;\n    }\n  }\n  const decodedHash = decodeUrlComponent(url.hash);\n  if (\n    url.hash &&\n    (hasSecret(decodedHash) || /(?:token|secret|password|api[_-]?key)=/i.test(decodedHash))\n  ) {\n    url.hash = \"\";\n    changed = true;\n  }\n  return changed ? url.href : value;\n}\n\n/** S2 (d) start check: throws a plain Error naming the rule, never the value. */\nexport function validateSecretValues(values: readonly string[]): void {\n  for (const value of values) {\n    if (typeof value !== \"string\") throw new Error(\"record.secretValues entries must be strings\");\n    if (value.length < MIN_SECRET_LENGTH) {\n      throw new Error(`record.secretValues entry shorter than ${MIN_SECRET_LENGTH} characters`);\n    }\n  }\n}\n\n// Recognized API-key header names beyond the credential-key regex\n// (for example `x-goog-api-key`).\nconst API_KEY_HEADER = /(?:^|[-_])api[-_]?key$/i;\n\n/** The value, the token after the scheme, and for `Basic` the decoded user and password. */\nfunction credentialParts(value: string): string[] {\n  const parts = [value];\n  const match = /^(\\S+)\\s+(\\S.*)$/.exec(value.trim());\n  if (match) {\n    const token = match[2].trim();\n    parts.push(token);\n    if (match[1].toLowerCase() === \"basic\") {\n      const decoded = Buffer.from(token, \"base64\").toString(\"utf8\");\n      const colon = decoded.indexOf(\":\");\n      if (colon >= 0) parts.push(decoded.slice(0, colon), decoded.slice(colon + 1));\n    }\n  }\n  return parts;\n}\n\nfunction urlParts(value: string): string[] {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return [];\n  }\n  const parts: string[] = [];\n  if (url.username) parts.push(url.username, decodeUrlComponent(url.username));\n  if (url.password) parts.push(url.password, decodeUrlComponent(url.password));\n  // Every query value; path segments are names, so they are not included (S2 c).\n  for (const val of url.searchParams.values()) parts.push(val);\n  return parts;\n}\n\n/** S2 (a)-(c): secrets from forwarded headers, upstreamAuth and the upstream URL; min length 8. */\nexport function knownSecrets(input: {\n  headers: Record<string, string>;\n  upstreamAuth?: { name: string; value: string };\n  upstreamUrl: string;\n  secretValues: readonly string[];\n}): string[] {\n  const derived: string[] = [];\n  for (const [name, value] of Object.entries(input.headers)) {\n    if (typeof value !== \"string\") continue;\n    if (CREDENTIAL_KEY.test(name) || API_KEY_HEADER.test(name)) {\n      derived.push(...credentialParts(value));\n    }\n  }\n  if (input.upstreamAuth) derived.push(...credentialParts(input.upstreamAuth.value));\n  derived.push(...urlParts(input.upstreamUrl));\n  const secrets = new Set(derived.filter((s) => s.length >= MIN_SECRET_LENGTH));\n  // (d) is validated at start (`validateSecretValues`); keep every non-empty entry.\n  for (const value of input.secretValues) if (value.length) secrets.add(value);\n  return [...secrets].sort((a, b) => b.length - a.length);\n}\n\n/** `%2b` for `%2B`: some encoders write lowercase hex. */\nfunction lowerHex(value: string): string {\n  return value.replace(/%[0-9A-F]{2}/g, (m) => m.toLowerCase());\n}\n\n/** `f(value)`, or nothing when it throws (a lone surrogate, a bad escape). */\nfunction attempt(f: (value: string) => string, value: string): string[] {\n  try {\n    return [f(value)];\n  } catch {\n    return [];\n  }\n}\n\n/**\n * Every textual form a known secret can take in a recording (G2b B1-r2): the\n * value as registered, its percent-decoded forms (it may have been\n * registered encoded, as a URL query value is), and for each of those the\n * `encodeURIComponent`, form (`URLSearchParams`, `+` for space) and\n * `encodeURI` encodings, with uppercase or lowercase hex. A derived form\n * shorter than `MIN_SECRET_LENGTH` is dropped; the value itself never is.\n */\nexport function secretForms(secret: string): string[] {\n  const bases = [\n    secret,\n    ...attempt(decodeURIComponent, secret),\n    ...attempt((v) => decodeURIComponent(v.replace(/\\+/g, \" \")), secret),\n  ];\n  const forms = new Set<string>();\n  for (const base of bases) {\n    forms.add(base);\n    const encoded = [\n      ...attempt(encodeURIComponent, base),\n      ...attempt((v) => new URLSearchParams([[\"v\", v]]).toString().slice(2), base),\n      ...attempt(encodeURI, base),\n      ...attempt((v) => encodeURIComponent(v).replace(/%20/g, \"+\"), base),\n    ];\n    for (const form of encoded) {\n      forms.add(form);\n      forms.add(lowerHex(form));\n    }\n  }\n  return [...forms].filter((form) => form === secret || form.length >= MIN_SECRET_LENGTH);\n}\n\nexport interface SanitizeResult<T> {\n  value: T;\n  /** `_warnings` text: \"<pointer>: redacted a known secret\" / \"<pointer>: looks like a <kind> token\" */\n  warnings: string[];\n}\n\n// S7: token-shaped strings are reported, never redacted. Order matters:\n// `sk-ant-` is checked before the generic `sk-`.\nconst TOKEN_PATTERNS: readonly { kind: string; pattern: RegExp }[] = [\n  { kind: \"Anthropic API key\", pattern: /\\bsk-ant-[A-Za-z0-9_-]{8,}/ },\n  { kind: \"OpenAI API key\", pattern: /\\bsk-(?!ant-)[A-Za-z0-9_-]{16,}/ },\n  { kind: \"GitHub token\", pattern: /\\b(?:ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/ },\n  { kind: \"Slack token\", pattern: /\\bxox[abp]-[A-Za-z0-9-]{10,}/ },\n  { kind: \"AWS access key\", pattern: /\\bAKIA[0-9A-Z]{16}\\b/ },\n  { kind: \"JWT\", pattern: /\\beyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/ },\n];\n\nfunction escapePointer(key: string): string {\n  return key.replace(/~/g, \"~0\").replace(/\\//g, \"~1\");\n}\n\n/**\n * S2-S7 over one JSON value. `isCredentialBranch(pointer)` is called with the\n * pointer of each object and says whether credential-shaped keys directly\n * under it are removed (S4: `/recorded…`, any `…/_meta…`).\n * Throws RecordUnsafeError (S6). The input is never mutated.\n */\nexport function sanitizeRecording<T>(\n  value: T,\n  secrets: readonly string[],\n  isCredentialBranch: (pointer: string) => boolean,\n): SanitizeResult<T> {\n  // G2b B1-r2: every form a secret can take (encoded, decoded) is matched.\n  const ordered = [...new Set(secrets.filter((s) => s.length).flatMap(secretForms))].sort(\n    (a, b) => b.length - a.length,\n  );\n  const hasSecret = (s: string) => ordered.some((secret) => s.includes(secret));\n  // S6 runs over JSON text, where `\"`, `\\` and control characters are escaped.\n  const jsonForms = ordered.map((secret) => JSON.stringify(secret).slice(1, -1));\n  const hasSecretInJson = (s: string) =>\n    hasSecret(s) || jsonForms.some((secret) => s.includes(secret));\n  const onPathSecret = (): never => {\n    throw new RecordUnsafeError(\"secret-in-path\");\n  };\n  const warnings: string[] = [];\n\n  function visitString(input: string, pointer: string): string {\n    const url = scrubUrl(input, hasSecret, onPathSecret);\n    if (url !== input) warnings.push(`${pointer}: removed credentials from a URL`);\n    let out = url;\n    for (const secret of ordered) out = out.split(secret).join(REDACTED);\n    if (out !== url) warnings.push(`${pointer}: redacted a known secret`);\n    for (const { kind, pattern } of TOKEN_PATTERNS) {\n      if (pattern.test(out)) warnings.push(`${pointer}: looks like a ${kind} token`);\n    }\n    return out;\n  }\n\n  function visit(node: unknown, pointer: string): unknown {\n    if (typeof node === \"string\") return visitString(node, pointer);\n    if (Array.isArray(node)) return node.map((item, i) => visit(item, `${pointer}/${i}`));\n    if (!node || typeof node !== \"object\") return node;\n    const removeCredentials = isCredentialBranch(pointer);\n    const output: Record<string, unknown> = {};\n    for (const [key, item] of Object.entries(node)) {\n      if (removeCredentials && CREDENTIAL_KEY.test(key)) continue;\n      // Own data property, so a `__proto__` key never rewires the prototype.\n      Object.defineProperty(output, key, {\n        value: visit(item, `${pointer}/${escapePointer(key)}`),\n        enumerable: true,\n        writable: true,\n        configurable: true,\n      });\n    }\n    return output;\n  }\n\n  const cleaned = visit(value, \"\") as T;\n  // S6: fail closed if any known secret remains (for example in a key name).\n  if (hasSecretInJson(JSON.stringify(cleaned) ?? \"\")) {\n    throw new RecordUnsafeError(\"secret-remains\");\n  }\n  return { value: cleaned, warnings };\n}\n"],"mappings":";;;;;;;;;AAQA,MAAa,iBACX;AACF,MAAa,WAAW;AACxB,MAAa,oBAAoB;;AAGjC,IAAa,oBAAb,cAAuC,MAAM;CAC3C,YAAY,AAAS,QAA6C;AAChE,QAAM,qBAAqB,SAAS;EADjB;AAEnB,OAAK,OAAO;;;AAIhB,SAAgB,mBAAmB,OAAuB;AAGxD,QAAO,IAAI,gBAAgB,SAAS,MAAM,QAAQ,OAAO,MAAM,CAAC,QAAQ,MAAM,MAAM,GAAG,CAAC,IACtF,QACD;;;;;;AAOH,SAAgB,SACd,OACA,WACA,cACQ;AAER,KAAI,CAAC,2BAA2B,KAAK,MAAM,CAAE,QAAO;CACpD,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,MAAM;SACd;AACN,SAAO;;AAGT,KAAI,UAAU,mBAAmB,IAAI,SAAS,CAAC,CAAE,eAAc;CAC/D,IAAI,UAAU;AACd,KAAI,IAAI,YAAY,IAAI,UAAU;AAChC,MAAI,WAAW;AACf,MAAI,WAAW;AACf,YAAU;;AAEZ,MAAK,MAAM,CAAC,KAAK,QAAQ,CAAC,GAAG,IAAI,aAAa,CAC5C,KAAI,eAAe,KAAK,IAAI,IAAI,UAAU,IAAI,IAAI,UAAU,IAAI,EAAE;AAChE,MAAI,aAAa,OAAO,IAAI;AAC5B,YAAU;;CAGd,MAAM,cAAc,mBAAmB,IAAI,KAAK;AAChD,KACE,IAAI,SACH,UAAU,YAAY,IAAI,0CAA0C,KAAK,YAAY,GACtF;AACA,MAAI,OAAO;AACX,YAAU;;AAEZ,QAAO,UAAU,IAAI,OAAO;;;AAI9B,SAAgB,qBAAqB,QAAiC;AACpE,MAAK,MAAM,SAAS,QAAQ;AAC1B,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,8CAA8C;AAC7F,MAAI,MAAM,SAAS,kBACjB,OAAM,IAAI,MAAM,0CAA0C,kBAAkB,aAAa;;;AAO/F,MAAM,iBAAiB;;AAGvB,SAAS,gBAAgB,OAAyB;CAChD,MAAM,QAAQ,CAAC,MAAM;CACrB,MAAM,QAAQ,mBAAmB,KAAK,MAAM,MAAM,CAAC;AACnD,KAAI,OAAO;EACT,MAAM,QAAQ,MAAM,GAAG,MAAM;AAC7B,QAAM,KAAK,MAAM;AACjB,MAAI,MAAM,GAAG,aAAa,KAAK,SAAS;GACtC,MAAM,UAAU,OAAO,KAAK,OAAO,SAAS,CAAC,SAAS,OAAO;GAC7D,MAAM,QAAQ,QAAQ,QAAQ,IAAI;AAClC,OAAI,SAAS,EAAG,OAAM,KAAK,QAAQ,MAAM,GAAG,MAAM,EAAE,QAAQ,MAAM,QAAQ,EAAE,CAAC;;;AAGjF,QAAO;;AAGT,SAAS,SAAS,OAAyB;CACzC,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,MAAM;SACd;AACN,SAAO,EAAE;;CAEX,MAAM,QAAkB,EAAE;AAC1B,KAAI,IAAI,SAAU,OAAM,KAAK,IAAI,UAAU,mBAAmB,IAAI,SAAS,CAAC;AAC5E,KAAI,IAAI,SAAU,OAAM,KAAK,IAAI,UAAU,mBAAmB,IAAI,SAAS,CAAC;AAE5E,MAAK,MAAM,OAAO,IAAI,aAAa,QAAQ,CAAE,OAAM,KAAK,IAAI;AAC5D,QAAO;;;AAIT,SAAgB,aAAa,OAKhB;CACX,MAAM,UAAoB,EAAE;AAC5B,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,QAAQ,EAAE;AACzD,MAAI,OAAO,UAAU,SAAU;AAC/B,MAAI,eAAe,KAAK,KAAK,IAAI,eAAe,KAAK,KAAK,CACxD,SAAQ,KAAK,GAAG,gBAAgB,MAAM,CAAC;;AAG3C,KAAI,MAAM,aAAc,SAAQ,KAAK,GAAG,gBAAgB,MAAM,aAAa,MAAM,CAAC;AAClF,SAAQ,KAAK,GAAG,SAAS,MAAM,YAAY,CAAC;CAC5C,MAAM,UAAU,IAAI,IAAI,QAAQ,QAAQ,MAAM,EAAE,UAAU,kBAAkB,CAAC;AAE7E,MAAK,MAAM,SAAS,MAAM,aAAc,KAAI,MAAM,OAAQ,SAAQ,IAAI,MAAM;AAC5E,QAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO;;;AAIzD,SAAS,SAAS,OAAuB;AACvC,QAAO,MAAM,QAAQ,kBAAkB,MAAM,EAAE,aAAa,CAAC;;;AAI/D,SAAS,QAAQ,GAA8B,OAAyB;AACtE,KAAI;AACF,SAAO,CAAC,EAAE,MAAM,CAAC;SACX;AACN,SAAO,EAAE;;;;;;;;;;;AAYb,SAAgB,YAAY,QAA0B;CACpD,MAAM,QAAQ;EACZ;EACA,GAAG,QAAQ,oBAAoB,OAAO;EACtC,GAAG,SAAS,MAAM,mBAAmB,EAAE,QAAQ,OAAO,IAAI,CAAC,EAAE,OAAO;EACrE;CACD,MAAM,wBAAQ,IAAI,KAAa;AAC/B,MAAK,MAAM,QAAQ,OAAO;AACxB,QAAM,IAAI,KAAK;EACf,MAAM,UAAU;GACd,GAAG,QAAQ,oBAAoB,KAAK;GACpC,GAAG,SAAS,MAAM,IAAI,gBAAgB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,KAAK;GAC5E,GAAG,QAAQ,WAAW,KAAK;GAC3B,GAAG,SAAS,MAAM,mBAAmB,EAAE,CAAC,QAAQ,QAAQ,IAAI,EAAE,KAAK;GACpE;AACD,OAAK,MAAM,QAAQ,SAAS;AAC1B,SAAM,IAAI,KAAK;AACf,SAAM,IAAI,SAAS,KAAK,CAAC;;;AAG7B,QAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,SAAS,SAAS,UAAU,KAAK,UAAU,kBAAkB;;AAWzF,MAAM,iBAA+D;CACnE;EAAE,MAAM;EAAqB,SAAS;EAA8B;CACpE;EAAE,MAAM;EAAkB,SAAS;EAAmC;CACtE;EAAE,MAAM;EAAgB,SAAS;EAA2D;CAC5F;EAAE,MAAM;EAAe,SAAS;EAAgC;CAChE;EAAE,MAAM;EAAkB,SAAS;EAAwB;CAC3D;EAAE,MAAM;EAAO,SAAS;EAAuD;CAChF;AAED,SAAS,cAAc,KAAqB;AAC1C,QAAO,IAAI,QAAQ,MAAM,KAAK,CAAC,QAAQ,OAAO,KAAK;;;;;;;;AASrD,SAAgB,kBACd,OACA,SACA,oBACmB;CAEnB,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,QAAQ,QAAQ,MAAM,EAAE,OAAO,CAAC,QAAQ,YAAY,CAAC,CAAC,CAAC,MAChF,GAAG,MAAM,EAAE,SAAS,EAAE,OACxB;CACD,MAAM,aAAa,MAAc,QAAQ,MAAM,WAAW,EAAE,SAAS,OAAO,CAAC;CAE7E,MAAM,YAAY,QAAQ,KAAK,WAAW,KAAK,UAAU,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;CAC9E,MAAM,mBAAmB,MACvB,UAAU,EAAE,IAAI,UAAU,MAAM,WAAW,EAAE,SAAS,OAAO,CAAC;CAChE,MAAM,qBAA4B;AAChC,QAAM,IAAI,kBAAkB,iBAAiB;;CAE/C,MAAM,WAAqB,EAAE;CAE7B,SAAS,YAAY,OAAe,SAAyB;EAC3D,MAAM,MAAM,SAAS,OAAO,WAAW,aAAa;AACpD,MAAI,QAAQ,MAAO,UAAS,KAAK,GAAG,QAAQ,kCAAkC;EAC9E,IAAI,MAAM;AACV,OAAK,MAAM,UAAU,QAAS,OAAM,IAAI,MAAM,OAAO,CAAC,KAAK,SAAS;AACpE,MAAI,QAAQ,IAAK,UAAS,KAAK,GAAG,QAAQ,2BAA2B;AACrE,OAAK,MAAM,EAAE,MAAM,aAAa,eAC9B,KAAI,QAAQ,KAAK,IAAI,CAAE,UAAS,KAAK,GAAG,QAAQ,iBAAiB,KAAK,QAAQ;AAEhF,SAAO;;CAGT,SAAS,MAAM,MAAe,SAA0B;AACtD,MAAI,OAAO,SAAS,SAAU,QAAO,YAAY,MAAM,QAAQ;AAC/D,MAAI,MAAM,QAAQ,KAAK,CAAE,QAAO,KAAK,KAAK,MAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;AACrF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;EAC9C,MAAM,oBAAoB,mBAAmB,QAAQ;EACrD,MAAM,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAK,EAAE;AAC9C,OAAI,qBAAqB,eAAe,KAAK,IAAI,CAAE;AAEnD,UAAO,eAAe,QAAQ,KAAK;IACjC,OAAO,MAAM,MAAM,GAAG,QAAQ,GAAG,cAAc,IAAI,GAAG;IACtD,YAAY;IACZ,UAAU;IACV,cAAc;IACf,CAAC;;AAEJ,SAAO;;CAGT,MAAM,UAAU,MAAM,OAAO,GAAG;AAEhC,KAAI,gBAAgB,KAAK,UAAU,QAAQ,IAAI,GAAG,CAChD,OAAM,IAAI,kBAAkB,iBAAiB;AAE/C,QAAO;EAAE,OAAO;EAAS;EAAU"}

package/dist/record-sanitize.js

@@ -0,0 +1,224 @@
+//#region src/record-sanitize.ts
+/**
+* Shared record sanitizer (D10, S1-S7).
+*
+* The credential-key and URL rules were moved here from `live-sanitize.ts`,
+* which imports them back unchanged. `sanitizeRecording` applies the generic
+* record rules to any JSON value (for example an `mcpFakes` recording).
+*/
+const CREDENTIAL_KEY = /^(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|password|secret|token|sec-websocket-protocol)$/i;
+const REDACTED = "[REDACTED]";
+const MIN_SECRET_LENGTH = 8;
+/** Thrown when a recording cannot be made safe (S6). Never carries a value. */
+var RecordUnsafeError = class extends Error {
+	constructor(reason) {
+		super(`unsafe recording: ${reason}`);
+		this.reason = reason;
+		this.name = "RecordUnsafeError";
+	}
+};
+function decodeUrlComponent(value) {
+	return new URLSearchParams(`value=${value.replace(/\+/g, "%2B").replace(/&/g, "%26")}`).get("value");
+}
+/**
+* S3: scrub one absolute URL string; non-URLs unchanged. `onPathSecret` is
+* called (and must throw) when the decoded path contains a secret.
+*/
+function scrubUrl(value, hasSecret, onPathSecret) {
+	if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) return value;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return value;
+	}
+	if (hasSecret(decodeUrlComponent(url.pathname))) onPathSecret();
+	let changed = false;
+	if (url.username || url.password) {
+		url.username = "";
+		url.password = "";
+		changed = true;
+	}
+	for (const [key, val] of [...url.searchParams]) if (CREDENTIAL_KEY.test(key) || hasSecret(key) || hasSecret(val)) {
+		url.searchParams.delete(key);
+		changed = true;
+	}
+	const decodedHash = decodeUrlComponent(url.hash);
+	if (url.hash && (hasSecret(decodedHash) || /(?:token|secret|password|api[_-]?key)=/i.test(decodedHash))) {
+		url.hash = "";
+		changed = true;
+	}
+	return changed ? url.href : value;
+}
+/** S2 (d) start check: throws a plain Error naming the rule, never the value. */
+function validateSecretValues(values) {
+	for (const value of values) {
+		if (typeof value !== "string") throw new Error("record.secretValues entries must be strings");
+		if (value.length < MIN_SECRET_LENGTH) throw new Error(`record.secretValues entry shorter than ${MIN_SECRET_LENGTH} characters`);
+	}
+}
+const API_KEY_HEADER = /(?:^|[-_])api[-_]?key$/i;
+/** The value, the token after the scheme, and for `Basic` the decoded user and password. */
+function credentialParts(value) {
+	const parts = [value];
+	const match = /^(\S+)\s+(\S.*)$/.exec(value.trim());
+	if (match) {
+		const token = match[2].trim();
+		parts.push(token);
+		if (match[1].toLowerCase() === "basic") {
+			const decoded = Buffer.from(token, "base64").toString("utf8");
+			const colon = decoded.indexOf(":");
+			if (colon >= 0) parts.push(decoded.slice(0, colon), decoded.slice(colon + 1));
+		}
+	}
+	return parts;
+}
+function urlParts(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return [];
+	}
+	const parts = [];
+	if (url.username) parts.push(url.username, decodeUrlComponent(url.username));
+	if (url.password) parts.push(url.password, decodeUrlComponent(url.password));
+	for (const val of url.searchParams.values()) parts.push(val);
+	return parts;
+}
+/** S2 (a)-(c): secrets from forwarded headers, upstreamAuth and the upstream URL; min length 8. */
+function knownSecrets(input) {
+	const derived = [];
+	for (const [name, value] of Object.entries(input.headers)) {
+		if (typeof value !== "string") continue;
+		if (CREDENTIAL_KEY.test(name) || API_KEY_HEADER.test(name)) derived.push(...credentialParts(value));
+	}
+	if (input.upstreamAuth) derived.push(...credentialParts(input.upstreamAuth.value));
+	derived.push(...urlParts(input.upstreamUrl));
+	const secrets = new Set(derived.filter((s) => s.length >= MIN_SECRET_LENGTH));
+	for (const value of input.secretValues) if (value.length) secrets.add(value);
+	return [...secrets].sort((a, b) => b.length - a.length);
+}
+/** `%2b` for `%2B`: some encoders write lowercase hex. */
+function lowerHex(value) {
+	return value.replace(/%[0-9A-F]{2}/g, (m) => m.toLowerCase());
+}
+/** `f(value)`, or nothing when it throws (a lone surrogate, a bad escape). */
+function attempt(f, value) {
+	try {
+		return [f(value)];
+	} catch {
+		return [];
+	}
+}
+/**
+* Every textual form a known secret can take in a recording (G2b B1-r2): the
+* value as registered, its percent-decoded forms (it may have been
+* registered encoded, as a URL query value is), and for each of those the
+* `encodeURIComponent`, form (`URLSearchParams`, `+` for space) and
+* `encodeURI` encodings, with uppercase or lowercase hex. A derived form
+* shorter than `MIN_SECRET_LENGTH` is dropped; the value itself never is.
+*/
+function secretForms(secret) {
+	const bases = [
+		secret,
+		...attempt(decodeURIComponent, secret),
+		...attempt((v) => decodeURIComponent(v.replace(/\+/g, " ")), secret)
+	];
+	const forms = /* @__PURE__ */ new Set();
+	for (const base of bases) {
+		forms.add(base);
+		const encoded = [
+			...attempt(encodeURIComponent, base),
+			...attempt((v) => new URLSearchParams([["v", v]]).toString().slice(2), base),
+			...attempt(encodeURI, base),
+			...attempt((v) => encodeURIComponent(v).replace(/%20/g, "+"), base)
+		];
+		for (const form of encoded) {
+			forms.add(form);
+			forms.add(lowerHex(form));
+		}
+	}
+	return [...forms].filter((form) => form === secret || form.length >= MIN_SECRET_LENGTH);
+}
+const TOKEN_PATTERNS = [
+	{
+		kind: "Anthropic API key",
+		pattern: /\bsk-ant-[A-Za-z0-9_-]{8,}/
+	},
+	{
+		kind: "OpenAI API key",
+		pattern: /\bsk-(?!ant-)[A-Za-z0-9_-]{16,}/
+	},
+	{
+		kind: "GitHub token",
+		pattern: /\b(?:ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/
+	},
+	{
+		kind: "Slack token",
+		pattern: /\bxox[abp]-[A-Za-z0-9-]{10,}/
+	},
+	{
+		kind: "AWS access key",
+		pattern: /\bAKIA[0-9A-Z]{16}\b/
+	},
+	{
+		kind: "JWT",
+		pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/
+	}
+];
+function escapePointer(key) {
+	return key.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+/**
+* S2-S7 over one JSON value. `isCredentialBranch(pointer)` is called with the
+* pointer of each object and says whether credential-shaped keys directly
+* under it are removed (S4: `/recorded…`, any `…/_meta…`).
+* Throws RecordUnsafeError (S6). The input is never mutated.
+*/
+function sanitizeRecording(value, secrets, isCredentialBranch) {
+	const ordered = [...new Set(secrets.filter((s) => s.length).flatMap(secretForms))].sort((a, b) => b.length - a.length);
+	const hasSecret = (s) => ordered.some((secret) => s.includes(secret));
+	const jsonForms = ordered.map((secret) => JSON.stringify(secret).slice(1, -1));
+	const hasSecretInJson = (s) => hasSecret(s) || jsonForms.some((secret) => s.includes(secret));
+	const onPathSecret = () => {
+		throw new RecordUnsafeError("secret-in-path");
+	};
+	const warnings = [];
+	function visitString(input, pointer) {
+		const url = scrubUrl(input, hasSecret, onPathSecret);
+		if (url !== input) warnings.push(`${pointer}: removed credentials from a URL`);
+		let out = url;
+		for (const secret of ordered) out = out.split(secret).join(REDACTED);
+		if (out !== url) warnings.push(`${pointer}: redacted a known secret`);
+		for (const { kind, pattern } of TOKEN_PATTERNS) if (pattern.test(out)) warnings.push(`${pointer}: looks like a ${kind} token`);
+		return out;
+	}
+	function visit(node, pointer) {
+		if (typeof node === "string") return visitString(node, pointer);
+		if (Array.isArray(node)) return node.map((item, i) => visit(item, `${pointer}/${i}`));
+		if (!node || typeof node !== "object") return node;
+		const removeCredentials = isCredentialBranch(pointer);
+		const output = {};
+		for (const [key, item] of Object.entries(node)) {
+			if (removeCredentials && CREDENTIAL_KEY.test(key)) continue;
+			Object.defineProperty(output, key, {
+				value: visit(item, `${pointer}/${escapePointer(key)}`),
+				enumerable: true,
+				writable: true,
+				configurable: true
+			});
+		}
+		return output;
+	}
+	const cleaned = visit(value, "");
+	if (hasSecretInJson(JSON.stringify(cleaned) ?? "")) throw new RecordUnsafeError("secret-remains");
+	return {
+		value: cleaned,
+		warnings
+	};
+}
+
+//#endregion
+export { CREDENTIAL_KEY, REDACTED, RecordUnsafeError, knownSecrets, sanitizeRecording, scrubUrl, validateSecretValues };
+//# sourceMappingURL=record-sanitize.js.map

package/dist/record-sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-sanitize.js","names":[],"sources":["../src/record-sanitize.ts"],"sourcesContent":["/**\n * Shared record sanitizer (D10, S1-S7).\n *\n * The credential-key and URL rules were moved here from `live-sanitize.ts`,\n * which imports them back unchanged. `sanitizeRecording` applies the generic\n * record rules to any JSON value (for example an `mcpFakes` recording).\n */\n\nexport const CREDENTIAL_KEY =\n  /^(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|api[_-]?key|access[_-]?token|refresh[_-]?token|client[_-]?secret|password|secret|token|sec-websocket-protocol)$/i;\nexport const REDACTED = \"[REDACTED]\";\nexport const MIN_SECRET_LENGTH = 8;\n\n/** Thrown when a recording cannot be made safe (S6). Never carries a value. */\nexport class RecordUnsafeError extends Error {\n  constructor(readonly reason: \"secret-in-path\" | \"secret-remains\") {\n    super(`unsafe recording: ${reason}`);\n    this.name = \"RecordUnsafeError\";\n  }\n}\n\nexport function decodeUrlComponent(value: string): string {\n  // Tolerate malformed escapes while exposing encoded secrets. Protect literal\n  // form separators so the entire component remains one value.\n  return new URLSearchParams(`value=${value.replace(/\\+/g, \"%2B\").replace(/&/g, \"%26\")}`).get(\n    \"value\",\n  )!;\n}\n\n/**\n * S3: scrub one absolute URL string; non-URLs unchanged. `onPathSecret` is\n * called (and must throw) when the decoded path contains a secret.\n */\nexport function scrubUrl(\n  value: string,\n  hasSecret: (s: string) => boolean,\n  onPathSecret: () => never,\n): string {\n  // Leave non-URLs and clean URLs byte-for-byte intact.\n  if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)) return value;\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return value;\n  }\n  // A path identifies the resource; changing it could change replay semantics.\n  if (hasSecret(decodeUrlComponent(url.pathname))) onPathSecret();\n  let changed = false;\n  if (url.username || url.password) {\n    url.username = \"\";\n    url.password = \"\";\n    changed = true;\n  }\n  for (const [key, val] of [...url.searchParams]) {\n    if (CREDENTIAL_KEY.test(key) || hasSecret(key) || hasSecret(val)) {\n      url.searchParams.delete(key);\n      changed = true;\n    }\n  }\n  const decodedHash = decodeUrlComponent(url.hash);\n  if (\n    url.hash &&\n    (hasSecret(decodedHash) || /(?:token|secret|password|api[_-]?key)=/i.test(decodedHash))\n  ) {\n    url.hash = \"\";\n    changed = true;\n  }\n  return changed ? url.href : value;\n}\n\n/** S2 (d) start check: throws a plain Error naming the rule, never the value. */\nexport function validateSecretValues(values: readonly string[]): void {\n  for (const value of values) {\n    if (typeof value !== \"string\") throw new Error(\"record.secretValues entries must be strings\");\n    if (value.length < MIN_SECRET_LENGTH) {\n      throw new Error(`record.secretValues entry shorter than ${MIN_SECRET_LENGTH} characters`);\n    }\n  }\n}\n\n// Recognized API-key header names beyond the credential-key regex\n// (for example `x-goog-api-key`).\nconst API_KEY_HEADER = /(?:^|[-_])api[-_]?key$/i;\n\n/** The value, the token after the scheme, and for `Basic` the decoded user and password. */\nfunction credentialParts(value: string): string[] {\n  const parts = [value];\n  const match = /^(\\S+)\\s+(\\S.*)$/.exec(value.trim());\n  if (match) {\n    const token = match[2].trim();\n    parts.push(token);\n    if (match[1].toLowerCase() === \"basic\") {\n      const decoded = Buffer.from(token, \"base64\").toString(\"utf8\");\n      const colon = decoded.indexOf(\":\");\n      if (colon >= 0) parts.push(decoded.slice(0, colon), decoded.slice(colon + 1));\n    }\n  }\n  return parts;\n}\n\nfunction urlParts(value: string): string[] {\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return [];\n  }\n  const parts: string[] = [];\n  if (url.username) parts.push(url.username, decodeUrlComponent(url.username));\n  if (url.password) parts.push(url.password, decodeUrlComponent(url.password));\n  // Every query value; path segments are names, so they are not included (S2 c).\n  for (const val of url.searchParams.values()) parts.push(val);\n  return parts;\n}\n\n/** S2 (a)-(c): secrets from forwarded headers, upstreamAuth and the upstream URL; min length 8. */\nexport function knownSecrets(input: {\n  headers: Record<string, string>;\n  upstreamAuth?: { name: string; value: string };\n  upstreamUrl: string;\n  secretValues: readonly string[];\n}): string[] {\n  const derived: string[] = [];\n  for (const [name, value] of Object.entries(input.headers)) {\n    if (typeof value !== \"string\") continue;\n    if (CREDENTIAL_KEY.test(name) || API_KEY_HEADER.test(name)) {\n      derived.push(...credentialParts(value));\n    }\n  }\n  if (input.upstreamAuth) derived.push(...credentialParts(input.upstreamAuth.value));\n  derived.push(...urlParts(input.upstreamUrl));\n  const secrets = new Set(derived.filter((s) => s.length >= MIN_SECRET_LENGTH));\n  // (d) is validated at start (`validateSecretValues`); keep every non-empty entry.\n  for (const value of input.secretValues) if (value.length) secrets.add(value);\n  return [...secrets].sort((a, b) => b.length - a.length);\n}\n\n/** `%2b` for `%2B`: some encoders write lowercase hex. */\nfunction lowerHex(value: string): string {\n  return value.replace(/%[0-9A-F]{2}/g, (m) => m.toLowerCase());\n}\n\n/** `f(value)`, or nothing when it throws (a lone surrogate, a bad escape). */\nfunction attempt(f: (value: string) => string, value: string): string[] {\n  try {\n    return [f(value)];\n  } catch {\n    return [];\n  }\n}\n\n/**\n * Every textual form a known secret can take in a recording (G2b B1-r2): the\n * value as registered, its percent-decoded forms (it may have been\n * registered encoded, as a URL query value is), and for each of those the\n * `encodeURIComponent`, form (`URLSearchParams`, `+` for space) and\n * `encodeURI` encodings, with uppercase or lowercase hex. A derived form\n * shorter than `MIN_SECRET_LENGTH` is dropped; the value itself never is.\n */\nexport function secretForms(secret: string): string[] {\n  const bases = [\n    secret,\n    ...attempt(decodeURIComponent, secret),\n    ...attempt((v) => decodeURIComponent(v.replace(/\\+/g, \" \")), secret),\n  ];\n  const forms = new Set<string>();\n  for (const base of bases) {\n    forms.add(base);\n    const encoded = [\n      ...attempt(encodeURIComponent, base),\n      ...attempt((v) => new URLSearchParams([[\"v\", v]]).toString().slice(2), base),\n      ...attempt(encodeURI, base),\n      ...attempt((v) => encodeURIComponent(v).replace(/%20/g, \"+\"), base),\n    ];\n    for (const form of encoded) {\n      forms.add(form);\n      forms.add(lowerHex(form));\n    }\n  }\n  return [...forms].filter((form) => form === secret || form.length >= MIN_SECRET_LENGTH);\n}\n\nexport interface SanitizeResult<T> {\n  value: T;\n  /** `_warnings` text: \"<pointer>: redacted a known secret\" / \"<pointer>: looks like a <kind> token\" */\n  warnings: string[];\n}\n\n// S7: token-shaped strings are reported, never redacted. Order matters:\n// `sk-ant-` is checked before the generic `sk-`.\nconst TOKEN_PATTERNS: readonly { kind: string; pattern: RegExp }[] = [\n  { kind: \"Anthropic API key\", pattern: /\\bsk-ant-[A-Za-z0-9_-]{8,}/ },\n  { kind: \"OpenAI API key\", pattern: /\\bsk-(?!ant-)[A-Za-z0-9_-]{16,}/ },\n  { kind: \"GitHub token\", pattern: /\\b(?:ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/ },\n  { kind: \"Slack token\", pattern: /\\bxox[abp]-[A-Za-z0-9-]{10,}/ },\n  { kind: \"AWS access key\", pattern: /\\bAKIA[0-9A-Z]{16}\\b/ },\n  { kind: \"JWT\", pattern: /\\beyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+/ },\n];\n\nfunction escapePointer(key: string): string {\n  return key.replace(/~/g, \"~0\").replace(/\\//g, \"~1\");\n}\n\n/**\n * S2-S7 over one JSON value. `isCredentialBranch(pointer)` is called with the\n * pointer of each object and says whether credential-shaped keys directly\n * under it are removed (S4: `/recorded…`, any `…/_meta…`).\n * Throws RecordUnsafeError (S6). The input is never mutated.\n */\nexport function sanitizeRecording<T>(\n  value: T,\n  secrets: readonly string[],\n  isCredentialBranch: (pointer: string) => boolean,\n): SanitizeResult<T> {\n  // G2b B1-r2: every form a secret can take (encoded, decoded) is matched.\n  const ordered = [...new Set(secrets.filter((s) => s.length).flatMap(secretForms))].sort(\n    (a, b) => b.length - a.length,\n  );\n  const hasSecret = (s: string) => ordered.some((secret) => s.includes(secret));\n  // S6 runs over JSON text, where `\"`, `\\` and control characters are escaped.\n  const jsonForms = ordered.map((secret) => JSON.stringify(secret).slice(1, -1));\n  const hasSecretInJson = (s: string) =>\n    hasSecret(s) || jsonForms.some((secret) => s.includes(secret));\n  const onPathSecret = (): never => {\n    throw new RecordUnsafeError(\"secret-in-path\");\n  };\n  const warnings: string[] = [];\n\n  function visitString(input: string, pointer: string): string {\n    const url = scrubUrl(input, hasSecret, onPathSecret);\n    if (url !== input) warnings.push(`${pointer}: removed credentials from a URL`);\n    let out = url;\n    for (const secret of ordered) out = out.split(secret).join(REDACTED);\n    if (out !== url) warnings.push(`${pointer}: redacted a known secret`);\n    for (const { kind, pattern } of TOKEN_PATTERNS) {\n      if (pattern.test(out)) warnings.push(`${pointer}: looks like a ${kind} token`);\n    }\n    return out;\n  }\n\n  function visit(node: unknown, pointer: string): unknown {\n    if (typeof node === \"string\") return visitString(node, pointer);\n    if (Array.isArray(node)) return node.map((item, i) => visit(item, `${pointer}/${i}`));\n    if (!node || typeof node !== \"object\") return node;\n    const removeCredentials = isCredentialBranch(pointer);\n    const output: Record<string, unknown> = {};\n    for (const [key, item] of Object.entries(node)) {\n      if (removeCredentials && CREDENTIAL_KEY.test(key)) continue;\n      // Own data property, so a `__proto__` key never rewires the prototype.\n      Object.defineProperty(output, key, {\n        value: visit(item, `${pointer}/${escapePointer(key)}`),\n        enumerable: true,\n        writable: true,\n        configurable: true,\n      });\n    }\n    return output;\n  }\n\n  const cleaned = visit(value, \"\") as T;\n  // S6: fail closed if any known secret remains (for example in a key name).\n  if (hasSecretInJson(JSON.stringify(cleaned) ?? \"\")) {\n    throw new RecordUnsafeError(\"secret-remains\");\n  }\n  return { value: cleaned, warnings };\n}\n"],"mappings":";;;;;;;;AAQA,MAAa,iBACX;AACF,MAAa,WAAW;AACxB,MAAa,oBAAoB;;AAGjC,IAAa,oBAAb,cAAuC,MAAM;CAC3C,YAAY,AAAS,QAA6C;AAChE,QAAM,qBAAqB,SAAS;EADjB;AAEnB,OAAK,OAAO;;;AAIhB,SAAgB,mBAAmB,OAAuB;AAGxD,QAAO,IAAI,gBAAgB,SAAS,MAAM,QAAQ,OAAO,MAAM,CAAC,QAAQ,MAAM,MAAM,GAAG,CAAC,IACtF,QACD;;;;;;AAOH,SAAgB,SACd,OACA,WACA,cACQ;AAER,KAAI,CAAC,2BAA2B,KAAK,MAAM,CAAE,QAAO;CACpD,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,MAAM;SACd;AACN,SAAO;;AAGT,KAAI,UAAU,mBAAmB,IAAI,SAAS,CAAC,CAAE,eAAc;CAC/D,IAAI,UAAU;AACd,KAAI,IAAI,YAAY,IAAI,UAAU;AAChC,MAAI,WAAW;AACf,MAAI,WAAW;AACf,YAAU;;AAEZ,MAAK,MAAM,CAAC,KAAK,QAAQ,CAAC,GAAG,IAAI,aAAa,CAC5C,KAAI,eAAe,KAAK,IAAI,IAAI,UAAU,IAAI,IAAI,UAAU,IAAI,EAAE;AAChE,MAAI,aAAa,OAAO,IAAI;AAC5B,YAAU;;CAGd,MAAM,cAAc,mBAAmB,IAAI,KAAK;AAChD,KACE,IAAI,SACH,UAAU,YAAY,IAAI,0CAA0C,KAAK,YAAY,GACtF;AACA,MAAI,OAAO;AACX,YAAU;;AAEZ,QAAO,UAAU,IAAI,OAAO;;;AAI9B,SAAgB,qBAAqB,QAAiC;AACpE,MAAK,MAAM,SAAS,QAAQ;AAC1B,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,MAAM,8CAA8C;AAC7F,MAAI,MAAM,SAAS,kBACjB,OAAM,IAAI,MAAM,0CAA0C,kBAAkB,aAAa;;;AAO/F,MAAM,iBAAiB;;AAGvB,SAAS,gBAAgB,OAAyB;CAChD,MAAM,QAAQ,CAAC,MAAM;CACrB,MAAM,QAAQ,mBAAmB,KAAK,MAAM,MAAM,CAAC;AACnD,KAAI,OAAO;EACT,MAAM,QAAQ,MAAM,GAAG,MAAM;AAC7B,QAAM,KAAK,MAAM;AACjB,MAAI,MAAM,GAAG,aAAa,KAAK,SAAS;GACtC,MAAM,UAAU,OAAO,KAAK,OAAO,SAAS,CAAC,SAAS,OAAO;GAC7D,MAAM,QAAQ,QAAQ,QAAQ,IAAI;AAClC,OAAI,SAAS,EAAG,OAAM,KAAK,QAAQ,MAAM,GAAG,MAAM,EAAE,QAAQ,MAAM,QAAQ,EAAE,CAAC;;;AAGjF,QAAO;;AAGT,SAAS,SAAS,OAAyB;CACzC,IAAI;AACJ,KAAI;AACF,QAAM,IAAI,IAAI,MAAM;SACd;AACN,SAAO,EAAE;;CAEX,MAAM,QAAkB,EAAE;AAC1B,KAAI,IAAI,SAAU,OAAM,KAAK,IAAI,UAAU,mBAAmB,IAAI,SAAS,CAAC;AAC5E,KAAI,IAAI,SAAU,OAAM,KAAK,IAAI,UAAU,mBAAmB,IAAI,SAAS,CAAC;AAE5E,MAAK,MAAM,OAAO,IAAI,aAAa,QAAQ,CAAE,OAAM,KAAK,IAAI;AAC5D,QAAO;;;AAIT,SAAgB,aAAa,OAKhB;CACX,MAAM,UAAoB,EAAE;AAC5B,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,QAAQ,EAAE;AACzD,MAAI,OAAO,UAAU,SAAU;AAC/B,MAAI,eAAe,KAAK,KAAK,IAAI,eAAe,KAAK,KAAK,CACxD,SAAQ,KAAK,GAAG,gBAAgB,MAAM,CAAC;;AAG3C,KAAI,MAAM,aAAc,SAAQ,KAAK,GAAG,gBAAgB,MAAM,aAAa,MAAM,CAAC;AAClF,SAAQ,KAAK,GAAG,SAAS,MAAM,YAAY,CAAC;CAC5C,MAAM,UAAU,IAAI,IAAI,QAAQ,QAAQ,MAAM,EAAE,UAAU,kBAAkB,CAAC;AAE7E,MAAK,MAAM,SAAS,MAAM,aAAc,KAAI,MAAM,OAAQ,SAAQ,IAAI,MAAM;AAC5E,QAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO;;;AAIzD,SAAS,SAAS,OAAuB;AACvC,QAAO,MAAM,QAAQ,kBAAkB,MAAM,EAAE,aAAa,CAAC;;;AAI/D,SAAS,QAAQ,GAA8B,OAAyB;AACtE,KAAI;AACF,SAAO,CAAC,EAAE,MAAM,CAAC;SACX;AACN,SAAO,EAAE;;;;;;;;;;;AAYb,SAAgB,YAAY,QAA0B;CACpD,MAAM,QAAQ;EACZ;EACA,GAAG,QAAQ,oBAAoB,OAAO;EACtC,GAAG,SAAS,MAAM,mBAAmB,EAAE,QAAQ,OAAO,IAAI,CAAC,EAAE,OAAO;EACrE;CACD,MAAM,wBAAQ,IAAI,KAAa;AAC/B,MAAK,MAAM,QAAQ,OAAO;AACxB,QAAM,IAAI,KAAK;EACf,MAAM,UAAU;GACd,GAAG,QAAQ,oBAAoB,KAAK;GACpC,GAAG,SAAS,MAAM,IAAI,gBAAgB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,KAAK;GAC5E,GAAG,QAAQ,WAAW,KAAK;GAC3B,GAAG,SAAS,MAAM,mBAAmB,EAAE,CAAC,QAAQ,QAAQ,IAAI,EAAE,KAAK;GACpE;AACD,OAAK,MAAM,QAAQ,SAAS;AAC1B,SAAM,IAAI,KAAK;AACf,SAAM,IAAI,SAAS,KAAK,CAAC;;;AAG7B,QAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,SAAS,SAAS,UAAU,KAAK,UAAU,kBAAkB;;AAWzF,MAAM,iBAA+D;CACnE;EAAE,MAAM;EAAqB,SAAS;EAA8B;CACpE;EAAE,MAAM;EAAkB,SAAS;EAAmC;CACtE;EAAE,MAAM;EAAgB,SAAS;EAA2D;CAC5F;EAAE,MAAM;EAAe,SAAS;EAAgC;CAChE;EAAE,MAAM;EAAkB,SAAS;EAAwB;CAC3D;EAAE,MAAM;EAAO,SAAS;EAAuD;CAChF;AAED,SAAS,cAAc,KAAqB;AAC1C,QAAO,IAAI,QAAQ,MAAM,KAAK,CAAC,QAAQ,OAAO,KAAK;;;;;;;;AASrD,SAAgB,kBACd,OACA,SACA,oBACmB;CAEnB,MAAM,UAAU,CAAC,GAAG,IAAI,IAAI,QAAQ,QAAQ,MAAM,EAAE,OAAO,CAAC,QAAQ,YAAY,CAAC,CAAC,CAAC,MAChF,GAAG,MAAM,EAAE,SAAS,EAAE,OACxB;CACD,MAAM,aAAa,MAAc,QAAQ,MAAM,WAAW,EAAE,SAAS,OAAO,CAAC;CAE7E,MAAM,YAAY,QAAQ,KAAK,WAAW,KAAK,UAAU,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;CAC9E,MAAM,mBAAmB,MACvB,UAAU,EAAE,IAAI,UAAU,MAAM,WAAW,EAAE,SAAS,OAAO,CAAC;CAChE,MAAM,qBAA4B;AAChC,QAAM,IAAI,kBAAkB,iBAAiB;;CAE/C,MAAM,WAAqB,EAAE;CAE7B,SAAS,YAAY,OAAe,SAAyB;EAC3D,MAAM,MAAM,SAAS,OAAO,WAAW,aAAa;AACpD,MAAI,QAAQ,MAAO,UAAS,KAAK,GAAG,QAAQ,kCAAkC;EAC9E,IAAI,MAAM;AACV,OAAK,MAAM,UAAU,QAAS,OAAM,IAAI,MAAM,OAAO,CAAC,KAAK,SAAS;AACpE,MAAI,QAAQ,IAAK,UAAS,KAAK,GAAG,QAAQ,2BAA2B;AACrE,OAAK,MAAM,EAAE,MAAM,aAAa,eAC9B,KAAI,QAAQ,KAAK,IAAI,CAAE,UAAS,KAAK,GAAG,QAAQ,iBAAiB,KAAK,QAAQ;AAEhF,SAAO;;CAGT,SAAS,MAAM,MAAe,SAA0B;AACtD,MAAI,OAAO,SAAS,SAAU,QAAO,YAAY,MAAM,QAAQ;AAC/D,MAAI,MAAM,QAAQ,KAAK,CAAE,QAAO,KAAK,KAAK,MAAM,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;AACrF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;EAC9C,MAAM,oBAAoB,mBAAmB,QAAQ;EACrD,MAAM,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,KAAK,EAAE;AAC9C,OAAI,qBAAqB,eAAe,KAAK,IAAI,CAAE;AAEnD,UAAO,eAAe,QAAQ,KAAK;IACjC,OAAO,MAAM,MAAM,GAAG,QAAQ,GAAG,cAAc,IAAI,GAAG;IACtD,YAAY;IACZ,UAAU;IACV,cAAc;IACf,CAAC;;AAEJ,SAAO;;CAGT,MAAM,UAAU,MAAM,OAAO,GAAG;AAEhC,KAAI,gBAAgB,KAAK,UAAU,QAAQ,IAAI,GAAG,CAChD,OAAM,IAAI,kBAAkB,iBAAiB;AAE/C,QAAO;EAAE,OAAO;EAAS;EAAU"}

package/dist/recorder.cjs

@@ -386,7 +386,8 @@ async function proxyAndRecord(req, res, request, providerKey, pathname, fixtures
 	const contentType = upstreamHeaders["content-type"];
 	const ctString = pickContentType(contentType);
 	const isBinaryStream = ctString.toLowerCase().includes("application/vnd.amazon.eventstream");
-	const collapsed = require_stream_collapse.collapseStreamingResponse(ctString, providerKey, isBinaryStream ? rawBuffer : upstreamBody, defaults.logger);
+	const collapsedRaw = require_stream_collapse.collapseStreamingResponseWithResponsesTools(ctString, providerKey, isBinaryStream ? rawBuffer : upstreamBody, defaults.logger);
+	const collapsed = collapsedRaw && defaults.responsesTools !== "extended" ? require_stream_collapse.withoutResponsesToolFields(collapsedRaw) : collapsedRaw;
 	let fixtureResponse;
 	if (ctString.toLowerCase().startsWith("audio/") && upstreamStatus >= 200 && upstreamStatus < 300) {
 		const audioFormat = ctString.toLowerCase().replace("audio/", "").replace("mpeg", "mp3").split(";")[0].trim();
@@ -420,7 +421,7 @@ async function proxyAndRecord(req, res, request, providerKey, pathname, fixtures
 				...audioContentSpread,
 				...audioReasoningSpread
 			};
-		} else if (collapsed.content === "" && (!collapsed.toolCalls || collapsed.toolCalls.length === 0)) {
+		} else if (collapsed.content === "" && (!collapsed.toolCalls || collapsed.toolCalls.length === 0) && !collapsed.customToolCalls?.length) {
 			defaults.logger.warn("Stream collapse produced empty content — fixture may be incomplete");
 			const reasoningSpread = collapsed.reasoning ? { reasoning: collapsed.reasoning } : {};
 			const reasoningSignatureSpread = collapsed.reasoning && collapsed.reasoningSignature ? { reasoningSignature: collapsed.reasoningSignature } : {};
@@ -441,12 +442,27 @@ async function proxyAndRecord(req, res, request, providerKey, pathname, fixtures
 			logDroppedReasoningSignature(defaults.logger, collapsed.reasoning, collapsed.reasoningSignature);
 			const redactedThinkingSpread = collapsed.redactedThinking?.length ? { redactedThinking: collapsed.redactedThinking } : {};
 			const webSearchesSpread = collapsed.webSearches?.length ? { webSearches: collapsed.webSearches } : {};
-			if (collapsed.toolCalls && collapsed.toolCalls.length > 0) {
-				const sanitizedToolCalls = collapsed.toolCalls.map((tc) => ({
+			if (collapsed.customToolCalls?.length) {
+				const toolCalls = (collapsed.toolCalls ?? []).map(sanitizeRecordedToolCall);
+				const customToolCalls = collapsed.customToolCalls.map((tc) => ({
 					...tc,
 					name: tc.name ?? "",
-					arguments: tc.arguments ?? "{}"
+					input: tc.input ?? ""
 				}));
+				const orderSpread = collapsed.responsesBlocks?.length ? { responsesBlocks: collapsed.responsesBlocks } : collapsed.blocks?.length ? { blocks: collapsed.blocks } : {};
+				fixtureResponse = {
+					...collapsed.content ? { content: collapsed.content } : {},
+					toolCalls,
+					customToolCalls,
+					...orderSpread,
+					...reasoningSpread,
+					...reasoningSignatureSpread,
+					...redactedThinkingSpread,
+					...webSearchesSpread,
+					...usageSpread
+				};
+			} else if (collapsed.toolCalls && collapsed.toolCalls.length > 0) {
+				const sanitizedToolCalls = collapsed.toolCalls.map(sanitizeRecordedToolCall);
 				if (collapsed.content) {
 					const blocksSpread = collapsed.blocks?.length ? { blocks: collapsed.blocks } : {};
 					fixtureResponse = {
@@ -809,6 +825,14 @@ function makeUpstreamRequest(target, headers, body, clientRes, method = "POST",
 function logDroppedReasoningSignature(logger, reasoning, reasoningSignature) {
 	if (reasoningSignature && !reasoning) logger?.warn("Dropping captured reasoningSignature — no plaintext reasoning to attach it to");
 }
+/** Sanitize a collapsed function call before it is persisted: string `name` and `arguments`. */
+function sanitizeRecordedToolCall(tc) {
+	return {
+		...tc,
+		name: tc.name ?? "",
+		arguments: tc.arguments ?? "{}"
+	};
+}
 /**
 * Coerce a tool call's `arguments` field into the string the fixture contract
 * requires (types.ts `ToolCall.arguments: string`). When the upstream omits the
@@ -1273,6 +1297,82 @@ function buildFixtureMetadata(request) {
 	if (request.tools && request.tools.length > 0) meta.toolsHash = node_crypto.createHash("sha256").update(JSON.stringify(request.tools)).digest("hex").slice(0, 8);
 	return Object.keys(meta).length > 0 ? meta : void 0;
 }
+/**
+* MR11: read-merge-validate-write one service fakes file atomically (temp +
+* rename, 0o600). Synchronous, so writes to one path never interleave in this
+* process. Keeps unknown top-level keys (fakes:F9). `validate` returns a
+* problem text, or null when the whole merged file is valid. Logs RL4 on a
+* write; a failure is returned, never logged here (the caller logs RL1 with
+* its own context).
+*/
+function persistServiceFakes(opts) {
+	const { filepath, merge, validate, logger } = opts;
+	let existing = null;
+	let text = null;
+	try {
+		text = node_fs.readFileSync(filepath, "utf-8");
+	} catch (err) {
+		if (err.code !== "ENOENT") return {
+			kind: "failed",
+			stage: "write",
+			error: err instanceof Error ? err.message : "Unknown filesystem error"
+		};
+	}
+	if (text !== null) {
+		let parsed;
+		try {
+			parsed = JSON.parse(text);
+		} catch {
+			return {
+				kind: "failed",
+				stage: "read",
+				error: `${filepath} is not valid JSON`
+			};
+		}
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {
+			kind: "failed",
+			stage: "read",
+			error: `${filepath} is not a JSON object`
+		};
+		existing = parsed;
+	}
+	const content = merge(existing);
+	const problem = validate(content);
+	if (problem !== null) return {
+		kind: "failed",
+		stage: "validate",
+		error: problem
+	};
+	let tmpPath;
+	try {
+		node_fs.mkdirSync(node_path.dirname(filepath), { recursive: true });
+		const bytes = Buffer.from(JSON.stringify(content, null, 2), "utf-8");
+		tmpPath = filepath + ".tmp." + node_crypto.randomUUID();
+		node_fs.writeFileSync(tmpPath, bytes, {
+			flag: "wx",
+			mode: 384
+		});
+		node_fs.renameSync(tmpPath, filepath);
+		tmpPath = void 0;
+		logger.warn(`Response recorded → ${filepath}`);
+		return {
+			kind: "written",
+			filepath,
+			sha256: node_crypto.createHash("sha256").update(bytes).digest("hex"),
+			content
+		};
+	} catch (err) {
+		return {
+			kind: "failed",
+			stage: "write",
+			error: err instanceof Error ? err.message : "Unknown filesystem error"
+		};
+	} finally {
+		if (tmpPath) try {
+			node_fs.unlinkSync(tmpPath);
+		} catch {}
+	}
+}
 
 //#endregion
 exports.DEFAULT_MAX_PROXY_BUFFER_BYTES = DEFAULT_MAX_PROXY_BUFFER_BYTES;
@@ -1282,6 +1382,7 @@ exports.buildFixtureMatch = buildFixtureMatch;
 exports.buildForwardHeaders = buildForwardHeaders;
 exports.clampTimeout = clampTimeout;
 exports.persistFixture = persistFixture;
+exports.persistServiceFakes = persistServiceFakes;
 exports.prepareEgressHeaders = prepareEgressHeaders;
 exports.proxyAndRecord = proxyAndRecord;
 exports.removeForwardHeader = removeForwardHeader;