@sovara/runner 0.3.3 → 0.4.0

package/README.md

@@ -1,18 +1,20 @@
 # @sovara/runner
 
-TypeScript runner for [Sovara](https://sovaralabs.github.io/sovara/) — wrap your script in a
+TypeScript runner for [Sovara](https://docs.sovara-labs.com) — wrap your script in a
 single function and Sovara records every LLM call, tool invocation, and log
-line into a structured run graph.
+line into structured run steps.
 
 The runner is the TS counterpart to the Python `sovara` runner. It targets
-the same Sovara server, produces the same node shapes, and is safe to mix
+the same Sovara server, produces the same step shapes, and is safe to mix
 with Python runs in the same project.
 
+Documentation: https://docs.sovara-labs.com
+
 ## Requirements
 
 - Node 18 or newer (built-in `fetch`).
-- A reachable Sovara backend. For local use, open the Sovara desktop app;
-  for enterprise use, point `SOVARA_SERVER_URL` at the remote endpoint.
+- A reachable Sovara backend. For local use, open the Sovara desktop app.
+  Enterprise agent projects should use their project-specific connection flow.
 - A Sovara user and project, configured once with `sovara init`.
 
 ## Install
@@ -66,7 +68,7 @@ Importing `@sovara/runner` patches two transports at module load:
 Inside `withSovaraRun(...)`, calls to whitelisted endpoints are observed:
 the runner builds a request envelope, posts it to the Sovara server's
 `/internal/runner/llm/prepare` endpoint (which optionally applies
-runtime preparation such as priors injection), executes the prepared
+runtime preparation such as lessons injection), executes the prepared
 request on the wire, and records the response or exception. Outside the
 run scope, both patches are no-ops.
 
@@ -93,9 +95,9 @@ completes.
 ```ts
 export type WithSovaraRunOptions = {
   name: string; // required run name
-  url?: string; // server URL (default: SOVARA_SERVER_URL or http://127.0.0.1:5959)
+  clientRunId?: string; // optional project-scoped correlation id
+  url?: string; // server URL (default: http://127.0.0.1:5959)
   captureLogs?: boolean; // default: true
-  user?: { fullName?: string; email?: string }; // overrides only
   project?: { name?: string; description?: string };
 };
 
@@ -115,14 +117,13 @@ whatever `fn` returns.
    user setup is missing.
 3. Resolves the project for `process.cwd()`. Fails hard with a `sovara init`
    hint if the cwd isn't part of a known Sovara project.
-4. Registers the run, opens an SSE shutdown listener, runs `fn` inside
-   an `AsyncLocalStorage` scope, and deregisters in `finally`.
+4. Registers the run, runs `fn` inside an `AsyncLocalStorage` scope, and
+   deregisters in `finally`.
 
-**Nested call** (called from inside another `withSovaraRun`):
+**Nested top-level call** (called from inside another `withSovaraRun`):
 
-The nested call is registered as a subrun via `/runner/subrun`, inheriting
-the parent's `client` and `url` settings. It deregisters its own subrun
-when `fn` returns.
+The nested `withSovaraRun` call is ignored with a warning and `fn` runs inside
+the existing active scope. Use `withSovaraSubrun(...)` for child execution.
 
 `fn` exceptions propagate untouched. The run is deregistered in either
 case.
@@ -131,12 +132,12 @@ case.
 
 ```ts
 await withSovaraRun("pipeline", async () => {
-  const docs = await withSovaraRun("retrieve", async () => loadDocs());
-  await withSovaraRun("summarize", async () => summarize(docs));
+  const docs = await withSovaraSubrun("retrieve", async () => loadDocs());
+  await withSovaraSubrun("summarize", async () => summarize(docs));
 });
 ```
 
-Every nested `withSovaraRun` becomes a subrun under the active scope.
+Every explicit `withSovaraSubrun` becomes a child run under the active scope.
 
 ### Logs
 
@@ -171,8 +172,8 @@ the `sovara init` requirement — they just refine the values.
 ### `trace(fn, options?)`
 
 Use `trace` when an important custom function or tool does not make an LLM
-HTTP call on its own, but should still appear as a tool node in the Sovara
-run graph.
+HTTP call on its own, but should still appear as a tool step in the Sovara
+run steps.
 
 ```ts
 import { trace, withSovaraRun } from "@sovara/runner";
@@ -190,15 +191,15 @@ await withSovaraRun("support-agent", async () => {
 });
 ```
 
-`trace` records function arguments as the node input and the return value as
-the node output. If the wrapped function throws, the error type and message
+`trace` records function arguments as the step input and the return value as
+the step output. If the wrapped function throws, the error type and message
 are recorded and the original exception is re-thrown. Outside an active
 `withSovaraRun(...)` scope, the wrapper calls the function normally without
 recording anything.
 
 ```ts
 export type TraceOptions = {
-  name?: string; // display name for the tool node, default: function/method name
+  name?: string; // display name for the tool step, default: function/method name
   meta?: Record<string, unknown>; // optional metadata stored with input/output
 };
 ```
@@ -233,13 +234,13 @@ That single import change is the entire integration. The wrapper:
 
 - Routes the spawned Claude CLI subprocess through Sovara's local Claude
   proxy by setting `ANTHROPIC_BASE_URL` in the subprocess env, so every
-  LLM request the SDK makes shows up in your run graph.
+  LLM request the SDK makes shows up as a run step.
 - Registers a unique proxy client with the server before each `query()` /
   `startup()` so concurrent SDK calls don't collide.
 - Sets `CLAUDE_CODE_ENTRYPOINT=sdk-ts` and `SOVARA_CLAUDE_PROXY_ACTIVE=1`
   to mark the subprocess as running under Sovara.
 - Wraps the returned `AsyncIterable` so each yielded message is parsed
-  for `tool_use` / `tool_result` blocks and recorded as nodes on the
+  for `tool_use` / `tool_result` blocks and recorded as steps on the
   run.
 - Throws if `options.transport` (custom transport) is supplied — this
   matches the Python runner's behavior.
@@ -284,30 +285,24 @@ for await (const message of handle.query("What did I install last?")) {
 
 | Variable                     | Purpose                                                                    | Default                 |
 | ---------------------------- | -------------------------------------------------------------------------- | ----------------------- |
-| `SOVARA_SERVER_URL`          | Override the Sovara server URL                                             | `http://127.0.0.1:5959` |
-| `HOST`                       | Server host (used to compute the default URL)                              | `127.0.0.1`             |
-| `PYTHON_PORT`                | Server port (used to compute the default URL)                              | `5959`                  |
+| `SOVARA_EXEC_SERVER_PORT`    | Exec server port (used to compute the default URL)                         | `5960`                  |
+| `SOVARA_EXEC_SERVER_URL`     | Explicit exec server URL                                                   | `http://127.0.0.1:5960` |
 | `SOVARA_CLAUDE_PROXY_ACTIVE` | Set automatically by `@sovara/runner/claude` to prevent nested proxy loops | unset                   |
 
 ### Server URL
 
-Either pass `url` per call:
+The TypeScript runner uses the local exec server by default. Pass `url` per call only when the caller explicitly manages a different exec-server connection:
 
 ```ts
 await withSovaraRun({ name: "demo", url: "http://localhost:6000" }, fn);
 ```
 
-Or set `SOVARA_SERVER_URL` once for the process.
-
 ## Error messages
 
 The runner fails fast for misconfiguration. Common ones:
 
-- **`Sovara backend is not reachable at <url>. Open the Sovara desktop app or configure SOVARA_SERVER_URL to a reachable enterprise Sovara backend endpoint.`**
-  Open the desktop app for local runs, or point `SOVARA_SERVER_URL` at the enterprise backend.
-
-- **``Sovara user setup is missing. Run `sovara init --user-name <full-name> --user-email <email>` and retry.``**
-  Run the suggested `sovara init` command.
+- **`Sovara exec server is not reachable at <url>. Run sovara-exec-server start or use the Sovara CLI package that bundles it.`**
+  Start the exec server or pass `url` when the caller owns exec-server setup.
 
 - **``Sovara project setup is missing for <cwd>. Run `sovara init --project-root "<cwd>" --project-name <project-name>` and retry.``**
   Run the suggested `sovara init` command.

package/dist/agentCredentials.d.ts

@@ -0,0 +1,13 @@
+export type ProjectConfig = {
+    projectName: string;
+    projectRoot: string;
+};
+export type AgentConnection = {
+    projectId: string;
+    serverUrl: string;
+    agentToken: string;
+};
+export declare function findProjectConfig(startPath: string): ProjectConfig | null;
+export declare function resolveProjectConfig(cwd: string, explicitProjectName?: string): ProjectConfig;
+export declare function loadAgentConnection(projectName: string, home?: string): AgentConnection | null;
+//# sourceMappingURL=agentCredentials.d.ts.map

package/dist/agentCredentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentCredentials.d.ts","sourceRoot":"","sources":["../src/agentCredentials.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAOF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAwBzE;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,mBAAmB,CAAC,EAAE,MAAM,GAC3B,aAAa,CAYf;AAMD,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,MAAkB,GACvB,eAAe,GAAG,IAAI,CA2CxB"}

package/dist/agentCredentials.js

@@ -0,0 +1,90 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+function normalizeProjectName(projectName) {
+    const normalized = projectName?.trim();
+    return normalized ? normalized : null;
+}
+export function findProjectConfig(startPath) {
+    let current = resolve(startPath);
+    while (true) {
+        const configPath = join(current, ".sovara");
+        try {
+            if (existsSync(configPath) && statSync(configPath).isFile()) {
+                const projectName = normalizeProjectName(readFileSync(configPath, "utf8"));
+                if (!projectName) {
+                    throw new Error("Project name is required.");
+                }
+                return { projectName, projectRoot: current };
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                throw error;
+            }
+            throw new Error("Could not read Sovara project configuration.");
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+}
+export function resolveProjectConfig(cwd, explicitProjectName) {
+    const explicit = normalizeProjectName(explicitProjectName);
+    const local = findProjectConfig(cwd);
+    if (explicit) {
+        return { projectName: explicit, projectRoot: local?.projectRoot ?? cwd };
+    }
+    if (local) {
+        return local;
+    }
+    throw new Error(`Sovara project setup is missing for ${cwd}. Run \`sovara init --project-root ${JSON.stringify(cwd)} --project-name <project-name>\` and retry.`);
+}
+function credentialsPath(home) {
+    return join(home, ".sovara", "agent_connections.json");
+}
+export function loadAgentConnection(projectName, home = homedir()) {
+    const account = normalizeProjectName(projectName);
+    if (!account)
+        return null;
+    let raw;
+    try {
+        raw = readFileSync(credentialsPath(home), "utf8");
+    }
+    catch {
+        return null;
+    }
+    let payload;
+    try {
+        payload = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof payload !== "object" || payload === null)
+        return null;
+    const entry = payload[account];
+    if (typeof entry !== "object" || entry === null)
+        return null;
+    const projectId = entry.project_id;
+    const serverUrl = entry.server_url;
+    const agentToken = entry.agent_token;
+    if (typeof projectId !== "string" ||
+        typeof serverUrl !== "string" ||
+        typeof agentToken !== "string") {
+        return null;
+    }
+    const normalizedProjectId = projectId.trim();
+    const normalizedUrl = serverUrl.trim().replace(/\/$/, "");
+    const normalizedToken = agentToken.trim();
+    if (!normalizedProjectId || !normalizedUrl || !normalizedToken)
+        return null;
+    return {
+        projectId: normalizedProjectId,
+        serverUrl: normalizedUrl,
+        agentToken: normalizedToken,
+    };
+}
+//# sourceMappingURL=agentCredentials.js.map

package/dist/agentCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentCredentials.js","sourceRoot":"","sources":["../src/agentCredentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAanD,SAAS,oBAAoB,CAAC,WAAsC;IAClE,MAAM,UAAU,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;IACvC,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,IAAI,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC5D,MAAM,WAAW,GAAG,oBAAoB,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC3E,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,mBAA4B;IAE5B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,GAAG,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CACb,uCAAuC,GAAG,sCAAsC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,6CAA6C,CACjJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,OAAe,OAAO,EAAE;IAExB,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,KAAK,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE7D,MAAM,SAAS,GAAI,KAAiC,CAAC,UAAU,CAAC;IAChE,MAAM,SAAS,GAAI,KAAiC,CAAC,UAAU,CAAC;IAChE,MAAM,UAAU,GAAI,KAAiC,CAAC,WAAW,CAAC;IAClE,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,SAAS,KAAK,QAAQ;QAC7B,OAAO,UAAU,KAAK,QAAQ,EAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,mBAAmB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAE5E,OAAO;QACL,SAAS,EAAE,mBAAmB;QAC9B,SAAS,EAAE,aAAa;QACxB,UAAU,EAAE,eAAe;KAC5B,CAAC;AACJ,CAAC"}

package/dist/capture/responseEnvelope.d.ts

@@ -4,10 +4,15 @@ export type ResponseEnvelope = {
     request_url: string | null;
     headers: Record<string, string>;
     content: unknown;
-    _response_format?: "sse";
+    _response_format?: "sse" | "ndjson";
     sse?: {
         events: Array<Record<string, unknown>>;
     };
+    ndjson?: {
+        events: unknown[];
+    };
+    _stream_normalization?: Record<string, string>;
+    error?: unknown;
     _encoding?: string;
 };
 export declare function buildResponseEnvelope(response: Response): Promise<ResponseEnvelope>;

package/dist/capture/responseEnvelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"responseEnvelope.d.ts","sourceRoot":"","sources":["../../src/capture/responseEnvelope.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAkBF,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6BzF"}
+{"version":3,"file":"responseEnvelope.d.ts","sourceRoot":"","sources":["../../src/capture/responseEnvelope.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IACpC,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC;IACjD,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AA8BF,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqCzF"}

package/dist/capture/responseEnvelope.js

@@ -1,4 +1,6 @@
-import { extractSseDisplayContent, parseSseEvents } from "./sseUtils.js";
+import { scrubSensitiveHeaders } from "./sensitiveHeaders.js";
+import { parseSseEvents } from "./sseUtils.js";
+import { normalizeNdjsonStream, normalizeSseStream, parseNdjsonEvents, } from "./streamNormalizers.js";
 function headersToObject(headers) {
     const out = {};
     for (const [key, value] of headers.entries()) {
@@ -13,8 +15,20 @@ function inferEncoding(contentType) {
     const match = /charset=([^;]+)/i.exec(contentType);
     return match ? match[1].trim() : "utf-8";
 }
+function shouldParseNdjson(requestUrl) {
+    if (!requestUrl) {
+        return false;
+    }
+    try {
+        const path = new URL(requestUrl).pathname;
+        return path.endsWith("/api/chat") || path.endsWith("/api/generate");
+    }
+    catch {
+        return false;
+    }
+}
 export async function buildResponseEnvelope(response) {
-    const headers = headersToObject(response.headers);
+    const headers = scrubSensitiveHeaders(headersToObject(response.headers));
     const contentType = response.headers.get("content-type");
     const text = await response.text();
     const envelope = {
@@ -28,8 +42,15 @@ export async function buildResponseEnvelope(response) {
     const parsedSse = parseSseEvents(text);
     if (parsedSse !== null) {
         envelope._response_format = "sse";
-        envelope.content = extractSseDisplayContent(parsedSse);
         envelope.sse = { events: parsedSse };
+        Object.assign(envelope, normalizeSseStream(parsedSse, envelope.request_url));
+        return envelope;
+    }
+    const parsedNdjson = shouldParseNdjson(envelope.request_url) ? parseNdjsonEvents(text) : null;
+    if (parsedNdjson !== null) {
+        envelope._response_format = "ndjson";
+        envelope.ndjson = { events: parsedNdjson };
+        Object.assign(envelope, normalizeNdjsonStream(parsedNdjson, envelope.request_url));
         return envelope;
     }
     try {

package/dist/capture/responseEnvelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"responseEnvelope.js","sourceRoot":"","sources":["../../src/capture/responseEnvelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAazE,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,WAA0B;IAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAkB;IAC5D,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,MAAM,QAAQ,GAAqB;QACjC,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,aAAa,EAAE,QAAQ,CAAC,UAAU;QAClC,WAAW,EAAE,QAAQ,CAAC,GAAG,IAAI,IAAI;QACjC,OAAO;QACP,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC;KACtC,CAAC;IAEF,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,QAAQ,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAClC,QAAQ,CAAC,OAAO,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACvD,QAAQ,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"responseEnvelope.js","sourceRoot":"","sources":["../../src/capture/responseEnvelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAgBhC,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,WAA0B;IAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAyB;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAkB;IAC5D,MAAM,OAAO,GAAG,qBAAqB,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,MAAM,QAAQ,GAAqB;QACjC,WAAW,EAAE,QAAQ,CAAC,MAAM;QAC5B,aAAa,EAAE,QAAQ,CAAC,UAAU;QAClC,WAAW,EAAE,QAAQ,CAAC,GAAG,IAAI,IAAI;QACjC,OAAO;QACP,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,aAAa,CAAC,WAAW,CAAC;KACtC,CAAC;IAEF,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,QAAQ,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAClC,QAAQ,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QAC7E,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC;QACrC,QAAQ,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACnF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;IAC1B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/capture/sensitiveHeaders.d.ts

@@ -0,0 +1,7 @@
+export declare function isSensitiveHeader(name: string): boolean;
+export declare function scrubSensitiveHeaders(headers: Record<string, string>): Record<string, string>;
+export declare function scrubRequestEnvelopeForStorage<T extends {
+    headers: Record<string, string>;
+}>(envelope: T): T;
+export declare function extractSensitiveHeaders(headers: Record<string, string>): Record<string, string>;
+//# sourceMappingURL=sensitiveHeaders.d.ts.map

package/dist/capture/sensitiveHeaders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitiveHeaders.d.ts","sourceRoot":"","sources":["../../src/capture/sensitiveHeaders.ts"],"names":[],"mappings":"AAcA,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB;AAKD,wBAAgB,8BAA8B,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,EAC1F,QAAQ,EAAE,CAAC,GACV,CAAC,CAEH;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQxB"}

package/dist/capture/sensitiveHeaders.js

@@ -0,0 +1,41 @@
+// Provider auth / session headers that must never be persisted to recorded
+// trace data. They are stripped from stored request/response envelopes; replay
+// re-supplies auth from the user's configured API key, so dropping them here is
+// safe. Live outbound requests keep their headers (see fetch patch re-merge).
+const SENSITIVE_HEADER_NAMES = new Set([
+    "authorization",
+    "proxy-authorization",
+    "x-api-key",
+    "api-key",
+    "x-goog-api-key",
+    "cookie",
+    "set-cookie",
+]);
+export function isSensitiveHeader(name) {
+    return SENSITIVE_HEADER_NAMES.has(name.toLowerCase());
+}
+export function scrubSensitiveHeaders(headers) {
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (!isSensitiveHeader(key)) {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+// Returns a copy of a request envelope safe to persist: auth headers are
+// stripped while the original (used for the live outbound request) is left
+// untouched. Generic over the envelope shape to avoid an import cycle.
+export function scrubRequestEnvelopeForStorage(envelope) {
+    return { ...envelope, headers: scrubSensitiveHeaders(envelope.headers) };
+}
+export function extractSensitiveHeaders(headers) {
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (isSensitiveHeader(key)) {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=sensitiveHeaders.js.map

package/dist/capture/sensitiveHeaders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitiveHeaders.js","sourceRoot":"","sources":["../../src/capture/sensitiveHeaders.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,eAAe;IACf,qBAAqB;IACrB,WAAW;IACX,SAAS;IACT,gBAAgB;IAChB,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAA+B;IAE/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,MAAM,UAAU,8BAA8B,CAC5C,QAAW;IAEX,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAA+B;IAE/B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/capture/streamNormalizers.d.ts

@@ -0,0 +1,6 @@
+type RecordValue = Record<string, unknown>;
+export declare function normalizeSseStream(events: Array<RecordValue>, requestUrl: string | null): RecordValue;
+export declare function parseNdjsonEvents(text: string): unknown[] | null;
+export declare function normalizeNdjsonStream(events: unknown[], requestUrl: string | null): RecordValue;
+export {};
+//# sourceMappingURL=streamNormalizers.d.ts.map

package/dist/capture/streamNormalizers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamNormalizers.d.ts","sourceRoot":"","sources":["../../src/capture/streamNormalizers.ts"],"names":[],"mappings":"AAEA,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAiL3C,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,WAAW,CA4Cb;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,GAAG,IAAI,CAchE;AA6CD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAoC/F"}