@zackbart/connecta 0.28.1 → 0.30.0

package/dist/activity.d.ts

@@ -1,6 +1,11 @@
 import type { ActivityModule } from "./module-contracts.js";
-import type { CatalogDriftCounts, Logger } from "./types.js";
-export type ActivityCallSource = "call_tool" | "call_destructive_tool" | "batch_call" | "execute_code" | "resume_execution";
+import { type ClassificationCode } from "./errors.js";
+import type { Logger } from "./types.js";
+/** One policy for the record builder, SQL write/read boundaries, and UI. */
+export declare function activityClientFact(value: unknown, field: "name" | "version"): string | undefined;
+/** Stored package versions use a bounded release-version grammar, including prereleases. */
+export declare function activityPackageVersion(value: unknown): string | undefined;
+export type ActivityCallSource = "catalog_refresh" | "call_tool" | "call_destructive_tool" | "batch_call" | "execute_code" | "resume_execution";
 export type ActivityOutcome = "success" | "error" | "timeout" | "cancelled" | "paused" | "approved";
 /** Read-only history: how much one `resume_execution` approved (#672). */
 export type ActivityApproval = "call" | "tool";
@@ -28,11 +33,37 @@ export interface ActivityActor {
  * by construction. Deployments that need a safe human summary can add a
  * separate, explicit connector-level feature later.
  */
+export interface ActivityCatalogChange {
+    kind: "catalog_changed";
+    addedTools: number;
+    removedTools: number;
+    changedTools: number;
+}
+/** Integer metadata is checked at every write and read boundary. */
+export declare function activityCount(value: unknown): number | undefined;
+export declare function activityBehaviorFacts(event: {
+    classification?: unknown;
+    resultBytes?: unknown;
+    kind?: unknown;
+    drift?: unknown;
+    pool?: unknown;
+    actorBasis?: unknown;
+}): Pick<ToolCallActivityEvent, "classification" | "resultBytes" | "kind" | "drift" | "pool" | "actorBasis">;
 export interface ToolCallActivityEvent {
     schemaVersion: 1;
     id: string;
     occurredAt: string;
     requestId: string;
+    /** Absent on legacy tool rows. Catalog changes use the same paging envelope. */
+    kind?: "catalog_drift";
+    drift?: ActivityCatalogChange;
+    /** The final registry verdict captured when resolution succeeded. */
+    classification?: "read" | "write";
+    /** UTF-8 bytes of the downstream value before result paging or truncation. */
+    resultBytes?: number;
+    pool?: string;
+    /** Personal ownership is provable only for rows recorded from the admitted principal. */
+    actorBasis?: "principal";
     actor: ActivityActor;
     connectorId: string;
     toolName: string;
@@ -55,28 +86,13 @@ export interface ToolCallActivityEvent {
      * here — the approved arguments were never recorded.
      */
     approval?: ActivityApproval;
+    /** Real build version. Absent only in history written before telemetry existed. */
+    packageVersion?: string;
     serverName: string;
     serverVersion: string;
-    deploymentId?: string;
-}
-/**
- * A downstream catalog moved away from the manifest a release reviewed.
- *
- * Four integers and an id: the type has nowhere to put a tool name, a schema,
- * an argument, a result, or a downstream error string, which is the same
- * construction guarantee `ToolCallActivityEvent` makes. Which tool drifted is
- * deliberately absent — the runtime reports that something did, and the
- * maintainer-run check with a live catalog in front of it names names
- * ([#343](https://github.com/zackbart/connecta/issues/343),
- * [#351](https://github.com/zackbart/connecta/issues/351)).
- */
-export interface CatalogDriftActivityEvent extends CatalogDriftCounts {
-    schemaVersion: 1;
-    id: string;
-    occurredAt: string;
-    connectorId: string;
-    serverName: string;
-    serverVersion: string;
+    /** Self-declared client identity checked by activityClientFact; invalid facts are absent. */
+    clientName?: string;
+    clientVersion?: string;
     deploymentId?: string;
 }
 export interface ActivityPage {
@@ -97,13 +113,6 @@ export interface ActivityReadPage {
 /** Write-only deployments can implement only this small, vendor-neutral seam. */
 export interface ActivitySink {
     record(event: ToolCallActivityEvent): void | Promise<void>;
-    /**
-     * Optional catalog-drift channel. Optional rather than a widened `record`,
-     * because a store written before drift existed already decided what a row
-     * looks like: a sink that does not implement this simply never hears about
-     * drift, and the operator still reads the same counts from connector status.
-     */
-    recordCatalogDrift?(event: CatalogDriftActivityEvent): void | Promise<void>;
 }
 /** Optional read side used by Connecta's authenticated Activity UI. */
 export interface ActivityReader {
@@ -114,6 +123,14 @@ export interface ActivityReader {
 }
 export interface ActivityStore extends ActivitySink {
     list?: ActivityReader["list"];
+    /**
+     * The adapter and its retention, for `Connecta.describeConfig()`. Kinds
+     * other than the shipped `"d1"` and `"sqlite"` are described as `"custom"`.
+     */
+    describe?(): {
+        kind: string;
+        retentionDays?: number;
+    };
 }
 /** Reader implementations throw this for an opaque cursor they cannot decode. */
 export declare class InvalidActivityCursorError extends Error {
@@ -122,17 +139,21 @@ export declare class InvalidActivityCursorError extends Error {
 }
 export type ActivityReadGate = (actor: ActivityActor) => boolean | Promise<boolean>;
 /**
- * Deployment-scoped destination for drift observations. Not request-scoped:
- * a drifting catalog is something the deployment saw, not something a caller
- * did, so it carries no actor and no request id to attribute it to one.
+ * Default destination for catalog changes. Request attribution overrides it
+ * when a publication belongs to an admitted caller.
  */
 export interface CatalogDriftActivityContext {
-    recordDrift?: typeof recordCatalogDriftActivity;
+    recordChange?: typeof recordCatalogChangeActivity;
+    defer?: (promise: Promise<unknown>) => void;
     sink: ActivitySink;
     serverInfo: {
         name: string;
         version: string;
     };
+    clientInfo?: {
+        name: string;
+        version: string;
+    };
     deploymentId?: string;
     logger: Logger;
 }
@@ -141,34 +162,47 @@ export interface ActivityRequestContext {
     recordTool?: typeof recordToolActivity | undefined;
     sink: ActivitySink;
     actor: ActivityActor;
+    /** Personal rows identify their admitted owner in the existing actor fields. */
+    principalActor?: ActivityActor;
     requestId: string;
+    pool?: string;
     serverInfo: {
         name: string;
         version: string;
     };
+    clientInfo?: {
+        name: string;
+        version: string;
+    };
     deploymentId?: string;
     defer?: (promise: Promise<unknown>) => void;
     logger: Logger;
 }
-export type ActivityEventInput = Pick<ToolCallActivityEvent, "connectorId" | "toolName" | "address" | "source" | "outcome" | "durationMs" | "attempts" | "errorCode" | "friction">;
+export type ActivityEventInput = Pick<ToolCallActivityEvent, "connectorId" | "toolName" | "address" | "source" | "outcome" | "durationMs" | "attempts" | "friction" | "classification" | "resultBytes" | "kind" | "drift"> & {
+    /**
+     * A code connecta assigns. Rows written by older deployments may hold
+     * others, so the stored event keeps `string`; a new row never does.
+     */
+    errorCode?: ClassificationCode;
+    personal?: boolean;
+    privateCatalog?: boolean;
+};
 /**
  * Best-effort by design: activity storage can never change a tool result.
  * Workers attach async sinks to waitUntil; synchronous sinks such as Analytics
  * Engine complete inline; Node promises remain detached from the response.
  */
 export declare function recordToolActivity(context: ActivityRequestContext | undefined, input: ActivityEventInput): void;
-/**
- * Record one catalog-drift observation, best-effort like every other activity
- * write: a store that is down, or a sink that never implemented the channel,
- * can never change what a refresh returned to the caller who paid for it.
- */
-export declare function recordCatalogDriftActivity(context: CatalogDriftActivityContext | undefined, input: {
+/** A discrete catalog change, with no catalog names, descriptions or schemas. */
+export declare function recordCatalogChangeActivity(context: CatalogDriftActivityContext | undefined, input: {
     connectorId: string;
-} & CatalogDriftCounts): void;
+    drift: ActivityCatalogChange;
+    personal?: boolean;
+    privateCatalog?: boolean;
+}, request?: ActivityRequestContext): void;
 export interface ActivityHistoryOptions {
     store: ActivityStore;
     deploymentId?: string;
     readGate?: ActivityReadGate;
 }
-/** Attach payload-free history without changing tool results on store failure. */
 export declare function activityHistory(options: ActivityHistoryOptions): ActivityModule;

package/dist/activity.js

@@ -1,5 +1,8 @@
+import { CONNECTA_VERSION } from "./version.js";
+import { assertKnownOptions, keys, optionsOf } from "./config-schema.js";
 import { routeActivity } from "./routes/activity.js";
-import { boundedEchoText } from "./errors.js";
+import { boundedEchoText, classificationCode } from "./errors.js";
+import { failureRecord, logFailure } from "./operator-record.js";
 /**
  * How long an identity field may be before the store stops believing it.
  *
@@ -15,10 +18,72 @@ import { boundedEchoText } from "./errors.js";
  * 40,000 would. The `…` marker keeps a clamped value from reading as a real one.
  */
 const MAX_ACTIVITY_NAME_BYTES = 128;
+/**
+ * Client facts use bounded ASCII grammars, never truncation or escaping.
+ * Names are 1 to 64 characters: alphanumeric or @ first (scoped package names
+ * such as `@modelcontextprotocol/inspector`), then alphanumerics, space, dot,
+ * underscore, @, /, + or -. Versions are 1 to 32 characters: alphanumeric
+ * first, then alphanumerics, dot, underscore, + or -. Prototype-key names are
+ * withheld too. The end assertion rejects even a final CR/LF, unlike `$`.
+ */
+const CLIENT_FACT_GRAMMARS = {
+    name: /^[A-Za-z0-9@][A-Za-z0-9 ._@/+-]{0,63}(?![\s\S])/,
+    version: /^[A-Za-z0-9][A-Za-z0-9._+-]{0,31}(?![\s\S])/,
+};
+const RESERVED_CLIENT_FACTS = new Set(["__proto__", "constructor", "prototype"]);
+/** One policy for the record builder, SQL write/read boundaries, and UI. */
+export function activityClientFact(value, field) {
+    return typeof value === "string" && !RESERVED_CLIENT_FACTS.has(value) && CLIENT_FACT_GRAMMARS[field].test(value)
+        ? value
+        : undefined;
+}
+/** Stored package versions use a bounded release-version grammar, including prereleases. */
+export function activityPackageVersion(value) {
+    return typeof value === "string" &&
+        value.length <= 128 &&
+        /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?(?![\s\S])/.test(value)
+        ? value
+        : undefined;
+}
 /** Two names and the dot between them. */
 const MAX_ACTIVITY_ADDRESS_BYTES = MAX_ACTIVITY_NAME_BYTES * 2 + 1;
 import { agentFrictionForCode } from "./activity-friction.js";
 export { agentFrictionForCode } from "./activity-friction.js";
+/** Integer metadata is checked at every write and read boundary. */
+export function activityCount(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}
+export function activityBehaviorFacts(event) {
+    const classification = event.classification === "read" || event.classification === "write" ? event.classification : undefined;
+    const resultBytes = activityCount(event.resultBytes);
+    const change = event.drift;
+    const drift = event.kind === "catalog_drift" &&
+        change?.kind === "catalog_changed" &&
+        activityCount(change.addedTools) !== undefined &&
+        activityCount(change.removedTools) !== undefined &&
+        activityCount(change.changedTools) !== undefined
+        ? {
+            kind: "catalog_changed",
+            addedTools: change.addedTools,
+            removedTools: change.removedTools,
+            changedTools: change.changedTools,
+        }
+        : undefined;
+    // Pool names come from matched deployment config, whose grammar has no size
+    // ceiling. Invalid stored scope stays withheld rather than becoming root scope.
+    const pool = event.pool === undefined || event.pool === null
+        ? undefined
+        : typeof event.pool === "string" && /^[a-z0-9_-]+(?![\s\S])/.test(event.pool)
+            ? event.pool
+            : "<withheld>";
+    return {
+        ...(event.actorBasis === "principal" ? { actorBasis: "principal" } : {}),
+        ...(classification !== undefined ? { classification } : {}),
+        ...(resultBytes !== undefined ? { resultBytes } : {}),
+        ...(drift ? { kind: "catalog_drift", drift } : {}),
+        ...(pool !== undefined ? { pool } : {}),
+    };
+}
 /** Reader implementations throw this for an opaque cursor they cannot decode. */
 export class InvalidActivityCursorError extends Error {
     name = "InvalidActivityCursorError";
@@ -36,13 +101,24 @@ export function recordToolActivity(context, input) {
         return;
     // A caller-supplied class wins because it knows something the code table
     // cannot: friction that belongs to a call which did not fail.
-    const friction = input.friction ?? agentFrictionForCode(input.errorCode);
+    // Checked here as well as by type: a handler can put any string in a
+    // `ConnectorCallError`'s code, and a downstream's own code is not recorded.
+    const errorCode = classificationCode(input.errorCode);
+    const friction = input.friction ?? agentFrictionForCode(errorCode);
+    // Re-check client grammars at the record boundary; never spread the envelope.
+    const clientName = activityClientFact(context.clientInfo?.name, "name");
+    const clientVersion = activityClientFact(context.clientInfo?.version, "version");
     const event = {
         schemaVersion: 1,
         id: crypto.randomUUID(),
         occurredAt: new Date().toISOString(),
         requestId: context.requestId,
-        actor: context.actor,
+        actor: input.personal || input.privateCatalog ? (context.principalActor ?? { kind: context.actor.kind }) : context.actor,
+        ...activityBehaviorFacts({
+            ...input,
+            pool: context.pool,
+            actorBasis: input.privateCatalog || (input.personal && context.principalActor) ? "principal" : undefined,
+        }),
         connectorId: boundedEchoText(input.connectorId, MAX_ACTIVITY_NAME_BYTES),
         toolName: boundedEchoText(input.toolName, MAX_ACTIVITY_NAME_BYTES),
         address: boundedEchoText(input.address, MAX_ACTIVITY_ADDRESS_BYTES),
@@ -50,13 +126,14 @@ export function recordToolActivity(context, input) {
         outcome: input.outcome,
         durationMs: Math.max(0, Math.trunc(input.durationMs)),
         attempts: Math.max(1, Math.trunc(input.attempts)),
-        ...(input.errorCode ? { errorCode: input.errorCode } : {}),
+        ...(errorCode ? { errorCode } : {}),
         ...(friction ? { friction } : {}),
+        packageVersion: CONNECTA_VERSION,
         serverName: context.serverInfo.name,
         serverVersion: context.serverInfo.version,
-        ...(context.deploymentId
-            ? { deploymentId: context.deploymentId }
-            : {}),
+        ...(clientName !== undefined ? { clientName } : {}),
+        ...(clientVersion !== undefined ? { clientVersion } : {}),
+        ...(context.deploymentId ? { deploymentId: context.deploymentId } : {}),
     };
     try {
         const result = context.sink.record(event);
@@ -64,51 +141,42 @@ export function recordToolActivity(context, input) {
             return;
         }
         const pending = Promise.resolve(result).catch((error) => {
-            context.logger.warn("[connecta] activity record failed", error);
+            logFailure(context.logger, "activity record failed", failureRecord({}, error));
         });
         if (context.defer)
             context.defer(pending);
     }
     catch (error) {
-        context.logger.warn("[connecta] activity record failed", error);
+        logFailure(context.logger, "activity record failed", failureRecord({}, error));
     }
 }
-/**
- * Record one catalog-drift observation, best-effort like every other activity
- * write: a store that is down, or a sink that never implemented the channel,
- * can never change what a refresh returned to the caller who paid for it.
- */
-export function recordCatalogDriftActivity(context, input) {
-    if (!context?.sink.recordCatalogDrift)
+/** A discrete catalog change, with no catalog names, descriptions or schemas. */
+export function recordCatalogChangeActivity(context, input, request) {
+    if (!context)
         return;
-    const event = {
-        schemaVersion: 1,
-        id: crypto.randomUUID(),
-        occurredAt: new Date().toISOString(),
-        connectorId: boundedEchoText(input.connectorId, MAX_ACTIVITY_NAME_BYTES),
-        unclassifiedTools: input.unclassifiedTools,
-        unservedTools: input.unservedTools,
-        annotationConflicts: input.annotationConflicts,
-        schemaChanges: input.schemaChanges,
-        serverName: context.serverInfo.name,
-        serverVersion: context.serverInfo.version,
-        ...(context.deploymentId ? { deploymentId: context.deploymentId } : {}),
-    };
-    try {
-        const result = context.sink.recordCatalogDrift(event);
-        if (!result || typeof result.then !== "function") {
-            return;
-        }
-        void Promise.resolve(result).catch((error) => {
-            context.logger.warn("[connecta] catalog drift record failed", error);
-        });
-    }
-    catch (error) {
-        context.logger.warn("[connecta] catalog drift record failed", error);
-    }
+    recordToolActivity(request ?? {
+        ...context,
+        actor: { kind: "system" },
+        requestId: crypto.randomUUID(),
+    }, {
+        connectorId: input.connectorId,
+        toolName: "<catalog>",
+        address: `${input.connectorId}.<catalog>`,
+        source: "catalog_refresh",
+        outcome: "success",
+        durationMs: 0,
+        attempts: 1,
+        kind: "catalog_drift",
+        drift: input.drift,
+        ...(input.personal ? { personal: true } : {}),
+        ...(input.privateCatalog ? { privateCatalog: true } : {}),
+    });
 }
 /** Attach payload-free history without changing tool results on store failure. */
+/** The closed options activityHistory() accepts; see `assertKnownOptions`. */
+const ACTIVITY_HISTORY_OPTIONS = optionsOf()(keys("store", "deploymentId", "readGate"));
 export function activityHistory(options) {
+    options = assertKnownOptions(options, "activityHistory()", ACTIVITY_HISTORY_OPTIONS);
     if (!options || typeof options.store?.record !== "function") {
         throw new Error("activityHistory.store must implement record(event)");
     }
@@ -116,6 +184,6 @@ export function activityHistory(options) {
         ...options,
         handle: routeActivity,
         recordTool: recordToolActivity,
-        recordDrift: recordCatalogDriftActivity,
+        recordChange: recordCatalogChangeActivity,
     };
 }

package/dist/argument-redaction.js

@@ -0,0 +1,230 @@
+const PUBLIC = {};
+const OMIT = { omit: true };
+const OMITTED = Symbol("omitted argument");
+const MAX_DEPTH = 32;
+const MAX_SCHEMAS = 2048;
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function sensitive(plan) {
+    return Object.keys(plan).length > 0;
+}
+function equal(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+function item(plan, index) {
+    return plan.prefix?.[index] ?? plan.items ?? PUBLIC;
+}
+/** Combine restrictions from references, siblings, and allOf without losing array indices. */
+function merge(left, right) {
+    if (left.omit || right.omit)
+        return OMIT;
+    const names = new Set([...Object.keys(left.properties ?? {}), ...Object.keys(right.properties ?? {})]);
+    const properties = Object.fromEntries([...names]
+        .sort()
+        .map((name) => [
+        name,
+        merge(Object.hasOwn(left.properties ?? {}, name) ? left.properties[name] : PUBLIC, Object.hasOwn(right.properties ?? {}, name) ? right.properties[name] : PUBLIC),
+    ]));
+    const items = mergeItems(left.items ?? PUBLIC, right.items ?? PUBLIC);
+    const prefix = Array.from({ length: Math.max(left.prefix?.length ?? 0, right.prefix?.length ?? 0) }, (_, index) => mergeItems(item(left, index), item(right, index)));
+    // Equivalent plans compare equally even when one schema spells out public prefixes.
+    while (prefix.length && equal(prefix.at(-1), items))
+        prefix.pop();
+    return {
+        ...(names.size ? { properties } : {}),
+        ...(prefix.length ? { prefix } : {}),
+        ...(sensitive(items) ? { items } : {}),
+    };
+}
+function mergeItems(left, right) {
+    if (!sensitive(left))
+        return right;
+    if (!sensitive(right))
+        return left;
+    return merge(left, right);
+}
+/** Compile a bounded plan. Unknown sensitivity refuses the entire echo, never just a branch. */
+function compile(root, unionAlternatives = false) {
+    let visited = 0;
+    const active = new Set();
+    const unresolved = () => {
+        throw new Error("Unresolved argument sensitivity");
+    };
+    function reference(ref) {
+        if (typeof ref !== "string" || !ref.startsWith("#"))
+            return unresolved();
+        const pointer = decodeURIComponent(ref.slice(1));
+        if (pointer === "")
+            return root;
+        if (!pointer.startsWith("/"))
+            return unresolved();
+        let target = root;
+        for (const encoded of pointer.slice(1).split("/")) {
+            if (/~[^01]|~$/.test(encoded))
+                return unresolved();
+            const key = encoded.replace(/~1/g, "/").replace(/~0/g, "~");
+            if (target === null || typeof target !== "object" || !Object.hasOwn(target, key))
+                return unresolved();
+            target = target[key];
+        }
+        return target;
+    }
+    function walk(schema, depth) {
+        if (++visited > MAX_SCHEMAS || depth > MAX_DEPTH)
+            return unresolved();
+        if (typeof schema === "boolean")
+            return PUBLIC;
+        if (!object(schema) || active.has(schema))
+            return unresolved();
+        if (schema["writeOnly"] !== undefined && typeof schema["writeOnly"] !== "boolean")
+            return unresolved();
+        if (schema["writeOnly"] === true)
+            return OMIT;
+        if ((schema !== root && schema["$id"] !== undefined) ||
+            schema["$dynamicRef"] !== undefined ||
+            schema["$recursiveRef"] !== undefined)
+            return unresolved();
+        active.add(schema);
+        try {
+            let plan = PUBLIC;
+            const child = (value) => walk(value, depth + 1);
+            if (schema["$ref"] !== undefined)
+                plan = merge(plan, child(reference(schema["$ref"])));
+            if (schema["properties"] !== undefined) {
+                if (!object(schema["properties"]))
+                    return unresolved();
+                const properties = Object.entries(schema["properties"])
+                    .map(([name, value]) => [name, child(value)])
+                    .filter(([, value]) => sensitive(value))
+                    .sort(([a], [b]) => a.localeCompare(b));
+                plan = merge(plan, properties.length ? { properties: Object.fromEntries(properties) } : PUBLIC);
+            }
+            const prefixes = schema["prefixItems"] ?? (Array.isArray(schema["items"]) ? schema["items"] : undefined);
+            if (prefixes !== undefined && !Array.isArray(prefixes))
+                return unresolved();
+            if (schema["prefixItems"] !== undefined && Array.isArray(schema["items"]))
+                return unresolved();
+            const tail = Array.isArray(schema["items"]) ? schema["additionalItems"] : schema["items"];
+            const arrayPlan = {
+                ...(prefixes ? { prefix: prefixes.map(child) } : {}),
+                ...(tail !== undefined ? { items: child(tail) } : {}),
+            };
+            plan = merge(plan, arrayPlan);
+            for (const keyword of ["allOf", "oneOf", "anyOf"]) {
+                const branches = schema[keyword];
+                if (branches === undefined)
+                    continue;
+                if (!Array.isArray(branches) || !branches.length)
+                    return unresolved();
+                const plans = branches.map(child);
+                if (keyword === "allOf" || unionAlternatives)
+                    for (const branch of plans)
+                        plan = merge(plan, branch);
+                else {
+                    if (plans.some((branch) => !equal(branch, plans[0])))
+                        return unresolved();
+                    plan = merge(plan, plans[0]);
+                }
+            }
+            // These applicators need matching/evaluation rules we do not implement.
+            // Public-only schemas are harmless; sensitivity or an unresolved reference fails closed.
+            for (const keyword of [
+                "additionalProperties",
+                "unevaluatedProperties",
+                "unevaluatedItems",
+                "contains",
+                "not",
+                "if",
+                "then",
+                "else",
+            ])
+                if (schema[keyword] !== undefined && sensitive(child(schema[keyword])))
+                    return unresolved();
+            for (const keyword of ["patternProperties", "dependentSchemas", "dependencies"]) {
+                if (schema[keyword] === undefined)
+                    continue;
+                if (!object(schema[keyword]))
+                    return unresolved();
+                for (const value of Object.values(schema[keyword])) {
+                    if (keyword === "dependencies" && Array.isArray(value))
+                        continue;
+                    if (sensitive(child(value)))
+                        return unresolved();
+                }
+            }
+            return plan;
+        }
+        finally {
+            active.delete(schema);
+        }
+    }
+    return walk(root, 0);
+}
+/** Omit whole array values when private elements cannot be removed without shifting indices. */
+function apply(value, plan, mark, depth = 0) {
+    if (!sensitive(plan))
+        return value;
+    if (depth > MAX_DEPTH)
+        throw new Error("Argument redaction depth exceeded");
+    if (plan.omit) {
+        mark(value);
+        return OMITTED;
+    }
+    if (Array.isArray(value)) {
+        const values = value.map((entry, index) => apply(entry, item(plan, index), mark, depth + 1));
+        return values.includes(OMITTED) ? OMITTED : values;
+    }
+    if (!object(value))
+        return value;
+    return Object.fromEntries(Object.entries(value).flatMap(([name, entry]) => {
+        const field = Object.hasOwn(plan.properties ?? {}, name) ? plan.properties[name] : PUBLIC;
+        const filtered = apply(entry, field, mark, depth + 1);
+        return filtered === OMITTED ? [] : [[name, filtered]];
+    }));
+}
+/** Output redaction protects the union of private fields across alternatives.
+ * Other sensitivity rules and unresolved-schema handling follow echo redaction. */
+export function visitPrivateCallArguments(args, schema, visit) {
+    // Public-only schemas need no sensitivity compilation, regardless of size.
+    // Iterative traversal visits each object once, including definitions and cycles.
+    const pending = [schema];
+    const seen = new Set();
+    let privateSchema = false;
+    while (pending.length) {
+        const value = pending.pop();
+        if (value === null || typeof value !== "object" || seen.has(value))
+            continue;
+        seen.add(value);
+        if (Object.hasOwn(value, "writeOnly") && value["writeOnly"] === true) {
+            privateSchema = true;
+            break;
+        }
+        for (const entry of Object.values(value))
+            pending.push(entry);
+    }
+    if (!privateSchema)
+        return;
+    try {
+        apply(args, compile(schema, true), visit);
+    }
+    catch {
+        // When a private annotation exists but its location cannot be resolved,
+        // treat every submitted value as private, just as the echo is withheld.
+        visit(args);
+    }
+}
+/** Internal schema filter; the single echo helper owns snapshotting and byte budgeting. */
+export function redactCallArguments(args, schema) {
+    try {
+        const plan = compile(schema);
+        let redacted = false;
+        const value = apply(args, plan, () => {
+            redacted = true;
+        });
+        return { ...(value !== OMITTED ? { value } : {}), redacted };
+    }
+    catch {
+        return { redacted: true };
+    }
+}