agent-hitch 0.2.7 → 0.2.8

package/dist/src/evals/verifier-runtime.js

@@ -0,0 +1,61 @@
+import { chmod, copyFile, mkdir, mkdtemp, rm } from "node:fs/promises";
+import path from "node:path";
+import { ensureControllerRuntime, PACKAGE_ROOT, useControllerRuntimeById } from "../controller-runtime/index.js";
+import { ensureDir, invalidInput, sha256JSON, statePaths } from "../foundation/index.js";
+export const VERIFIER_ENVIRONMENT_PROVIDER = "integrations/harbor/hitch_harbor_environment.py";
+/** Runtime changes for artifact-only regrades are restricted to one provider.
+ * The complete file membership, grader, normalizer, candidate and CLI stay fixed. */
+export function verifierRuntimeRepair(source, replacement) {
+    if (source.runtime_id === replacement.runtime_id)
+        return null;
+    const before = source.manifest, after = replacement.manifest;
+    if (before.schema_version !== after.schema_version || before.node_range !== after.node_range
+        || sha256JSON(before.entrypoints) !== sha256JSON(after.entrypoints)
+        || before.files.length !== after.files.length)
+        throw invalidInput("verifier runtime repair changes its execution contract");
+    const changed = before.files.filter(file => {
+        const other = after.files.find(candidate => candidate.path === file.path);
+        if (!other || other.executable !== file.executable)
+            throw invalidInput("verifier runtime repair changes file membership or permissions");
+        return sha256JSON(file) !== sha256JSON(other);
+    });
+    if (changed.length !== 1 || changed[0].path !== VERIFIER_ENVIRONMENT_PROVIDER) {
+        throw invalidInput("verifier runtime repair may change only the Docker environment provider");
+    }
+    return {
+        schema_version: "1", kind: "verifier-environment-runtime-repair",
+        source_runtime_id: source.runtime_id, replacement_runtime_id: replacement.runtime_id,
+        path: VERIFIER_ENVIRONMENT_PROVIDER, source_sha256: changed[0].sha256,
+        replacement_sha256: after.files.find(file => file.path === VERIFIER_ENVIRONMENT_PROVIDER).sha256,
+        unchanged_file_count: before.files.length - 1,
+    };
+}
+/** Build a new immutable runtime without writing into the original CAS entry. */
+export async function prepareVerifierEnvironmentRuntime(options) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(options.sourceRuntimeId))
+        throw invalidInput("invalid source controller runtime ID");
+    const paths = statePaths(options.root);
+    const source = await useControllerRuntimeById(paths, options.sourceRuntimeId.slice(7));
+    if (!source.manifest.files.some(file => file.path === VERIFIER_ENVIRONMENT_PROVIDER))
+        throw invalidInput("source runtime has no Docker environment provider");
+    const staging = await mkdtemp(path.join(await ensureDir(paths.temporary), "verifier-runtime-"));
+    try {
+        for (const file of source.manifest.files) {
+            const target = path.join(staging, file.path);
+            await mkdir(path.dirname(target), { recursive: true });
+            await copyFile(path.join(source.directory, "payload", file.path), target);
+            await chmod(target, file.executable ? 0o755 : 0o644);
+        }
+        await copyFile(options.providerPath ?? path.join(PACKAGE_ROOT, VERIFIER_ENVIRONMENT_PROVIDER), path.join(staging, VERIFIER_ENVIRONMENT_PROVIDER));
+        await chmod(path.join(staging, VERIFIER_ENVIRONMENT_PROVIDER), source.manifest.files.find(file => file.path === VERIFIER_ENVIRONMENT_PROVIDER).executable ? 0o755 : 0o644);
+        const replacement = await ensureControllerRuntime({ root: options.root, payloadRoot: staging,
+            rules: source.manifest.files.map(file => ({ path: file.path, executable: file.executable })) });
+        verifierRuntimeRepair(source, replacement);
+        await useControllerRuntimeById(paths, options.sourceRuntimeId.slice(7));
+        return replacement;
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=verifier-runtime.js.map

package/dist/src/evals/verifier-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier-runtime.js","sourceRoot":"","sources":["../../../src/evals/verifier-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAEjH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzF,MAAM,CAAC,MAAM,6BAA6B,GAAG,iDAAiD,CAAC;AAE/F;qFACqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,MAAkC,EAAE,WAAuC;IAC/G,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC;IAC7D,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;WACvF,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;WAChE,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,YAAY,CAAC,wDAAwD,CAAC,CAAC;IAC9H,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;YAAE,MAAM,YAAY,CAAC,gEAAgE,CAAC,CAAC;QACzI,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;QAC/E,MAAM,YAAY,CAAC,yEAAyE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,qCAAqC;QAChE,iBAAiB,EAAE,MAAM,CAAC,UAAU,EAAE,sBAAsB,EAAE,WAAW,CAAC,UAAU;QACpF,IAAI,EAAE,6BAA6B,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM;QACtE,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,6BAA6B,CAAE,CAAC,MAAM;QACjG,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,OAEvD;IACC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,MAAM,YAAY,CAAC,sCAAsC,CAAC,CAAC;IACvH,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,6BAA6B,CAAC;QAAE,MAAM,YAAY,CAAC,mDAAmD,CAAC,CAAC;IAC9J,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1E,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,6BAA6B,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAAC;QAClJ,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,6BAA6B,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,6BAA6B,CAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5K,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO;YAC1F,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3C,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,WAAW,CAAC;IACrB,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACpE,CAAC"}

package/dist/src/evals/verifier-score-artifacts.js

@@ -0,0 +1,119 @@
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+import { MAX_VERIFIER_FEEDBACK_BYTES, MAX_VERIFIER_PROCESS_BYTES, assertVerifierScoreEvidenceConsistency, parseVerifierFeedback, parseVerifierProcessEvidence, parseVerifierScores, } from "../domain/index.js";
+import { atomicWriteJSON, openContainedRegularFile, safeDiagnosticMessage, sha256Bytes } from "../foundation/index.js";
+import { sanitizeVerifierJson } from "../runs/index.js";
+import { loadBenchmarkAdapterManifest, scoreWithinRange } from "./benchmark-adapter-manifest.js";
+/**
+ * Validate and persist only the two standard structured verifier artifacts.
+ * Arbitrary files in the verifier directory remain private and inaccessible.
+ */
+export async function captureVerifierScoreEvidence(input) {
+    try {
+        throwIfAborted(input.signal);
+        const adapterManifest = input.dataset === undefined ? null : await loadBenchmarkAdapterManifest(input.dataset);
+        if (adapterManifest && adapterManifest.dataset_digest !== input.benchmarkRevision) {
+            throw new TypeError("benchmark adapter manifest changed after eval admission");
+        }
+        const root = await realpath(input.trialDirectory);
+        const processSource = await optionalJson(root, "process.json", MAX_VERIFIER_PROCESS_BYTES, input.signal);
+        const feedbackSource = await optionalJson(root, "feedback.json", MAX_VERIFIER_FEEDBACK_BYTES, input.signal);
+        const scores = parseVerifierScores(input.verifierResult);
+        let processEvidence = processSource === undefined ? undefined : parseVerifierProcessEvidence(processSource.value);
+        let feedback = feedbackSource === undefined ? undefined : parseVerifierFeedback(feedbackSource.value, processEvidence);
+        assertVerifierScoreEvidenceConsistency({
+            scores,
+            ...(processEvidence === undefined ? {} : { process: processEvidence }),
+            ...(feedback === undefined ? {} : { feedback }),
+        });
+        if (adapterManifest) {
+            if (!scores || scores.normalization !== "standard")
+                throw new TypeError("standardized benchmark requires total_score");
+            if (!scoreWithinRange(scores.total_score, adapterManifest.scoring.total_score))
+                throw new TypeError("total_score is outside the benchmark range");
+            const processDefinition = adapterManifest.scoring.process_score;
+            if ((scores.process_score !== undefined) !== (processDefinition !== undefined)) {
+                throw new TypeError("process_score availability differs from the benchmark manifest");
+            }
+            if (processDefinition && scores.process_score !== undefined && !scoreWithinRange(scores.process_score, processDefinition)) {
+                throw new TypeError("process_score is outside the benchmark range");
+            }
+            if (processDefinition && processEvidence?.metric !== processDefinition.source_metric) {
+                throw new TypeError("process evidence metric differs from the benchmark manifest");
+            }
+        }
+        // Sanitize while credentials are still available, before sealing the run.
+        // Revalidate both artifacts before writing either: a redacted identifier or
+        // reference must fail closed instead of persisting an invalid contract.
+        const credentials = input.credentialValues ?? [];
+        processEvidence = processEvidence === undefined ? undefined : parseVerifierProcessEvidence(sanitizeVerifierJson(processEvidence, credentials).value);
+        feedback = feedback === undefined ? undefined : parseVerifierFeedback(sanitizeVerifierJson(feedback, credentials).value, processEvidence);
+        const structuredArtifacts = {};
+        if (processEvidence) {
+            const target = path.join(input.runDirectory, "verifier", "process.json");
+            await atomicWriteJSON(target, processEvidence);
+            structuredArtifacts.process = artifact("verifier/process.json", encoded(processEvidence));
+        }
+        if (feedback) {
+            const target = path.join(input.runDirectory, "verifier", "feedback.json");
+            await atomicWriteJSON(target, feedback);
+            structuredArtifacts.feedback = artifact("verifier/feedback.json", encoded(feedback));
+        }
+        return {
+            ...(scores === undefined ? {} : { scores }),
+            ...(processEvidence === undefined ? {} : { process: processEvidence }),
+            ...(feedback === undefined ? {} : { feedback }),
+            ...(Object.keys(structuredArtifacts).length === 0 ? {} : { structured_artifacts: structuredArtifacts }),
+        };
+    }
+    catch (error) {
+        if (input.signal?.aborted || error?.name === "AbortError")
+            throw error;
+        return {
+            issue: safeDiagnosticMessage(error, input.credentialValues ?? []).slice(0, 1024),
+        };
+    }
+}
+async function optionalJson(root, name, maximumBytes, signal) {
+    let safe;
+    try {
+        safe = await openContainedRegularFile(root, `verifier/${name}`, maximumBytes);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new TypeError(`unsafe structured verifier artifact: ${name}`, { cause: error });
+    }
+    try {
+        throwIfAborted(signal);
+        const bytes = await safe.handle.readFile();
+        await safe.assertUnchanged();
+        const value = JSON.parse(bytes.toString("utf8"));
+        if (!isJsonValue(value))
+            throw new TypeError(`${name} is not JSON data`);
+        return { value, bytes };
+    }
+    finally {
+        await safe.handle.close();
+    }
+}
+function artifact(ref, bytes) {
+    return { ref, bytes: bytes.length, sha256: sha256Bytes(bytes) };
+}
+function encoded(value) {
+    return Buffer.from(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+function isJsonValue(value) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return true;
+    if (typeof value === "number")
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return value.every(isJsonValue);
+    return Boolean(value) && typeof value === "object" && Object.values(value).every(isJsonValue);
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+//# sourceMappingURL=verifier-score-artifacts.js.map

package/dist/src/evals/verifier-score-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier-score-artifacts.js","sourceRoot":"","sources":["../../../src/evals/verifier-score-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,sCAAsC,EACtC,qBAAqB,EACrB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAajG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAQlD;IACC,IAAI,CAAC;QACH,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/G,IAAI,eAAe,IAAI,eAAe,CAAC,cAAc,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAClF,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,0BAA0B,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzG,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,2BAA2B,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzD,IAAI,eAAe,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAClH,IAAI,QAAQ,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACvH,sCAAsC,CAAC;YACrC,MAAM;YACN,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;YACvH,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;YAClJ,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC/E,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,iBAAiB,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAC1H,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,iBAAiB,IAAI,eAAe,EAAE,MAAM,KAAK,iBAAiB,CAAC,aAAa,EAAE,CAAC;gBACrF,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACjD,eAAe,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CACxF,oBAAoB,CAAC,eAAuC,EAAE,WAAW,CAAC,CAAC,KAAK,CACjF,CAAC;QACF,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CACnE,oBAAoB,CAAC,QAAgC,EAAE,WAAW,CAAC,CAAC,KAAK,EACzE,eAAe,CAChB,CAAC;QACF,MAAM,mBAAmB,GAAyE,EAAE,CAAC;QACrG,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACzE,MAAM,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAC/C,mBAAmB,CAAC,OAAO,GAAG,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;YAC1E,MAAM,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACxC,mBAAmB,CAAC,QAAQ,GAAG,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,OAAO;YACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;SACxG,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,IAAK,KAAe,EAAE,IAAI,KAAK,YAAY;YAAE,MAAM,KAAK,CAAC;QAClF,OAAO;YACL,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,IAAsC,EACtC,YAAoB,EACpB,MAAoB;IAEpB,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,IAAI,SAAS,CAAC,wCAAwC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC;QACH,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAwC,EAAE,KAAa;IACvE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAW,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC3H,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;AAC1G,CAAC"}

package/dist/src/foundation/contained-file.js

@@ -0,0 +1,85 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+/** Open an untrusted relative file without following any directory or file symlink. */
+export async function openContainedRegularFile(root, relative, maximumBytes = Number.MAX_SAFE_INTEGER) {
+    const segments = normalizedSegments(relative);
+    const canonicalRoot = await realpath(root);
+    if (canonicalRoot !== path.resolve(root))
+        throw new TypeError("contained file root must be canonical");
+    const parents = [];
+    let directory = canonicalRoot;
+    parents.push({ path: directory, stats: await safeDirectory(directory) });
+    for (const segment of segments.slice(0, -1)) {
+        directory = path.join(directory, segment);
+        const info = await safeDirectory(directory);
+        if (!isWithin(canonicalRoot, await realpath(directory)))
+            throw new TypeError("contained file parent escapes its root");
+        parents.push({ path: directory, stats: info });
+    }
+    const target = path.join(canonicalRoot, ...segments);
+    const before = await lstat(target);
+    if (before.isSymbolicLink() || !before.isFile() || before.nlink !== 1)
+        throw new TypeError("contained file is not a safe regular file");
+    const handle = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const opened = await handle.stat();
+        const after = await lstat(target);
+        await assertParentsUnchanged(parents);
+        if (!sameFile(opened, before) || !sameFile(opened, after) || !isWithin(canonicalRoot, await realpath(target))) {
+            throw new TypeError("contained file identity changed while opening");
+        }
+        await assertParentsUnchanged(parents);
+        if (opened.size > maximumBytes)
+            throw new TypeError("contained file exceeds its limit");
+        return {
+            handle,
+            size: opened.size,
+            assertUnchanged: async () => {
+                const current = await handle.stat();
+                const pathname = await lstat(target);
+                await assertParentsUnchanged(parents);
+                if (!sameFile(opened, current) || !sameFile(opened, pathname)
+                    || current.size !== opened.size || current.mtimeMs !== opened.mtimeMs
+                    || !isWithin(canonicalRoot, await realpath(target))) {
+                    throw new TypeError("contained file changed while being read");
+                }
+                await assertParentsUnchanged(parents);
+            },
+        };
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+async function safeDirectory(directory) {
+    const info = await lstat(directory);
+    if (info.isSymbolicLink() || !info.isDirectory())
+        throw new TypeError("contained file parent is unsafe");
+    return info;
+}
+async function assertParentsUnchanged(parents) {
+    for (const parent of parents) {
+        const current = await safeDirectory(parent.path);
+        if (current.dev !== parent.stats.dev || current.ino !== parent.stats.ino) {
+            throw new TypeError("contained file parent changed while opening");
+        }
+    }
+}
+function normalizedSegments(relative) {
+    if (!relative || relative.includes("\\") || relative.startsWith("/"))
+        throw new TypeError("contained file path is invalid");
+    const segments = relative.split("/");
+    if (segments.some((segment) => !segment || segment === "." || segment === ".."))
+        throw new TypeError("contained file path is invalid");
+    return segments;
+}
+function sameFile(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.isFile() && right.isFile() && right.nlink === 1;
+}
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+//# sourceMappingURL=contained-file.js.map

package/dist/src/foundation/contained-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contained-file.js","sourceRoot":"","sources":["../../../src/foundation/contained-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAc,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAmB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,QAAgB,EAChB,YAAY,GAAG,MAAM,CAAC,gBAAgB;IAEtC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,aAAa,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IACvG,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,IAAI,SAAS,GAAG,aAAa,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACzE,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;QACvH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACxI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC9G,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,GAAG,YAAY;YAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACxF,OAAO;YACL,MAAM;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,eAAe,EAAE,KAAK,IAAmB,EAAE;gBACzC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrC,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;uBACxD,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;uBAClE,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;oBACtD,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAA8C;IAClF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACzE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC5H,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACvI,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAW,EAAE,KAAY;IACzC,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC;AAClH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC"}

package/dist/src/foundation/credential-redaction.js

@@ -16,6 +16,16 @@ const TEXT_RULES = [
 ];
 const SECRET_HEADER = /^(\s*(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|x-[a-z0-9-]*(?:secret|token|api-key)[a-z0-9-]*)\s*:\s*).+$/gim;
 const NAMED_SECRET = /((?:"|')?(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|api[-_]?key|access[-_]?token|refresh[-_]?token|client[-_]?secret|secret|password|credential)(?:"|')?\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;}\]]+)/gi;
+/** Match credential-bearing JSON/header field names independently of current environment values. */
+export function isSensitiveFieldName(value) {
+    const normalized = value
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_");
+    const parts = normalized.split("_").filter(Boolean);
+    return parts.includes("token") || parts.includes("auth")
+        || /authorization|cookie|api_key|client_secret|private_key|password|credential|(?:^|_)secret(?:_|$)/.test(normalized);
+}
 export function safeDiagnosticMessage(value, credentialValues = [], maxCharacters = 4_096) {
     if (!Number.isSafeInteger(maxCharacters) || maxCharacters < 32)
         throw new TypeError("diagnostic message limit is invalid");
@@ -64,8 +74,23 @@ export function credentialValuesFromEnv(names, env) {
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
             throw new TypeError(`invalid credential environment name: ${name}`);
         const value = env[name];
-        if (value !== undefined && value.length > 0)
+        if (value !== undefined && value.length > 0) {
             values.push(value);
+            // Structured credential files can be handed off as one environment value.
+            // Also redact their opaque strings when a client prints a nested token.
+            if (value.trimStart().startsWith("{")) {
+                try {
+                    const collect = (entry) => {
+                        if (typeof entry === "string" && entry.length >= 16)
+                            values.push(entry);
+                        else if (entry && typeof entry === "object")
+                            Object.values(entry).forEach(collect);
+                    };
+                    collect(JSON.parse(value));
+                }
+                catch { /* Opaque non-JSON credentials retain the exact-value rule. */ }
+            }
+        }
     }
     return [...new Set(values)].sort((left, right) => right.length - left.length || left.localeCompare(right));
 }

package/dist/src/foundation/credential-redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-redaction.js","sourceRoot":"","sources":["../../../src/foundation/credential-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB;IACpH,mBAAmB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,gBAAgB;IAChI,sBAAsB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,uBAAuB;IACzH,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,UAAU;CAC3E,CAAC;AACX,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAC9D,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,MAAM,UAAU,GAAgE;IAC9E,EAAE,EAAE,EAAE,yBAAyB,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,UAAU,2BAA2B,EAAE,EAAE;IACvI,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,sCAAsC,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACxH,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,0FAA0F,EAAE,WAAW,EAAE,KAAK,2BAA2B,EAAE,EAAE;CAChL,CAAC;AAEF,MAAM,aAAa,GAAG,qIAAqI,CAAC;AAC5J,MAAM,YAAY,GAAG,0NAA0N,CAAC;AAOhP,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,mBAAsC,EAAE,EACxC,aAAa,GAAG,KAAK;IAErB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,oBAAoB,CAAE,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC;IAC9G,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,mBAAsC,EAAE;IAC1F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7E,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;YAChC,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,2BAA2B,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,UAAU,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;QACpD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE;QAC5D,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC7C,OAAO,GAAG,MAAM,GAAG,2BAA2B,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,OAAe,EAAE,EAAE;QAC5E,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,2BAA2B,GAAG,KAAK,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAwB,EAAE,GAAsB;IACtF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QAChH,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,gBAAmC,EACnC,YAAY,GAAG,sBAAsB;IAErC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IAC9H,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChJ,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAsB,EAAE,SAAS,EAAE,QAAQ;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnE,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAc,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpG,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAc,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CACZ,MAAiB,EACjB,KAAa,EACb,gBAAmC,EACnC,YAAoB,EACpB,YAA2B,EAC3B,aAAuC;IAEvC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,YAAY,EAAE,EAAE,CAAC;YACnB,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACnC,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAAC;;gBACjF,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,EAAE,CAAC;YACZ,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,MAA2B,EAAE,IAAY,EAAE,KAAK,GAAG,CAAC;IACrE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"credential-redaction.js","sourceRoot":"","sources":["../../../src/foundation/credential-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB;IACpH,mBAAmB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,gBAAgB;IAChI,sBAAsB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,uBAAuB;IACzH,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,UAAU;CAC3E,CAAC;AACX,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAC9D,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,MAAM,UAAU,GAAgE;IAC9E,EAAE,EAAE,EAAE,yBAAyB,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,UAAU,2BAA2B,EAAE,EAAE;IACvI,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,sCAAsC,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACxH,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,0FAA0F,EAAE,WAAW,EAAE,KAAK,2BAA2B,EAAE,EAAE;CAChL,CAAC;AAEF,MAAM,aAAa,GAAG,qIAAqI,CAAC;AAC5J,MAAM,YAAY,GAAG,0NAA0N,CAAC;AAOhP,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK;SACrB,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnD,iGAAiG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,mBAAsC,EAAE,EACxC,aAAa,GAAG,KAAK;IAErB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,oBAAoB,CAAE,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC;IAC9G,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,mBAAsC,EAAE;IAC1F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7E,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;YAChC,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,2BAA2B,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,UAAU,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;QACpD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE;QAC5D,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC7C,OAAO,GAAG,MAAM,GAAG,2BAA2B,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,OAAe,EAAE,EAAE;QAC5E,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,2BAA2B,GAAG,KAAK,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAwB,EAAE,GAAsB;IACtF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QAChH,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,CAAC,KAAc,EAAQ,EAAE;wBACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;4BAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;6BACnE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;4BAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBACrF,CAAC,CAAC;oBACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC,CAAC,8DAA8D,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,gBAAmC,EACnC,YAAY,GAAG,sBAAsB;IAErC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IAC9H,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChJ,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAsB,EAAE,SAAS,EAAE,QAAQ;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnE,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAc,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpG,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAc,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CACZ,MAAiB,EACjB,KAAa,EACb,gBAAmC,EACnC,YAAoB,EACpB,YAA2B,EAC3B,aAAuC;IAEvC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,YAAY,EAAE,EAAE,CAAC;YACnB,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACnC,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAAC;;gBACjF,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,EAAE,CAAC;YACZ,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,MAA2B,EAAE,IAAY,EAAE,KAAK,GAAG,CAAC;IACrE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/foundation/fs.js

@@ -1,4 +1,4 @@
-import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { chmod, mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { randomBytes } from "node:crypto";
 import path from "node:path";
 export async function ensureDir(directory) {
@@ -41,5 +41,6 @@ export async function removeIfExists(file) {
 export async function writePrivateFile(file, value) {
     await ensureDir(path.dirname(file));
     await writeFile(file, value, { mode: 0o600 });
+    await chmod(file, 0o600);
 }
 //# sourceMappingURL=fs.js.map

package/dist/src/foundation/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/foundation/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAiB;IAC/C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,IAAY,EAAE,QAAY;IACpE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QACnG,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc,EAAE,IAAI,GAAG,KAAK;IAC9E,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC/F,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAChE,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../../src/foundation/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAiB;IAC/C,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,IAAY,EAAE,QAAY;IACpE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QACnG,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc,EAAE,IAAI,GAAG,KAAK;IAC9E,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC/F,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAA0B;IAC7E,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/src/foundation/index.js

@@ -1,6 +1,7 @@
 export { DEFAULT_MAX_CONCURRENT, DEFAULT_PORT, SCHEMA_VERSION, defaultRoot, hitchRootId, parseDuration, positiveInteger, statePaths } from "./config.js";
 export { HitchError, invalidInput } from "./errors.js";
 export { appendLine, atomicWriteJSON, ensureDir, readJSON, removeIfExists, writePrivateFile } from "./fs.js";
+export { openContainedRegularFile } from "./contained-file.js";
 export { reclaimStaleLock } from "./locks.js";
 export { withFileLock } from "./locks.js";
 export { captureProcessIdentity, inspectProcessIdentity, validateProcessIdentity } from "./process-identity.js";
@@ -10,5 +11,5 @@ export { packageRoot, packageVersion } from "./package-root.js";
 export { delay, terminateProcess } from "./process.js";
 export { commandExecutable, commandVersion, detectVersion, fingerprintExecutable, prepareSpawnCommand, resolveExecutable, runCommand, selectVersionLine } from "./executable.js";
 export { canonicalJSON, digest, sha256Bytes, sha256JSON } from "./hash.js";
-export { CREDENTIAL_REDACTION_MARKER, PROVIDER_ENVIRONMENT_NAMES, createCredentialRedactionTransform, credentialValuesFromEnv, redactCredentialText, safeDiagnosticMessage } from "./credential-redaction.js";
+export { CREDENTIAL_REDACTION_MARKER, PROVIDER_ENVIRONMENT_NAMES, createCredentialRedactionTransform, credentialValuesFromEnv, isSensitiveFieldName, redactCredentialText, safeDiagnosticMessage } from "./credential-redaction.js";
 //# sourceMappingURL=index.js.map

package/dist/src/foundation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzJ,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhH,OAAO,EAAE,iCAAiC,EAAE,kCAAkC,EAAE,iCAAiC,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAElM,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjL,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzJ,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAA6B,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhH,OAAO,EAAE,iCAAiC,EAAE,kCAAkC,EAAE,iCAAiC,EAAE,mCAAmC,EAAE,MAAM,mCAAmC,CAAC;AAElM,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjL,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,kCAAkC,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/src/runs/adapter-process.js

@@ -0,0 +1,12 @@
+/** Bind a verified artifact and its invocation prefix to the adapter request. */
+export async function prepareAdapterProcess(adapter, request, artifact, resolution, runDirectory, runtimeHome) {
+    const specification = await adapter.process(request, artifact.executable, {
+        entrypoint_integrity: artifact.entrypoint_integrity,
+        observed_version: artifact.observed_version ?? undefined,
+        resolution, run_directory: runDirectory, runtime_home: runtimeHome,
+    });
+    if (artifact.entrypoint_args?.length)
+        specification.args.unshift(...artifact.entrypoint_args);
+    return specification;
+}
+//# sourceMappingURL=adapter-process.js.map

package/dist/src/runs/adapter-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-process.js","sourceRoot":"","sources":["../../../src/runs/adapter-process.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA0B,EAC1B,OAAuB,EACvB,QAA0B,EAC1B,UAA4B,EAC5B,YAAoB,EACpB,WAAmB;IAEnB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE;QACxE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,SAAS;QACxD,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW;KACnE,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,eAAe,EAAE,MAAM;QAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC9F,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/src/runs/executor.js

@@ -14,8 +14,14 @@ import { buildManifest, safeAgentArgsForPersistence } from "./manifest.js";
 import { assertQueuedRunIdentity } from "./queued.js";
 import { adapterFidelity, failureResult, mergeRedactions, providerModelId } from "./outcome.js";
 import { writeResultBundleIndex } from "./bundle.js";
-export async function executeRun({ runId, request, runsRoot, root = path.dirname(runsRoot), resolvedRevision, preparedArtifact, verifiedLocalGitSource, workspacePlan, onEvent, onProcess, signal, }) {
+import { prepareAdapterProcess } from "./adapter-process.js";
+import { completedRunManifest } from "./finalizer.js";
+export async function executeRun({ runId, request, runsRoot, root = path.dirname(runsRoot), resolvedRevision, preparedArtifact, verifiedLocalGitSource, workspacePlan, onEvent, onProcess, signal, candidateDeadlineNs, }) {
     const normalized = await validateRunRequest(request);
+    if (candidateDeadlineNs !== undefined && (typeof candidateDeadlineNs !== "bigint" || candidateDeadlineNs <= 0n
+        || normalized.context.kind !== "benchmark_task" || !normalized.defer_benchmark_observation)) {
+        throw new HitchError("candidate deadline requires a managed benchmark task", { code: "invalid_input", exitCode: 2 });
+    }
     const credentialValues = credentialValuesFromEnv(normalized.credential_names, process.env);
     workspacePlan ||= await planWorkspace({ runId, sourceCwd: normalized.cwd, mode: normalized.workspace_mode, root });
     const runDirectory = path.join(runsRoot, runId);
@@ -140,14 +146,7 @@ export async function executeRun({ runId, request, runsRoot, root = path.dirname
         stage = "adapter_setup";
         const adapterState = {};
         const executionRequest = { ...normalized, cwd: workspaceLease.execution_workspace };
-        const specification = await adapter.process(executionRequest, artifact.executable, {
-            observed_version: artifact.observed_version ?? undefined,
-            resolution,
-            run_directory: runDirectory,
-            runtime_home: runtimeHome,
-        });
-        if (artifact.entrypoint_args?.length)
-            specification.args.unshift(...artifact.entrypoint_args);
+        const specification = await prepareAdapterProcess(adapter, executionRequest, artifact, resolution, runDirectory, runtimeHome);
         if (signal?.aborted) {
             result = failureResult(runId, startedAt, "cancelled", "agent run cancelled before launch", 9);
             sink.emit({ type: "run.failed", status: "cancelled", error: result.error });
@@ -162,6 +161,11 @@ export async function executeRun({ runId, request, runsRoot, root = path.dirname
             };
             delete childEnvironment.OLDPWD;
             const invocation = prepareSpawnCommand(specification.executable, specification.args);
+            const remainingMs = candidateDeadlineNs === undefined ? normalized.timeout_ms
+                : Number((candidateDeadlineNs - process.hrtime.bigint()) / 1000000n);
+            if (candidateDeadlineNs !== undefined && remainingMs <= 0) {
+                throw new HitchError("candidate budget expired before model launch", { code: "timed_out", exitCode: 8 });
+            }
             child = spawn(invocation.executable, invocation.args, {
                 cwd: workspaceLease.execution_workspace,
                 env: childEnvironment,
@@ -174,10 +178,16 @@ export async function executeRun({ runId, request, runsRoot, root = path.dirname
             launched.stdin?.on("error", () => { });
             onProcess?.({ child: launched });
             abortHandler = () => {
+                if (cancelled)
+                    return;
                 cancelled = true;
                 terminateProcess(launched).catch(() => { });
             };
             signal?.addEventListener("abort", abortHandler, { once: true });
+            // Cancellation can arrive during workspace launch or synchronously from
+            // onProcess, before this listener has been installed.
+            if (signal?.aborted)
+                abortHandler();
             consumeLines(launched.stdout, (line) => {
                 if (adapter.translateLine) {
                     const safeLine = providerCapture?.appendText(line) ?? redactProviderText(line, new Map(), credentialValues);
@@ -239,11 +249,13 @@ export async function executeRun({ runId, request, runsRoot, root = path.dirname
                 launched.once("error", reject);
                 launched.once("close", (code, processSignal) => resolve({ code, signal: processSignal }));
             });
-            if (normalized.timeout_ms > 0) {
+            if (normalized.timeout_ms > 0 || candidateDeadlineNs !== undefined) {
+                const processTimeoutMs = candidateDeadlineNs === undefined ? normalized.timeout_ms
+                    : Math.max(1, Number((candidateDeadlineNs - process.hrtime.bigint()) / 1000000n));
                 timeout = setTimeout(async () => {
                     timedOut = true;
                     await terminateProcess(launched).catch(() => { });
-                }, normalized.timeout_ms);
+                }, processTimeoutMs);
                 timeout.unref?.();
             }
             launched.stdin?.end(specification.input);
@@ -466,25 +478,7 @@ export async function executeRun({ runId, request, runsRoot, root = path.dirname
         result.effective_model = observedEffectiveModel;
     }
     await atomicWriteJSON(resultPath, result);
-    const terminalStatus = result.status;
-    const observation = normalized.context.kind === "benchmark_task" && !normalized.defer_benchmark_observation
-        ? {
-            status: "invalid",
-            invalid_reason: terminalStatus === "succeeded"
-                ? "verifier_result_missing"
-                : terminalStatus === "cancelled"
-                    ? "cancelled"
-                    : "infrastructure_failure",
-        }
-        : undefined;
-    const terminalManifest = {
-        ...manifest,
-        status: terminalStatus,
-        result_ref: "result.json",
-        ...(observation ? { observation } : {}),
-        completed_at: result.completed_at,
-        sealed: !normalized.defer_benchmark_observation,
-    };
+    const terminalManifest = completedRunManifest(manifest, result, normalized);
     await atomicWriteJSON(manifestPath, terminalManifest);
     if (terminalManifest.sealed)
         await writeResultBundleIndex(runDirectory);