archal 0.9.15 → 0.9.17

package/dist/index.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-const version = "0.9.15";
+const version = "0.9.17";
 const archal = { version };
 
 archal.default = archal;

package/dist/vitest/{chunk-WVRVNHAX.js → chunk-CJJ32YQF.js}

@@ -94,16 +94,37 @@ var SESSION_STOP_CONFIRM_MAX_ATTEMPTS = 40;
 var ARCHAL_WORKSPACE_HEADER = "x-archal-workspace";
 var SESSION_RESPONSE_SCOPE_HEADER = "x-archal-session-response";
 var CLI_SESSION_TRANSPORT_SCOPE = "cli-transport";
+var INFRASTRUCTURE_DETAIL_PATTERN = /(?:archal[-_\s]?(?:proxy|runtime|control[-_\s]?plane|service[-_\s]?gateway|openclaw[-_\s]?gateway)|control[-_\s]?plane|CLI_JWT_SECRET|CONTROL_PLANE|JWT_SECRET|ARCHAL_|runtime provider|runtime\/session|worker[-_\s]?endpoint|x[-_]?archal|service[-_\s]?gateway|service[-_\s]?runtime|provider[-_\s]?gateway|graphql[-_\s]?gateway|workflow[-_\s]?(?:runtime|harness|session)|harness[-_\s]?bootstrap|service_mcp_servers|\/service-gateway|tls intercept|sidecar|openclaw[-_\s]?gateway|credential_issuance_seed|hosted\s+clone|cloud(?:Clone|Twin)Urls|(?:clone|twin)[-_]access[-_]denied|twin[-_]not[-_]in[-_]catalog|pre[-_\s]?migration|stale[-_\s]?data)/i;
+function publicHostedSessionDetail(detail) {
+  if (!detail?.trim()) {
+    return "";
+  }
+  return INFRASTRUCTURE_DETAIL_PATTERN.test(detail) ? "service routing failed to prepare the requested services." : detail;
+}
+function hostedSessionRequestErrorMessage(method, path2, status, detail) {
+  const publicDetail = publicHostedSessionDetail(detail);
+  return `Hosted session request failed (${method} ${path2}, HTTP ${status}${publicDetail ? `: ${publicDetail}` : ""}).`;
+}
 var HostedSessionRequestError = class extends Error {
   constructor(method, path2, status, detail) {
-    super(
-      `Hosted session request failed (${method} ${path2}, HTTP ${status}${detail ? `: ${detail}` : ""}).`
-    );
+    super(hostedSessionRequestErrorMessage(method, path2, status, detail));
     this.method = method;
     this.path = path2;
     this.status = status;
-    this.detail = detail;
     this.name = "HostedSessionRequestError";
+    this.detail = publicHostedSessionDetail(detail);
+    Object.defineProperty(this, "internalDetail", {
+      value: detail,
+      enumerable: false,
+      configurable: false,
+      writable: false
+    });
+  }
+  detail;
+  internalDetail;
+  /** @internal */
+  getInternalDetailForRetry() {
+    return this.internalDetail;
   }
 };
 function trimEnv(name) {
@@ -215,7 +236,7 @@ function isTransientHostedSessionStartError(error48) {
     if (error48.status === 401 || error48.status === 429 || error48.status === 500 || error48.status === 502 || error48.status === 503 || error48.status === 504) {
       return true;
     }
-    return detailLooksTransient(error48.detail);
+    return detailLooksTransient(error48.getInternalDetailForRetry());
   }
   if (error48 instanceof Error) {
     if (error48.message.startsWith("Hosted session timed out waiting for readiness")) {

package/dist/vitest/{chunk-2GY4SFKE.js → chunk-FU2VLK75.js}

@@ -21,7 +21,7 @@ import {
   requestedSeedsMatchSession,
   sleep,
   trimEnv
-} from "./chunk-WVRVNHAX.js";
+} from "./chunk-CJJ32YQF.js";
 
 // ../../node_modules/.pnpm/ajv@8.18.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -6793,7 +6793,7 @@ var require_dist = __commonJS({
 });
 
 // src/runtime-module-resolution.ts
-import { dirname, extname, resolve } from "path";
+import { dirname, extname, isAbsolute, resolve } from "path";
 import { fileURLToPath } from "url";
 function resolveRuntimeModuleExtension(currentExtension, buildExtension) {
   if (currentExtension === ".ts" || currentExtension === ".mts" || currentExtension === ".cts") {
@@ -6807,7 +6807,7 @@ function resolveRuntimeModuleFromFile(currentModuleFile, relativePath, buildExte
   return resolve(dirname(currentModuleFile), relativePath.replace(/\.js$/, resolvedExtension));
 }
 function resolveRuntimeModule(relativePath, buildExtension) {
-  const currentModuleFile = typeof __filename === "string" ? __filename : fileURLToPath(import.meta.url);
+  const currentModuleFile = typeof __filename === "string" && isAbsolute(__filename) ? __filename : fileURLToPath(import.meta.url);
   return resolveRuntimeModuleFromFile(currentModuleFile, relativePath, buildExtension);
 }
 
@@ -6843,6 +6843,7 @@ var RouteRuntimePolicyError = class extends Error {
 
 // ../route-runtime-core/src/runtime.ts
 import { createRequire } from "module";
+import { isAbsolute as isAbsolute2 } from "path";
 
 // ../../twins/core/src/errors.ts
 function errorMessage(error48) {
@@ -7094,7 +7095,7 @@ var discordRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Discord traffic to ${url2}. Declare discord in archalVitestProject({ services: { discord: { mode: "route" } } }) before calling the Discord REST API in Vitest.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Discord escape to ${url2}. Discord route mode is configured, but this domain is outside the approved Discord REST route surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Discord escape to ${url2}. Discord route mode is configured, but this domain is outside the approved Discord REST route surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Discord domain ${url2}. Archal did not reroute this request because it is outside the approved Discord REST route surface.`
   },
   sdkIdentifiers: ["discord.js", "@discordjs/rest"],
@@ -7142,7 +7143,7 @@ var githubRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked GitHub traffic to ${url2}. Declare github in archalVitestProject({ services: { github: { mode: "route" } } }) before using the official GitHub SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked GitHub escape to ${url2}. GitHub route mode is configured, but this domain is outside the primary routed GitHub surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked GitHub escape to ${url2}. GitHub route mode is configured, but this domain is outside the primary routed GitHub surface.`,
     warning: ({ url: url2 }) => `Observed adjacent GitHub domain ${url2}. Archal did not reroute this request because it is outside the primary GitHub API route surface.`
   },
   sdkIdentifiers: ["@octokit/rest"],
@@ -7170,7 +7171,7 @@ var googleWorkspaceRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Google Workspace traffic to ${url2}. Declare google-workspace in archalVitestProject({ services: { 'google-workspace': { mode: "route" } } }) before using the official Google client.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Google Workspace escape to ${url2}. Google Workspace route mode is configured, but this domain is outside the primary routed surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Google Workspace escape to ${url2}. Google Workspace route mode is configured, but this domain is outside the primary routed surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Google Workspace domain ${url2}. Archal did not reroute this request because it is outside the primary Google Workspace API route surface.`
   },
   sdkIdentifiers: ["googleapis"],
@@ -7192,7 +7193,7 @@ var apifyRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Apify traffic to ${url2}. Declare apify before using the official Apify client.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Apify escape to ${url2}. Apify route mode is configured, but this domain is outside the primary routed Apify API surface. Configured clone base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Apify escape to ${url2}. Apify route mode is configured, but this domain is outside the primary routed Apify API surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Apify domain ${url2}. Archal did not reroute this request because it is outside the primary Apify API route surface.`
   },
   sdkIdentifiers: ["apify-client", "apify"],
@@ -7217,7 +7218,7 @@ var jiraRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Jira traffic to ${url2}. Declare jira in archalVitestProject({ services: { jira: { mode: "route" } } }) before using the official Jira SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Jira escape to ${url2}. Jira route mode is configured, but this domain is outside the primary routed Jira surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Jira escape to ${url2}. Jira route mode is configured, but this domain is outside the primary routed Jira surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Jira domain ${url2}. Archal did not reroute this request because it is outside the primary Jira route surface.`
   },
   sdkIdentifiers: ["jira.js"],
@@ -7238,7 +7239,7 @@ var linearRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Linear traffic to ${url2}. Declare linear in archalVitestProject({ services: { linear: { mode: "route" } } }) before using the official Linear SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Linear escape to ${url2}. Linear route mode is configured, but this domain is outside the primary routed Linear API surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Linear escape to ${url2}. Linear route mode is configured, but this domain is outside the primary routed Linear API surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Linear domain ${url2}. Archal did not reroute this request because it is outside the primary Linear API route surface.`
   },
   sdkIdentifiers: ["@linear/sdk"],
@@ -7260,7 +7261,7 @@ var rampRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Ramp traffic to ${url2}. Declare ramp in archalVitestProject({ services: { ramp: { mode: "route" } } }) before using the official Ramp client.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Ramp escape to ${url2}. Ramp route mode is configured, but this domain is outside the primary routed Ramp API surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Ramp escape to ${url2}. Ramp route mode is configured, but this domain is outside the primary routed Ramp API surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Ramp domain ${url2}. Archal did not reroute this request because it is outside the primary Ramp API route surface.`
   },
   sdkIdentifiers: ["ramp"],
@@ -7293,7 +7294,7 @@ var slackRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Slack traffic to ${url2}. Declare slack in archalVitestProject({ services: { slack: { mode: "route" } } }) before using the official Slack SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Slack escape to ${url2}. Slack route mode is configured, but this domain is outside the primary routed Slack surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Slack escape to ${url2}. Slack route mode is configured, but this domain is outside the primary routed Slack surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Slack domain ${url2}. Archal did not reroute this request because it is outside the primary Slack API route surface.`
   },
   sdkIdentifiers: ["@slack/web-api"],
@@ -7361,7 +7362,7 @@ var stripeRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Stripe traffic to ${url2}. Declare stripe in archalVitestProject({ services: { stripe: { mode: "route" } } }) before using the official Stripe SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Stripe escape to ${url2}. Stripe route mode is configured, but this Stripe-owned domain is outside the current routed surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Stripe escape to ${url2}. Stripe route mode is configured, but this Stripe-owned domain is outside the current routed surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Stripe domain ${url2}. Archal did not reroute this request because it is outside the primary Stripe API route surface.`
   },
   runtimeSurface: stripeRuntimeSurface,
@@ -7384,7 +7385,7 @@ var supabaseRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Supabase traffic to ${url2}. Declare supabase in archalVitestProject({ services: { supabase: { mode: "route" } } }) before using the official Supabase SDK.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Supabase escape to ${url2}. Supabase route mode is configured, but this domain is outside the primary routed Supabase surface. Configured twin base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Supabase escape to ${url2}. Supabase route mode is configured, but this domain is outside the primary routed Supabase surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Supabase domain ${url2}. Archal did not reroute this request because it is outside the primary Supabase route surface.`
   },
   sdkIdentifiers: ["@supabase/supabase-js"],
@@ -7406,7 +7407,7 @@ var tavilyRouteManifest = {
   ],
   diagnostics: {
     undeclared: ({ url: url2 }) => `Blocked Tavily traffic to ${url2}. Declare tavily before using the official Tavily client.`,
-    declaredEscape: ({ url: url2, configuredBaseUrl }) => `Blocked Tavily escape to ${url2}. Tavily route mode is configured, but this domain is outside the primary routed Tavily API surface. Configured clone base URL: ${configuredBaseUrl ?? "unknown"}.`,
+    declaredEscape: ({ url: url2 }) => `Blocked Tavily escape to ${url2}. Tavily route mode is configured, but this domain is outside the primary routed Tavily API surface.`,
     warning: ({ url: url2 }) => `Observed adjacent Tavily domain ${url2}. Archal did not reroute this request because it is outside the primary Tavily API route surface.`
   },
   sdkIdentifiers: ["@tavily/core", "tavily"],
@@ -7450,10 +7451,25 @@ function buildServiceCompatibilityProfile(manifest) {
 }
 
 // ../route-runtime-core/src/runtime.ts
-var require2 = createRequire(typeof __filename === "string" ? __filename : import.meta.url);
+var require2 = createRequire(
+  typeof __filename === "string" && isAbsolute2(__filename) ? __filename : import.meta.url
+);
 var httpModule = require2("node:http");
 var httpsModule = require2("node:https");
 var SHARED_SERVICE_PROFILES = listSharedRouteManifests().map(buildServiceCompatibilityProfile);
+var CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE = "Network request failed";
+function createClientVisibleNetworkError() {
+  return new TypeError(CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE);
+}
+function sanitizeClientVisibleNetworkError(error48) {
+  const visibleError = error48;
+  for (const key of Reflect.ownKeys(error48)) {
+    delete visibleError[key];
+  }
+  error48.name = "TypeError";
+  error48.message = CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE;
+  error48.stack = `${error48.name}: ${error48.message}`;
+}
 function now() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -7657,7 +7673,7 @@ var NodeRouteRuntime = class {
               response3 = await this.originalFetch(
                 buildRoutedFetchRequest(originalRequest, decision.targetUrl, service, init)
               );
-            } catch (error48) {
+            } catch {
               this.traceRequest({
                 method,
                 sourceUrl: sourceUrl.toString(),
@@ -7667,9 +7683,9 @@ var NodeRouteRuntime = class {
                 outcome: "failed",
                 reason: "network_error",
                 targetUrl,
-                error: errorMessage(error48)
+                error: CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE
               });
-              throw error48;
+              throw createClientVisibleNetworkError();
             }
             this.traceRequest({
               method,
@@ -7693,7 +7709,7 @@ var NodeRouteRuntime = class {
               ...init,
               headers
             });
-          } catch (error48) {
+          } catch {
             this.traceRequest({
               method,
               sourceUrl: sourceUrl.toString(),
@@ -7703,9 +7719,9 @@ var NodeRouteRuntime = class {
               outcome: "failed",
               reason: "network_error",
               targetUrl,
-              error: errorMessage(error48)
+              error: CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE
             });
-            throw error48;
+            throw createClientVisibleNetworkError();
           }
           this.traceRequest({
             method,
@@ -8115,28 +8131,29 @@ var NodeRouteRuntime = class {
     if (record2.target === "twin") {
       request.once("response", sanitizeIncomingResponseHeaders);
     }
-    if (!this.traceEnabled) {
-      return request;
-    }
     let settled = false;
-    request.once("response", (response) => {
-      settled = true;
-      this.traceRequest({
-        ...record2,
-        statusCode: response.statusCode,
-        statusText: response.statusMessage
+    if (this.traceEnabled) {
+      request.once("response", (response) => {
+        settled = true;
+        this.traceRequest({
+          ...record2,
+          statusCode: response.statusCode,
+          statusText: response.statusMessage
+        });
       });
-    });
+    }
     request.once("error", (error48) => {
-      if (settled) {
-        return;
+      if (this.traceEnabled && !settled) {
+        this.traceRequest({
+          ...record2,
+          outcome: "failed",
+          reason: "network_error",
+          error: record2.target === "twin" ? CLIENT_VISIBLE_BLOCKED_REQUEST_MESSAGE : error48.message
+        });
+      }
+      if (record2.target === "twin") {
+        sanitizeClientVisibleNetworkError(error48);
       }
-      this.traceRequest({
-        ...record2,
-        outcome: "failed",
-        reason: "network_error",
-        error: error48.message
-      });
     });
     return request;
   }
@@ -27592,7 +27609,7 @@ import { readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
 // ../../twins/core/src/seed-loader.ts
 import { readFile } from "fs/promises";
 import { existsSync, readFileSync, readdirSync } from "fs";
-import { resolve as resolve2, dirname as dirname2, relative, isAbsolute } from "path";
+import { resolve as resolve2, dirname as dirname2, relative, isAbsolute as isAbsolute3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../twins/core/src/mcp/mcp-handler-runtime.ts
@@ -29085,7 +29102,7 @@ function isTruthyEnv(value) {
 }
 function formatTraceRecord(record2) {
   const manifestStatus = record2.manifestMatched ? `matched ${record2.service ?? "manifest"}` : "no manifest match";
-  const destination = record2.target === "twin" ? `twin${record2.targetUrl ? ` ${record2.targetUrl}` : ""}` : record2.target === "upstream" ? "real upstream" : "blocked";
+  const destination = record2.target === "twin" ? "service endpoint" : record2.target === "upstream" ? "real upstream" : "blocked";
   const status = record2.statusCode === void 0 ? record2.error ? `error=${record2.error}` : "no status" : `${record2.statusCode}${record2.statusText ? ` ${record2.statusText}` : ""}`;
   return `\x1B[2m[archal:route] ${record2.method} ${record2.sourceUrl} | ${manifestStatus} | ${record2.outcome} -> ${destination} | ${status}\x1B[0m
 `;