orizu 0.4.0 → 0.5.0

package/dist/kill-switch-cli.js

@@ -0,0 +1,89 @@
+/**
+ * Per-team agent kill switch CLI (ALI-1007 / G6):
+ *   orizu team kill-agents <team> [--reason <text>]
+ *   orizu team release-agents <team>
+ *
+ * `kill-agents` ENGAGES the switch — ends every active session of the team and
+ * revokes its agent tokens "in seconds"; `release-agents` re-enables minting
+ * (killed sessions stay ended). Human ADMIN only: the server rejects agent
+ * bearers and non-admins. Pure command logic with an injected fetcher so the
+ * entry point owns argument parsing and human/JSON output.
+ */
+import { authedFetch } from './http.js';
+async function responseMessage(response) {
+    try {
+        const data = (await response.clone().json());
+        const error = typeof data.error === 'string' ? data.error : null;
+        return error || response.statusText || String(response.status);
+    }
+    catch {
+        return response.statusText || String(response.status);
+    }
+}
+function fetcherFrom(io) {
+    return io.fetcher ?? authedFetch;
+}
+function argValue(args, flag) {
+    const index = args.indexOf(flag);
+    if (index === -1 || index + 1 >= args.length || args[index + 1].startsWith('--')) {
+        return null;
+    }
+    return args[index + 1];
+}
+function firstPositional(args) {
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg.startsWith('--')) {
+            if (argValue(args, arg) !== null) {
+                i += 1;
+            }
+            continue;
+        }
+        return arg;
+    }
+    return null;
+}
+function emit(io, payload, human) {
+    io.print(io.json ? JSON.stringify(payload) : human);
+}
+function printErr(io, message) {
+    ;
+    (io.printErr ?? io.print)(message);
+}
+export async function killSwitchCommand(args, io) {
+    const subcommand = args[0];
+    if (subcommand !== 'kill-agents' && subcommand !== 'release-agents') {
+        printErr(io, 'Usage: orizu team <kill-agents|release-agents> <team> [--reason <text>] [--json]');
+        return 1;
+    }
+    const teamSlug = firstPositional(args.slice(1));
+    if (!teamSlug) {
+        printErr(io, `Usage: orizu team ${subcommand} <team>${subcommand === 'kill-agents' ? ' [--reason <text>]' : ''} [--json]`);
+        return 1;
+    }
+    const path = `/api/cli/teams/${encodeURIComponent(teamSlug)}/agent-kill-switch`;
+    if (subcommand === 'kill-agents') {
+        const reason = argValue(args, '--reason');
+        const response = await fetcherFrom(io)(path, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(reason ? { reason } : {}),
+        });
+        if (!response.ok) {
+            printErr(io, `kill-agents failed (${response.status}): ${await responseMessage(response)}`);
+            return 1;
+        }
+        const data = (await response.json());
+        emit(io, data, `agent kill switch ENGAGED for ${teamSlug} ` +
+            `(${data.sessionsEnded ?? 0} sessions ended, ${data.tokensRevoked ?? 0} tokens revoked)`);
+        return 0;
+    }
+    const response = await fetcherFrom(io)(path, { method: 'DELETE' });
+    if (!response.ok) {
+        printErr(io, `release-agents failed (${response.status}): ${await responseMessage(response)}`);
+        return 1;
+    }
+    const data = (await response.json());
+    emit(io, data, `agent kill switch RELEASED for ${teamSlug} (killed sessions stay ended)`);
+    return 0;
+}

package/dist/manifests-cli.js

@@ -0,0 +1,143 @@
+/**
+ * Promotion manifests CLI (ALI-907): list | show | approve | reject | apply.
+ * Pure command logic with an injected fetcher and project resolver; the entry
+ * point owns argument parsing and human/JSON output. apply is idempotent on the
+ * server — re-applying returns the stored outcome.
+ */
+import { authedFetch } from './http.js';
+const MANIFEST_ACTIONS = new Set(['approve', 'reject', 'apply']);
+async function responseMessage(response) {
+    try {
+        const data = (await response.clone().json());
+        const error = typeof data.error === 'string' ? data.error : null;
+        const message = typeof data.message === 'string' ? data.message : null;
+        return error || message || response.statusText || String(response.status);
+    }
+    catch {
+        return response.statusText || String(response.status);
+    }
+}
+async function requireOk(response, action) {
+    if (!response.ok) {
+        throw new Error(`${action} failed (${response.status}): ${await responseMessage(response)}`);
+    }
+    try {
+        return (await response.json());
+    }
+    catch {
+        return {};
+    }
+}
+function fetcherFrom(io) {
+    return io.fetcher ?? authedFetch;
+}
+function argValue(args, flag) {
+    const index = args.indexOf(flag);
+    if (index === -1 || index + 1 >= args.length || args[index + 1].startsWith('--')) {
+        return null;
+    }
+    return args[index + 1];
+}
+function positionalArgs(args) {
+    const values = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg.startsWith('--')) {
+            if (argValue(args, arg) !== null) {
+                i += 1;
+            }
+            continue;
+        }
+        values.push(arg);
+    }
+    return values;
+}
+async function requireProjectSlug(io, args) {
+    if (!io.resolveProjectSlug) {
+        throw new Error('Project resolver unavailable');
+    }
+    return io.resolveProjectSlug(argValue(args, '--project'));
+}
+function emit(io, payload, human) {
+    io.print(io.json ? JSON.stringify(payload) : human);
+}
+function manifestLine(manifest) {
+    const id = typeof manifest.id === 'string' ? manifest.id : '(unknown)';
+    const status = typeof manifest.status === 'string' ? manifest.status : '(unknown)';
+    const actionType = typeof manifest.actionType === 'string' ? manifest.actionType : '(unknown)';
+    return `${id}  ${status}  ${actionType}`;
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+function num(value) {
+    return typeof value === 'number' ? value : 0;
+}
+// repo_merge manifests (ALI-972) render the compare summary from stored evidence
+// — no live GitHub call — so a reviewer can approve informed without a PR.
+function repoMergeShow(manifest) {
+    const proposed = asRecord(manifest.proposedState);
+    const compare = asRecord(asRecord(manifest.evidence).compare);
+    const branch = typeof proposed.branch === 'string' ? proposed.branch : '(branch)';
+    const defaultBranch = typeof proposed.defaultBranch === 'string' ? proposed.defaultBranch : '(default)';
+    const files = num(compare.filesChanged || proposed.filesChanged);
+    const additions = num(compare.additions ?? proposed.additions);
+    const deletions = num(compare.deletions ?? proposed.deletions);
+    const lines = [
+        manifestLine(manifest),
+        `  ${branch} -> ${defaultBranch}`,
+        `  ${files} files, +${additions}/-${deletions}`,
+    ];
+    const compareFiles = Array.isArray(compare.files) ? compare.files : [];
+    for (const file of compareFiles.slice(0, 100)) {
+        const status = typeof file.status === 'string' ? file.status : 'modified';
+        const filename = typeof file.filename === 'string' ? file.filename : '(file)';
+        lines.push(`    ${status} ${filename} (+${num(file.additions)}/-${num(file.deletions)})`);
+    }
+    return lines.join('\n');
+}
+export async function manifestsCommand(args, io) {
+    const positional = positionalArgs(args);
+    const subcommand = positional[0];
+    if (subcommand === 'list') {
+        const projectSlug = await requireProjectSlug(io, args);
+        const status = argValue(args, '--status');
+        const query = status
+            ? `?project=${encodeURIComponent(projectSlug)}&status=${encodeURIComponent(status)}`
+            : `?project=${encodeURIComponent(projectSlug)}`;
+        const response = await fetcherFrom(io)(`/api/cli/promotion-manifests${query}`);
+        const data = await requireOk(response, 'Manifest list');
+        const manifests = Array.isArray(data.manifests) ? data.manifests : [];
+        emit(io, { manifests }, ['promotion manifests', ...manifests.map(manifestLine)].join('\n'));
+        return 0;
+    }
+    if (subcommand === 'show') {
+        const id = positional[1];
+        if (!id) {
+            throw new Error('Usage: orizu manifests show <id> [--json]');
+        }
+        const response = await fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`);
+        const data = await requireOk(response, 'Manifest show');
+        const manifest = (data.manifest ?? {});
+        const human = manifest.actionType === 'repo_merge' ? repoMergeShow(manifest) : manifestLine(manifest);
+        emit(io, { manifest }, human);
+        return 0;
+    }
+    if (subcommand && MANIFEST_ACTIONS.has(subcommand)) {
+        const id = positional[1];
+        if (!id) {
+            throw new Error(`Usage: orizu manifests ${subcommand} <id> [--json]`);
+        }
+        const response = await fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ action: subcommand }),
+        });
+        const data = await requireOk(response, `Manifest ${subcommand}`);
+        const manifest = (data.manifest ?? {});
+        emit(io, { manifest }, manifestLine(manifest));
+        return 0;
+    }
+    io.print('Usage: orizu manifests <list|show|approve|reject|apply> ... [--json]');
+    return 1;
+}

package/dist/preview-runtime.js

@@ -50,6 +50,9 @@ export const PREVIEW_ALLOWED_IMPORTS = {
     '@/components/templates/ranking/RankingList': ['RankingList'],
     '@/components/templates/rating/SingleItemRater': ['SingleItemRater'],
 };
+function isNodeError(error) {
+    return error instanceof Error;
+}
 const SUPPORTED_SCHEMA_KEYS = new Set(['type', 'required', 'properties', 'items', 'enum']);
 export function validatePreviewInputs(options) {
     const issues = [];
@@ -827,7 +830,7 @@ async function listenOnAvailablePort(server) {
         }
         catch (error) {
             server.removeAllListeners('error');
-            if (error?.code !== 'EADDRINUSE')
+            if (!isNodeError(error) || error.code !== 'EADDRINUSE')
                 throw error;
         }
     }

package/dist/sandbox-provider.js

@@ -0,0 +1,238 @@
+/**
+ * Orizu-owned sandbox provider seam (ALI-973 / WS-F, per ADR-003).
+ *
+ * ADR-003 requires every provider call (GitHub, Daytona) to sit behind an
+ * Orizu-owned interface so the durable contracts never couple to whichever SDK
+ * wins the quarter. This module defines `SandboxProvider` / `SandboxSession` and
+ * ships two implementations:
+ *
+ *   - `createDaytonaProvider(config)` — a THIN adapter over the Daytona
+ *     TypeScript SDK (`@daytonaio/sdk`). The SDK is imported LAZILY (dynamic
+ *     import through a non-literal specifier) so the CLI works without it
+ *     installed, the app build never resolves it, and tests never load it.
+ *   - `createLocalSimProvider(config)` — a temp-dir + real-`git`-subprocess
+ *     simulation used by the unit tests AND by the no-credentials local-sim
+ *     rehearsal. It is a genuine rehearsal (real clone/commit/push against a
+ *     local bare repo), not a mock.
+ *
+ * SDK-vs-docs note (verified against daytona.io/docs, 2026-07-02): the real
+ * `git.clone` signature is
+ *   clone(url, path, branch?, commitId?, username?, password?, insecureSkipTls?)
+ * i.e. a `commitId` argument sits BETWEEN `branch` and `username` — the ALI-973
+ * brief documented `clone(url, path, branch, username, password)`. The adapter
+ * passes `undefined` for `commitId` so the Orizu seam keeps its clean per-call
+ * credential shape. `git.push(path, username?, password?)` matches the brief.
+ */
+import { spawnSync } from 'child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { basename, dirname, join } from 'path';
+// The package name lives in a variable so TypeScript treats the dynamic import
+// as `any` (no static module resolution / no ts2307 at app build time) and so
+// no bundler traces it. This is what keeps the SDK genuinely optional.
+//
+// PIN CONTRACT: `wrapDaytonaSandbox` hard-codes the POSITIONAL git.clone
+// signature (url, path, branch, commitId, username, password) verified against
+// @daytonaio/sdk@0.193.0. package.json pins that version EXACTLY (no caret) and
+// packages/cli/bun.lock records it, so a minor bump cannot silently shift the
+// argument order out from under this adapter. Re-verify the signature before
+// changing the pin.
+//
+// TRANSITIVE-DEPENDENCY NOTE: @daytonaio/sdk itself drags in a substantial
+// tree — @aws-sdk/client-s3, the OpenTelemetry SDK/exporters, and friends —
+// into packages/cli's dependency graph. `bun install --cwd packages/cli`
+// resolves and downloads all of it even though this file only ever reaches
+// the package via the lazy `import(specifier)` above. That's judged
+// acceptable because: (1) this is a founder-only, not end-user-shipped,
+// script — packages/cli's app build and published `dist/` never bundle or
+// execute this path; (2) the lazy import means the SDK (and its transitive
+// tree) is never loaded into the running process unless `runDaytonaSlice`
+// actually selects the `daytona` provider; (3) `bun install`'s resolve-time
+// cost is a one-time developer/CI tax on this package, not a runtime or
+// shipped-artifact cost. Re-evaluate if @daytonaio/sdk ever becomes a
+// dependency of a package that IS shipped to end users.
+const DAYTONA_SDK_SPECIFIER = '@daytonaio/sdk';
+async function loadDaytonaModule() {
+    try {
+        const specifier = DAYTONA_SDK_SPECIFIER;
+        const mod = (await import(specifier));
+        if (!mod || typeof mod.Daytona !== 'function') {
+            throw new Error('module did not export a Daytona class');
+        }
+        return mod;
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Daytona SDK unavailable (${detail}). Install it before the live run: \`bun install --cwd packages/cli\` (declares @daytonaio/sdk).`);
+    }
+}
+function wrapDaytonaSandbox(sandbox) {
+    return {
+        id: sandbox.id,
+        async gitClone(params) {
+            // commitId (4th arg) is undefined — clean per-call credential shape.
+            await sandbox.git.clone(params.url, params.path, params.branch, undefined, params.username, params.password);
+        },
+        async gitPush(params) {
+            await sandbox.git.push(params.path, params.username, params.password);
+        },
+        async exec(command, opts) {
+            const res = await sandbox.process.executeCommand(command, opts?.cwd);
+            const stdout = typeof res.result === 'string' ? res.result : res.artifacts?.stdout ?? '';
+            const stderr = res.stderr ?? res.artifacts?.stderr;
+            // A missing exitCode is treated as a FAILURE (1), never masked to success:
+            // a live clone/push that returns no code must not read as green.
+            const exitCode = typeof res.exitCode === 'number' ? res.exitCode : 1;
+            return { stdout, exitCode, stderr };
+        },
+        async readFile(path) {
+            const data = await sandbox.fs.downloadFile(path);
+            if (typeof data === 'string')
+                return data;
+            return Buffer.from(data).toString('utf8');
+        },
+        async writeFile(path, content) {
+            await sandbox.fs.uploadFile(Buffer.from(content, 'utf8'), path);
+        },
+        async fileExists(path) {
+            try {
+                await sandbox.fs.getFileDetails(path);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        async destroy() {
+            await sandbox.delete();
+        },
+    };
+}
+export function createDaytonaProvider(config, deps = {}) {
+    const load = deps.loadModule ?? loadDaytonaModule;
+    let clientPromise = null;
+    const client = () => {
+        if (!clientPromise) {
+            clientPromise = (async () => {
+                const mod = await load();
+                return new mod.Daytona({
+                    apiKey: config.apiKey,
+                    apiUrl: config.apiUrl,
+                    target: config.target,
+                });
+            })();
+        }
+        return clientPromise;
+    };
+    return {
+        kind: 'daytona',
+        async createSandbox(opts) {
+            const daytona = await client();
+            const params = {};
+            if (opts?.language)
+                params.language = opts.language;
+            if (opts?.snapshot)
+                params.snapshot = opts.snapshot;
+            if (opts?.envVars)
+                params.envVars = opts.envVars;
+            if (opts?.labels)
+                params.labels = opts.labels;
+            // ORPHAN-SANDBOX WINDOW: `daytona.create(...)` is a single SDK call that
+            // provisions the remote sandbox AND resolves with its handle as one unit.
+            // If it throws AFTER the remote sandbox exists but BEFORE this awaits
+            // returns (e.g. the create succeeded server-side but the response never
+            // reached us), the caller (runDaytonaSlice) never receives a
+            // SandboxSession and has no id to destroy — the sandbox is orphaned on
+            // Daytona's side with nothing in our process able to name it. This is
+            // inherent to the SDK's create-returns-handle shape, not fixable by
+            // catching here (there is no id to catch). `--keep`/manual cleanup in
+            // the Daytona dashboard is the backstop. A create-then-fetch-id two-phase
+            // API (create returns an id immediately, a separate call waits for
+            // readiness) would close this window if Daytona ever ships one.
+            const sandbox = await daytona.create(Object.keys(params).length ? params : undefined);
+            return wrapDaytonaSandbox(sandbox);
+        },
+    };
+}
+function runIn(bin, args, cwd, home) {
+    // Strip git's repo-context env (set by git when this code runs inside a
+    // hook, e.g. pre-push running `bun test`) so sim git commands operate on
+    // the sandbox cwd — not whatever repo GIT_DIR points at. See
+    // daytona-slice-rehearsal.ts for the core.bare=true corruption this caused.
+    const env = {
+        ...process.env,
+        HOME: home,
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_CONFIG_NOSYSTEM: '1',
+    };
+    delete env.GIT_DIR;
+    delete env.GIT_WORK_TREE;
+    delete env.GIT_INDEX_FILE;
+    delete env.GIT_OBJECT_DIRECTORY;
+    delete env.GIT_COMMON_DIR;
+    const res = spawnSync(bin, args, { cwd, encoding: 'utf8', env });
+    return { stdout: res.stdout ?? '', stderr: res.stderr ?? '', exitCode: res.status ?? 1 };
+}
+function makeLocalSimSession(id, root, keepOnDestroy) {
+    // A self-contained git identity so commits work regardless of host config.
+    writeFileSync(join(root, '.gitconfig'), '[user]\n\temail = orizu-slice@local.sim\n\tname = Orizu Slice\n' +
+        '[init]\n\tdefaultBranch = main\n[safe]\n\tdirectory = *\n');
+    const inRoot = (p) => join(root, p);
+    return {
+        id,
+        async gitClone(params) {
+            const args = ['clone'];
+            if (params.branch)
+                args.push('--branch', params.branch);
+            // Clean per-call shape: the clone URL is the bare repo path; the
+            // per-call username/password are honored by the transport but never
+            // persisted into the cloned repo's config (mirrors the contract we
+            // require of Daytona). Nothing to sanitize because nothing is embedded.
+            args.push(params.url, params.path);
+            const r = runIn('git', args, root, root);
+            if (r.exitCode !== 0) {
+                throw new Error(`git clone failed: ${r.stderr.trim() || `exit ${r.exitCode}`}`);
+            }
+        },
+        async gitPush(params) {
+            const r = runIn('git', ['-C', params.path, 'push'], root, root);
+            if (r.exitCode !== 0) {
+                throw new Error(`git push failed: ${r.stderr.trim() || `exit ${r.exitCode}`}`);
+            }
+        },
+        async exec(command, opts) {
+            const cwd = opts?.cwd ? inRoot(opts.cwd) : root;
+            const r = runIn('bash', ['-c', command], cwd, root);
+            return { stdout: r.stdout, exitCode: r.exitCode, stderr: r.stderr };
+        },
+        async readFile(path) {
+            return readFileSync(inRoot(path), 'utf8');
+        },
+        async writeFile(path, content) {
+            const abs = inRoot(path);
+            mkdirSync(dirname(abs), { recursive: true });
+            writeFileSync(abs, content);
+        },
+        async fileExists(path) {
+            return existsSync(inRoot(path));
+        },
+        async destroy() {
+            if (!keepOnDestroy) {
+                rmSync(root, { recursive: true, force: true });
+            }
+        },
+    };
+}
+export function createLocalSimProvider(config = {}) {
+    let counter = 0;
+    return {
+        kind: 'local-sim',
+        async createSandbox() {
+            counter += 1;
+            const parent = config.rootDir ?? tmpdir();
+            mkdirSync(parent, { recursive: true });
+            const root = mkdtempSync(join(parent, 'orizu-sim-'));
+            return makeLocalSimSession(`local-sim-${counter}-${basename(root)}`, root, Boolean(config.keepOnDestroy));
+        },
+    };
+}

package/dist/secret-redaction.js

@@ -0,0 +1,112 @@
+/**
+ * Secret redaction for hosted-sandbox bootstrap (G3 / ALI-1004).
+ *
+ * The bootstrap orchestrator records lifecycle events to the RunAPI and may
+ * capture hook / install output. None of that may ever carry the Orizu bearer,
+ * a minted repo token, or any token-shaped value. `redactSecrets` scrubs a
+ * value two ways:
+ *
+ *   1. exact-match on caller-supplied secrets (the bearer, any token the
+ *      orchestrator itself minted) — these are known verbatim, so replace them
+ *      wherever they appear, even mid-string;
+ *   2. shape-match on the well-known credential prefixes GitHub, Orizu, and the
+ *      model providers emit (ghs_/ghp_/gho_/ghu_/ghr_/github_pat_ installation+PAT
+ *      tokens, Orizu's own `orizu_pat_`/`orizu_agent_` tokens, Anthropic
+ *      `sk-ant-…` and OpenAI `sk-proj-…`/legacy `sk-…` model keys, and a generic
+ *      `Bearer <blob>` header) — a defense-in-depth net for tokens the
+ *      orchestrator never held a copy of (e.g. a model key echoed by a customer
+ *      setup hook or an OpenCode error message).
+ *
+ * SHAPES ARE DEFENSE IN DEPTH, NOT THE GUARANTEE. The guaranteed scrub is the
+ * exact-match pass (1): any secret that will be present in the sandbox MUST be
+ * handed to the caller's secret list (the RunEventSink's `redactSecretsList`)
+ * so it is stripped verbatim wherever it appears, even mid-string and even when
+ * its shape is unknown. The shape patterns below only catch credentials no one
+ * declared; do not rely on them as the primary control.
+ *
+ * The function is pure and recursive over JSON-ish structures so an entire
+ * event payload can be passed through before it is sent to the RunAPI.
+ */
+export const REDACTION_PLACEHOLDER = '[redacted]';
+// Token SHAPES, not values. Ordered longest-prefix-first so `github_pat_` wins
+// over a hypothetical shorter alias. Each matches the prefix plus its base62/_-
+// body. `Bearer <token>` is caught separately so an Authorization header value
+// is scrubbed even when the token body is short.
+const TOKEN_SHAPE_PATTERNS = [
+    /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+    /\bgh[posur]_[A-Za-z0-9_]{20,}/g,
+    // Orizu-issued credentials: `orizu_pat_` (personal access tokens, see
+    // lib/personal-access-tokens.ts — prefix + base64url body) and the future
+    // `orizu_agent_` session-token prefix. base64url alphabet is [A-Za-z0-9_-].
+    /\borizu_(agent|pat)_[A-Za-z0-9_-]{10,}/g,
+    // Model-provider API keys the agent runs with. Specific prefixes first so the
+    // bare `sk-` fallback below cannot partially shadow them:
+    //   Anthropic  `sk-ant-…`  (real keys look like `sk-ant-api03-<blob>`);
+    //   OpenAI     `sk-proj-…` (project-scoped keys) and legacy bare `sk-<blob>`.
+    // The bare fallback demands 20+ base62 chars after `sk-` so it cannot fire on
+    // the hyphenated `sk-ant-`/`sk-proj-` prefixes (both break the run at the
+    // first `-`) or on short `sk-` substrings — tuned to avoid a false-positive
+    // massacre while still netting an undeclared legacy OpenAI key.
+    /\bsk-ant-[A-Za-z0-9_-]{10,}/g,
+    /\bsk-proj-[A-Za-z0-9_-]{10,}/g,
+    /\bsk-[A-Za-z0-9]{20,}\b/g,
+    /\bBearer\s+[A-Za-z0-9._~+/-]{16,}=*/g,
+];
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Redact a scalar string: exact secrets first, then token shapes.
+ */
+function redactString(input, secrets) {
+    let out = input;
+    for (const secret of secrets) {
+        if (secret.length === 0)
+            continue;
+        out = out.replace(new RegExp(escapeRegExp(secret), 'g'), REDACTION_PLACEHOLDER);
+    }
+    for (const pattern of TOKEN_SHAPE_PATTERNS) {
+        out = out.replace(pattern, match => match.toLowerCase().startsWith('bearer') ? `Bearer ${REDACTION_PLACEHOLDER}` : REDACTION_PLACEHOLDER);
+    }
+    return out;
+}
+/**
+ * Deep-redact a JSON-ish value. Strings are scrubbed; arrays/objects are walked;
+ * everything else is returned as-is. Object KEYS are never treated as secrets
+ * (a key literally named after a token is not the token), but their VALUES are.
+ */
+export function redactSecrets(value, options = {}) {
+    const secrets = (options.secrets ?? []).filter(s => typeof s === 'string' && s.length > 0);
+    return redactValue(value, secrets);
+}
+function redactValue(value, secrets) {
+    if (typeof value === 'string') {
+        return redactString(value, secrets);
+    }
+    if (Array.isArray(value)) {
+        return value.map(item => redactValue(item, secrets));
+    }
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            out[key] = redactValue(inner, secrets);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * True when a string still contains any of the supplied secrets or a
+ * token-shaped substring — the assertion tests use it to prove an event payload
+ * left the orchestrator clean.
+ */
+export function containsSecret(input, secrets) {
+    for (const secret of secrets) {
+        if (secret.length > 0 && input.includes(secret))
+            return true;
+    }
+    return TOKEN_SHAPE_PATTERNS.some(pattern => {
+        pattern.lastIndex = 0;
+        return pattern.test(input);
+    });
+}