rea-agents 3.2.1 → 4.0.0

package/dist/application/ProcessReactiveObservations.js

@@ -1,105 +0,0 @@
-import { createProcessObservation, processObservationSubject, } from "../domain/processObservation.js";
-const terminalObservation = (options, entry) => {
-    const value = options.frames[entry.index];
-    return value === undefined
-        ? undefined
-        : createProcessObservation({
-            source: "terminal_raw",
-            source_sequence: value.sequence,
-            captured_at_ms: value.at_ms,
-            subject_id: null,
-            location: entry,
-            payload: value,
-        });
-};
-const interactionObservation = (options, entry) => {
-    const value = options.interactions[entry.index];
-    return value === undefined
-        ? undefined
-        : createProcessObservation({
-            source: "interaction",
-            source_sequence: value.sequence,
-            captured_at_ms: value.dispatched_at_ms,
-            subject_id: null,
-            location: entry,
-            payload: value,
-        });
-};
-const filesystemObservation = (options, entry) => {
-    const value = options.checkpointAt(entry.index);
-    return value === undefined
-        ? undefined
-        : createProcessObservation({
-            source: "filesystem",
-            source_sequence: entry.index,
-            captured_at_ms: value.at_ms,
-            subject_id: processObservationSubject("filesystem", value),
-            location: entry,
-            payload: value,
-        });
-};
-const processObservation = (options, entry) => {
-    const value = options.processSampleAt(entry.index);
-    return value === undefined
-        ? undefined
-        : createProcessObservation({
-            source: "process",
-            source_sequence: entry.index,
-            captured_at_ms: value.at_ms,
-            subject_id: processObservationSubject("process", value),
-            location: entry,
-            payload: value,
-        });
-};
-const protocolObservation = (options, entry) => {
-    const value = options.protocolEventAt(entry.index);
-    return value === undefined
-        ? undefined
-        : createProcessObservation({
-            source: value.protocol,
-            source_sequence: value.sequence,
-            captured_at_ms: value.at_ms,
-            subject_id: processObservationSubject(value.protocol, value),
-            location: entry,
-            payload: value,
-        });
-};
-const shimObservation = (options, entry) => {
-    const normalized = options.shimEventAt(entry.index);
-    if (normalized === undefined)
-        return undefined;
-    return createProcessObservation({
-        source: "shim",
-        source_sequence: normalized.sequence,
-        captured_at_ms: normalized.at_ms,
-        subject_id: processObservationSubject("shim", normalized),
-        location: entry,
-        payload: normalized,
-    });
-};
-const observationFor = (options, entry) => {
-    if (entry.collection === "frames")
-        return terminalObservation(options, entry);
-    if (entry.collection === "interaction_events")
-        return interactionObservation(options, entry);
-    if (entry.collection === "filesystem_checkpoints")
-        return filesystemObservation(options, entry);
-    if (entry.collection === "process_samples")
-        return processObservation(options, entry);
-    if (entry.collection === "protocol_events")
-        return protocolObservation(options, entry);
-    if (entry.collection === "shim_events")
-        return shimObservation(options, entry);
-    return undefined;
-};
-/** Subscribe the reactive coordinator to admitted normalized journal records. */
-export const subscribeProcessReactiveObservations = (options) => {
-    const enqueue = (entry) => {
-        const observation = observationFor(options, entry);
-        if (observation !== undefined)
-            options.sink.enqueue({ kind: "observation", observation });
-    };
-    for (const entry of options.journal.entries)
-        enqueue(entry);
-    return options.journal.subscribe(enqueue);
-};

package/dist/application/ProjectPermissionStore.js

@@ -1,199 +0,0 @@
-import { createStoreFileLock, removeStaleStoreFileLock, } from "./StoreFileLock.js";
-import { createHash } from "node:crypto";
-import { constants } from "node:fs";
-import { lstat, mkdir, open, realpath, } from "node:fs/promises";
-import { dirname } from "node:path";
-import { setTimeout as delay } from "node:timers/promises";
-import writeFileAtomic from "write-file-atomic";
-import { z } from "zod";
-import { PERMISSION_CAPABILITIES, } from "../domain/permissionPolicy.js";
-import { err, ok } from "../domain/result.js";
-const grantSchema = z.object({
-    grant_id: z.string().min(1),
-    capability: z.enum(PERMISSION_CAPABILITIES),
-    roots: z.array(z.string()),
-    executables: z.array(z.string()),
-    environment_names: z.array(z.string()),
-    origins: z.array(z.string()).optional(),
-    network: z.enum(["none", "loopback", "external"]),
-    mount: z.boolean(),
-    lifetime: z.literal("project"),
-    operation_identity: z.string().nullable(),
-    expires_at: z.iso.datetime().nullable(),
-});
-const storeSchema = z.object({
-    project_id: z.string().regex(/^project_[a-f0-9]{64}$/u),
-    project_root: z.string(),
-    grants: z.array(grantSchema),
-});
-/** Owner-only project policy persistence failure. */
-export class ProjectPermissionStoreError extends Error {
-    reason;
-    _tag = "ProjectPermissionStoreError";
-    constructor(reason, options) {
-        super(`Project permission store failed: ${reason}`, options);
-        this.reason = reason;
-    }
-}
-/** Derive relocation-explicit project identity from its canonical root. */
-const identifyPermissionProject = async (projectRoot) => {
-    try {
-        const root = await realpath(projectRoot);
-        return ok({
-            id: `project_${createHash("sha256").update(root).digest("hex")}`,
-            root,
-        });
-    }
-    catch (cause) {
-        return err(new ProjectPermissionStoreError("project_not_found", { cause }));
-    }
-};
-/** Read and validate an owner-only store bound to the requested project. */
-export const readProjectPermissionStore = async (path, projectRoot) => {
-    const project = await identifyPermissionProject(projectRoot);
-    if (!project.ok)
-        return project;
-    if (process.getuid === undefined)
-        return err(new ProjectPermissionStoreError("not_owner_only"));
-    let handle;
-    try {
-        const opened = await openPrivateStore(path);
-        if (!opened.ok)
-            return opened;
-        if (opened.value === null)
-            return ok(null);
-        handle = opened.value;
-        const encoded = await handle.readFile("utf8");
-        let decoded;
-        try {
-            decoded = JSON.parse(encoded);
-        }
-        catch (cause) {
-            return err(new ProjectPermissionStoreError("invalid", { cause }));
-        }
-        const parsed = storeSchema.safeParse(decoded);
-        if (!parsed.success ||
-            parsed.data.project_id !== project.value.id ||
-            parsed.data.project_root !== project.value.root)
-            return err(new ProjectPermissionStoreError("invalid"));
-        return ok(parsed.data);
-    }
-    catch (cause) {
-        if (isNotFound(cause))
-            return ok(null);
-        return err(new ProjectPermissionStoreError("io", { cause }));
-    }
-    finally {
-        await handle?.close().catch(() => undefined);
-    }
-};
-/** Atomically replace explicit project grants with owner-only permissions. */
-export const writeProjectPermissionStore = async (path, projectRoot, grants) => {
-    const project = await identifyPermissionProject(projectRoot);
-    if (!project.ok)
-        return project;
-    const candidate = storeSchema.safeParse({
-        project_id: project.value.id,
-        project_root: project.value.root,
-        grants,
-    });
-    if (!candidate.success)
-        return err(new ProjectPermissionStoreError("invalid", { cause: candidate.error }));
-    if (process.getuid === undefined)
-        return err(new ProjectPermissionStoreError("not_owner_only"));
-    return withPermissionStoreLock(path, () => writePreparedPermissionStore(path, projectRoot, candidate.data));
-};
-const writePreparedPermissionStore = async (path, projectRoot, candidate) => {
-    await writeFileAtomic(path, `${JSON.stringify(candidate, null, 2)}\n`, {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    const verified = await readProjectPermissionStore(path, projectRoot);
-    if (!verified.ok)
-        return verified;
-    if (verified.value === null ||
-        JSON.stringify(verified.value) !== JSON.stringify(candidate))
-        return err(new ProjectPermissionStoreError("invalid"));
-    return ok(candidate);
-};
-/** Revoke one grant while serializing the complete read-modify-write cycle. */
-export const revokeProjectPermissionGrant = async (path, projectRoot, grantId) => withPermissionStoreLock(path, async () => {
-    const current = await readProjectPermissionStore(path, projectRoot);
-    if (!current.ok)
-        return current;
-    if (current.value === null)
-        return ok(false);
-    const retained = current.value.grants.filter(({ grant_id }) => grant_id !== grantId);
-    if (retained.length === current.value.grants.length)
-        return ok(false);
-    const written = await writePreparedPermissionStore(path, projectRoot, {
-        ...current.value,
-        grants: retained,
-    });
-    return written.ok ? ok(true) : written;
-});
-const withPermissionStoreLock = async (path, action) => {
-    let lock;
-    try {
-        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-        const acquired = await acquirePermissionStoreLock(path);
-        if (!acquired.ok)
-            return acquired;
-        lock = acquired.value;
-        return await action();
-    }
-    catch (cause) {
-        return err(new ProjectPermissionStoreError("io", { cause }));
-    }
-    finally {
-        if (lock !== undefined)
-            await lock.release();
-    }
-};
-const acquirePermissionStoreLock = async (destination) => {
-    const path = `${destination}.lock`;
-    for (let attempt = 0; attempt < 100; attempt += 1) {
-        try {
-            return ok(await createStoreFileLock(path));
-        }
-        catch (cause) {
-            if (!isAlreadyExists(cause))
-                return err(new ProjectPermissionStoreError("io", { cause }));
-            if (await removeStaleStoreFileLock(path))
-                continue;
-            if (attempt === 99)
-                return err(new ProjectPermissionStoreError("locked", { cause }));
-            await delay(10);
-        }
-    }
-    return err(new ProjectPermissionStoreError("locked"));
-};
-const isNotFound = (cause) => errorCode(cause) === "ENOENT";
-const openPrivateStore = async (path) => {
-    let handle;
-    try {
-        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-        const metadata = await handle.stat();
-        if (!privateRegularFile(metadata)) {
-            await handle.close();
-            return err(new ProjectPermissionStoreError("not_owner_only"));
-        }
-        return ok(handle);
-    }
-    catch (cause) {
-        await handle?.close().catch(() => undefined);
-        if (isNotFound(cause))
-            return ok(null);
-        return err(new ProjectPermissionStoreError(isSymlinkRefusal(cause) ? "not_owner_only" : "io", { cause }));
-    }
-};
-const privateRegularFile = (metadata) => metadata.isFile() &&
-    !metadata.isSymbolicLink() &&
-    (Number(metadata.mode) & 0o077) === 0 &&
-    process.getuid !== undefined &&
-    metadata.uid === process.getuid();
-const isAlreadyExists = (cause) => errorCode(cause) === "EEXIST";
-const errorCode = (cause) => typeof cause === "object" && cause !== null && "code" in cause
-    ? cause.code
-    : undefined;
-const isSymlinkRefusal = (cause) => errorCode(cause) === "ELOOP" || errorCode(cause) === "EMLINK";

package/dist/application/RuntimeExecutableDiagnostics.js

@@ -1,198 +0,0 @@
-import { spawn } from "node:child_process";
-import { constants } from "node:fs";
-import { access, realpath } from "node:fs/promises";
-import { delimiter, join } from "node:path";
-const TOOL_NAMES = ["node", "npm", "npx"];
-const PROBE_CONCURRENCY = 4;
-/** Inventory and probe Node toolchain candidates under one exact PATH. */
-export const inspectRuntimeExecutables = async (options) => {
-    const pathEntries = unique(options.path.split(delimiter).filter(Boolean));
-    const candidates = [
-        {
-            tool: "node",
-            path: options.launcherNode,
-            pathIndex: null,
-            selection: "rea-launcher",
-        },
-    ];
-    for (const tool of TOOL_NAMES) {
-        const discovered = await discoverToolCandidates(tool, pathEntries, options.platform, options.pathExtensions);
-        for (const [index, candidate] of discovered.entries())
-            candidates.push({
-                tool,
-                path: candidate.path,
-                pathIndex: candidate.pathIndex,
-                selection: index === 0 ? "path-primary" : "path-shadowed",
-            });
-    }
-    const seen = new Set();
-    const uniqueCandidates = [];
-    for (const candidate of candidates) {
-        const key = `${candidate.tool}\0${candidate.path}`;
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        uniqueCandidates.push(candidate);
-    }
-    const diagnostics = await mapConcurrentBounded(uniqueCandidates, PROBE_CONCURRENCY, (candidate) => probeCandidate(candidate, options.timeoutMs, options.path));
-    return {
-        launcher_node: await canonicalPath(options.launcherNode),
-        candidates: diagnostics,
-    };
-};
-const discoverToolCandidates = async (tool, pathEntries, platform, configuredExtensions) => {
-    const extensions = platform === "win32"
-        ? (configuredExtensions ?? [".COM", ".EXE", ".BAT", ".CMD"])
-        : [""];
-    const candidates = [];
-    for (const [pathIndex, directory] of pathEntries.entries()) {
-        for (const extension of extensions) {
-            const path = join(directory, `${tool}${extension}`);
-            if (await isExecutable(path, platform)) {
-                candidates.push({ path, pathIndex });
-                break;
-            }
-        }
-    }
-    return candidates;
-};
-const probeCandidate = async (candidate, timeoutMs, effectivePath) => {
-    const canonical = await canonicalPath(candidate.path);
-    const result = await executeVersion(candidate.path, timeoutMs, effectivePath);
-    const identity = {
-        tool: candidate.tool,
-        lexical_path: candidate.path,
-        canonical_path: canonical,
-        path_index: candidate.pathIndex,
-        selection: candidate.selection,
-    };
-    return result.ok
-        ? { ...identity, version: result.version, healthy: true, failure: null }
-        : {
-            ...identity,
-            version: null,
-            healthy: false,
-            failure: result.failure,
-        };
-};
-const executeVersion = (path, timeoutMs, effectivePath) => new Promise((resolve) => {
-    const child = spawn(path, ["--version"], {
-        windowsHide: true,
-        env: environmentWithPath(effectivePath),
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    let stdout = "";
-    let stderr = "";
-    let spawnError;
-    let timeout;
-    let timedOut = false;
-    child.stdout?.setEncoding("utf8");
-    child.stderr?.setEncoding("utf8");
-    child.stdout?.on("data", (chunk) => {
-        stdout += chunk;
-    });
-    child.stderr?.on("data", (chunk) => {
-        stderr += chunk;
-    });
-    child.once("error", (cause) => {
-        spawnError = cause;
-    });
-    if (timeoutMs !== undefined && timeoutMs > 0) {
-        timeout = setTimeout(() => {
-            timedOut = true;
-            child.kill();
-        }, timeoutMs);
-        timeout.unref();
-    }
-    child.once("close", () => {
-        if (timeout !== undefined)
-            clearTimeout(timeout);
-        if (spawnError === undefined && child.exitCode === 0) {
-            const version = firstNonemptyLine(stdout) ?? firstNonemptyLine(stderr);
-            if (version !== undefined) {
-                resolve({ ok: true, version });
-                return;
-            }
-            resolve({
-                ok: false,
-                failure: failure("runtime_invalid_version_output", child, stderr),
-            });
-            return;
-        }
-        const cause = spawnError ??
-            new Error("Runtime version probe did not exit successfully");
-        resolve({
-            ok: false,
-            failure: timedOut
-                ? failure("runtime_timeout", child, stderr)
-                : classifyProbeFailure(cause, child, stderr),
-        });
-    });
-});
-const classifyProbeFailure = (cause, child, stderr) => {
-    const dependency = missingDynamicLibrary(stderr);
-    if (dependency !== null)
-        return failure("runtime_dynamic_library_missing", child, stderr, dependency);
-    if ("killed" in cause && cause.killed === true)
-        return failure("runtime_timeout", child, stderr);
-    if (child.signalCode !== null)
-        return failure("runtime_signal", child, stderr);
-    if ("code" in cause && typeof cause.code === "string")
-        return failure("runtime_spawn_failed", child, stderr);
-    return failure("runtime_nonzero_exit", child, stderr);
-};
-const failure = (code, child, stderr, dependency = null) => ({
-    code,
-    exit_code: child.exitCode,
-    signal: child.signalCode,
-    dependency,
-    stderr: stderr.trim(),
-});
-const missingDynamicLibrary = (stderr) => /(?:dyld(?:\[[^\]]+\])?: )?Library not loaded:\s*([^\r\n]+)/u
-    .exec(stderr)?.[1]
-    ?.trim() ?? null;
-const isExecutable = async (path, platform) => {
-    try {
-        await access(path, platform === "win32" ? constants.F_OK : constants.X_OK);
-        return true;
-    }
-    catch {
-        return false;
-    }
-};
-const canonicalPath = async (path) => {
-    try {
-        return await realpath(path);
-    }
-    catch {
-        return path;
-    }
-};
-const firstNonemptyLine = (value) => value
-    .split(/\r?\n/u)
-    .find((line) => line.trim().length > 0)
-    ?.trim();
-const unique = (values) => [...new Set(values)];
-const environmentWithPath = (path) => {
-    const environment = {};
-    for (const [name, value] of Object.entries(process.env))
-        if (name.toUpperCase() !== "PATH")
-            environment[name] = value;
-    environment.PATH = path;
-    return environment;
-};
-const mapConcurrentBounded = async (inputs, concurrency, operation) => {
-    const outputs = [];
-    let nextIndex = 0;
-    const workers = Array.from({ length: Math.min(concurrency, inputs.length) }, async () => {
-        while (nextIndex < inputs.length) {
-            const index = nextIndex;
-            nextIndex += 1;
-            const input = inputs[index];
-            if (input !== undefined)
-                outputs[index] = await operation(input);
-        }
-    });
-    await Promise.all(workers);
-    return outputs;
-};

package/dist/application/Upgrade.js

@@ -1,134 +0,0 @@
-import { execFile, spawn } from "node:child_process";
-import { realpath } from "node:fs/promises";
-import { basename, dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { promisify } from "node:util";
-import { gt, valid } from "semver";
-import { z } from "zod";
-import { PRODUCT_IDENTITY } from "../identity.js";
-const execFileAsync = promisify(execFile);
-const registryResponseSchema = z.object({ version: z.string().min(1) });
-const UPGRADE_COMMAND = "npm install --global rea-agents@latest";
-const CLI_SCRIPT_PATH = fileURLToPath(new URL("../../scripts/rea.mjs", import.meta.url));
-/** Check the npm registry and update the same global REA installation. */
-export const runUpgrade = async (currentVersion, host = systemUpgradeHost(), output = "human") => {
-    const latestVersion = await host.latestVersion();
-    const currentIsValid = valid(currentVersion) !== null;
-    const latestIsValid = latestVersion !== undefined && valid(latestVersion) !== null;
-    if (!currentIsValid || !latestIsValid)
-        return {
-            status: "failed",
-            currentVersion,
-            latestVersion: latestVersion ?? null,
-            reason: "version-check",
-            remediation: "REA could not verify a newer registry release. Check npm registry access and version metadata, then rerun rea upgrade.",
-        };
-    if (!gt(latestVersion, currentVersion))
-        return {
-            status: "current",
-            currentVersion,
-            latestVersion,
-            installMethod: "npm",
-        };
-    const installation = await host.installation();
-    if (installation === undefined)
-        return {
-            status: "failed",
-            currentVersion,
-            latestVersion: latestVersion ?? null,
-            reason: "unknown-install-method",
-            remediation: `Update manually with: ${UPGRADE_COMMAND}`,
-        };
-    if (!(await host.installLatest(installation, output)))
-        return {
-            status: "failed",
-            currentVersion,
-            latestVersion: latestVersion ?? null,
-            reason: "install",
-            remediation: `REA could not update through npm. Check npm registry access and global install permissions, then run: ${UPGRADE_COMMAND}`,
-        };
-    const integrationSyncResult = await host.syncAgentIntegration(output);
-    const integrationSync = integrationSyncResult === undefined
-        ? "deferred"
-        : integrationSyncResult
-            ? "setup_invoked"
-            : "failed";
-    return {
-        status: "upgraded",
-        previousVersion: currentVersion,
-        latestVersion,
-        versionCheck: "available",
-        installMethod: "npm",
-        command: UPGRADE_COMMAND,
-        integrationSync,
-        clientRestartRequired: true,
-        remediation: integrationSync === "setup_invoked"
-            ? "The updated setup journey was opened to align registrations and the skill. Restart clients whose approved registration changed."
-            : "Run rea setup --all-detected to align registrations and the skill, then restart clients that may retain an older MCP server.",
-    };
-};
-/** Create the npm registry and subprocess effects for a production upgrade. */
-export const systemUpgradeHost = () => ({
-    latestVersion: async () => {
-        try {
-            const response = await fetch(`https://registry.npmjs.org/${PRODUCT_IDENTITY.packageName}/latest`, { signal: AbortSignal.timeout(10_000) });
-            if (!response.ok)
-                return undefined;
-            const parsed = registryResponseSchema.safeParse(await response.json());
-            return parsed.success ? parsed.data.version : undefined;
-        }
-        catch {
-            return undefined;
-        }
-    },
-    installation: () => detectNpmInstallation(fileURLToPath(new URL("../..", import.meta.url)), systemNpmInstallationHost),
-    installLatest: ({ prefix }, output) => runCommand("npm", [
-        "install",
-        "--global",
-        "--prefix",
-        prefix,
-        `${PRODUCT_IDENTITY.packageName}@latest`,
-    ], output),
-    syncAgentIntegration: (output) => output === "structured" ||
-        process.stdin.isTTY !== true ||
-        process.stderr.isTTY !== true
-        ? Promise.resolve(undefined)
-        : runCommand(process.execPath, [CLI_SCRIPT_PATH, "setup", "--all-detected"], "human"),
-});
-const systemNpmInstallationHost = {
-    canonicalPath: realpath,
-    globalRoot: async () => (await execFileAsync("npm", ["root", "--global"])).stdout.trim(),
-    globalPrefix: async () => (await execFileAsync("npm", ["prefix", "--global"])).stdout.trim(),
-};
-/** Identify the npm prefix only when it owns the running package. */
-export const detectNpmInstallation = async (packageRoot, host) => {
-    try {
-        const canonicalPackageRoot = await host.canonicalPath(packageRoot);
-        const npmRoot = await host.globalRoot();
-        const globalPackageRoot = await host.canonicalPath(resolve(npmRoot, PRODUCT_IDENTITY.packageName));
-        if (canonicalPackageRoot === globalPackageRoot) {
-            const prefix = await host.globalPrefix();
-            return prefix.length === 0 ? undefined : { prefix };
-        }
-        return inferUnixGlobalPrefix(canonicalPackageRoot);
-    }
-    catch {
-        return inferUnixGlobalPrefix(packageRoot);
-    }
-};
-const inferUnixGlobalPrefix = (packageRoot) => {
-    const nodeModules = dirname(packageRoot);
-    const library = dirname(nodeModules);
-    if (basename(packageRoot) !== PRODUCT_IDENTITY.packageName ||
-        basename(nodeModules) !== "node_modules" ||
-        basename(library) !== "lib")
-        return undefined;
-    return { prefix: dirname(library) };
-};
-const runCommand = (command, arguments_, output) => new Promise((resolveResult) => {
-    const child = spawn(command, [...arguments_], {
-        stdio: output === "human" ? "inherit" : ["inherit", "ignore", "inherit"],
-    });
-    child.once("error", () => resolveResult(false));
-    child.once("exit", (code) => resolveResult(code === 0));
-});

package/dist/browser/SensitiveTextCapture.js

@@ -1,8 +0,0 @@
-const SECRET_ASSIGNMENT = /\b(authorization|api[_-]?key|access[_-]?token|refresh[_-]?token|token|password|passwd|secret|cookie|session)\b\s*[:=]\s*(?:Bearer\s+[A-Za-z0-9._~+/=-]+|"[^"]*"|'[^']*'|[^\s,;]+)/giu;
-const BEARER = /\bBearer\s+[A-Za-z0-9._~+/=-]+/giu;
-const JWT = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/gu;
-/** Redact credential-shaped substrings before approved console text is retained. */
-export const redactSensitiveText = (value) => value
-    .replace(SECRET_ASSIGNMENT, (_match, name) => `${name}=[REDACTED]`)
-    .replace(BEARER, "Bearer [REDACTED]")
-    .replace(JWT, "[REDACTED_JWT]");