The runtime serves a bundle its module's state (novox/hq ADR 0201)

mesh/state.get, put, delete, keys and watch on the stdio channel, from the
buckets the membership issues. A watch hands the current values without
deletions, then every change, and is answered once the current values are
delivered. Refused with the reason: state not issued, a reader's write, a
value with a credential-named field — the bus alone would answer a refused
write with a timeout.

node-tools/internal/bus/state_test.go

@@ -0,0 +1,23 @@
+package bus
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+// A value naming a credential anywhere in it is found (novox/hq ADR 0201) — the guard against the
+// ordinary mistake — and a value that only mentions tokens as a count is not.
+func TestACredentialNamedFieldIsFoundAnywhereInAValue(t *testing.T) {
+	for value, want := range map[string]string{
+		`{"url":"http://x","headers":{"Authorization":"Bearer s"}}`: "Authorization",
+		`[{"name":"a","env":{"API_KEY":"s"}}]`:                       "API_KEY",
+		`{"refresh_token":"s"}`:                                      "refresh_token",
+		`{"clientSecret":"s"}`:                                       "clientSecret",
+		`{"maxTokens":4096,"name":"a","generation":3}`:               "",
+		`"just a string"`:                                            "",
+	} {
+		if got := credentialField(json.RawMessage(value)); got != want {
+			t.Errorf("%s: found %q, want %q", value, got, want)
+		}
+	}
+}