[donmasakayan]

Stacked on #2325 — review only the top commit (299660d)

Summary

Document the generic delegated credential contract, host settings, PAT naming, and rollout and rollback behavior. Add the release changeset and emulator-backed local browser/MCP acceptance while keeping one-time secret flows unrecorded and redacting recorded identity credentials at the browser boundary.

This targets v2 following the backlog invitation to resubmit, after the prior closed #1610/#1948.

Verification

All verification below was run locally from the final frozen stack; no public CI run is claimed.

• bun run format:check — 2,226 files, exit 0.
• bun run lint — 1,933 files, zero warnings or errors, including the changeset stub check.
• bun run typecheck — 45/45 tasks, exit 0.
• bun run test — 39/39 workspace tasks; 4,633 tests passed, 45 conditional skips, zero failures.
• e2e — local self-host scenarios delegated-credentials-a-member-key-keeps-an-approved-emulator-connection-scoped- and delegated-credentials-selfhost-issues-masks-and-revokes-a-local-key passed 2 applicable cases with issuance enabled; the default issuance-disabled case also passed. Local trace-redaction coverage passed 3/3, and the local browser/MCP acceptance artifacts include scoped emulator invocation and post-revocation denial checks. Recordings and traces are retained locally and are not publicly linked.

Live IdP and Cloudflare Access login flows were not exercised; coverage for those flows is limited to unit/integration tests.

Checklist

• Added a changeset (bun run changeset).
• Added or updated tests for the new behaviour.
• No secrets, credentials, or private data in the diff.

Stack

• #2322 — delegated credential lifecycle and private storage.
• #2323 — delegated scope enforcement across execution and sessions.
• #2324 — delegated credentials across hosted adapters.
• #2325 — delegated credential account controls.
• #2326 — delegated credential documentation and local rollout verification.