MCP/XAA discovery and connection error messages that previously interpolated raw URLs (issuer, token endpoint, resource) now pass them through a zn(...) helper before inclusion in error text, and the MCP OAuth client's debug logging also runs scope values through a rw("scope", ...) redaction helper, covering messages like 'Using scope from metadata:' and 'Overrode authorization scope from...'.
A new _presented tracker records access tokens, refresh tokens, client secrets, and code verifiers whenever they are handed out (e.g. this._presented.record(e?.client_secret), this._presented.record(k.access_token)), in addition to the existing _lastServedAccessToken/_lastServedRefreshToken tracking, apparently to support redaction or duplicate/leak detection for tokens.