Merge branch 'mmccarthy/AIC-2664/ai-config-tracker-overhaul' of github.com:launchdarkly/java-core into mmccarthy/AIC-2837/java-ai-sdk-agent-graph

Author: mattrmc1

lib/sdk/server-ai/src/main/java/com/launchdarkly/sdk/server/ai/LDAIConfigTracker.java

@@ -41,6 +41,10 @@ public interface LDAIConfigTracker {
    * The resumption token encodes the run's identity and can be passed to
    * {@link LDAIClient#createTracker(String, com.launchdarkly.sdk.LDContext)} to reconstruct a
    * tracker on a subsequent request (for example, in a streaming scenario).
+   * <p>
+   * <strong>Security note:</strong> resumption tokens embed flag-evaluation details such as the
+   * variation key and config version. Keep tokens server-side and do not round-trip them through
+   * untrusted clients where they could leak flag-targeting information.
    *
    * @return the resumption token, or {@code null} if not available
    */

lib/sdk/server-ai/src/main/java/com/launchdarkly/sdk/server/ai/datamodel/LDAITrackingTypes.java

@@ -575,6 +575,10 @@ public List<String> getToolCalls() {
 
     /**
      * Returns the resumption token for this tracker.
+     * <p>
+     * <strong>Security note:</strong> resumption tokens embed flag-evaluation details such as the
+     * variation key and config version. Keep tokens server-side and do not round-trip them through
+     * untrusted clients where they could leak flag-targeting information.
      *
      * @return the resumption token, or {@code null} if not available
      */