@assembly-js/app-foundation 0.0.0 → 0.0.1-rc.2

package/dist/network-capture.js

@@ -0,0 +1,473 @@
+// Client-side network capture: monkey-patches window.fetch and XMLHttpRequest so every
+// generated app records its own HTTP traffic and reports it to the parent frame for
+// debugging. This module only emits postMessage records — the wave-2 webapp relay that
+// listens for MESSAGE_TYPE, and the backend ingest that stores them, ship separately.
+// Until that listener exists this is inert: postToParent() no-ops if there's no parent
+// to receive it.
+//
+// Redaction here is best-effort and CLIENT-SIDE ONLY. The real security boundary is
+// server-side, at ingest — never trust this module alone to keep secrets out of a
+// downstream store.
+export const NETWORK_CAPTURE_MESSAGE_TYPE = 'assembly.debug.network';
+// Header names whose values are fingerprinted instead of forwarded. Matched
+// case-insensitively against both request and response header names.
+const SENSITIVE_HEADER_NAMES = new Set([
+    'authorization', 'cookie', 'set-cookie', 'x-api-key', 'x-assembly-token',
+]);
+// URL query parameter names redacted before a request/response URL is captured — these
+// commonly carry bearer tokens, OAuth codes, or signed-URL credentials in the clear.
+const SENSITIVE_QUERY_PARAM_NAMES = new Set([
+    'token', 'access_token', 'refresh_token', 'id_token', 'code', 'api_key', 'apikey',
+    'key', 'secret', 'client_secret', 'password', 'passwd', 'pwd', 'signature', 'sig',
+    'session', 'sessionid', 'auth',
+]);
+// Field/param name pattern redacted out of request bodies before capture. Matched
+// case-insensitively against JSON keys and URL-encoded field names.
+const SENSITIVE_BODY_FIELD_PATTERN = /pass(word)?|pwd|token|secret|api[-_]?key|access[-_]?key|auth|credential|ssn|card(number)?|cvv|cvc|pin/i;
+const MAX_RING_SIZE = 50;
+const MAX_HEADER_VALUE_CHARS = 200;
+const MAX_BODY_SNIPPET_CHARS = 2_000;
+const MAX_RECORD_JSON_CHARS = 8_000;
+const HEADER_FINGERPRINT_PREFIX_CHARS = 8;
+// Above this, an XHR response's Content-Length is large enough that materializing
+// `responseText` just for a 2,000-char snippet isn't worth the memory it holds onto.
+const MAX_XHR_SNIPPET_CONTENT_LENGTH_BYTES = 100_000;
+let recordCounter = 0;
+function nextRecordId() {
+    recordCounter += 1;
+    return `net_${Date.now().toString(36)}_${recordCounter}`;
+}
+function truncate(value, maxChars) {
+    return value.length > maxChars ? `${value.slice(0, maxChars)}…` : value;
+}
+// Reads only enough of a response body to fill a `maxChars` snippet, then cancels the
+// rest of the stream — so a large file download or a long-lived/streaming response never
+// gets fully buffered in memory just for telemetry. Falls back to a single `.text()` read
+// when the body isn't a stream (e.g. in test environments that polyfill `Response`).
+async function readBoundedResponseText(response, maxChars) {
+    const clone = response.clone();
+    const body = clone.body;
+    if (!body)
+        return truncate(await clone.text(), maxChars);
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let text = '';
+    try {
+        while (text.length <= maxChars) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            text += decoder.decode(value, { stream: true });
+        }
+    }
+    finally {
+        void reader.cancel().catch(() => { });
+    }
+    return truncate(text, maxChars);
+}
+// Fingerprints a single sensitive header value. Deliberately uniform across
+// authorization/cookie/x-api-key: scheme+prefix+len is enough to debug "is a token
+// present / did it change" without ever forwarding the value that grants access.
+function fingerprintHeaderValue(value) {
+    const trimmed = value.trim();
+    const schemeMatch = /^([A-Za-z][\w-]*)\s+([\s\S]*)$/.exec(trimmed);
+    const scheme = schemeMatch?.[1];
+    const rest = schemeMatch ? schemeMatch[2] : trimmed;
+    return {
+        present: true,
+        ...(scheme ? { scheme } : {}),
+        prefix: rest.slice(0, HEADER_FINGERPRINT_PREFIX_CHARS),
+        len: value.length,
+    };
+}
+function redactHeaderValue(name, value) {
+    if (SENSITIVE_HEADER_NAMES.has(name.toLowerCase()))
+        return fingerprintHeaderValue(value);
+    return truncate(value, MAX_HEADER_VALUE_CHARS);
+}
+// Redacts sensitive query parameter values (tokens, OAuth codes, signed-URL secrets, ...)
+// out of a captured URL. Falls back to the raw URL if it can't be parsed — a relative or
+// malformed URL still gets recorded, since redaction here is best-effort, not the boundary.
+// Presigned-URL credentials live under vendor prefixes (AWS SigV4 x-amz-*, GCP
+// x-goog-*) or a bare AWSAccessKeyId, none of which match the exact-name set.
+// Redacting the whole vendor-prefixed family is safe — over-redacting a benign
+// x-amz-date in a debug capture is fine, leaking the signature is not.
+function isSensitiveQueryParam(name) {
+    const lower = name.toLowerCase();
+    return (SENSITIVE_QUERY_PARAM_NAMES.has(lower) ||
+        lower.startsWith('x-amz-') ||
+        lower.startsWith('x-goog-') ||
+        lower === 'awsaccesskeyid');
+}
+export function redactUrl(rawUrl) {
+    try {
+        const url = new URL(rawUrl, typeof window !== 'undefined' ? window.location.href : undefined);
+        let redacted = false;
+        for (const name of Array.from(url.searchParams.keys())) {
+            if (!isSensitiveQueryParam(name))
+                continue;
+            const value = url.searchParams.get(name) ?? '';
+            url.searchParams.set(name, `[redacted:${value.length}]`);
+            redacted = true;
+        }
+        return redacted ? url.toString() : rawUrl;
+    }
+    catch {
+        return rawUrl;
+    }
+}
+// Normalizes the many shapes fetch()/XHR headers can take into a redacted map.
+export function collectHeaders(headers) {
+    const result = {};
+    if (!headers)
+        return result;
+    const entries = headers instanceof Headers
+        ? Array.from(headers.entries())
+        : Array.isArray(headers)
+            ? headers
+            : Object.entries(headers);
+    for (const [name, value] of entries) {
+        result[name] = redactHeaderValue(name, String(value));
+    }
+    return result;
+}
+// Parses a raw XHR getAllResponseHeaders() blob ("name: value\r\n...") into a redacted map.
+export function collectXhrResponseHeaders(raw) {
+    const result = {};
+    for (const line of raw.split(/\r?\n/)) {
+        const idx = line.indexOf(':');
+        if (idx === -1)
+            continue;
+        const name = line.slice(0, idx).trim();
+        const value = line.slice(idx + 1).trim();
+        if (!name)
+            continue;
+        result[name] = redactHeaderValue(name, value);
+    }
+    return result;
+}
+// Redacts sensitive keys (password, token, card number, ...) out of a parsed JSON body,
+// recursing into nested objects/arrays. Non-sensitive values pass through unchanged.
+function redactSensitiveFields(value) {
+    if (Array.isArray(value))
+        return value.map(redactSensitiveFields);
+    if (value !== null && typeof value === 'object') {
+        const result = {};
+        for (const [key, val] of Object.entries(value)) {
+            result[key] = SENSITIVE_BODY_FIELD_PATTERN.test(key) ? '[redacted]' : redactSensitiveFields(val);
+        }
+        return result;
+    }
+    return value;
+}
+// Redacts sensitive field values out of a `application/x-www-form-urlencoded` body.
+function redactUrlEncodedBody(raw) {
+    const params = new URLSearchParams(raw);
+    let redacted = false;
+    for (const name of Array.from(params.keys())) {
+        if (!SENSITIVE_BODY_FIELD_PATTERN.test(name))
+            continue;
+        params.set(name, '[redacted]');
+        redacted = true;
+    }
+    return redacted ? params.toString() : raw;
+}
+// Best-effort field-level redaction for a string request body. Handles the two structured
+// shapes a login/payment/API request body normally takes — JSON and url-encoded form data —
+// so passwords, tokens, and card numbers don't ship verbatim. Anything else (plain text,
+// unstructured strings) is left as-is: there's no reliable field boundary to redact within.
+// Fallback scrub for a body that can't be parsed as structured data — most
+// importantly a JSON response truncated mid-object before it reached this
+// point. Redacts the values of sensitive JSON fields and query/form params by
+// name (reusing SENSITIVE_BODY_FIELD_PATTERN) so a partial body still can't
+// ship a credential to the parent frame.
+function scrubSensitivePatterns(text) {
+    return text
+        .replace(/"([\w.-]+)"(\s*:\s*)"[^"]*"/g, (m, key, sep) => SENSITIVE_BODY_FIELD_PATTERN.test(key) ? `"${key}"${sep}"[redacted]"` : m)
+        .replace(/([\w.-]+)=([^&\s"']+)/g, (m, key) => SENSITIVE_BODY_FIELD_PATTERN.test(key) ? `${key}=[redacted]` : m);
+}
+function redactStringBody(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+        try {
+            return JSON.stringify(redactSensitiveFields(JSON.parse(trimmed)));
+        }
+        catch {
+            // Truncated or otherwise invalid JSON — pattern-scrub the raw text so a
+            // sensitive field in the retained prefix is still redacted.
+            return scrubSensitivePatterns(raw);
+        }
+    }
+    // URLSearchParams parses any string without throwing and redactUrlEncodedBody
+    // returns the original when nothing sensitive is present, so plain text passes
+    // through untouched while a form body — even one whose value contains '=' —
+    // still gets its sensitive fields redacted.
+    return redactUrlEncodedBody(raw);
+}
+// Field-level redaction for a captured response body, mirroring the request-body
+// path so a login/token-refresh response can't ship an access token or PII to the
+// parent frame. Best-effort: a body larger than the snippet bound may not parse as
+// JSON, in which case it falls through unredacted — the server ingest is the hard
+// boundary — but the common small structured response is redacted here first.
+function snippetFromResponseText(text) {
+    return truncate(redactStringBody(text), MAX_BODY_SNIPPET_CHARS);
+}
+// Best-effort, synchronous snapshot of an outgoing body. Anything that isn't cheap and
+// safe to stringify (FormData, Blob, streams, ...) is summarized rather than read, so
+// capture never buffers large/binary payloads or consumes a stream the app still needs.
+export function snippetFromRequestBody(body) {
+    if (body == null)
+        return undefined;
+    if (typeof body === 'string')
+        return truncate(redactStringBody(body), MAX_BODY_SNIPPET_CHARS);
+    if (body instanceof URLSearchParams) {
+        return truncate(redactUrlEncodedBody(body.toString()), MAX_BODY_SNIPPET_CHARS);
+    }
+    if (typeof FormData !== 'undefined' && body instanceof FormData) {
+        return `[FormData fields: ${truncate(Array.from(body.keys()).join(', '), MAX_BODY_SNIPPET_CHARS)}]`;
+    }
+    if (typeof Blob !== 'undefined' && body instanceof Blob)
+        return `[Blob ${body.size} bytes]`;
+    if (body instanceof ArrayBuffer)
+        return `[ArrayBuffer ${body.byteLength} bytes]`;
+    return undefined;
+}
+// Keeps the final record within MAX_RECORD_JSON_CHARS by dropping the least useful
+// (largest, most redundant) fields first — bodies before headers, since method/url/
+// status/timing is the part worth keeping if something has to give.
+function capRecordSize(record) {
+    let candidate = record;
+    const fits = (r) => JSON.stringify(r).length <= MAX_RECORD_JSON_CHARS;
+    if (fits(candidate))
+        return candidate;
+    candidate = { ...candidate, responseBodySnippet: undefined };
+    if (fits(candidate))
+        return candidate;
+    candidate = { ...candidate, requestBodySnippet: undefined };
+    if (fits(candidate))
+        return candidate;
+    candidate = { ...candidate, responseHeaders: {} };
+    if (fits(candidate))
+        return candidate;
+    return { ...candidate, requestHeaders: {} };
+}
+const ring = [];
+export function getCapturedRecords() {
+    return ring;
+}
+let cachedParentOrigin;
+// Mirrors sdk/app-bridge's src/core/origins.ts allowlist. Kept as a local copy (rather
+// than importing the npm package) because only its public AssemblyBridge API — not this
+// internal helper — is exported for consumers.
+const ALLOWED_PARENT_ORIGIN_PATTERNS = [
+    /^https?:\/\/localhost(:\d+)?$/,
+    /^https?:\/\/127\.0\.0\.1(:\d+)?$/,
+    /^https:\/\/([a-z0-9-]+\.)?copilot\.app$/,
+    /^https:\/\/([a-z0-9-]+\.)?myassembly\.com$/,
+    /^https:\/\/dashboard\.assembly\.com$/,
+    /^https:\/\/([a-z0-9-]+\.)?copilot-staging\.app$/,
+    /^https:\/\/([a-z0-9-]+\.)?myassembly-staging\.com$/,
+    /^https:\/\/dashboard\.assembly-staging\.com$/,
+];
+function isAllowedParentOrigin(origin) {
+    return ALLOWED_PARENT_ORIGIN_PATTERNS.some((pattern) => pattern.test(origin));
+}
+function getParentOrigin() {
+    if (cachedParentOrigin !== undefined)
+        return cachedParentOrigin;
+    if (typeof document === 'undefined' || !document.referrer) {
+        cachedParentOrigin = null;
+        return null;
+    }
+    try {
+        cachedParentOrigin = new URL(document.referrer).origin;
+    }
+    catch {
+        cachedParentOrigin = null;
+    }
+    return cachedParentOrigin;
+}
+function postToParent(record) {
+    if (typeof window === 'undefined' || window.parent === window)
+        return;
+    const origin = getParentOrigin();
+    if (!origin || !isAllowedParentOrigin(origin))
+        return;
+    try {
+        window.parent.postMessage({ type: NETWORK_CAPTURE_MESSAGE_TYPE, record }, origin);
+    }
+    catch {
+        // Best-effort telemetry — never let a postMessage failure surface to the app.
+    }
+}
+export function recordNetworkCapture(record) {
+    const capped = capRecordSize(record);
+    ring.push(capped);
+    if (ring.length > MAX_RING_SIZE)
+        ring.shift();
+    postToParent(capped);
+}
+function methodFromFetchArgs(input, init) {
+    if (init?.method)
+        return init.method.toUpperCase();
+    if (typeof Request !== 'undefined' && input instanceof Request)
+        return input.method.toUpperCase();
+    return 'GET';
+}
+function urlFromFetchArgs(input) {
+    const raw = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
+    return redactUrl(raw);
+}
+let fetchPatched = false;
+export function installFetchCapture() {
+    if (fetchPatched || typeof window === 'undefined' || typeof window.fetch !== 'function')
+        return;
+    fetchPatched = true;
+    const originalFetch = window.fetch.bind(window);
+    window.fetch = async function capturedFetch(input, init) {
+        const startedAt = Date.now();
+        const method = methodFromFetchArgs(input, init);
+        const url = urlFromFetchArgs(input);
+        const requestHeaders = collectHeaders(init?.headers ?? (typeof Request !== 'undefined' && input instanceof Request ? input.headers : undefined));
+        let requestBodySnippet;
+        try {
+            requestBodySnippet = snippetFromRequestBody(init?.body);
+        }
+        catch {
+            // Reading the body description shouldn't ever throw, but never let capture break the app.
+        }
+        try {
+            const response = await originalFetch(input, init);
+            // Read the body off a clone, in the background, so capture never delays or
+            // consumes the stream the caller's own `await fetch()` is waiting on.
+            void (async () => {
+                let responseBodySnippet;
+                try {
+                    const text = await readBoundedResponseText(response, MAX_BODY_SNIPPET_CHARS);
+                    responseBodySnippet = text === undefined ? undefined : snippetFromResponseText(text);
+                }
+                catch {
+                    // Non-text or already-consumed body — omit the snippet, metadata still ships.
+                }
+                recordNetworkCapture({
+                    id: nextRecordId(),
+                    source: 'fetch',
+                    method,
+                    url,
+                    status: response.status,
+                    ok: response.ok,
+                    startedAt,
+                    durationMs: Date.now() - startedAt,
+                    requestHeaders,
+                    responseHeaders: collectHeaders(response.headers),
+                    requestBodySnippet,
+                    responseBodySnippet,
+                });
+            })();
+            return response;
+        }
+        catch (err) {
+            recordNetworkCapture({
+                id: nextRecordId(),
+                source: 'fetch',
+                method,
+                url,
+                status: null,
+                ok: null,
+                startedAt,
+                durationMs: Date.now() - startedAt,
+                requestHeaders,
+                responseHeaders: {},
+                requestBodySnippet,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            throw err;
+        }
+    };
+}
+let xhrPatched = false;
+export function installXhrCapture() {
+    if (xhrPatched || typeof window === 'undefined' || typeof window.XMLHttpRequest !== 'function')
+        return;
+    xhrPatched = true;
+    const OriginalXhr = window.XMLHttpRequest;
+    const originalOpen = OriginalXhr.prototype.open;
+    const originalSend = OriginalXhr.prototype.send;
+    const originalSetRequestHeader = OriginalXhr.prototype.setRequestHeader;
+    const state = new WeakMap();
+    OriginalXhr.prototype.open = function patchedOpen(method, url, ...rest) {
+        state.set(this, { method: method.toUpperCase(), url: redactUrl(String(url)), startedAt: 0, requestHeaders: {} });
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return originalOpen.apply(this, [method, url, ...rest]);
+    };
+    OriginalXhr.prototype.setRequestHeader = function patchedSetRequestHeader(name, value) {
+        const entry = state.get(this);
+        if (entry)
+            entry.requestHeaders[name] = redactHeaderValue(name, value);
+        return originalSetRequestHeader.call(this, name, value);
+    };
+    OriginalXhr.prototype.send = function patchedSend(body) {
+        const entry = state.get(this);
+        if (entry) {
+            entry.startedAt = Date.now();
+            const requestBodySnippet = (() => {
+                try {
+                    return snippetFromRequestBody(body);
+                }
+                catch {
+                    return undefined;
+                }
+            })();
+            this.addEventListener('loadend', () => {
+                let responseBodySnippet;
+                try {
+                    if (this.responseType === '' || this.responseType === 'text') {
+                        // Only materialize the body when a finite, acceptable Content-Length
+                        // is present. A chunked response omits the header (Number(null) === 0),
+                        // so this skips capture rather than buffering an unbounded stream.
+                        const contentLengthHeader = this.getResponseHeader('content-length');
+                        const contentLength = Number(contentLengthHeader);
+                        responseBodySnippet =
+                            contentLengthHeader !== null &&
+                                Number.isFinite(contentLength) &&
+                                contentLength <= MAX_XHR_SNIPPET_CONTENT_LENGTH_BYTES
+                                ? snippetFromResponseText(this.responseText)
+                                : undefined;
+                    }
+                }
+                catch {
+                    // responseText throws for some responseTypes — omit rather than guess.
+                }
+                let responseHeaders = {};
+                try {
+                    responseHeaders = collectXhrResponseHeaders(this.getAllResponseHeaders());
+                }
+                catch {
+                    // getAllResponseHeaders() can throw before headers arrive (e.g. network error).
+                }
+                recordNetworkCapture({
+                    id: nextRecordId(),
+                    source: 'xhr',
+                    method: entry.method,
+                    url: entry.url,
+                    status: this.status || null,
+                    ok: this.status >= 200 && this.status < 400,
+                    startedAt: entry.startedAt,
+                    durationMs: Date.now() - entry.startedAt,
+                    requestHeaders: entry.requestHeaders,
+                    responseHeaders,
+                    requestBodySnippet,
+                    responseBodySnippet,
+                    error: this.status === 0 ? 'Network error or request aborted' : undefined,
+                });
+            });
+        }
+        return originalSend.call(this, body ?? null);
+    };
+}
+// Installs both patches. Safe to call more than once (each patch is idempotent) — the
+// client component below calls it from an effect that can re-run in dev StrictMode.
+export function installNetworkCapture() {
+    installFetchCapture();
+    installXhrCapture();
+}

package/dist/params.d.ts

@@ -0,0 +1,3 @@
+import type { NextResponse } from 'next/server';
+export declare function isUuid(value: string): boolean;
+export declare function parseUuid(value: string, label?: string): string | NextResponse;

package/dist/params.js

@@ -0,0 +1,20 @@
+import { badRequest } from './api-errors.js';
+// RFC 4122 UUID. Call before passing a value into a uuid-typed Drizzle column —
+// Postgres throws on bad syntax and route handlers must not leak that string.
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export function isUuid(value) {
+    return UUID_RE.test(value);
+}
+// Returns the value, or a 400 NextResponse. Use only when the next step is a
+// query/mutation against a uuid column — not as a blanket route-param check
+// (slugs, external ids, and other non-uuid route segments are fine).
+//   const id = parseUuid(rawId);
+//   if (id instanceof NextResponse) return id;
+//   await db.query.items.findFirst({ where: eq(items.id, id) });
+// In server components/pages, use isUuid(id) and call notFound() instead.
+export function parseUuid(value, label = 'id') {
+    if (!isUuid(value)) {
+        return badRequest(`Invalid ${label}`);
+    }
+    return value;
+}

package/dist/resource-resolution.d.ts

@@ -0,0 +1,89 @@
+export interface ResourceOption {
+    /** Stable provider-side identifier — what the app stores and sends back. */
+    id: string;
+    /** Human-readable name — what the UI renders. Never display the id. */
+    label: string;
+}
+export interface ResourceError {
+    /** ConnectorError code, e.g. 'needs_reauth', 'connection_required'. */
+    code: string;
+    provider: string;
+}
+/**
+ * One page of resolved options, as data rather than exceptions: a thrown
+ * ConnectorError does not survive a Server Action boundary in production
+ * (Next.js redacts server errors), so broker failures travel inside the
+ * payload where the client can still branch on `error.code`.
+ */
+export type ResourcePage = {
+    ok: true;
+    options: ResourceOption[];
+    nextCursor?: string;
+} | {
+    ok: false;
+    error: ResourceError;
+};
+/**
+ * Where the id/label/items/cursor live on a resolver action's result. Resolver
+ * actions disagree on all four (Slack returns `conversations` + `next_cursor`,
+ * Drive `files` + `nextPageToken`, HubSpot `items`/`contacts` + `nextCursor`),
+ * so the caller supplies the mapping — take it from the action's catalog
+ * signature. All values are dot-paths (`response_metadata.next_cursor` works).
+ */
+export interface ResourceFieldMap {
+    /** Path to the identifier on each raw item. */
+    id: string;
+    /** Path to the display name on each raw item; falls back to the id. */
+    label: string;
+    /**
+     * Path to the item array on the result. When omitted, the result itself (if
+     * an array) or its first array-valued property is used.
+     */
+    items?: string;
+    /**
+     * Path to the next-page cursor on the result. When omitted, common cursor
+     * keys are tried in order.
+     */
+    nextCursor?: string;
+}
+/**
+ * Normalize one raw resolver-action result into `{ id, label }` options plus
+ * the next-page cursor. Items without a usable id are dropped; a missing label
+ * falls back to the id. When `query` is given, options are filtered by
+ * case-insensitive label substring — the client-side fallback for resolver
+ * actions with no server-side search (it narrows each fetched page, so paging
+ * through "Load more" still walks the full list).
+ */
+export declare function normalizeResourcePage(raw: unknown, fields: ResourceFieldMap, opts?: {
+    query?: string;
+    requestCursor?: string;
+}): {
+    options: ResourceOption[];
+    nextCursor?: string;
+};
+/**
+ * Walk normalized pages until an option matches. The generic half of "resolve
+ * a name to an id": the caller's `fetchPage` owns transport and provider
+ * quirks (retries, scope fallbacks); this owns the cursor walk, the page
+ * bound, and the echoed-cursor stop.
+ */
+export declare function findResource(fetchPage: (cursor?: string) => Promise<{
+    options: ResourceOption[];
+    nextCursor?: string;
+}>, match: (option: ResourceOption) => boolean, opts?: {
+    maxPages?: number;
+}): Promise<ResourceOption | null>;
+/**
+ * Small process-lifetime memo with a TTL and a size cap, for resolver results
+ * that are safe to share across requests. A deployed app serves exactly one
+ * workspace and connections are workspace-scoped, so entries never leak across
+ * tenants; the TTL just keeps freshly created resources from being invisible
+ * for long.
+ */
+export declare class TtlCache<V> {
+    private readonly maxEntries;
+    private readonly entries;
+    constructor(maxEntries: number);
+    get(key: string): V | undefined;
+    set(key: string, value: V, ttlMs: number): void;
+}