@bevel-software/platform-core-backend 0.13.6 → 0.15.1

package/dist/modules/connection-probe/connection-probe.service.d.ts

@@ -0,0 +1,94 @@
+import '@utcp/http';
+import '@utcp/mcp';
+import type { IToolManualService } from '../tool-manuals/tool-manuals.contract.js';
+import type { ISecretsVaultService } from '../secrets-vault/secrets-vault.contract.js';
+import type { IConnectionProbeService, ProbeVerdict } from './connection-probe.contract.js';
+/**
+ * Runs one credential probe and hands back the answer. Holds no state and
+ * writes nothing: see {@link ProbeVerdict} for why the verdict isn't stored.
+ */
+export declare class ConnectionProbeService implements IConnectionProbeService {
+    private readonly toolManualService;
+    private readonly secretsVault;
+    constructor(toolManualService: IToolManualService, secretsVault: ISecretsVaultService);
+    probe(userId: string, userEmail: string, slug: string): Promise<ProbeVerdict | null>;
+    /**
+     * Pick the probe for this manual.
+     *
+     * A DECLARED health check wins for every type, including `mcp`. The author
+     * naming an endpoint is a stronger statement about how to test their tool
+     * than any inference of ours, and honouring it means a declaration is never
+     * silently ignored — which is the whole contract of the field.
+     *
+     * Failing that, an `mcp` manual tests itself: its handshake is authenticated,
+     * so connecting at all proves the token. `http` and `inline` have no such
+     * moment (an `http` manual's registration fetches its public DESCRIPTION; an
+     * `inline` manual's points at Bevel's own API), so with nothing declared
+     * there is genuinely nothing to call.
+     */
+    private runProbe;
+    /**
+     * Call the endpoint the manual declared, carrying the caller's credential.
+     *
+     * Headers default to the manual's own — that is where the credential normally
+     * lives, so the common case is a one-line `healthCheck: { url }` and the probe
+     * authenticates exactly like a real call.
+     */
+    private probeDeclared;
+    /**
+     * Register the manual on a throwaway client and a session of its own: for a
+     * remote MCP server the handshake is authenticated, so a successful
+     * registration IS proof the token works, and a rejection is the provider's own
+     * verdict.
+     */
+    private probeMcpHandshake;
+    /**
+     * Resolve every MCP server url in `template` IN PLACE, or say why one of them
+     * may not be dialled.
+     *
+     * The substitution and the check are the same act, deliberately: checking a
+     * resolved url and then handing UTCP the `${HOST}` template back would leave
+     * the vault free to answer differently the second time. A concurrent
+     * `PUT …/vars/HOST` landing in that gap aims the handshake at whatever the
+     * new value says — the metadata endpoint, say — with the guard's approval
+     * behind it. Writing the resolved url back means the bytes that passed the
+     * check are the bytes dialled, which is how the declared probe already works.
+     */
+    private resolveServerUrls;
+    /**
+     * Read the values behind every variable `template` references, purely so
+     * {@link SecretRedactor} can keep them out of anything quoted.
+     *
+     * The MCP path leaves headers and auth as `${VAR}` for UTCP's loader, so
+     * unlike the declared probe it never learns those values in passing — and a
+     * rejected handshake surfaces as prose from the transport, which on many
+     * servers includes the response body and therefore the key. Best-effort by
+     * design: redaction is a safety net over the quote, and failing to build it
+     * must not fail the probe.
+     */
+    private rememberTemplateSecrets;
+    /**
+     * Replace every variable reference with the caller's resolved secret. Throws
+     * when one has no value, so the caller can report "not set yet" rather than
+     * sending a request with an empty credential and reading the inevitable 401
+     * as proof the key is wrong.
+     *
+     * One left-to-right pass, like the SDK's own substitutor, rather than a
+     * replace per name: with bare `$VAR` accepted, substituting `$API` before
+     * `$API_KEY` would corrupt the longer reference.
+     */
+    private substitute;
+}
+/**
+ * At most `limit` bytes of a response body, decoded as text.
+ *
+ * Each CHUNK is sliced to the remaining budget before being decoded, not just
+ * counted against it: a provider that answers in one 5MB chunk would otherwise
+ * put the whole thing through the decoder before the loop noticed it was over,
+ * which is the bound bypassed by the very party it is meant to bound.
+ *
+ * Exported for its test — the property here is how much is held in memory,
+ * which the caller's 200-character snippet hides completely.
+ */
+export declare function readCapped(res: Response, limit: number): Promise<string>;
+//# sourceMappingURL=connection-probe.service.d.ts.map

package/dist/modules/connection-probe/connection-probe.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-probe.service.d.ts","sourceRoot":"","sources":["../../../src/modules/connection-probe/connection-probe.service.ts"],"names":[],"mappings":"AACA,OAAO,YAAY,CAAC;AACpB,OAAO,WAAW,CAAC;AAInB,OAAO,KAAK,EAAE,kBAAkB,EAAoC,MAAM,0CAA0C,CAAC;AACrH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAOvF,OAAO,KAAK,EAAE,uBAAuB,EAAe,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAuUzG;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,uBAAuB;IAElE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBADZ,iBAAiB,EAAE,kBAAkB,EACrC,YAAY,EAAE,oBAAoB;IAG/C,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAY1F;;;;;;;;;;;;;OAaG;YACW,QAAQ;IAYtB;;;;;;OAMG;YACW,aAAa;IAqE3B;;;;;OAKG;YACW,iBAAiB;IAyE/B;;;;;;;;;;;OAWG;YACW,iBAAiB;IA+B/B;;;;;;;;;;OAUG;YACW,uBAAuB;IAmBrC;;;;;;;;;OASG;YACW,UAAU;CAqCzB;AAoCD;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB9E"}