@bevel-software/platform-core-backend 0.34.0 → 0.36.1

package/src/shared/pending-proposals.ts

@@ -1,4 +1,4 @@
-import type { ChangeRequest, IWorkflowService } from '@bevel-software/platform-shared';
+import type { ChangeRequest, IVersionControlService } from '@bevel-software/platform-shared';
 import type { WorkspaceService } from '../modules/workspace/workspace.service.js';
 import type { KbContext } from './kb-context.js';
 import type { IAccessControl } from '../modules/access/access-control.interface.js';
@@ -33,7 +33,7 @@ const log = logger('pending-proposals');
 export interface ProposalSources {
   workspaceService: Pick<WorkspaceService, 'ensureRemotesFetched' | 'readFileAtRef'>;
   accessControl: Pick<IAccessControl, 'canWriteBatch'>;
-  workflow: Pick<IWorkflowService, 'listChangeRequests'>;
+  versionControl: Pick<IVersionControlService, 'listChangeRequests'>;
   /** Which branch is the released one, and its clone. */
   kb: Pick<KbContext, 'defaultBranch' | 'defaultWorkspaceId'>;
 }
@@ -62,7 +62,7 @@ export interface ProposedFile {
  * runs BEFORE the access batch, also where it drops what it already serves from
  * the default branch, so the batch stays as small as the answer.
  *
- * Order follows the change requests as the workflow service listed them; a
+ * Order follows the change requests as the version-control service listed them; a
  * caller that wants a stable reading order sorts the result itself.
  */
 export async function visibleProposedFiles(
@@ -81,7 +81,7 @@ export async function visibleProposedFiles(
     // other branch is not a proposal these surfaces can speak about: merging it
     // puts nothing in the catalog, and the card would never resolve.
     const defaultBranch = sources.kb.defaultBranch;
-    crs = (await sources.workflow.listChangeRequests()).filter(
+    crs = (await sources.versionControl.listChangeRequests()).filter(
       (c) => c.state === 'open' && c.base === defaultBranch,
     );
   } catch {

package/src/shared/read-capped.ts

@@ -0,0 +1,40 @@
+/**
+ * At most `limit` bytes of a response body, decoded as text, the rest of the
+ * stream cancelled.
+ *
+ * Each CHUNK is sliced to the remaining budget before being decoded, not just
+ * counted against it: a provider that answers in one 5MB chunk would otherwise
+ * put the whole thing through the decoder before the loop noticed it was over,
+ * which is the bound bypassed by the very party it is meant to bound. Never a
+ * byte past the limit: once the budget is spent the read stops without asking
+ * for more, so a body of exactly `limit` bytes on a stream that stays open
+ * returns at once. And the read never falls back to `res.text()` on a live
+ * stream: a cap applied after that read bounds nothing.
+ *
+ * Shared, not a module's own: the connection probe reads a provider's
+ * rejection with it and the secrets vault a token endpoint's refusal, and one
+ * reader is the only way the two cannot disagree about what "bounded" means.
+ */
+export async function readCapped(res: Response, limit: number): Promise<string> {
+  const reader = res.body?.getReader();
+  // No stream (a mocked or already-consumed response): fall back to the whole
+  // body, which for those cases is ours and small.
+  if (!reader) return (await res.text()).slice(0, limit);
+  const decoder = new TextDecoder();
+  let out = '';
+  let read = 0;
+  try {
+    while (read < limit) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      const remaining = limit - read;
+      const chunk = value.byteLength > remaining ? value.subarray(0, remaining) : value;
+      read += chunk.byteLength;
+      out += decoder.decode(chunk, { stream: true });
+      if (chunk.byteLength < value.byteLength) break;
+    }
+  } finally {
+    await reader.cancel().catch(() => {});
+  }
+  return out;
+}