@hed-hog/core 0.0.400 → 0.0.402

package/src/file/provider/abstract.provider.ts

@@ -40,6 +40,47 @@ export function supportsServerSideCopy(
   return typeof (provider as Partial<ProviderServerSideCopy>).copy === 'function';
 }
 
+/** Parte ja enviada de um upload multipart: numero (1-based) e o ETag que o storage devolveu. */
+export type MultipartUploadPart = { partNumber: number; etag: string };
+
+/**
+ * Upload direto do cliente para o storage, em partes com URL assinada: os bytes nao
+ * atravessam a API (nem o teto de 100 MB por requisicao do Cloudflare na frente dela).
+ *
+ * Opcional como o `copy`: so S3 e Spaces implementam, e quem chama confere com
+ * `supportsDirectUpload` antes de oferecer o caminho.
+ */
+export interface ProviderDirectUpload {
+  createMultipartUpload(key: string, contentType: string): Promise<string>;
+  signUploadParts(
+    key: string,
+    uploadId: string,
+    partNumbers: number[],
+    ttlSeconds: number,
+  ): Promise<Array<{ partNumber: number; url: string }>>;
+  completeMultipartUpload(
+    key: string,
+    uploadId: string,
+    parts: MultipartUploadPart[],
+  ): Promise<void>;
+  abortMultipartUpload(key: string, uploadId: string): Promise<void>;
+  /** Os primeiros `bytes` do objeto (Range GET), para conferir o tipo real. */
+  readHead(key: string, bytes: number): Promise<Buffer>;
+}
+
+export function supportsDirectUpload(
+  provider: AbstractProvider,
+): provider is AbstractProvider & ProviderDirectUpload {
+  const candidate = provider as Partial<ProviderDirectUpload>;
+  return (
+    typeof candidate.createMultipartUpload === 'function' &&
+    typeof candidate.signUploadParts === 'function' &&
+    typeof candidate.completeMultipartUpload === 'function' &&
+    typeof candidate.abortMultipartUpload === 'function' &&
+    typeof candidate.readHead === 'function'
+  );
+}
+
 export abstract class AbstractProvider implements IProvider {
   abstract uploadFromString(
     destination: string,
@@ -67,6 +108,22 @@ export abstract class AbstractProvider implements IProvider {
    */
   copy?(sourcePath: string, destination: string, filename: string): Promise<string>;
 
+  /** Upload direto em partes; ver `ProviderDirectUpload` e `supportsDirectUpload`. */
+  createMultipartUpload?(key: string, contentType: string): Promise<string>;
+  signUploadParts?(
+    key: string,
+    uploadId: string,
+    partNumbers: number[],
+    ttlSeconds: number,
+  ): Promise<Array<{ partNumber: number; url: string }>>;
+  completeMultipartUpload?(
+    key: string,
+    uploadId: string,
+    parts: MultipartUploadPart[],
+  ): Promise<void>;
+  abortMultipartUpload?(key: string, uploadId: string): Promise<void>;
+  readHead?(key: string, bytes: number): Promise<Buffer>;
+
   getExtension(filename: string) {
     return filename.split('.').pop();
   }

package/src/file/provider/s3-multipart.spec.ts

@@ -0,0 +1,123 @@
+import { afterEach, describe, expect, it, jest } from '@jest/globals';
+import {
+  AbortMultipartUploadCommand,
+  CompleteMultipartUploadCommand,
+  CreateMultipartUploadCommand,
+  GetObjectCommand,
+  S3Client,
+} from '@aws-sdk/client-s3';
+import { Readable } from 'stream';
+import { supportsDirectUpload } from './abstract.provider';
+import { S3Provider } from './s3.provider';
+import { SpacesProvider } from './spaces.provider';
+
+/**
+ * Upload multipart assinado no S3 e no Spaces, com o S3Client mockado: o que vai em cada
+ * comando, a URL de parte assinada de verdade (o presigner roda offline) e o Range GET.
+ */
+const s3Settings = {
+  'storage-s3-key': 'AKIAEXAMPLE',
+  'storage-s3-secret': 'secret',
+  'storage-s3-region': 'us-east-1',
+  'storage-s3-bucket': 'bucket-s3',
+};
+
+const spacesSettings = {
+  'storage-spaces-key': 'DOEXAMPLE',
+  'storage-spaces-secret': 'secret',
+  'storage-spaces-region': 'nyc3',
+  'storage-spaces-bucket': 'spaces-hub',
+};
+
+function mockSend(impl: (command: any) => any) {
+  return jest.spyOn(S3Client.prototype, 'send').mockImplementation(async (command: any) => impl(command));
+}
+
+type ProviderCase = [string, () => any, string, string | undefined, string];
+
+describe.each<ProviderCase>([
+  ['S3', () => new S3Provider(s3Settings), 'bucket-s3', undefined, 'amazonaws.com'],
+  ['Spaces', () => new SpacesProvider(spacesSettings), 'spaces-hub', 'public-read', 'digitaloceanspaces.com'],
+])('%s provider — upload direto', (_name, build, bucket, acl, host) => {
+  afterEach(() => jest.restoreAllMocks());
+
+  it('implementa o contrato de upload direto', () => {
+    expect(supportsDirectUpload(build())).toBe(true);
+  });
+
+  it('createMultipartUpload manda bucket, chave e tipo e devolve o UploadId', async () => {
+    const send = mockSend(() => ({ UploadId: 'up-1' }));
+
+    await expect(build().createMultipartUpload('social/brands/1/a.mp4', 'video/mp4')).resolves.toBe('up-1');
+
+    const command = send.mock.calls[0][0] as any;
+    expect(command).toBeInstanceOf(CreateMultipartUploadCommand);
+    expect(command.input).toEqual({
+      Bucket: bucket,
+      Key: 'social/brands/1/a.mp4',
+      ContentType: 'video/mp4',
+      ...(acl ? { ACL: acl } : {}),
+    });
+  });
+
+  it('createMultipartUpload sem UploadId é erro', async () => {
+    mockSend(() => ({}));
+    await expect(build().createMultipartUpload('k', 'video/mp4')).rejects.toThrow('multipart upload id');
+  });
+
+  it('signUploadParts devolve uma URL assinada de PUT por parte', async () => {
+    const parts = await build().signUploadParts('social/brands/1/a.mp4', 'up-1', [1, 2], 3600);
+
+    expect(parts.map((p) => p.partNumber)).toEqual([1, 2]);
+    for (const part of parts) {
+      const url = new URL(part.url);
+      expect(url.host).toContain(host);
+      expect(url.searchParams.get('uploadId')).toBe('up-1');
+      expect(url.searchParams.get('partNumber')).toBe(String(part.partNumber));
+      expect(url.searchParams.get('X-Amz-Expires')).toBe('3600');
+      expect(url.searchParams.get('X-Amz-Signature')).toBeTruthy();
+    }
+  });
+
+  it('completeMultipartUpload ordena as partes pelo número', async () => {
+    const send = mockSend(() => ({}));
+
+    await build().completeMultipartUpload('k', 'up-1', [
+      { partNumber: 2, etag: '"b"' },
+      { partNumber: 1, etag: '"a"' },
+    ]);
+
+    const command = send.mock.calls[0][0] as any;
+    expect(command).toBeInstanceOf(CompleteMultipartUploadCommand);
+    expect(command.input).toEqual({
+      Bucket: bucket,
+      Key: 'k',
+      UploadId: 'up-1',
+      MultipartUpload: {
+        Parts: [
+          { PartNumber: 1, ETag: '"a"' },
+          { PartNumber: 2, ETag: '"b"' },
+        ],
+      },
+    });
+  });
+
+  it('abortMultipartUpload aborta o upload da chave', async () => {
+    const send = mockSend(() => ({}));
+    await build().abortMultipartUpload('k', 'up-1');
+    const command = send.mock.calls[0][0] as any;
+    expect(command).toBeInstanceOf(AbortMultipartUploadCommand);
+    expect(command.input).toEqual({ Bucket: bucket, Key: 'k', UploadId: 'up-1' });
+  });
+
+  it('readHead pede só os primeiros bytes e corta o que vier a mais', async () => {
+    const send = mockSend(() => ({ Body: Readable.from([Buffer.from('0123456789'), Buffer.from('abc')]) }));
+
+    const head = await build().readHead('k', 4);
+
+    const command = send.mock.calls[0][0] as any;
+    expect(command).toBeInstanceOf(GetObjectCommand);
+    expect(command.input).toEqual({ Bucket: bucket, Key: 'k', Range: 'bytes=0-3' });
+    expect(head.toString()).toBe('0123');
+  });
+});

package/src/file/provider/s3-multipart.util.ts

@@ -0,0 +1,126 @@
+import {
+  AbortMultipartUploadCommand,
+  CompleteMultipartUploadCommand,
+  CreateMultipartUploadCommand,
+  GetObjectCommand,
+  ObjectCannedACL,
+  S3Client,
+  UploadPartCommand,
+} from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { Readable } from 'stream';
+import { MultipartUploadPart } from './abstract.provider';
+
+/**
+ * Upload multipart assinado, comum ao S3 e ao Spaces (mesma API): o servidor abre,
+ * assina e fecha; o cliente so recebe URLs que valem para uma parte e expiram.
+ * Mesmo desenho de libraries/studio/src/common/studio-s3-compatible.client.ts.
+ */
+export async function s3CreateMultipartUpload(
+  client: S3Client,
+  bucket: string,
+  key: string,
+  contentType: string,
+  acl?: ObjectCannedACL,
+): Promise<string> {
+  const result = await client.send(
+    new CreateMultipartUploadCommand({
+      Bucket: bucket,
+      Key: key,
+      ContentType: contentType,
+      ...(acl ? { ACL: acl } : {}),
+    }),
+  );
+
+  if (!result.UploadId) {
+    throw new Error('The storage did not return a multipart upload id.');
+  }
+
+  return result.UploadId;
+}
+
+export async function s3SignUploadParts(
+  client: S3Client,
+  bucket: string,
+  key: string,
+  uploadId: string,
+  partNumbers: number[],
+  ttlSeconds: number,
+): Promise<Array<{ partNumber: number; url: string }>> {
+  return Promise.all(
+    partNumbers.map(async (partNumber) => ({
+      partNumber,
+      url: await getSignedUrl(
+        client as any,
+        new UploadPartCommand({
+          Bucket: bucket,
+          Key: key,
+          UploadId: uploadId,
+          PartNumber: partNumber,
+        }),
+        { expiresIn: ttlSeconds },
+      ),
+    })),
+  );
+}
+
+export async function s3CompleteMultipartUpload(
+  client: S3Client,
+  bucket: string,
+  key: string,
+  uploadId: string,
+  parts: MultipartUploadPart[],
+): Promise<void> {
+  await client.send(
+    new CompleteMultipartUploadCommand({
+      Bucket: bucket,
+      Key: key,
+      UploadId: uploadId,
+      MultipartUpload: {
+        Parts: [...parts]
+          .sort((a, b) => a.partNumber - b.partNumber)
+          .map((part) => ({ PartNumber: part.partNumber, ETag: part.etag })),
+      },
+    }),
+  );
+}
+
+export async function s3AbortMultipartUpload(
+  client: S3Client,
+  bucket: string,
+  key: string,
+  uploadId: string,
+): Promise<void> {
+  await client.send(
+    new AbortMultipartUploadCommand({ Bucket: bucket, Key: key, UploadId: uploadId }),
+  );
+}
+
+/** Range GET dos primeiros `bytes`: basta para o sniff do tipo, sem baixar o objeto. */
+export async function s3ReadHead(
+  client: S3Client,
+  bucket: string,
+  key: string,
+  bytes: number,
+): Promise<Buffer> {
+  const length = Math.max(1, Math.floor(bytes));
+  const result = await client.send(
+    new GetObjectCommand({ Bucket: bucket, Key: key, Range: `bytes=0-${length - 1}` }),
+  );
+
+  const stream = result.Body as Readable;
+  const chunks: Buffer[] = [];
+  let total = 0;
+  for await (const chunk of stream) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    chunks.push(buffer);
+    total += buffer.length;
+    // Storage que ignora o Range devolveria o objeto inteiro: para no que basta.
+    if (total >= length) {
+      stream.destroy?.();
+      break;
+    }
+  }
+
+  return Buffer.concat(chunks).subarray(0, length);
+}

package/src/file/provider/s3.provider.ts

@@ -14,7 +14,14 @@ import { BadRequestException } from '@nestjs/common';
 import { createReadStream } from 'fs';
 import { basename } from 'path';
 import { Readable } from 'stream';
-import { AbstractProvider } from './abstract.provider';
+import { AbstractProvider, MultipartUploadPart } from './abstract.provider';
+import {
+  s3AbortMultipartUpload,
+  s3CompleteMultipartUpload,
+  s3CreateMultipartUpload,
+  s3ReadHead,
+  s3SignUploadParts,
+} from './s3-multipart.util';
 
 export class S3Provider extends AbstractProvider {
   private S3: S3 | undefined;
@@ -253,4 +260,61 @@ export class S3Provider extends AbstractProvider {
     // Use S3Client instance for getSignedUrl
     return await getSignedUrl(s3Client as any, command, { expiresIn: expires });
   }
+
+  async createMultipartUpload(key: string, contentType: string): Promise<string> {
+    return s3CreateMultipartUpload(
+      await this.getS3Client(),
+      this.setting['storage-s3-bucket'],
+      this.resolveS3Key(key),
+      contentType,
+    );
+  }
+
+  async signUploadParts(
+    key: string,
+    uploadId: string,
+    partNumbers: number[],
+    ttlSeconds: number,
+  ) {
+    return s3SignUploadParts(
+      await this.getS3Client(),
+      this.setting['storage-s3-bucket'],
+      this.resolveS3Key(key),
+      uploadId,
+      partNumbers,
+      ttlSeconds,
+    );
+  }
+
+  async completeMultipartUpload(
+    key: string,
+    uploadId: string,
+    parts: MultipartUploadPart[],
+  ): Promise<void> {
+    await s3CompleteMultipartUpload(
+      await this.getS3Client(),
+      this.setting['storage-s3-bucket'],
+      this.resolveS3Key(key),
+      uploadId,
+      parts,
+    );
+  }
+
+  async abortMultipartUpload(key: string, uploadId: string): Promise<void> {
+    await s3AbortMultipartUpload(
+      await this.getS3Client(),
+      this.setting['storage-s3-bucket'],
+      this.resolveS3Key(key),
+      uploadId,
+    );
+  }
+
+  async readHead(key: string, bytes: number): Promise<Buffer> {
+    return s3ReadHead(
+      await this.getS3Client(),
+      this.setting['storage-s3-bucket'],
+      this.resolveS3Key(key),
+      bytes,
+    );
+  }
 }

package/src/file/provider/spaces.provider.ts

@@ -14,7 +14,14 @@ import { BadRequestException } from '@nestjs/common';
 import { createReadStream } from 'fs';
 import { basename } from 'path';
 import { Readable } from 'stream';
-import { AbstractProvider } from './abstract.provider';
+import { AbstractProvider, MultipartUploadPart } from './abstract.provider';
+import {
+  s3AbortMultipartUpload,
+  s3CompleteMultipartUpload,
+  s3CreateMultipartUpload,
+  s3ReadHead,
+  s3SignUploadParts,
+} from './s3-multipart.util';
 
 export class SpacesProvider extends AbstractProvider {
   private S3: S3 | undefined;
@@ -280,4 +287,63 @@ export class SpacesProvider extends AbstractProvider {
     });
     return await getSignedUrl(s3Client as any, command, { expiresIn: expires });
   }
+
+  /** Mesmo ACL dos demais uploads deste provider (o objeto nasce com ele no create). */
+  async createMultipartUpload(key: string, contentType: string): Promise<string> {
+    return s3CreateMultipartUpload(
+      await this.getS3Client(),
+      this.setting['storage-spaces-bucket'],
+      this.resolveKey(key),
+      contentType,
+      'public-read',
+    );
+  }
+
+  async signUploadParts(
+    key: string,
+    uploadId: string,
+    partNumbers: number[],
+    ttlSeconds: number,
+  ) {
+    return s3SignUploadParts(
+      await this.getS3Client(),
+      this.setting['storage-spaces-bucket'],
+      this.resolveKey(key),
+      uploadId,
+      partNumbers,
+      ttlSeconds,
+    );
+  }
+
+  async completeMultipartUpload(
+    key: string,
+    uploadId: string,
+    parts: MultipartUploadPart[],
+  ): Promise<void> {
+    await s3CompleteMultipartUpload(
+      await this.getS3Client(),
+      this.setting['storage-spaces-bucket'],
+      this.resolveKey(key),
+      uploadId,
+      parts,
+    );
+  }
+
+  async abortMultipartUpload(key: string, uploadId: string): Promise<void> {
+    await s3AbortMultipartUpload(
+      await this.getS3Client(),
+      this.setting['storage-spaces-bucket'],
+      this.resolveKey(key),
+      uploadId,
+    );
+  }
+
+  async readHead(key: string, bytes: number): Promise<Buffer> {
+    return s3ReadHead(
+      await this.getS3Client(),
+      this.setting['storage-spaces-bucket'],
+      this.resolveKey(key),
+      bytes,
+    );
+  }
 }

package/src/index.ts

@@ -33,6 +33,9 @@ export * from './mail-layout/mail-layout.service';
 export * from './message-template/message-template.module';
 export * from './message-template/message-template.registry';
 export * from './message-template/message-template.service';
+export * from './document-kit/document-kit.module';
+export * from './document-kit/document-kit.registry';
+export * from './document-kit/document-kit.service';
 export * from './mail/mail.module';
 export * from './mail/mail.service';
 
@@ -57,8 +60,10 @@ export * from './file/mcp-file-source.schema';
 export * from './file/mimetype-sniff.util';
 export * from './file/remote-fetch.util';
 
+export * from './pdf/document';
 export * from './pdf/pdf.module';
 export * from './pdf/pdf.service';
+export * from './pdf/templates/commercial-proposal.template';
 export * from './setting/brand-asset.service';
 export * from './setting/setting.module';
 export * from './setting/setting.service';

package/src/integration-profile/integration-profile.secrets.ts

@@ -76,6 +76,32 @@ export const INTEGRATION_SECRET_KEYS: Record<string, string[]> = {
   // uso, então ele é reescrito no perfil a cada renovação: se não estiver aqui,
   // cada renovação grava a credencial em texto puro no banco.
   'melhor-envio': ['access_token', 'client_secret', 'refresh_token'],
+  // Redes sociais
+  // O app_secret troca o code do OAuth por token de qualquer Pagina que autorize o
+  // app; o webhook_verify_token e comparado no handshake dos webhooks da Meta.
+  // Os tokens das contas conectadas NAO moram aqui (ficam cifrados em
+  // social_channel, uma linha por Pagina/conta).
+  'meta-social': ['app_secret', 'webhook_verify_token'],
+  // App do Instagram (Instagram API with Instagram Login) — o segredo do app do
+  // INSTAGRAM, nao o do app da Meta. Troca o code do OAuth pelo token de
+  // qualquer conta que autorize o app; os tokens de 60 dias das contas ficam
+  // cifrados em social_channel. O webhook_verify_token e comparado no
+  // handshake do webhook do Instagram (inbox de comentarios e DMs).
+  'instagram-social': ['app_secret', 'webhook_verify_token'],
+  // Apps do Google para o modulo social (um projeto por rede). O client_secret
+  // troca o code do OAuth pelo refresh token de qualquer canal/local que
+  // autorize o app; os refresh tokens ficam cifrados em social_channel.
+  'youtube-social': ['client_secret'],
+  'google-business-social': ['client_secret'],
+  // App do LinkedIn para paginas de empresa (Community Management API). O
+  // client_secret troca o code do OAuth e renova o access token de qualquer
+  // pagina que autorize o app; as credenciais das paginas (envelope lir1:/lia1:)
+  // ficam cifradas em social_channel.
+  'linkedin-social': ['client_secret'],
+  // App do X (OAuth 2.0, cliente confidencial). O client_secret vai no header
+  // Basic da troca do code, da renovacao e da revogacao; os tokens de cada
+  // conta (que rotacionam) ficam cifrados em social_channel_oauth_token.
+  'x-social': ['client_secret'],
 };
 
 /** Chaves sensíveis de um provider (vazio se desconhecido). */

package/src/integration-profile/integration-profile.service.ts

@@ -544,6 +544,7 @@ export class IntegrationProfileService {
       provider: provider.slug,
       ...(outcome.info ? { info: outcome.info } : {}),
       ...(outcome.warning ? { warning: outcome.warning } : {}),
+      ...(outcome.warningCodes?.length ? { warning_codes: outcome.warningCodes } : {}),
       tested_at: new Date().toISOString(),
       persisted,
     };

package/src/integration-profile/testers/ai.testers.ts

@@ -3,11 +3,45 @@ import {
   fail,
   pass,
   probeJson,
+  redactSecrets,
   requireFields,
   str,
+  type ProbeResult,
 } from './http-probe';
 import { IntegrationTester } from './integration-tester.types';
 
+/**
+ * A frase do veredito mais o que o provider de fato respondeu.
+ *
+ * Sem isso todo 401 virava a mesma sentenca fixa e a resposta do provider —
+ * que o `probeJson` ja captura — era jogada fora. Foi o que fez um header de
+ * organizacao errado ser reportado como "chave invalida", mandando conferir o
+ * campo que estava certo.
+ *
+ * O resultado de um tester NAO passa por `sanitizeTesterError` (esse so cobre o
+ * caminho de excecao), entao a redacao dos segredos acontece aqui.
+ */
+function withProviderDetail(
+  base: string,
+  result: ProbeResult,
+  secretValues: string[],
+): string {
+  const raw = String(result.body?.error?.message ?? '').trim();
+  if (!raw) return base;
+
+  const detail = redactSecrets(raw, secretValues).trim();
+  return detail ? `${base} ${detail}` : base;
+}
+
+/** O 401 da OpenAI culpa a chave ou a organizacao? A resposta dela ja diz. */
+function isOpenAiOrganizationProblem(result: ProbeResult): boolean {
+  const code = String(result.body?.error?.code ?? '');
+  const message = String(result.body?.error?.message ?? '');
+  return (
+    code === 'invalid_organization' || /no such organization/i.test(message)
+  );
+}
+
 /**
  * Testadores dos providers de IA e geração de vídeo.
  *
@@ -33,7 +67,26 @@ const openAiTester: IntegrationTester = {
       ctx.signal,
     );
 
-    if (result.status === 401) return fail('Invalid OpenAI API key.');
+    if (result.status === 401) {
+      // O header de organizacao e opcional e so este testador o envia: o chat
+      // real nunca manda. Apontar o campo certo evita trocar uma chave boa.
+      if (isOpenAiOrganizationProblem(result)) {
+        return fail(
+          withProviderDetail(
+            organization
+              ? `OpenAI rejected the organization "${organization}". ` +
+                'Check the Organization ID field (it looks like "org-..."), ' +
+                'or leave it empty.'
+              : 'OpenAI rejected the organization.',
+            result,
+            ctx.secretValues,
+          ),
+        );
+      }
+      return fail(
+        withProviderDetail('Invalid OpenAI API key.', result, ctx.secretValues),
+      );
+    }
     if (result.status === 403) {
       return fail('This API key has no permission to list models.');
     }
@@ -72,7 +125,9 @@ const geminiTester: IntegrationTester = {
     const result = await probeJson(url, {}, ctx.signal);
 
     if (result.status === 400 || result.status === 401 || result.status === 403) {
-      return fail('Invalid Gemini API key.');
+      return fail(
+        withProviderDetail('Invalid Gemini API key.', result, ctx.secretValues),
+      );
     }
     if (!result.ok) {
       return fail(describeHttpError(result, 'Google rejected the credentials.'));
@@ -102,7 +157,11 @@ const claudeTester: IntegrationTester = {
       ctx.signal,
     );
 
-    if (result.status === 401) return fail('Invalid Anthropic API key.');
+    if (result.status === 401) {
+      return fail(
+        withProviderDetail('Invalid Anthropic API key.', result, ctx.secretValues),
+      );
+    }
     if (!result.ok) {
       return fail(describeHttpError(result, 'Anthropic rejected the credentials.'));
     }
@@ -124,7 +183,11 @@ const deepseekTester: IntegrationTester = {
       ctx.signal,
     );
 
-    if (result.status === 401) return fail('Invalid DeepSeek API key.');
+    if (result.status === 401) {
+      return fail(
+        withProviderDetail('Invalid DeepSeek API key.', result, ctx.secretValues),
+      );
+    }
     if (!result.ok) {
       return fail(describeHttpError(result, 'DeepSeek rejected the credentials.'));
     }
@@ -147,7 +210,9 @@ const lumaTester: IntegrationTester = {
     );
 
     if (result.status === 401 || result.status === 403) {
-      return fail('Invalid Luma API key.');
+      return fail(
+        withProviderDetail('Invalid Luma API key.', result, ctx.secretValues),
+      );
     }
     if (!result.ok) {
       return fail(describeHttpError(result, 'Luma rejected the credentials.'));

package/src/integration-profile/testers/http-probe.ts

@@ -81,16 +81,18 @@ export async function probeJson(
   signal: AbortSignal,
 ): Promise<ProbeResult> {
   const response = await fetch(url, { ...init, signal });
-  const text = (await response.text().catch(() => '')).slice(0, 2_000);
+  const raw = await response.text().catch(() => '');
 
+  // O parse usa o corpo inteiro: um access token JWT (ex.: o do Graph com muitas
+  // permissões de aplicação) passa fácil de 2 KB, e o JSON truncado viraria `{}`.
   let body: any = {};
   try {
-    body = text ? JSON.parse(text) : {};
+    body = raw ? JSON.parse(raw) : {};
   } catch {
     body = {};
   }
 
-  return { ok: response.ok, status: response.status, body, text };
+  return { ok: response.ok, status: response.status, body, text: raw.slice(0, 2_000) };
 }
 
 /** Remove qualquer ocorrência dos segredos do texto. */