@namzu/sdk 0.4.2 → 0.4.4

package/src/vault/instrumentation.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, it } from 'vitest'
+
+import { createProbeRegistry } from '../probe/registry.js'
+import type { AgentBusEvent } from '../types/bus/index.js'
+import type { CredentialId, TenantId } from '../types/ids/index.js'
+
+import { InMemoryCredentialVault } from './InMemoryCredentialVault.js'
+import { wrapVaultWithProbes } from './instrumentation.js'
+
+const tenant = 'tnt_acme' as TenantId
+const connector = 'conn_x' as never
+
+describe('wrapVaultWithProbes', () => {
+	it('emits vault_lookup with found:true when retrieve hits', async () => {
+		const reg = createProbeRegistry()
+		const seen: AgentBusEvent[] = []
+		reg.onAny((event) => seen.push(event as AgentBusEvent))
+
+		const inner = new InMemoryCredentialVault()
+		const ref = await inner.store(tenant, connector, 'k', { type: 'apiKey', apiKey: 's' } as never)
+		const wrapped = wrapVaultWithProbes(inner, { probes: reg, vaultId: 'in-memory' })
+
+		const result = await wrapped.retrieve(ref.id)
+		expect(result).toBeDefined()
+		expect(seen.length).toBe(1)
+		const event = seen[0] as AgentBusEvent & { type: 'vault_lookup' }
+		expect(event.type).toBe('vault_lookup')
+		expect(event.found).toBe(true)
+		expect(event.vaultId).toBe('in-memory')
+		expect(event.credentialId).toBe(ref.id)
+	})
+
+	it('emits vault_lookup with found:false when retrieve misses', async () => {
+		const reg = createProbeRegistry()
+		const seen: AgentBusEvent[] = []
+		reg.onAny((event) => seen.push(event as AgentBusEvent))
+
+		const wrapped = wrapVaultWithProbes(new InMemoryCredentialVault(), {
+			probes: reg,
+			vaultId: 'in-memory',
+		})
+		const missing = 'cred_missing' as CredentialId
+		const result = await wrapped.retrieve(missing)
+
+		expect(result).toBeUndefined()
+		expect(seen.length).toBe(1)
+		const event = seen[0] as AgentBusEvent & { type: 'vault_lookup' }
+		expect(event.found).toBe(false)
+		expect(event.credentialId).toBe(missing)
+	})
+
+	it('does not emit on store/revoke/list — retrieve is the audit point', async () => {
+		const reg = createProbeRegistry()
+		const seen: AgentBusEvent[] = []
+		reg.onAny((event) => seen.push(event as AgentBusEvent))
+
+		const wrapped = wrapVaultWithProbes(new InMemoryCredentialVault(), { probes: reg })
+		const ref = await wrapped.store(tenant, connector, 'k', {
+			type: 'apiKey',
+			apiKey: 's',
+		} as never)
+		await wrapped.list(tenant)
+		await wrapped.revoke(ref.id)
+		expect(seen.length).toBe(0)
+	})
+
+	it('does not leak the secret value in the emitted event', async () => {
+		const reg = createProbeRegistry()
+		const seen: AgentBusEvent[] = []
+		reg.onAny((event) => seen.push(event as AgentBusEvent))
+
+		const inner = new InMemoryCredentialVault()
+		const ref = await inner.store(tenant, connector, 'k', {
+			type: 'apiKey',
+			apiKey: 'super-secret-value',
+		} as never)
+		const wrapped = wrapVaultWithProbes(inner, { probes: reg })
+		await wrapped.retrieve(ref.id)
+
+		const event = seen[0]
+		const serialized = JSON.stringify(event)
+		expect(serialized).not.toContain('super-secret-value')
+	})
+
+	it('falls back to constructor.name as vaultId when not specified', async () => {
+		const reg = createProbeRegistry()
+		const seen: AgentBusEvent[] = []
+		reg.onAny((event) => seen.push(event as AgentBusEvent))
+
+		const inner = new InMemoryCredentialVault()
+		const ref = await inner.store(tenant, connector, 'k', { type: 'apiKey', apiKey: 's' } as never)
+		const wrapped = wrapVaultWithProbes(inner, { probes: reg })
+		await wrapped.retrieve(ref.id)
+
+		const event = seen[0] as AgentBusEvent & { type: 'vault_lookup' }
+		expect(event.vaultId).toBe('InMemoryCredentialVault')
+	})
+})

package/src/vault/instrumentation.ts

@@ -0,0 +1,56 @@
+import { buildProbeContext } from '../probe/context.js'
+import { type ProbeRegistry, probe as defaultProbeRegistry } from '../probe/registry.js'
+import type { AuthConfig, CredentialRef, CredentialVault } from '../types/connector/index.js'
+import type { ConnectorId, CredentialId, RunId, TenantId } from '../types/ids/index.js'
+
+export interface VaultInstrumentationOptions {
+	readonly probes?: ProbeRegistry
+	readonly runId?: RunId
+	readonly vaultId?: string
+	readonly tenantId?: TenantId
+}
+
+export function wrapVaultWithProbes(
+	vault: CredentialVault,
+	opts: VaultInstrumentationOptions = {},
+): CredentialVault {
+	const probes = opts.probes ?? defaultProbeRegistry
+	const runId = opts.runId
+	const vaultId = opts.vaultId ?? vault.constructor.name
+	const tenantIdHint = opts.tenantId
+
+	return {
+		store(
+			tenantId: TenantId,
+			connectorId: ConnectorId,
+			label: string,
+			auth: AuthConfig,
+		): Promise<CredentialRef> {
+			return vault.store(tenantId, connectorId, label, auth)
+		},
+
+		async retrieve(credentialId: CredentialId): Promise<AuthConfig | undefined> {
+			const result = await vault.retrieve(credentialId)
+			probes.dispatch(
+				{
+					type: 'vault_lookup',
+					vaultId,
+					credentialId,
+					tenantId: tenantIdHint,
+					found: result !== undefined,
+					runId,
+				},
+				buildProbeContext({ runId }),
+			)
+			return result
+		},
+
+		revoke(credentialId: CredentialId): Promise<boolean> {
+			return vault.revoke(credentialId)
+		},
+
+		list(tenantId: TenantId, connectorId?: ConnectorId): Promise<CredentialRef[]> {
+			return vault.list(tenantId, connectorId)
+		},
+	}
+}