@novorb/mcp-core 2.1.2 → 3.0.1

package/dist/credential-checks.js

@@ -0,0 +1,189 @@
+/**
+ * @novorb/mcp-core - Startup credential checks
+ *
+ * `runMcpServer` registers every credential the env schema declares (a server's own `secret` keys and
+ * every key with a `check`; each member of a `multi` family on its own, pooled under the family's base
+ * key) and then runs the declared checks ONCE, in parallel, each bounded by
+ * `MCP_CREDENTIAL_CHECK_TIMEOUT_MS` (default 5000). `MCP_CREDENTIAL_CHECKS=false` skips them. A check
+ * never stops the server: a throw, a timeout or a network error reads `unknown`, and the results are
+ * logged by key name and status only.
+ *
+ *   {
+ *     key: 'SEARCH_API_KEY', multi: true, secret: true,
+ *     check: async (value, { http, signal }) => {
+ *       await http({ baseURL: 'https://api.example.com', auth: { type: 'bearer', token: value } })
+ *         .get('/account', { signal });
+ *       return 'valid';
+ *     },
+ *   }
+ *
+ * A check may return a status, `{ status, reason?, retryAfterMs? }`, or throw: a thrown `HttpError`
+ * is classified like any HTTP outcome (401/403 invalid, 402/429 degraded, ...).
+ */
+import { CREDENTIAL_STATUSES, credentialOutcomeFromError, UnknownCredentialError, } from './credentials.js';
+import { createHttpClient } from './http-client.js';
+import { CORE_ENV_SCHEMA } from './utils/envLoader.js';
+import { getLogger, maskSecretValues } from './utils/logger.js';
+export const DEFAULT_CREDENTIAL_CHECK_TIMEOUT_MS = 5000;
+const CORE_KEYS = new Set(CORE_ENV_SCHEMA.map((s) => s.key));
+/**
+ * Register the env's credentials in `registry`: every set value of a spec with a `check`, and of every
+ * `secret` spec that is not one of mcp-core's own keys. A multi family's members are pooled under the
+ * base key. Returns the registered key names with their checks.
+ */
+export function registerEnvCredentials(env, registry) {
+    const out = [];
+    const declared = new Set(env.schema.map((s) => s.key));
+    for (const spec of env.schema) {
+        if (spec.check === undefined && !(spec.secret === true && !CORE_KEYS.has(spec.key)))
+            continue;
+        for (const key of env.members(spec.key)) {
+            registry.register(key, spec.multi ? { pool: spec.key } : {});
+            out.push(spec.check ? { key, check: spec.check } : { key });
+        }
+    }
+    // Covered parts follow their primary's status; undeclared or unset parts are skipped.
+    for (const spec of env.schema) {
+        if (spec.check === undefined || spec.covers === undefined)
+            continue;
+        const parts = spec.covers.filter((k) => declared.has(k)).flatMap((k) => env.members(k));
+        for (const part of parts) {
+            const partSpec = env.schema.find((s) => s.key === part || env.members(s.key).includes(part));
+            registry.register(part, partSpec?.multi ? { pool: partSpec.key } : {});
+        }
+        for (const key of env.members(spec.key))
+            registry.cover(key, parts);
+    }
+    return out;
+}
+const STATUSES = new Set(CREDENTIAL_STATUSES);
+function isStatus(value) {
+    return typeof value === 'string' && STATUSES.has(value);
+}
+function asResult(value) {
+    if (isStatus(value))
+        return { status: value };
+    if (typeof value === 'object' && value !== null) {
+        const r = value;
+        if (isStatus(r.status)) {
+            return {
+                status: r.status,
+                ...(typeof r.reason === 'string' ? { reason: r.reason } : {}),
+                ...(typeof r.retryAfterMs === 'number' ? { retryAfterMs: r.retryAfterMs } : {}),
+            };
+        }
+    }
+    return { status: 'unknown', reason: 'check returned no status' };
+}
+function fromThrow(err, timedOut) {
+    if (timedOut)
+        return { status: 'unknown', reason: 'timeout' };
+    const classified = credentialOutcomeFromError(err);
+    if (classified) {
+        return {
+            status: classified.outcome,
+            ...(classified.reason !== undefined ? { reason: classified.reason } : {}),
+            ...(classified.retryAfterMs !== undefined ? { retryAfterMs: classified.retryAfterMs } : {}),
+        };
+    }
+    const status = err?.status;
+    return { status: 'unknown', reason: typeof status === 'number' ? `check failed (HTTP ${status})` : 'check failed' };
+}
+async function runOne(key, value, check, timeoutMs, get) {
+    const controller = new AbortController();
+    let timedOut = false;
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+            reject(new Error('timeout'));
+        }, timeoutMs);
+        timer.unref?.();
+    });
+    const ctx = {
+        key,
+        signal: controller.signal,
+        http: (config) => createHttpClient({ timeout: timeoutMs, ...config, retry: { retries: 0, ...config.retry } }),
+        get,
+    };
+    try {
+        return asResult(await Promise.race([check(value, ctx), timeout]));
+    }
+    catch (err) {
+        return fromThrow(err, timedOut);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+export const DEFAULT_CREDENTIAL_CHECK_CONCURRENCY = 4;
+/** Run `jobs` with at most `limit` in flight, results in input order. */
+async function mapLimited(items, limit, job) {
+    const out = new Array(items.length);
+    let next = 0;
+    const worker = async () => {
+        while (next < items.length) {
+            const index = next++;
+            out[index] = await job(items[index]);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(Math.max(1, limit), items.length) }, worker));
+    return out;
+}
+function positive(value) {
+    return value !== undefined && value > 0 ? value : undefined;
+}
+/**
+ * Register the env's credentials and run their checks once (at most `concurrency` at a time, each with
+ * a timeout), then attach each check as the key's re-check probe (run again after the
+ * MCP_CREDENTIAL_RECHECK_MS cool-down while the key is invalid or expired). Never throws; logs one
+ * summary line (key names and statuses only). Resolves with the checked keys' results.
+ */
+export async function runCredentialChecks(env, registry, options = {}) {
+    const logger = options.logger ?? getLogger();
+    const declared = registerEnvCredentials(env, registry);
+    const withCheck = declared.filter((d) => d.check !== undefined);
+    if (withCheck.length === 0)
+        return [];
+    const enabled = options.enabled ?? env.bool('MCP_CREDENTIAL_CHECKS') ?? true;
+    if (!enabled) {
+        logger.info(`credential checks skipped (MCP_CREDENTIAL_CHECKS=false): ${withCheck.length} credential(s) unknown`, 'Credentials');
+        return [];
+    }
+    const timeoutMs = Math.max(1, options.timeoutMs ?? positive(env.int('MCP_CREDENTIAL_CHECK_TIMEOUT_MS')) ?? DEFAULT_CREDENTIAL_CHECK_TIMEOUT_MS);
+    const recheckMs = options.recheckMs ?? positive(env.int('MCP_CREDENTIAL_RECHECK_MS'));
+    if (recheckMs !== undefined)
+        registry.setRecheckMs(recheckMs);
+    const declaredKeys = new Set(env.schema.flatMap((spec) => [spec.key, ...env.members(spec.key)]));
+    const get = (name) => {
+        if (!declaredKeys.has(name))
+            throw new UnknownCredentialError();
+        return env.get(name);
+    };
+    const mask = (reason) => reason !== undefined ? maskSecretValues(reason).slice(0, 200) : undefined;
+    const results = await mapLimited(withCheck, options.concurrency ?? DEFAULT_CREDENTIAL_CHECK_CONCURRENCY, async ({ key, check }) => {
+        const value = env.get(key) ?? '';
+        const probe = async () => {
+            const r = await runOne(key, value, check, timeoutMs, get);
+            const reason = mask(r.reason);
+            return { status: r.status, ...(reason !== undefined ? { reason } : {}), ...retryOf(r) };
+        };
+        const result = await probe();
+        registry.set(key, result.status, { silent: true, ...result });
+        registry.setProbe(key, probe);
+        return { key, status: result.status, ...(result.reason !== undefined ? { reason: result.reason } : {}) };
+    });
+    const summary = results.map((r) => `${r.key} ${r.status}${r.reason ? ` (${r.reason})` : ''}`).join(', ');
+    const healthy = results.every((r) => r.status === 'valid');
+    if (healthy)
+        logger.info(`credential checks: ${summary}`, 'Credentials');
+    else
+        logger.warn(`credential checks: ${summary}`, 'Credentials');
+    return results;
+}
+function retryOf(r) {
+    return r.retryAfterMs !== undefined ? { retryAfterMs: r.retryAfterMs } : {};
+}
+//# sourceMappingURL=credential-checks.js.map

package/dist/credential-checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-checks.js","sourceRoot":"","sources":["../src/credential-checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,mBAAmB,EAInB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAA6C,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAkB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAe,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA4B7E,MAAM,CAAC,MAAM,mCAAmC,GAAG,IAAI,CAAC;AAExD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAE7D;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAc,EACd,QAA4B;IAE5B,MAAM,GAAG,GAAoD,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QAC9F,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,sFAAsF;IACtF,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7F,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAcD,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAEnE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,KAAuE,CAAC;QAClF,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,QAAiB;IAChD,IAAI,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,OAA2B;YAC9C,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,UAAU,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAI,GAAmC,EAAE,MAAM,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,MAAM,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AACtH,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,GAAW,EACX,KAAa,EACb,KAAsB,EACtB,SAAiB,EACjB,GAAwC;IAExC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAiC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/B,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAA2B;QAClC,GAAG;QACH,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7G,GAAG;KACJ,CAAC;IACF,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC;AAEtD,yEAAyE;AACzE,KAAK,UAAU,UAAU,CAAO,KAAmB,EAAE,KAAa,EAAE,GAA4B;IAC9F,MAAM,GAAG,GAAG,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;QACvC,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAM,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAc,EACd,QAA4B,EAC5B,UAAsC,EAAE;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAgD,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC9G,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;IAC7E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,4DAA4D,SAAS,CAAC,MAAM,wBAAwB,EACpG,aAAa,CACd,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,CAAC,EACD,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC,IAAI,mCAAmC,CACjH,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACtF,IAAI,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,GAAG,GAAG,CAAC,IAAY,EAAsB,EAAE;QAC/C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAA0B,EAAsB,EAAE,CAC9D,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,UAAU,CAC9B,SAAS,EACT,OAAO,CAAC,WAAW,IAAI,oCAAoC,EAC3D,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,IAAoC,EAAE;YACvD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;QAC7B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC9D,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3G,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;;QACpE,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,CAAwB;IACvC,OAAO,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC"}

package/dist/credential-health.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @novorb/mcp-core - Credential health (subpath `./credentials`)
+ *
+ * The one import for credential health: the registry and the per-call scope (`credentials.ts`), the
+ * startup checks (`credential-checks.ts`), the result report (`credential-report.ts`) and the status
+ * tool (`credential-status-tool.ts`). Pure re-exports.
+ */
+export { type CredentialCheck, type CredentialCheckContext, type CredentialCheckResult, DEFAULT_CREDENTIAL_CHECK_CONCURRENCY, DEFAULT_CREDENTIAL_CHECK_TIMEOUT_MS, type RunCredentialChecksOptions, registerEnvCredentials, runCredentialChecks, } from './credential-checks.js';
+export { attachCredentialMeta, attachCredentialReport, CREDENTIALS_FIELD, CREDENTIALS_JSON_SCHEMA, CREDENTIALS_META_KEY, credentialReportBytes, withCredentialsField, } from './credential-report.js';
+export { type CredentialStatusToolOptions, credentialStatusTool } from './credential-status-tool.js';
+export { type AuthChallenge, type ClassifiedOutcome, CREDENTIAL_STATUSES, type CredentialHttpFacts, type CredentialOutcome, type CredentialOutcomeInfo, type CredentialProbe, type CredentialRecorder, CredentialRegistry, type CredentialRegistryOptions, type CredentialReportEntry, CredentialScope, type CredentialState, type CredentialStatus, credentialOutcomeFromError, credentialOutcomeFromHttp, currentCredentialScope, DEFAULT_CREDENTIAL_RECHECK_MS, formatCredentialReport, NoUsableCredentialError, parseAuthChallenge, processCredentials, runWithCredentialScope, setProcessCredentials, UnknownCredentialError, } from './credentials.js';
+//# sourceMappingURL=credential-health.d.ts.map

package/dist/credential-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-health.d.ts","sourceRoot":"","sources":["../src/credential-health.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,oCAAoC,EACpC,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,2BAA2B,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACrG,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC"}

package/dist/credential-health.js

@@ -0,0 +1,12 @@
+/**
+ * @novorb/mcp-core - Credential health (subpath `./credentials`)
+ *
+ * The one import for credential health: the registry and the per-call scope (`credentials.ts`), the
+ * startup checks (`credential-checks.ts`), the result report (`credential-report.ts`) and the status
+ * tool (`credential-status-tool.ts`). Pure re-exports.
+ */
+export { DEFAULT_CREDENTIAL_CHECK_CONCURRENCY, DEFAULT_CREDENTIAL_CHECK_TIMEOUT_MS, registerEnvCredentials, runCredentialChecks, } from './credential-checks.js';
+export { attachCredentialMeta, attachCredentialReport, CREDENTIALS_FIELD, CREDENTIALS_JSON_SCHEMA, CREDENTIALS_META_KEY, credentialReportBytes, withCredentialsField, } from './credential-report.js';
+export { credentialStatusTool } from './credential-status-tool.js';
+export { CREDENTIAL_STATUSES, CredentialRegistry, CredentialScope, credentialOutcomeFromError, credentialOutcomeFromHttp, currentCredentialScope, DEFAULT_CREDENTIAL_RECHECK_MS, formatCredentialReport, NoUsableCredentialError, parseAuthChallenge, processCredentials, runWithCredentialScope, setProcessCredentials, UnknownCredentialError, } from './credentials.js';
+//# sourceMappingURL=credential-health.js.map

package/dist/credential-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-health.js","sourceRoot":"","sources":["../src/credential-health.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAIL,oCAAoC,EACpC,mCAAmC,EAEnC,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAoC,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACrG,OAAO,EAGL,mBAAmB,EAMnB,kBAAkB,EAGlB,eAAe,EAGf,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC"}

package/dist/credential-report.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @novorb/mcp-core - The credential report on a tool result
+ *
+ * `registerTools` appends the report of a call's credentials (see `credentials.ts`) to every result
+ * that touched one, in three shapes:
+ *
+ * - a short text block the model reads: `Credentials: A used; B degraded (quota, retry in 60s)`;
+ * - `_meta[CREDENTIALS_META_KEY]`: the same entries, machine-readable;
+ * - `structuredContent.credentials`, when the result has an object `structuredContent`. The tool's
+ *   outputSchema gets that optional field automatically (`withCredentialsField`), unless the schema
+ *   already declares its own `credentials` property (then only the text and `_meta` carry the report).
+ *
+ * Key names only, never values; the text passes the client masking.
+ */
+import type { CallToolResult, StandardSchemaWithJSON } from '@modelcontextprotocol/server';
+import { type CredentialReportEntry } from './credentials.js';
+/** The `_meta` key of the machine-readable report. */
+export declare const CREDENTIALS_META_KEY = "io.novorb/credentials";
+/** The field name added to `structuredContent` and to the output schema. */
+export declare const CREDENTIALS_FIELD = "credentials";
+/** JSON Schema of the `credentials` field. */
+export declare const CREDENTIALS_JSON_SCHEMA: Record<string, unknown>;
+/**
+ * The output schema plus an optional `credentials` field: validation strips the field before the
+ * tool's own schema sees it (so strict schemas keep passing) and the listed JSON Schema declares it.
+ * Returned UNCHANGED (the same object) when the listed schema cannot declare it: it already has its own
+ * `credentials`, or its root is not an object with `properties` (a record root, `allOf`, `$ref`). Such
+ * tools get the report in text and `_meta` only, never in `structuredContent`.
+ */
+export declare function withCredentialsField(schema: StandardSchemaWithJSON): StandardSchemaWithJSON;
+/** The serialized size the report adds to a result (text block, `_meta`, and `structuredContent` when structured). */
+export declare function credentialReportBytes(entries: readonly CredentialReportEntry[], structured: boolean): number;
+/**
+ * Append the report to a result: the text block, `_meta`, and `structuredContent.credentials` when
+ * `structured` (the listed output schema declares it) and the result has object structured content.
+ * Every copy (text, `_meta`, structured) passes `mask`. No entries = the result unchanged.
+ */
+export declare function attachCredentialReport(result: CallToolResult, entries: readonly CredentialReportEntry[], options: {
+    structured: boolean;
+    mask: (text: string) => string;
+}): CallToolResult;
+/** The report on a result that has no content (an input-required result): `_meta` only, masked. */
+export declare function attachCredentialMeta<R extends {
+    _meta?: Record<string, unknown>;
+}>(result: R, entries: readonly CredentialReportEntry[], mask: (text: string) => string): R;
+//# sourceMappingURL=credential-report.d.ts.map

package/dist/credential-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-report.d.ts","sourceRoot":"","sources":["../src/credential-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAAuB,KAAK,qBAAqB,EAA0B,MAAM,kBAAkB,CAAC;AAE3G,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAE5D,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,8CAA8C;AAC9C,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAc3D,CAAC;AAoBF;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,sBAAsB,GAAG,sBAAsB,CA+B3F;AAcD,sHAAsH;AACtH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,CAK5G;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,SAAS,qBAAqB,EAAE,EACzC,OAAO,EAAE;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,GAC/D,cAAc,CAgBhB;AAED,mGAAmG;AACnG,wBAAgB,oBAAoB,CAAC,CAAC,SAAS;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAChF,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,SAAS,qBAAqB,EAAE,EACzC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAC7B,CAAC,CAGH"}

package/dist/credential-report.js

@@ -0,0 +1,135 @@
+/**
+ * @novorb/mcp-core - The credential report on a tool result
+ *
+ * `registerTools` appends the report of a call's credentials (see `credentials.ts`) to every result
+ * that touched one, in three shapes:
+ *
+ * - a short text block the model reads: `Credentials: A used; B degraded (quota, retry in 60s)`;
+ * - `_meta[CREDENTIALS_META_KEY]`: the same entries, machine-readable;
+ * - `structuredContent.credentials`, when the result has an object `structuredContent`. The tool's
+ *   outputSchema gets that optional field automatically (`withCredentialsField`), unless the schema
+ *   already declares its own `credentials` property (then only the text and `_meta` carry the report).
+ *
+ * Key names only, never values; the text passes the client masking.
+ */
+import { CREDENTIAL_STATUSES, formatCredentialReport } from './credentials.js';
+/** The `_meta` key of the machine-readable report. */
+export const CREDENTIALS_META_KEY = 'io.novorb/credentials';
+/** The field name added to `structuredContent` and to the output schema. */
+export const CREDENTIALS_FIELD = 'credentials';
+/** JSON Schema of the `credentials` field. */
+export const CREDENTIALS_JSON_SCHEMA = {
+    type: 'array',
+    description: 'Credentials this call used, and the ones it found degraded, invalid or expired (key names only)',
+    items: {
+        type: 'object',
+        properties: {
+            key: { type: 'string' },
+            status: { type: 'string', enum: [...CREDENTIAL_STATUSES] },
+            used: { type: 'boolean' },
+            reason: { type: 'string' },
+            retryInSeconds: { type: 'number' },
+        },
+        required: ['key', 'status', 'used'],
+    },
+};
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Whether the listed output JSON Schema can carry the field: an object root (no `type`, or `object`)
+ * with a `properties` map that does not already declare `credentials`.
+ */
+function extensible(schema) {
+    try {
+        const json = schema['~standard'].jsonSchema.output({ target: 'draft-2020-12' });
+        const objectRoot = json.type === undefined || json.type === 'object';
+        return objectRoot && isPlainObject(json.properties) && !(CREDENTIALS_FIELD in json.properties);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The output schema plus an optional `credentials` field: validation strips the field before the
+ * tool's own schema sees it (so strict schemas keep passing) and the listed JSON Schema declares it.
+ * Returned UNCHANGED (the same object) when the listed schema cannot declare it: it already has its own
+ * `credentials`, or its root is not an object with `properties` (a record root, `allOf`, `$ref`). Such
+ * tools get the report in text and `_meta` only, never in `structuredContent`.
+ */
+export function withCredentialsField(schema) {
+    if (!extensible(schema))
+        return schema;
+    const std = schema['~standard'];
+    const restore = (result, credentials) => result.issues !== undefined || !isPlainObject(result.value)
+        ? result
+        : { value: { ...result.value, [CREDENTIALS_FIELD]: credentials } };
+    const validate = (value, options) => {
+        if (!isPlainObject(value) || !(CREDENTIALS_FIELD in value))
+            return std.validate(value, options);
+        const { [CREDENTIALS_FIELD]: credentials, ...rest } = value;
+        const result = std.validate(rest, options);
+        return result instanceof Promise ? result.then((r) => restore(r, credentials)) : restore(result, credentials);
+    };
+    return {
+        '~standard': {
+            version: 1,
+            vendor: std.vendor,
+            ...(std.types !== undefined ? { types: std.types } : {}),
+            validate,
+            jsonSchema: {
+                input: (options) => std.jsonSchema.input(options),
+                output: (options) => {
+                    const json = std.jsonSchema.output(options);
+                    if (!isPlainObject(json.properties))
+                        return json;
+                    return { ...json, properties: { ...json.properties, [CREDENTIALS_FIELD]: CREDENTIALS_JSON_SCHEMA } };
+                },
+            },
+        },
+    };
+}
+/** Every copy of the entries goes through the same masking as the text block. */
+function maskedEntries(entries, mask) {
+    return entries.map((e) => ({
+        ...e,
+        key: mask(e.key),
+        ...(e.reason !== undefined ? { reason: mask(e.reason) } : {}),
+    }));
+}
+/** The serialized size the report adds to a result (text block, `_meta`, and `structuredContent` when structured). */
+export function credentialReportBytes(entries, structured) {
+    if (entries.length === 0)
+        return 0;
+    const text = Buffer.byteLength(JSON.stringify({ type: 'text', text: formatCredentialReport(entries) }));
+    const meta = Buffer.byteLength(JSON.stringify({ [CREDENTIALS_META_KEY]: entries }));
+    return text + meta + (structured ? Buffer.byteLength(JSON.stringify({ [CREDENTIALS_FIELD]: entries })) : 0) + 16;
+}
+/**
+ * Append the report to a result: the text block, `_meta`, and `structuredContent.credentials` when
+ * `structured` (the listed output schema declares it) and the result has object structured content.
+ * Every copy (text, `_meta`, structured) passes `mask`. No entries = the result unchanged.
+ */
+export function attachCredentialReport(result, entries, options) {
+    if (entries.length === 0)
+        return result;
+    const masked = maskedEntries(entries, options.mask);
+    const out = {
+        ...result,
+        content: [...result.content, { type: 'text', text: options.mask(formatCredentialReport(masked)) }],
+        _meta: { ...(result._meta ?? {}), [CREDENTIALS_META_KEY]: masked.map((e) => ({ ...e })) },
+    };
+    if (options.structured &&
+        isPlainObject(result.structuredContent) &&
+        !(CREDENTIALS_FIELD in result.structuredContent)) {
+        out.structuredContent = { ...result.structuredContent, [CREDENTIALS_FIELD]: masked.map((e) => ({ ...e })) };
+    }
+    return out;
+}
+/** The report on a result that has no content (an input-required result): `_meta` only, masked. */
+export function attachCredentialMeta(result, entries, mask) {
+    if (entries.length === 0)
+        return result;
+    return { ...result, _meta: { ...(result._meta ?? {}), [CREDENTIALS_META_KEY]: maskedEntries(entries, mask) } };
+}
+//# sourceMappingURL=credential-report.js.map

package/dist/credential-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-report.js","sourceRoot":"","sources":["../src/credential-report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,mBAAmB,EAA8B,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE3G,sDAAsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAE/C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAA4B;IAC9D,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,iGAAiG;IAC9G,KAAK,EAAE;QACL,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,mBAAmB,CAAC,EAAE;YAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SACnC;QACD,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;KACpC;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAA8B;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAChF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;QACrE,OAAO,UAAU,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA8B;IACjE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAGhC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,WAAoB,EAAU,EAAE,CAC/D,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;QACzD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,iBAAiB,IAAI,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChG,MAAM,EAAE,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC5D,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,MAAM,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChH,CAAC,CAAC;IACF,OAAO;QACL,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,QAAQ;YACR,UAAU,EAAE;gBACV,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;gBACjD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;oBAClB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACjD,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,EAAE,EAAE,CAAC;gBACvG,CAAC;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CACpB,OAAyC,EACzC,IAA8B;IAE9B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,GAAG,CAAC;QACJ,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAChB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,qBAAqB,CAAC,OAAyC,EAAE,UAAmB;IAClG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAsB,EACtB,OAAyC,EACzC,OAAgE;IAEhE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,GAAG,GAAmB;QAC1B,GAAG,MAAM;QACT,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAClG,KAAK,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE;KAC1F,CAAC;IACF,IACE,OAAO,CAAC,UAAU;QAClB,aAAa,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACvC,CAAC,CAAC,iBAAiB,IAAI,MAAM,CAAC,iBAAiB,CAAC,EAChD,CAAC;QACD,GAAG,CAAC,iBAAiB,GAAG,EAAE,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,oBAAoB,CAClC,MAAS,EACT,OAAyC,EACzC,IAA8B;IAE9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACjH,CAAC"}

package/dist/credential-status-tool.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @novorb/mcp-core - The credential status tool
+ *
+ * `credentialStatusTool()` is a ready tool definition a server may register (with `registerTools`)
+ * to list every credential's current status: key names, pools, statuses, reasons and retry-after
+ * only, never a value. Integration tests read the startup check results through it.
+ *
+ *   registerTools(server, [...buildTools(shared), credentialStatusTool()], { env, serverName });
+ */
+import { type CredentialRegistry } from './credentials.js';
+import { type AnyToolDefinition } from './tools.js';
+export interface CredentialStatusToolOptions {
+    /** Tool name (default `credential_status`). */
+    name?: string;
+    /** The registry to list (default the process registry). */
+    registry?: CredentialRegistry;
+}
+/** A read-only tool listing every credential's status (names and statuses only). */
+export declare function credentialStatusTool(options?: CredentialStatusToolOptions): AnyToolDefinition;
+//# sourceMappingURL=credential-status-tool.d.ts.map

package/dist/credential-status-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-status-tool.d.ts","sourceRoot":"","sources":["../src/credential-status-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,KAAK,kBAAkB,EAAsB,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EAAE,KAAK,iBAAiB,EAA0B,MAAM,YAAY,CAAC;AAE5E,MAAM,WAAW,2BAA2B;IAC1C,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,2BAAgC,GAAG,iBAAiB,CAsBjG"}

package/dist/credential-status-tool.js

@@ -0,0 +1,33 @@
+/**
+ * @novorb/mcp-core - The credential status tool
+ *
+ * `credentialStatusTool()` is a ready tool definition a server may register (with `registerTools`)
+ * to list every credential's current status: key names, pools, statuses, reasons and retry-after
+ * only, never a value. Integration tests read the startup check results through it.
+ *
+ *   registerTools(server, [...buildTools(shared), credentialStatusTool()], { env, serverName });
+ */
+import { processCredentials } from './credentials.js';
+import { fromJsonSchema, TOOL_ANNOTATIONS } from './server.js';
+import { defineTool, toolResult } from './tools.js';
+/** A read-only tool listing every credential's status (names and statuses only). */
+export function credentialStatusTool(options = {}) {
+    return defineTool({
+        name: options.name ?? 'credential_status',
+        title: 'Credential status',
+        description: 'List the status of every credential this server holds (valid, invalid, expired, degraded or unknown), by key name only.',
+        inputSchema: fromJsonSchema({ type: 'object', properties: {}, additionalProperties: false }),
+        annotations: TOOL_ANNOTATIONS.readOnly,
+        handler: async () => {
+            const credentials = (options.registry ?? processCredentials()).snapshot();
+            const lines = credentials.map((c) => {
+                const details = [c.reason, c.retryInSeconds !== undefined ? `retry in ${c.retryInSeconds}s` : undefined]
+                    .filter((d) => d !== undefined)
+                    .join(', ');
+                return `${c.key}${c.pool !== undefined && c.pool !== c.key ? ` [${c.pool}]` : ''}: ${c.status}${details ? ` (${details})` : ''}`;
+            });
+            return toolResult({ credentials }, { text: credentials.length === 0 ? 'No credentials are registered.' : lines.join('\n') });
+        },
+    });
+}
+//# sourceMappingURL=credential-status-tool.js.map

package/dist/credential-status-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-status-tool.js","sourceRoot":"","sources":["../src/credential-status-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAA2B,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAA0B,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAS5E,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,UAAuC,EAAE;IAC5E,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,mBAAmB;QACzC,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,yHAAyH;QAC3H,WAAW,EAAE,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QAC5F,WAAW,EAAE,gBAAgB,CAAC,QAAQ;QACtC,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAClC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;qBACrG,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;qBAC3C,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACnI,CAAC,CAAC,CAAC;YACH,OAAO,UAAU,CACf,EAAE,WAAW,EAAE,EACf,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}