@sema-agent/server 7.135.0 → 7.137.0

package/dist/url-credential.d.ts

@@ -1,52 +0,0 @@
-/** 拒因词(闭集;判序 = 本数组序)。wire 上即 `request.field_invalid` 拒体的 `reason`。 */
-export declare const URL_CREDENTIAL_REASONS: readonly ["url_userinfo", "url_credential_param"];
-export type UrlCredentialReason = (typeof URL_CREDENTIAL_REASONS)[number];
-/** 一处命中:`url_userinfo`,或 `url_credential_param` + 它在哪一段、表里的哪个词(小写;不是调用方的原字节)。 */
-export type UrlCredential = {
-    readonly reason: "url_userinfo";
-} | {
-    readonly reason: "url_credential_param";
-    readonly at: "query" | "fragment";
-    readonly name: string;
-};
-/**
- * 判:这个值作为 URL 读出来(WHATWG),带不带 **userinfo**(判官的第一问,也是 {@link findUrlCredential} 的第一步)。只问这一件的座位 —— 运行时本就拒带 userinfo 的 URL、
- * 而凭据名参数不由它拒的载体(搜索后端的部署 env 与续跑重放读法)—— 问这一只,不在座位里另写一份 userinfo 谓词。纯函数。
- */
-export declare function findUrlUserinfo(raw: string): Extract<UrlCredential, {
-    readonly reason: "url_userinfo";
-}> | undefined;
-/**
- * 判:这个值作为 URL 读出来(WHATWG),带不带凭据。首个命中;没有(含不透明 / 解析不了的值)⇒ `undefined`。纯函数。
- */
-export declare function findUrlCredential(raw: string): UrlCredential | undefined;
-/** 一处命中的规则句(穷举;新拒因词不补 = 编译红)。只说规则与表词,不含值。 */
-export declare function urlCredentialRule(c: UrlCredential): string;
-/** 拒体上的机读位(加性键:直接当 `request.field_invalid` 的附加键用)。 */
-export type UrlCredentialFacts = {
-    readonly field: string;
-    readonly reason: UrlCredentialReason;
-};
-/** 机读位的唯一铸点:`field` 是座位给的体内全坐标,`reason` 是判官的拒因词(不另造)。 */
-export declare function urlCredentialFacts(field: string, credential: UrlCredential): UrlCredentialFacts;
-/**
- * 出路句(停驻封签的位是请求头):凭据改写进这一条的 `headers`(停驻任务的续跑上下文里只以封签存在)。MCP `transport.headers` · A2A 对端 `headers` ·
- * http 钩子条目 `headers` 三座同一句骨架,`place` 是那一条的 `headers` 在请求体里的坐标。
- */
-export declare function urlCredentialHeaderExit(place: string): string;
-/**
- * 原因句骨架(四座同一句,值不回显):规则句 + 「URL 原样存」的事实 + 出路。`exit` 是座位给的出路句(`urlCredentialHeaderExit` 或座位自己的)。
- * 为什么说「原样存」:封签闭集刻意不收 URL 一类自由文本,所以 URL 照原样进停驻上下文、日志与读面 —— 凭据只许走为它设的座。
- */
-export declare function urlCredentialRefusalReason(credential: UrlCredential, exit: string): string;
-/** 一处请求面拒的整句 + 机读位({@link buildRequestUrlCredentialRefusal} 的产物)。 */
-export interface UrlCredentialRefusal {
-    readonly message: string;
-    readonly facts: UrlCredentialFacts;
-}
-/**
- * 请求面 URL 座位的拒(整句 + 机读位),`<field>[ (<subject>)] <原因句>`。`subject` 是座位给的条目指认(MCP 的 server 名 / A2A 的 peer 名;坐标本身唯一的座位不带)。
- * MCP 座的整句要接它自己的条目键律尾句,所以 MCP 直接取 {@link urlCredentialRefusalReason} + {@link urlCredentialFacts},另三座走这一只。
- */
-export declare function buildRequestUrlCredentialRefusal(field: string, credential: UrlCredential, exit: string, subject?: string): UrlCredentialRefusal;
-//# sourceMappingURL=url-credential.d.ts.map

package/dist/url-credential.js

@@ -1,49 +0,0 @@
-import { httpUrlFlaws, httpUrlRule, isHierarchicalUrl } from "@sema-agent/settings-schema";
-import { isCredentialParamName } from "./trace/redact.js";
-export const URL_CREDENTIAL_REASONS = ["url_userinfo", "url_credential_param"];
-function credentialParamIn(params) {
-    for (const name of new URLSearchParams(params).keys()) {
-        if (isCredentialParamName(name))
-            return name.replace(/[A-Z]/g, (c) => c.toLowerCase());
-    }
-    return undefined;
-}
-export function findUrlUserinfo(raw) {
-    return isHierarchicalUrl(raw) && httpUrlFlaws(raw, ["userinfo"]).includes("userinfo") ? { reason: "url_userinfo" } : undefined;
-}
-export function findUrlCredential(raw) {
-    if (!isHierarchicalUrl(raw))
-        return undefined;
-    const userinfo = findUrlUserinfo(raw);
-    if (userinfo !== undefined)
-        return userinfo;
-    const u = new URL(raw);
-    const inQuery = credentialParamIn(u.search);
-    if (inQuery !== undefined)
-        return { reason: "url_credential_param", at: "query", name: inQuery };
-    const inFragment = credentialParamIn(u.hash.slice(1));
-    if (inFragment !== undefined)
-        return { reason: "url_credential_param", at: "fragment", name: inFragment };
-    return undefined;
-}
-export function urlCredentialRule(c) {
-    switch (c.reason) {
-        case "url_userinfo":
-            return httpUrlRule("userinfo");
-        case "url_credential_param":
-            return `must not carry a credential parameter (the ${c.at} names "${c.name}", a name the service's log redactor treats as a credential)`;
-    }
-}
-export function urlCredentialFacts(field, credential) {
-    return { field, reason: credential.reason };
-}
-export function urlCredentialHeaderExit(place) {
-    return `${place} is stored sealed: send the credential as a header in ${place} (for example "Authorization": "Bearer …")`;
-}
-export function urlCredentialRefusalReason(credential, exit) {
-    return `${urlCredentialRule(credential)} — the URL is kept as written (a parked task's resume context, logs), while ${exit}`;
-}
-export function buildRequestUrlCredentialRefusal(field, credential, exit, subject) {
-    return { message: `${field}${subject === undefined ? "" : ` (${subject})`} ${urlCredentialRefusalReason(credential, exit)}`, facts: urlCredentialFacts(field, credential) };
-}
-//# sourceMappingURL=url-credential.js.map