@suveren/gateway 0.7.2 → 0.7.3

package/README.md

@@ -119,7 +119,16 @@ suveren-gateway stop               # stop a detached run
 
 Open `http://localhost:3400`. The MCP server is at `http://localhost:3430`.
 
-To upgrade later: `npm install -g @suveren/gateway@latest && suveren-gateway restart`.
+To upgrade later, run these two commands:
+
+```
+npm install -g @suveren/gateway@latest
+suveren-gateway restart
+```
+
+(Written as two lines on purpose: `&&` is not a valid separator in Windows
+PowerShell 5.1, which is what ships with Windows. Use `;` there if you want
+them on one line.)
 
 ### Connecting an MCP client
 

package/dist/control-plane/index.mjs

@@ -685,6 +685,64 @@ function createAuthRouter(vault2, logoutAuth, loginRateLimit2) {
 
 // src/routes/vault.ts
 import { Router as Router2 } from "express";
+
+// src/lib/credential-meta.ts
+var META_KEY = "__updatedAt";
+var MIN_PREVIEW_LENGTH = 12;
+var PREFIX_RE = /^([A-Za-z][A-Za-z0-9]*(?:[-_][A-Za-z0-9]+)*[-_])/;
+var MAX_PREFIX_LENGTH = 12;
+var HIDDEN_FLOOR = 12;
+function previewSecret(value) {
+  if (value.length < MIN_PREVIEW_LENGTH) return { preview: null };
+  const match = PREFIX_RE.exec(value)?.[1] ?? "";
+  const prefix = match && match.length <= MAX_PREFIX_LENGTH && value.length - match.length - 4 >= HIDDEN_FLOOR ? match : "";
+  if (!prefix && value.length - 4 < 8) return { preview: null };
+  return { preview: `${prefix}\u2026${value.slice(-4)}` };
+}
+var AI_CONFIG_TEXT_FIELDS = /* @__PURE__ */ new Set(["provider", "endpoint", "model"]);
+function textFieldsFor(name, manifests) {
+  if (name === "ai-config") return AI_CONFIG_TEXT_FIELDS;
+  const list = Array.isArray(manifests) ? manifests : [];
+  const manifest = list.find((m) => m?.id === name);
+  const out = /* @__PURE__ */ new Set();
+  for (const f of manifest?.credentials?.fields ?? []) {
+    if (typeof f?.key === "string" && f?.type === "text") out.add(f.key);
+  }
+  return out;
+}
+function credentialView(cred, textFields) {
+  const fields = {};
+  const secrets = {};
+  let updatedAt;
+  for (const [key, value] of Object.entries(cred)) {
+    if (key === META_KEY) {
+      updatedAt = value;
+      continue;
+    }
+    if (textFields.has(key)) fields[key] = value;
+    else secrets[key] = previewSecret(value);
+  }
+  return {
+    configured: true,
+    fieldNames: Object.keys(fields).concat(Object.keys(secrets)),
+    fields,
+    secrets,
+    ...updatedAt ? { updatedAt } : {}
+  };
+}
+
+// src/routes/vault.ts
+var manifestCache = null;
+async function cachedManifests() {
+  if (manifestCache && Date.now() - manifestCache.at < 6e4) return manifestCache.value;
+  try {
+    const m = await getManifests();
+    manifestCache = { at: Date.now(), value: m?.manifests ?? m };
+  } catch {
+    manifestCache = { at: Date.now(), value: [] };
+  }
+  return manifestCache.value;
+}
 function createVaultRouter(vault2) {
   const router = Router2();
   router.get("/status", (_req, res) => {
@@ -696,14 +754,14 @@ function createVaultRouter(vault2) {
       serviceCount: services.length
     });
   });
-  router.get("/credentials/:name", (req, res) => {
+  router.get("/credentials/:name", async (req, res) => {
     const { name } = req.params;
     const cred = vault2.getCredential(name);
     if (!cred) {
       res.json({ configured: false });
       return;
     }
-    res.json({ configured: true, fieldNames: Object.keys(cred), fields: cred });
+    res.json(credentialView(cred, textFieldsFor(name, await cachedManifests())));
   });
   router.put("/credentials/:name", async (req, res) => {
     const { name } = req.params;
@@ -714,6 +772,7 @@ function createVaultRouter(vault2) {
       if (existing) fields = { ...existing, ...incoming };
     } catch {
     }
+    fields = { ...fields, [META_KEY]: (/* @__PURE__ */ new Date()).toISOString() };
     vault2.setCredential(name, fields);
     try {
       await pushServiceCredentials(name, fields);
@@ -2327,7 +2386,7 @@ function resolveOrigin(req) {
   return `${req.protocol}://${req.get("host")}`;
 }
 var oauthRedirectUris = /* @__PURE__ */ new Map();
-var manifestCache = null;
+var manifestCache2 = null;
 function resolvePath(obj, path) {
   const v = path.split(".").reduce((acc, key) => {
     return acc && typeof acc === "object" ? acc[key] : void 0;
@@ -2347,15 +2406,15 @@ function decodeJwtEmail(idToken) {
   }
 }
 async function getOAuthManifest(integrationId) {
-  if (!manifestCache) {
+  if (!manifestCache2) {
     try {
       const data = await getManifests();
-      manifestCache = data.manifests;
+      manifestCache2 = data.manifests;
     } catch {
       return null;
     }
   }
-  return manifestCache?.find((m) => m.id === integrationId && m.oauth) ?? null;
+  return manifestCache2?.find((m) => m.id === integrationId && m.oauth) ?? null;
 }
 app.get("/auth/oauth/:integrationId/start", async (req, res) => {
   const { integrationId } = req.params;