@zackbart/connecta 0.4.0 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +83 -0
- package/README.md +34 -14
- package/SECURITY.md +1 -1
- package/dist/connectors/api.d.ts +10 -0
- package/dist/connectors/api.d.ts.map +1 -1
- package/dist/connectors/api.js +11 -1
- package/dist/connectors/api.js.map +1 -1
- package/dist/connectors/remote-mcp.d.ts +14 -1
- package/dist/connectors/remote-mcp.d.ts.map +1 -1
- package/dist/connectors/remote-mcp.js +29 -0
- package/dist/connectors/remote-mcp.js.map +1 -1
- package/dist/credentials.d.ts +2 -1
- package/dist/credentials.d.ts.map +1 -1
- package/dist/credentials.js +4 -2
- package/dist/credentials.js.map +1 -1
- package/dist/executors/quickjs.d.ts.map +1 -1
- package/dist/executors/quickjs.js +32 -4
- package/dist/executors/quickjs.js.map +1 -1
- package/dist/index.d.ts +16 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +40 -1
- package/dist/index.js.map +1 -1
- package/dist/meta-tools.d.ts +3 -0
- package/dist/meta-tools.d.ts.map +1 -1
- package/dist/meta-tools.js +47 -6
- package/dist/meta-tools.js.map +1 -1
- package/dist/server.d.ts +2 -0
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +29 -5
- package/dist/server.js.map +1 -1
- package/dist/storage/file.d.ts.map +1 -1
- package/dist/storage/file.js +19 -3
- package/dist/storage/file.js.map +1 -1
- package/dist/ui.d.ts +1 -1
- package/dist/ui.d.ts.map +1 -1
- package/dist/ui.js +13 -9
- package/dist/ui.js.map +1 -1
- package/dist/validate.d.ts +33 -1
- package/dist/validate.d.ts.map +1 -1
- package/dist/validate.js +32 -2
- package/dist/validate.js.map +1 -1
- package/dist/version.d.ts +1 -1
- package/dist/version.js +1 -1
- package/package.json +1 -1
- package/src/connectors/api.ts +21 -1
- package/src/connectors/remote-mcp.ts +52 -0
- package/src/credentials.ts +6 -3
- package/src/executors/quickjs.ts +32 -4
- package/src/index.ts +72 -1
- package/src/meta-tools.ts +90 -16
- package/src/server.ts +32 -5
- package/src/storage/file.ts +18 -2
- package/src/ui.ts +13 -8
- package/src/validate.ts +60 -2
- package/src/version.ts +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,89 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to this package are documented here.
|
|
4
4
|
|
|
5
|
+
## 0.4.1 — 2026-07-25
|
|
6
|
+
|
|
7
|
+
A security-hardening release from a full audit of the codebase. Every change is
|
|
8
|
+
backward-compatible: new safety that could alter behavior is opt-in or a
|
|
9
|
+
generous default, and existing well-behaved deployments are unaffected. No
|
|
10
|
+
sandbox-escape, RCE, or XSS was found; the items below are the real gaps.
|
|
11
|
+
|
|
12
|
+
### Security
|
|
13
|
+
|
|
14
|
+
- **QuickJS sandbox log memory is now bounded.** `execute_code`'s `console.log`
|
|
15
|
+
capped only the *number* of retained entries (200), not their size, so
|
|
16
|
+
untrusted guest code — the sandbox's explicit threat model — could
|
|
17
|
+
`console.log("x".repeat(25_000_000))` two hundred times and retain multiple
|
|
18
|
+
GB of host memory, OOMing the Node process. Each entry is now truncated to 8k
|
|
19
|
+
chars and the cumulative buffer to 256k, both at capture time. Small logs are
|
|
20
|
+
byte-for-byte unchanged.
|
|
21
|
+
|
|
22
|
+
- **The `fileStorage` state file is now owner-only.** It holds downstream OAuth
|
|
23
|
+
access/refresh tokens in cleartext on the Node backend and was written with
|
|
24
|
+
no mode (world-readable `0644`), so any local user could read long-lived
|
|
25
|
+
tokens. The directory is now `0700`, the temp file `0600` (the atomic rename
|
|
26
|
+
preserves it), and an existing loose-mode file is repaired to `0600` on load.
|
|
27
|
+
Repair is best-effort so a non-POSIX filesystem can't block startup.
|
|
28
|
+
|
|
29
|
+
- **Cleartext-credential and destination guard on `remoteMcp`.** Static
|
|
30
|
+
`headers` credentials were attached with no scheme check, so an `http://`
|
|
31
|
+
`url` sent bearer tokens / API keys in cleartext. `remoteMcp` now warns at
|
|
32
|
+
construction when headers-auth targets a non-https, non-loopback URL, and a
|
|
33
|
+
new opt-in `requireHttps` makes that a hard error. A `NOTE` documents the
|
|
34
|
+
residual redirect-following SSRF in the SDK's fetch transport (a malicious
|
|
35
|
+
downstream could 3xx-redirect to an internal address); a full guard needs
|
|
36
|
+
manual redirect handling in the SDK and is deferred to a non-patch release.
|
|
37
|
+
|
|
38
|
+
- **Construction-time warnings for insecure deployment shapes.**
|
|
39
|
+
`createConnecta` now emits a one-time `logger.warn` when: no inbound `auth`
|
|
40
|
+
is configured while credential/OAuth connectors are present (any caller
|
|
41
|
+
reaches the credential vault — connecta's trust model is single-domain, so an
|
|
42
|
+
open or open-signup deployment grants every caller full access); `publicUrl`
|
|
43
|
+
is unset while OAuth connectors exist (the downstream `redirect_uri` is
|
|
44
|
+
derived from the attacker-influenced inbound `Host` header — set `publicUrl`
|
|
45
|
+
to a fixed https origin); or a connector exposes `finishAuth` but not
|
|
46
|
+
`verifyState` (its `/oauth/callback` would exchange any delivered `code`).
|
|
47
|
+
The shipped `remoteMcp` implements `verifyState`, so the last fires only for
|
|
48
|
+
hand-rolled connectors. Full per-actor authorization remains an architectural
|
|
49
|
+
change for a future release.
|
|
50
|
+
|
|
51
|
+
- **The discovery meta-tools no longer hang on a stuck downstream.**
|
|
52
|
+
`list_connectors`, `search_tools`, and `describe_tools` fanned out live
|
|
53
|
+
probes to every connector with no deadline, so one hung downstream stalled
|
|
54
|
+
the whole call. Bounded by the new `probeTimeoutMs` (below); a timed-out
|
|
55
|
+
connector degrades to an unavailable/errored entry. The bound is
|
|
56
|
+
caller-facing — the registry takes no `AbortSignal` yet, so the underlying
|
|
57
|
+
fetch is not cancelled; real cancellation is a documented follow-up.
|
|
58
|
+
|
|
59
|
+
- **`/ui` now ships a nonce-based script CSP.** The operator page carried no
|
|
60
|
+
script-restricting CSP, so any future escaping regression would be directly
|
|
61
|
+
exploitable. It now sends a per-request `script-src 'nonce-…' 'strict-dynamic'
|
|
62
|
+
https: 'unsafe-inline'; object-src 'none'; base-uri 'none'; frame-ancestors
|
|
63
|
+
'none'`. `'strict-dynamic'` keeps Clerk's runtime-injected scripts working;
|
|
64
|
+
the `https:`/`'unsafe-inline'` fallbacks are ignored by modern browsers and
|
|
65
|
+
only cover legacy ones; and no `default-src` is set so Clerk's network/fonts
|
|
66
|
+
and the inline styles stay unrestricted. Operator `branding` `productUrl`/
|
|
67
|
+
`ownerUrl` values are now scheme-gated (a `javascript:` URL is dropped rather
|
|
68
|
+
than rendered as a link), and credential metadata omits `lastFour` for values
|
|
69
|
+
shorter than 12 chars so a short secret doesn't leak half of itself.
|
|
70
|
+
|
|
71
|
+
### Added
|
|
72
|
+
|
|
73
|
+
- `RemoteMcpOptions.requireHttps` (default `false`) — reject a non-`https://`
|
|
74
|
+
(non-loopback) `url` at construction, and `RemoteMcpOptions.logger` for the
|
|
75
|
+
cleartext-credential warning.
|
|
76
|
+
- `ApiOptions.strictValidation` (default `false`) and
|
|
77
|
+
`ValidateToolInputOptions.failClosed` (default `false`) — reject a call whose
|
|
78
|
+
`inputSchema` the validator cannot evaluate instead of passing the raw
|
|
79
|
+
arguments through. The default remains fail-open (a broken schema does not
|
|
80
|
+
break an otherwise working tool); `api()` also now eagerly compiles each tool
|
|
81
|
+
schema at construction so a bad one warns once at startup rather than
|
|
82
|
+
silently on first use.
|
|
83
|
+
- `ConnectaConfig.probeTimeoutMs` (default `30_000`) — per-connector deadline
|
|
84
|
+
for the `list_connectors`/`search_tools`/`describe_tools` fan-out. Generous
|
|
85
|
+
by default so it trips only on a pathological hang; does not apply to
|
|
86
|
+
`call_tool`/`batch_call`, which carry `defaultToolTimeoutMs`.
|
|
87
|
+
|
|
5
88
|
## 0.4.0 — 2026-07-25
|
|
6
89
|
|
|
7
90
|
### Added
|
package/README.md
CHANGED
|
@@ -65,9 +65,7 @@ connector configuration, auth policy, domain, bindings, migrations, and secrets.
|
|
|
65
65
|
|
|
66
66
|
```ts
|
|
67
67
|
import { DynamicWorkerExecutor } from "@cloudflare/codemode";
|
|
68
|
-
import {
|
|
69
|
-
api, bearerToken, createConnecta, remoteMcp,
|
|
70
|
-
} from "@zackbart/connecta";
|
|
68
|
+
import { bearerToken, createConnecta, remoteMcp } from "@zackbart/connecta";
|
|
71
69
|
import { clerkAuth } from "@zackbart/connecta/auth/clerk";
|
|
72
70
|
import { cloudflareKvStorage } from "./cloudflare-kv.js";
|
|
73
71
|
|
|
@@ -202,9 +200,11 @@ api("example", {
|
|
|
202
200
|
```
|
|
203
201
|
|
|
204
202
|
Set `credentialEncryptionKey` on `createConnecta` to a base64-encoded 32-byte
|
|
205
|
-
key held in the runtime's secret store (`openssl rand -base64 32`)
|
|
206
|
-
|
|
207
|
-
|
|
203
|
+
key held in the runtime's secret store (`openssl rand -base64 32`) — a connector
|
|
204
|
+
that declares a credential without one fails at construction rather than booting
|
|
205
|
+
with an unusable vault. Credential mutation routes require the configured Clerk
|
|
206
|
+
provider and a same-origin browser request; the static inbound bearer cannot
|
|
207
|
+
administer the vault.
|
|
208
208
|
|
|
209
209
|
Connecta does not bundle service-specific HTTP API connectors. Package consumers
|
|
210
210
|
define them with `api()` (or implement `Connector` directly), keeping endpoint,
|
|
@@ -233,17 +233,37 @@ const connecta = createConnecta({
|
|
|
233
233
|
```
|
|
234
234
|
|
|
235
235
|
One final event is emitted for each resolved connector call made through
|
|
236
|
-
`call_tool`, `batch_call`, or `execute_code`; retries
|
|
237
|
-
`attempts` count. Implementing `list` enables the
|
|
238
|
-
`/ui`; `activityReadGate` can narrow reads
|
|
239
|
-
never change a tool result. Clerk calls
|
|
240
|
-
calls are honestly labeled as bearer
|
|
241
|
-
`bearerToken(secret, { subjectId })` assigns that credential a stable
|
|
236
|
+
`call_tool`, `call_destructive_tool`, `batch_call`, or `execute_code`; retries
|
|
237
|
+
remain one event with an `attempts` count. Implementing `list` enables the
|
|
238
|
+
authenticated Activity tab in `/ui`; `activityReadGate` can narrow reads
|
|
239
|
+
further. Writes are best-effort and never change a tool result. Clerk calls
|
|
240
|
+
carry the Clerk user ID; shared bearer calls are honestly labeled as bearer
|
|
241
|
+
unless `bearerToken(secret, { subjectId })` assigns that credential a stable
|
|
242
|
+
subject. On Workers, pass `ctx` through to `connecta.fetch(request, env, ctx)`
|
|
243
|
+
so async writes settle on `waitUntil`.
|
|
244
|
+
[`examples/worker/src/d1-activity.ts`](./examples/worker/src/d1-activity.ts) is
|
|
245
|
+
a complete D1 implementation with keyset paging and a retention pass.
|
|
246
|
+
|
|
247
|
+
## Operator dashboard
|
|
248
|
+
|
|
249
|
+
`GET /ui` is a read-only dashboard with no build step: connector health, tool
|
|
250
|
+
counts and descriptions with a client-side filter, downstream authorization
|
|
251
|
+
links, the credential controls above, and an Activity tab when an activity store
|
|
252
|
+
is configured. The shell is open because it carries no data; everything it shows
|
|
253
|
+
comes from `/ui/data`, behind the same auth gate as `/mcp`. With Clerk
|
|
254
|
+
configured it signs operators in through Clerk's hosted portal; a bearer-only
|
|
255
|
+
deployment falls back to a pasted token.
|
|
256
|
+
|
|
257
|
+
Every deployment-facing label and mark on `/ui` and the OAuth result pages comes
|
|
258
|
+
from `ConnectaConfig.branding` — `productName`, `ownerName`, their URLs,
|
|
259
|
+
`description`, `pageTitle`, `themeColor`, and `favicon` — each falling back to a
|
|
260
|
+
neutral Connecta default. Nothing about the operator is baked into the package.
|
|
242
261
|
|
|
243
262
|
## Learn more
|
|
244
263
|
|
|
245
264
|
- **[`docs/documentation.md`](./docs/documentation.md)** — how everything works: architecture,
|
|
246
265
|
the meta-tools, connectors, inbound auth, downstream OAuth, storage, running it
|
|
247
|
-
(Node / Workers / Docker), Clerk setup, testing, troubleshooting
|
|
266
|
+
(Node / Workers / Docker), Clerk setup, testing, troubleshooting, code mode,
|
|
267
|
+
the status UI, and activity history.
|
|
248
268
|
- **[`docs/design.md`](./docs/design.md)** — why it's built this way, and the non-goals.
|
|
249
|
-
- **
|
|
269
|
+
- **[`CHANGELOG.md`](./CHANGELOG.md)** — what changed in each release.
|
package/SECURITY.md
CHANGED
|
@@ -16,7 +16,7 @@ CI blocks high and critical production dependency advisories. Moderate findings
|
|
|
16
16
|
are reviewed for reachability and recorded when an upstream package has not yet
|
|
17
17
|
released a compatible fix.
|
|
18
18
|
|
|
19
|
-
|
|
19
|
+
As of 0.4.0, one such finding remains open:
|
|
20
20
|
`@modelcontextprotocol/sdk@1.29.0` declares `@hono/node-server` 1.x, which is
|
|
21
21
|
covered by `GHSA-frvp-7c67-39w9`. The advisory affects Hono's Windows
|
|
22
22
|
`serve-static` implementation. Connecta does not import that adapter or serve
|
package/dist/connectors/api.d.ts
CHANGED
|
@@ -31,6 +31,16 @@ export interface ApiOptions {
|
|
|
31
31
|
* on loose coercion.
|
|
32
32
|
*/
|
|
33
33
|
validateArgs?: boolean;
|
|
34
|
+
/**
|
|
35
|
+
* Fail-closed on a tool whose `inputSchema` the validator cannot evaluate
|
|
36
|
+
* (default false). The default surfaces such a schema as a one-time warning
|
|
37
|
+
* and then passes the raw arguments through, so a broken schema never breaks
|
|
38
|
+
* an otherwise working tool. Set true to instead reject those calls with a
|
|
39
|
+
* non-retryable `invalid_args` ConnectorCallError, so a schema that cannot be
|
|
40
|
+
* enforced never silently admits unvalidated input. Only consulted when
|
|
41
|
+
* `validateArgs` is not false.
|
|
42
|
+
*/
|
|
43
|
+
strictValidation?: boolean;
|
|
34
44
|
tools: ApiTool[];
|
|
35
45
|
}
|
|
36
46
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,yBAAyB,EACzB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,eAAe,EAEhB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC3E;AAED,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,oDAAoD;IACpD,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,SAAS,
|
|
1
|
+
{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,yBAAyB,EACzB,yBAAyB,EACzB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,eAAe,EAEhB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC3E;AAED,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,oDAAoD;IACpD,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,SAAS,CAgD3D"}
|
package/dist/connectors/api.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { validateToolInput } from "../validate.js";
|
|
1
|
+
import { precompileValidator, validateToolInput } from "../validate.js";
|
|
2
2
|
/**
|
|
3
3
|
* A connector defined entirely in code: static tool defs + fetch handlers.
|
|
4
4
|
* Tool inputs are plain JSON Schema objects (bring your own zod-to-json-schema
|
|
@@ -20,6 +20,15 @@ export function api(id, opts) {
|
|
|
20
20
|
}));
|
|
21
21
|
const byName = new Map(opts.tools.map((t) => [t.name, t]));
|
|
22
22
|
const validateArgs = opts.validateArgs ?? true;
|
|
23
|
+
const strictValidation = opts.strictValidation ?? false;
|
|
24
|
+
if (validateArgs) {
|
|
25
|
+
// Compile each schema now so a validator-hostile inputSchema surfaces once
|
|
26
|
+
// here rather than silently on its first call. Warning-only; never throws.
|
|
27
|
+
for (const t of opts.tools) {
|
|
28
|
+
if (t.inputSchema)
|
|
29
|
+
precompileValidator(t.inputSchema, { address: `${id}.${t.name}` });
|
|
30
|
+
}
|
|
31
|
+
}
|
|
23
32
|
return {
|
|
24
33
|
id,
|
|
25
34
|
title: opts.title,
|
|
@@ -42,6 +51,7 @@ export function api(id, opts) {
|
|
|
42
51
|
const invalid = validateToolInput(tool.inputSchema, input, {
|
|
43
52
|
address: `${id}.${name}`,
|
|
44
53
|
logger: ctx.logger,
|
|
54
|
+
failClosed: strictValidation,
|
|
45
55
|
});
|
|
46
56
|
if (invalid)
|
|
47
57
|
throw invalid;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/connectors/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAgExE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,IAAgB;IAC9C,MAAM,IAAI,GAAc,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IAC/C,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IACxD,IAAI,YAAY,EAAE,CAAC;QACjB,2EAA2E;QAC3E,2EAA2E;QAC3E,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,WAAW;gBACf,mBAAmB,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,WAAW,EAAE,IAAI;QACjB,KAAK,CAAC,SAAS;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,YAAY,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE;oBACzD,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,UAAU,EAAE,gBAAgB;iBAC7B,CAAC,CAAC;gBACH,IAAI,OAAO;oBAAE,MAAM,OAAO,CAAC;YAC7B,CAAC;YACD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
|
|
2
|
-
import type { Connector, ConnectorContext } from "../types.js";
|
|
2
|
+
import type { Connector, ConnectorContext, Logger } from "../types.js";
|
|
3
3
|
export type RemoteMcpAuth = {
|
|
4
4
|
type: "headers";
|
|
5
5
|
headers: Record<string, string>;
|
|
@@ -12,6 +12,19 @@ export interface RemoteMcpOptions {
|
|
|
12
12
|
title?: string;
|
|
13
13
|
description?: string;
|
|
14
14
|
auth?: RemoteMcpAuth;
|
|
15
|
+
/**
|
|
16
|
+
* Refuse to connect to a non-`https://` `url` at construction (default
|
|
17
|
+
* false). Loopback hosts (`localhost`, `127.0.0.1`, `[::1]`) are always
|
|
18
|
+
* allowed for local development. Off by default, static `headers` credentials
|
|
19
|
+
* over a cleartext connection are warned about but permitted; set this true
|
|
20
|
+
* to make that misconfiguration a hard error instead.
|
|
21
|
+
*/
|
|
22
|
+
requireHttps?: boolean;
|
|
23
|
+
/**
|
|
24
|
+
* Destination for the cleartext-credential warning emitted at construction.
|
|
25
|
+
* Default console.
|
|
26
|
+
*/
|
|
27
|
+
logger?: Logger;
|
|
15
28
|
/**
|
|
16
29
|
* @internal Testing seam. When set, this transport is used instead of the
|
|
17
30
|
* HTTP transport, letting tests point the connector at an in-process MCP
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,
|
|
1
|
+
{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,MAAM,EAEP,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAC1D;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CA4TvE"}
|
|
@@ -8,6 +8,12 @@ import { CONNECTA_VERSION } from "../version.js";
|
|
|
8
8
|
function msg(err) {
|
|
9
9
|
return err instanceof Error ? err.message : String(err);
|
|
10
10
|
}
|
|
11
|
+
function isLoopbackHost(hostname) {
|
|
12
|
+
return (hostname === "localhost" ||
|
|
13
|
+
hostname === "127.0.0.1" ||
|
|
14
|
+
hostname === "[::1]" ||
|
|
15
|
+
hostname === "::1");
|
|
16
|
+
}
|
|
11
17
|
/**
|
|
12
18
|
* Proxy a downstream remote MCP server. SDK clients and transports are scoped
|
|
13
19
|
* to one inbound request: reused by calls within a batch/execute_code run, but
|
|
@@ -24,6 +30,21 @@ export function remoteMcp(id, opts) {
|
|
|
24
30
|
// from the isolate singleton. Those are request-bound in Cloudflare Workers.
|
|
25
31
|
const states = new WeakMap();
|
|
26
32
|
const isOauth = opts.auth?.type === "oauth";
|
|
33
|
+
const logger = opts.logger ?? console;
|
|
34
|
+
// Check the destination scheme once at construction: buildTransport (and the
|
|
35
|
+
// SDK's fetch) attach any static credentials to every request, so an http://
|
|
36
|
+
// endpoint sends bearer tokens / API keys in cleartext. Loopback is exempt
|
|
37
|
+
// for local development.
|
|
38
|
+
const destination = new URL(opts.url);
|
|
39
|
+
const insecureDestination = destination.protocol !== "https:" && !isLoopbackHost(destination.hostname);
|
|
40
|
+
if (insecureDestination) {
|
|
41
|
+
if (opts.requireHttps) {
|
|
42
|
+
throw new Error(`[connecta] connector "${id}" url ${opts.url} is not https:// (and not loopback) — refusing to connect (requireHttps).`);
|
|
43
|
+
}
|
|
44
|
+
if (opts.auth?.type === "headers") {
|
|
45
|
+
logger.warn(`[connecta] connector "${id}" sends static credentials to ${opts.url} over a non-https:// connection — those tokens will be transmitted in cleartext.`);
|
|
46
|
+
}
|
|
47
|
+
}
|
|
27
48
|
/** Typed per-call auth signal; the SDK's UnauthorizedError stays as cause. */
|
|
28
49
|
const authRequiredError = (cause) => new ConnectorCallError("auth_required", `Connector "${id}" requires authorization — call authorize_connector({ connector: "${id}" }) and open the returned URL.`, { cause });
|
|
29
50
|
const stateFor = (ctx) => {
|
|
@@ -46,6 +67,14 @@ export function remoteMcp(id, opts) {
|
|
|
46
67
|
state.provider ??= new KvOAuthProvider(id, ctx.storage, `${ctx.baseUrl}/oauth/callback/${id}`);
|
|
47
68
|
return state.provider;
|
|
48
69
|
};
|
|
70
|
+
// NOTE: StreamableHTTPClientTransport speaks over fetch, which transparently
|
|
71
|
+
// follows 3xx redirects. A malicious or compromised downstream MCP could
|
|
72
|
+
// redirect to an internal address (e.g. http://169.254.169.254/…) and fetch
|
|
73
|
+
// would re-issue the request — potentially carrying static auth headers. The
|
|
74
|
+
// scheme check above only guards the first hop; a fully robust guard (manual
|
|
75
|
+
// redirect handling + per-hop re-validation + stripping auth headers cross-
|
|
76
|
+
// origin) lives in the SDK transport and is deferred to a future non-patch
|
|
77
|
+
// release rather than reimplemented here.
|
|
49
78
|
const buildTransport = (ctx, state) => {
|
|
50
79
|
if (opts._transportFactory)
|
|
51
80
|
return opts._transportFactory(ctx);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"remote-mcp.js","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"remote-mcp.js","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAwCjD,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK,CACnB,CAAC;AACJ,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,IAAsB;IAC1D,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,OAAO,EAA2B,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IAEtC,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,mBAAmB,GACvB,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,yBAAyB,EAAE,SAAS,IAAI,CAAC,GAAG,2EAA2E,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CACT,yBAAyB,EAAE,iCAAiC,IAAI,CAAC,GAAG,kFAAkF,CACvJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAE,EAAE,CAC3C,IAAI,kBAAkB,CACpB,eAAe,EACf,cAAc,EAAE,qEAAqE,EAAE,iCAAiC,EACxH,EAAE,KAAK,EAAE,CACV,CAAC;IAEJ,MAAM,QAAQ,GAAG,CAAC,GAAqB,EAAmB,EAAE;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC;QACtC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG;gBACN,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,KAAK;gBACnB,QAAQ,EAAE,IAAI;gBACd,mBAAmB,EAAE,IAAI;aAC1B,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAClB,GAAqB,EACrB,KAAsB,EACL,EAAE;QACnB,KAAK,CAAC,QAAQ,KAAK,IAAI,eAAe,CACpC,EAAE,EACF,GAAG,CAAC,OAAO,EACX,GAAG,GAAG,CAAC,OAAO,mBAAmB,EAAE,EAAE,CACtC,CAAC;QACF,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC;IAEF,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,cAAc,GAAG,CACrB,GAAqB,EACrB,KAAsB,EACX,EAAE;QACb,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE;gBAC5C,YAAY,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,OAAO,IAAI,6BAA6B,CACtC,GAAG,EACH,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAsB,EAAE,EAAE;QACvC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;QAC3B,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAC3B,GAAqB,EACrB,KAAsB,EACP,EAAE;QACjB,4EAA4E;QAC5E,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAClE,IACE,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC5C,KAAK,CAAC,mBAAmB,EACzB,CAAC;gBACD,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO;QACzB,KAAK,CAAC,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,2EAA2E;YAC3E,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACxC,wEAAwE;YACxE,gEAAgE;YAChE,wEAAwE;YACxE,wDAAwD;YACxD,MAAM,CAAC,GAAG,IAAI,MAAM,CAClB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC/C,EAAE,mBAAmB,EAAE,IAAI,2BAA2B,EAAE,EAAE,CAC3D,CAAC;YACF,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACnB,uEAAuE;gBACvE,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,kBAAkB;gBAClB,IAAI,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC7D,IAAI,CAAC;wBACH,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;oBAClB,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;oBACD,MAAM,IAAI,iBAAiB,CACzB,iEAAiE,CAClE,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjB,KAAK,CAAC,mBAAmB,GAAG,UAAU,CAAC;gBACvC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,mEAAmE;gBACnE,mBAAmB;gBACnB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,SAAS,GAAc;QAC3B,EAAE;QACF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAE7B,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAClB,CAAC,CAAC,EAAW,EAAE,CAAC,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAqC;gBACpD,YAAY,EAAE,CAAC,CAAC,YAAuC;gBACvD,WAAW,EAAE,CAAC,CAAC,WAAqC;aACrD,CAAC,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,MAAO,CAAC,QAAQ,CACjC;oBACE,IAAI;oBACJ,SAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAA4B;iBACnD,EACD,SAAS,EACT,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM;oBACzB,CAAC,CAAC;wBACE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9C;oBACH,CAAC,CAAC,SAAS,CACd,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,CAAC;oBACpE,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,GAAG;wBACrB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG;YACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS;gBACxB,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAkC,CAAC;YAC/D,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC9B,mEAAmE;YACnE,KAAK,CAAC,KAAK,CAAC,CAAC;QACf,CAAC;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAChC,SAAS,CAAC,WAAW,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,SAAS,CAAC,SAAS,GAAG,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,qEAAqE;gBACrE,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,0BAA0B;gBAC1B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,mEAAmE;gBACnE,qEAAqE;gBACrE,6DAA6D;gBAC7D,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC;gBACzB,wEAAwE;gBACxE,yCAAyC;gBACzC,MAAM,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC;gBACvB,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,wEAAwE;gBACxE,uEAAuE;gBACvE,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,uBAAuB,EAAE,CAAC;gBAClD,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,OAAO;wBACzB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,6CAA6C;iBACvD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,MAAM,CAAC,CAAC,uBAAuB,EAAE;wBACnD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
package/dist/credentials.d.ts
CHANGED
|
@@ -1,7 +1,8 @@
|
|
|
1
1
|
import type { ConnectorCredentialValues, KVStorage } from "./types.js";
|
|
2
2
|
export interface CredentialFieldMetadata {
|
|
3
3
|
configured: true;
|
|
4
|
-
|
|
4
|
+
/** Only emitted when the value is long enough that four chars don't leak much. */
|
|
5
|
+
lastFour?: string;
|
|
5
6
|
updatedAt: string;
|
|
6
7
|
}
|
|
7
8
|
export interface CredentialMetadata {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAqBvE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAqBvE,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,IAAI,CAAC;IACjB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,IAAI,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;CAClD;AAkGD;;;;GAIG;AACH,qBAAa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;gBAGtB,OAAO,EAAE,SAAS,EACnC,aAAa,EAAE,MAAM;IAiBvB,OAAO,CAAC,cAAc;YAIR,IAAI;IAoBZ,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,SAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIjE,MAAM,CACV,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAKtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAwBjE,GAAG,CACP,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IAOxB,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,yBAAyB,EACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC;IA2BxB,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD"}
|
package/dist/credentials.js
CHANGED
|
@@ -133,14 +133,16 @@ export class CredentialVault {
|
|
|
133
133
|
field,
|
|
134
134
|
{
|
|
135
135
|
configured: true,
|
|
136
|
-
|
|
136
|
+
// Only reveal the tail on values comfortably longer than four chars;
|
|
137
|
+
// for a short secret those four would be half of it.
|
|
138
|
+
...(value.length >= 12 ? { lastFour: value.slice(-4) } : {}),
|
|
137
139
|
updatedAt: credential.updatedAt,
|
|
138
140
|
},
|
|
139
141
|
]));
|
|
140
142
|
const single = fields.value;
|
|
141
143
|
return {
|
|
142
144
|
configured: true,
|
|
143
|
-
...(single ? { lastFour: single.lastFour } : {}),
|
|
145
|
+
...(single?.lastFour ? { lastFour: single.lastFour } : {}),
|
|
144
146
|
updatedAt: credential.updatedAt,
|
|
145
147
|
fields,
|
|
146
148
|
};
|
package/dist/credentials.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAEA,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAEA,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AA+BlC,SAAS,UAAU,CAAC,WAAmB;IACrC,OAAO,QAAQ,WAAW,gBAAgB,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;QACpD,IACE,MAAM,CAAC,OAAO,KAAK,CAAC;YACpB,MAAM,CAAC,SAAS,KAAK,SAAS;YAC9B,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;YAC7B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EACrC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,MAAkB,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAC;QACF,MAAM,MAAM,GACV,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;YACzB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QACpB,IACE,CAAC,MAAM;YACP,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAC3B,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CACjB,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;gBACtC,OAAO,KAAK,KAAK,QAAQ,CAC5B;YACD,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EACpC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,MAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACxE,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,mBAAmB,CAAC,CAAC;QACjE,CAAC;QACD,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC;IACD,IACE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;QACrD,oBAAoB,EACpB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,oBAAoB,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAe;IAIP;IAHF,GAAG,CAAqB;IAEzC,YACmB,OAAkB,EACnC,aAAqB;QADJ,YAAO,GAAP,OAAO,CAAW;QAGnC,MAAM,GAAG,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAChC,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,WAAmB;QACxC,OAAO,OAAO,CAAC,MAAM,CAAC,uBAAuB,WAAW,KAAK,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,WAAmB;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C;gBACE,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;aACjD,EACD,MAAM,IAAI,CAAC,GAAG,EACd,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CACnC,CAAC;YACF,OAAO,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAmB,EAAE,KAAK,GAAG,OAAO;QAC5C,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CACV,WAAmB;QAEnB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YACxD,KAAK;YACL;gBACE,UAAU,EAAE,IAAa;gBACzB,qEAAqE;gBACrE,qDAAqD;gBACrD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC;SACF,CAAC,CACH,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,MAAM;SACP,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CACP,WAAmB,EACnB,KAAa,EACb,SAAiB;QAEjB,0EAA0E;QAC1E,wEAAwE;QACxE,8CAA8C;QAC9C,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,MAAM,CACV,WAAmB,EACnB,MAAiC,EACjC,SAAiB;QAEjB,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAwB;YACrC,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;SACV,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C;YACE,IAAI,EAAE,SAAS;YACf,EAAE;YACF,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;SACjD,EACD,MAAM,IAAI,CAAC,GAAG,EACd,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAC1C,CAAC;QACF,MAAM,QAAQ,GAAa;YACzB,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,SAAS;YACpB,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;YACrB,UAAU,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;SACtD,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACrD,CAAC;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"quickjs.d.ts","sourceRoot":"","sources":["../../src/executors/quickjs.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAiB,QAAQ,EAAoB,MAAM,aAAa,CAAC;AAE7E,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;
|
|
1
|
+
{"version":3,"file":"quickjs.d.ts","sourceRoot":"","sources":["../../src/executors/quickjs.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAiB,QAAQ,EAAoB,MAAM,aAAa,CAAC;AAE7E,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAgBD,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUlD;AAwJD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,OAAO,GAAE,sBAA2B,GACnC,QAAQ,CAiIV"}
|
|
@@ -9,6 +9,14 @@
|
|
|
9
9
|
// provider args/results must be JSON-serializable.
|
|
10
10
|
import { getQuickJS, shouldInterruptAfterDeadline, } from "quickjs-emscripten";
|
|
11
11
|
const MAX_LOG_ENTRIES = 200;
|
|
12
|
+
// Cap each entry AND the cumulative buffer at capture time so untrusted guest
|
|
13
|
+
// code can't retain unbounded host memory: a single `console.log("x".repeat(N))`
|
|
14
|
+
// otherwise copies the whole N-char guest string into a host array we hold for
|
|
15
|
+
// the entire execution. 8k chars/entry is generous for glue-code logging (the
|
|
16
|
+
// join in execute.ts trims the assembled log to 4k anyway), and 256k total
|
|
17
|
+
// keeps the worst case — 200 maxed-out entries — bounded well under a MiB.
|
|
18
|
+
const MAX_LOG_ENTRY_CHARS = 8_000;
|
|
19
|
+
const MAX_LOG_TOTAL_CHARS = 256_000;
|
|
12
20
|
function msg(err) {
|
|
13
21
|
return err instanceof Error ? err.message : String(err);
|
|
14
22
|
}
|
|
@@ -84,13 +92,33 @@ function installBridge(ctx, providers, logs) {
|
|
|
84
92
|
waitForSettle: Promise.resolve(),
|
|
85
93
|
};
|
|
86
94
|
armWake(bridge);
|
|
95
|
+
// Running total of chars actually retained in `logs`; once the cumulative
|
|
96
|
+
// budget is spent we push one marker and drop the rest, so a flood of large
|
|
97
|
+
// entries can't grow the host array without bound.
|
|
98
|
+
let logTotalChars = 0;
|
|
99
|
+
let logBudgetSpent = false;
|
|
87
100
|
const logFn = ctx.newFunction("__log", (h) => {
|
|
88
|
-
if (logs.length
|
|
89
|
-
logs.
|
|
101
|
+
if (logs.length >= MAX_LOG_ENTRIES) {
|
|
102
|
+
if (logs.length === MAX_LOG_ENTRIES) {
|
|
103
|
+
logs.push(`[log truncated after ${MAX_LOG_ENTRIES} entries]`);
|
|
104
|
+
}
|
|
105
|
+
return;
|
|
106
|
+
}
|
|
107
|
+
if (logBudgetSpent)
|
|
108
|
+
return;
|
|
109
|
+
// Cap the entry before retaining it: `getString` yields a transient copy,
|
|
110
|
+
// but slicing here keeps only a bounded string alive in `logs`.
|
|
111
|
+
let entry = ctx.getString(h);
|
|
112
|
+
if (entry.length > MAX_LOG_ENTRY_CHARS) {
|
|
113
|
+
entry = `${entry.slice(0, MAX_LOG_ENTRY_CHARS)}…[entry truncated]`;
|
|
90
114
|
}
|
|
91
|
-
|
|
92
|
-
logs.push(
|
|
115
|
+
if (logTotalChars + entry.length > MAX_LOG_TOTAL_CHARS) {
|
|
116
|
+
logs.push("[log truncated: size budget exceeded]");
|
|
117
|
+
logBudgetSpent = true;
|
|
118
|
+
return;
|
|
93
119
|
}
|
|
120
|
+
logs.push(entry);
|
|
121
|
+
logTotalChars += entry.length;
|
|
94
122
|
});
|
|
95
123
|
ctx.setProp(ctx.global, "__log", logFn);
|
|
96
124
|
logFn.dispose();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"quickjs.js","sourceRoot":"","sources":["../../src/executors/quickjs.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,mEAAmE;AACnE,6EAA6E;AAC7E,mDAAmD;AAEnD,OAAO,EACL,UAAU,EACV,4BAA4B,GAG7B,MAAM,oBAAoB,CAAC;AAkB5B,MAAM,eAAe,GAAG,GAAG,CAAC;
|
|
1
|
+
{"version":3,"file":"quickjs.js","sourceRoot":"","sources":["../../src/executors/quickjs.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,mEAAmE;AACnE,6EAA6E;AAC7E,mDAAmD;AAEnD,OAAO,EACL,UAAU,EACV,4BAA4B,GAG7B,MAAM,oBAAoB,CAAC;AAkB5B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,8EAA8E;AAC9E,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,KAAK;QAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,kBAAkB,CAAC,KAAK,CAAC;AAClC,CAAC;AAED,iGAAiG;AACjG,SAAS,WAAW,CAAC,SAA6B;IAChD,MAAM,KAAK,GAAa;QACtB;;;;MAIE;QACF;;;;GAID;KACA,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;YAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7B,qEAAqE;YACrE,sEAAsE;YACtE,uEAAuE;YACvE,OAAO,MAAM,CAAC,yBAAyB,EAAE,KAAK,CAAC,OAAO,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,uEAAuE;AACvE,SAAS,WAAW,CAAC,MAAe;IAClC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,GAAG,MAA+C,CAAC;IAC1D,OAAO,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC;AACnE,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAe;IACvC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,MAA+C,CAAC;QAC1D,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;gBACzC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;gBAC3C,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACtE,CAAC;AASD,SAAS,OAAO,CAAC,MAAkB;IACjC,MAAM,CAAC,aAAa,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7C,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,GAAmB,EACnB,SAA6B,EAC7B,IAAc;IAEd,MAAM,MAAM,GAAe;QACzB,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;QACd,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE;KACjC,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhB,0EAA0E;IAC1E,4EAA4E;IAC5E,mDAAmD;IACnD,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QAC3C,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,wBAAwB,eAAe,WAAW,CAAC,CAAC;YAChE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,cAAc;YAAE,OAAO;QAC3B,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACvC,KAAK,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,oBAAoB,CAAC;QACrE,CAAC;QACD,IAAI,aAAa,GAAG,KAAK,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;YACnD,cAAc,GAAG,IAAI,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,KAAK,CAAC,OAAO,EAAE,CAAC;IAEhB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,EAClB,EAAU,EACV,EAAU,EACV,QAAgB,EACC,EAAE;QACnB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChC,MAAM,CAAC,GACL,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC;gBACzC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAc,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,QAAQ,GAA2B,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1D,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC1C,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,yEAAyE;gBACzE,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC9B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACpB,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,OAAO,EAAE,CAAC;IAEjB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAkC,EAAE;IAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACtE,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,GAAG,IAAI,CAAC;IAEnE,OAAO;QACL,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,SAA6B;YAE7B,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,MAAM,YAAY,GAAG,6BAA6B,SAAS,KAAK,CAAC;YACjE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;YAC7C,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC;YAC/C,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;YAExE,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,CAAC,CAAgB,EAAiB,EAAE;gBACjD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;gBACtB,oEAAoE;gBACpE,qEAAqE;gBACrE,mEAAmE;gBACnE,oEAAoE;gBACpE,gEAAgE;gBAChE,kEAAkE;gBAClE,sEAAsE;gBACtE,qEAAqE;gBACrE,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;oBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;qBACnC,CAAC;oBACJ,KAAK,CAAC,KAAK,IAAI,EAAE;wBACf,OAAO,CAAC,MAAM,CAAC,CAAC;wBAChB,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;4BAC1B,MAAM,MAAM,CAAC,aAAa,CAAC;4BAC3B,OAAO,CAAC,MAAM,CAAC,CAAC;wBAClB,CAAC;wBACD,GAAG,CAAC,OAAO,EAAE,CAAC;oBAChB,CAAC,CAAC,EAAE,CAAC;gBACP,CAAC;gBACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC;YACF,MAAM,IAAI,GAAG,CAAC,KAAa,EAAiB,EAAE,CAC5C,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAEvC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;YACnD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvD,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,IAAI,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAEtB,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAC5B,sBAAsB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAClD,CAAC;YACF,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBACzC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAC1B,kEAAkE;gBAClE,mEAAmE;gBACnE,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;oBAAE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC7E,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC;YAEtC,mEAAmE;YACnE,oEAAoE;YACpE,0EAA0E;YAC1E,MAAM,KAAK,GAAG,KAAK,IAA4B,EAAE;gBAC/C,SAAS,CAAC;oBACR,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;oBAC9C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBACf,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACpC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;wBACrB,oEAAoE;wBACpE,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;4BAClD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;wBACpD,CAAC;wBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChE,CAAC;oBACD,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;oBACjD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;wBAC/B,MAAM,MAAM,GAAY,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBAC9C,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;wBACtB,OAAO,EAAE,MAAM,EAAE,CAAC;oBACpB,CAAC;oBACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;wBAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBACrC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;wBACtB,gEAAgE;wBAChE,8DAA8D;wBAC9D,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;4BAClD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;wBACpD,CAAC;wBACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChE,CAAC;oBACD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;wBACzB,OAAO;4BACL,MAAM,EAAE,SAAS;4BACjB,KAAK,EACH,iEAAiE;yBACpE,CAAC;oBACJ,CAAC;oBACD,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;wBACnB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;oBACpD,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;wBACjC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;wBACrC,IAAI,OAAO,CAAU,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;qBACnE,CAAC,CAAC;oBACH,IAAI,OAAO;wBAAE,OAAO,CAAC,MAAM,CAAC,CAAC;yBACxB,CAAC;wBACJ,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;oBACpD,CAAC;gBACH,CAAC;YACH,CAAC,CAAC;YAEF,IAAI,OAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;YAC1B,CAAC;oBAAS,CAAC;gBACT,aAAa,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -65,6 +65,22 @@ export interface ConnectaConfig {
|
|
|
65
65
|
* not explicitly ask to retry.
|
|
66
66
|
*/
|
|
67
67
|
defaultToolTimeoutMs?: number;
|
|
68
|
+
/**
|
|
69
|
+
* Deadline (ms) applied to each individual downstream probe/catalog call that
|
|
70
|
+
* the discovery meta-tools fan out — `list_connectors` (with `probe`),
|
|
71
|
+
* `search_tools`, and `describe_tools` — so a single hung connector can no
|
|
72
|
+
* longer stall the whole meta-tool call. **Defaults to a generous 30_000**,
|
|
73
|
+
* chosen to trip only on a pathological hang, not on a realistically slow
|
|
74
|
+
* probe, so having it on by default will not break existing deployments.
|
|
75
|
+
* Bounds one downstream call, not the whole fan-out: a connector that outruns
|
|
76
|
+
* it degrades to an unavailable/errored entry while the rest are unaffected.
|
|
77
|
+
*
|
|
78
|
+
* Does NOT apply to `call_tool`/`batch_call` — those carry their own budget
|
|
79
|
+
* via `defaultToolTimeoutMs` or a per-call `timeoutMs`. Note this bounds the
|
|
80
|
+
* caller-facing wait only; the underlying fetch is not currently aborted, so
|
|
81
|
+
* real cancellation of the downstream request is a deferred follow-up.
|
|
82
|
+
*/
|
|
83
|
+
probeTimeoutMs?: number;
|
|
68
84
|
serverInfo?: {
|
|
69
85
|
name?: string;
|
|
70
86
|
version?: string;
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,SAAS,EACT,MAAM,EACP,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACnC,mDAAmD;IACnD,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE;QACX,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,8DAA8D;QAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yDAAyD;QACzD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iFAAiF;QACjF,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;KACrE,CAAC;IACF,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,wFAAwF;IACxF,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,QAAQ,EAAE,QAAQ,CAAC;CACpB;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAIzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,SAAS,EACT,MAAM,EACP,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,WAAW,GAAG,WAAW,EAAE,CAAC;IACnC,mDAAmD;IACnD,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE;QACX,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,8DAA8D;QAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yDAAyD;QACzD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iFAAiF;QACjF,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC,CAAC;KACrE,CAAC;IACF,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,QAAQ;IACvB,wFAAwF;IACxF,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7E,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAwED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAqD/D;AAED,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,YAAY,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIhD,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAClF,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EACV,SAAS,EACT,gBAAgB,EAChB,yBAAyB,EACzB,yBAAyB,EACzB,8BAA8B,EAC9B,yBAAyB,EACzB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,aAAa,EACb,QAAQ,EACR,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,EACT,MAAM,EACN,OAAO,EACP,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC"}
|