studiograph 1.3.48-next.21 → 1.3.48-next.211

package/dist/core/secrets/master-key.js

@@ -0,0 +1,122 @@
+/**
+ * Master-key bootstrap.
+ *
+ * Resolution order:
+ *   1. STUDIOGRAPH_MASTER_KEY env var (base64-encoded 32 bytes).
+ *      Always wins. In production this is the only acceptable source.
+ *   2. ~/.studiograph/master-key file (mode 0600). Local-dev only.
+ *      If absent, a fresh 32-byte key is generated, written, and a one-time
+ *      warning printed to stderr with backup instructions.
+ *
+ * Production gate: when RAILWAY_ENVIRONMENT is set and the env-var is
+ * unset, throw. We do NOT silently generate a key in production — that
+ * would be ephemeral, would invalidate every encrypted row on the next
+ * restart, and would mask a misconfigured deploy.
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { generateMasterKey } from './encryption.js';
+const MASTER_KEY_ENV = 'STUDIOGRAPH_MASTER_KEY';
+const MASTER_KEY_PREVIOUS_ENV = 'STUDIOGRAPH_MASTER_KEY_PREVIOUS';
+/**
+ * Default location of the local-dev fallback file.
+ */
+function defaultMasterKeyPath() {
+    return join(homedir(), '.studiograph', 'master-key');
+}
+function isProduction() {
+    return Boolean(process.env.RAILWAY_ENVIRONMENT);
+}
+function decodeBase64Key(raw, source) {
+    const trimmed = raw.trim();
+    let bytes;
+    try {
+        bytes = new Uint8Array(Buffer.from(trimmed, 'base64'));
+    }
+    catch {
+        throw new Error(`master-key: ${source} is not valid base64`);
+    }
+    if (bytes.length !== 32) {
+        throw new Error(`master-key: ${source} decoded to ${bytes.length} bytes (need 32)`);
+    }
+    return bytes;
+}
+/**
+ * Load the master key. Idempotent — safe to call multiple times.
+ *
+ * In a long-running process you should call once at boot and cache the
+ * result. The local-dev side-effect (file generate + warn) only fires if
+ * the file does not exist.
+ */
+export function loadMasterKey(opts = {}) {
+    const envValue = process.env[MASTER_KEY_ENV];
+    if (envValue && envValue.trim()) {
+        return {
+            key: decodeBase64Key(envValue, `${MASTER_KEY_ENV} env var`),
+            source: 'env',
+        };
+    }
+    // Production must be env-only. Fall through is misconfiguration.
+    if (isProduction()) {
+        throw new Error(`master-key: ${MASTER_KEY_ENV} is required in production (RAILWAY_ENVIRONMENT is set). ` +
+            `Generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"`);
+    }
+    // Local-dev: file fallback.
+    const filePath = opts.filePath ?? defaultMasterKeyPath();
+    if (existsSync(filePath)) {
+        const raw = readFileSync(filePath, 'utf-8');
+        return {
+            key: decodeBase64Key(raw, `master-key file at ${filePath}`),
+            source: 'file',
+            filePath,
+        };
+    }
+    // First-run on local dev: generate and persist.
+    const key = generateMasterKey();
+    const b64 = Buffer.from(key).toString('base64');
+    // Make sure the parent directory exists with restrictive mode.
+    mkdirSync(join(filePath, '..'), { recursive: true, mode: 0o700 });
+    // mkdirSync's mode is masked by umask, so retighten.
+    try {
+        chmodSync(join(filePath, '..'), 0o700);
+    }
+    catch { /* non-fatal */ }
+    writeFileSync(filePath, b64, { mode: 0o600 });
+    try {
+        chmodSync(filePath, 0o600);
+    }
+    catch { /* non-fatal */ }
+    // One-time stderr warning. Local-dev UX only; production never lands here.
+    // Stderr because stdout is reserved for app output and could be piped.
+    process.stderr.write([
+        '',
+        '─'.repeat(72),
+        'studiograph: generated a new master key (first run)',
+        `  Location: ${filePath}`,
+        '  Mode:     0600 (owner read/write only)',
+        '',
+        `  This key encrypts the secrets store. If you lose it, every encrypted`,
+        `  row in secrets.db is permanently unrecoverable.`,
+        '',
+        `  Back it up. To export for a different environment:`,
+        `    cat ${filePath}`,
+        `  Then set in the new environment:`,
+        `    ${MASTER_KEY_ENV}=<contents>`,
+        '─'.repeat(72),
+        '',
+    ].join('\n'));
+    return { key, source: 'generated', filePath };
+}
+/**
+ * Optional companion: load a previous master key for rotation transitions.
+ * Returns undefined when STUDIOGRAPH_MASTER_KEY_PREVIOUS is unset — that's
+ * the steady state. Caller must tolerate undefined.
+ */
+export function loadPreviousMasterKey() {
+    const v = process.env[MASTER_KEY_PREVIOUS_ENV];
+    if (!v || !v.trim())
+        return undefined;
+    return decodeBase64Key(v, `${MASTER_KEY_PREVIOUS_ENV} env var`);
+}
+//# sourceMappingURL=master-key.js.map

package/dist/core/secrets/master-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"master-key.js","sourceRoot":"","sources":["../../../src/core/secrets/master-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACnF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAUlE;;GAEG;AACH,SAAS,oBAAoB;IAC3B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,MAAc;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,sBAAsB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,eAAe,KAAK,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAA8B,EAAE;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE,GAAG,cAAc,UAAU,CAAC;YAC3D,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,eAAe,cAAc,2DAA2D;YACxF,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,oBAAoB,EAAE,CAAC;IACzD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO;YACL,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,sBAAsB,QAAQ,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM;YACd,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,+DAA+D;IAC/D,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,qDAAqD;IACrD,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IACzE,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC;QAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;IAE7D,2EAA2E;IAC3E,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB;QACE,EAAE;QACF,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACd,qDAAqD;QACrD,eAAe,QAAQ,EAAE;QACzB,0CAA0C;QAC1C,EAAE;QACF,wEAAwE;QACxE,mDAAmD;QACnD,EAAE;QACF,sDAAsD;QACtD,WAAW,QAAQ,EAAE;QACrB,oCAAoC;QACpC,OAAO,cAAc,aAAa;QAClC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,eAAe,CAAC,CAAC,EAAE,GAAG,uBAAuB,UAAU,CAAC,CAAC;AAClE,CAAC"}

package/dist/core/secrets/probes/anthropic.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Test-connection probe for Anthropic API keys.
+ *
+ * Implements the staged-advisory contract: each call walks an ordered
+ * sequence of stages (reachable → auth → listing → model_in_list), and
+ * returns the per-stage outcomes plus an overall ok flag. The overall
+ * flag is true IFF every non-advisory stage passed; the `model_in_list`
+ * stage is advisory, so a missing model.id only surfaces as a hint —
+ * the user might be using a preview-tagged or beta model that isn't in
+ * the public listing yet.
+ *
+ * No upstream error bodies are echoed. Stage details are short,
+ * human-authored strings, and never carry the API key, header values,
+ * or the upstream response payload beyond what's explicitly modeled
+ * here.
+ *
+ * Other providers (r2, brave) still use the legacy stub shape — they
+ * return `{ ok, message, durationMs }` only, no stages. The shared
+ * TestResult type below treats the new fields as optional so both
+ * shapes coexist behind one type until later waves promote the rest
+ * to staged diagnostics.
+ */
+/**
+ * One step in a staged probe. The Anthropic probe today emits four
+ * stages in order. Other probes (r2, brave) don't emit stages — they
+ * fill `stages: undefined`.
+ *
+ * `error_code` is a stable string the UI can switch on (e.g. 'network',
+ * 'unauthorized', 'upstream_5xx'). `detail` is human-readable copy
+ * suitable for direct display; it never carries the secret value or an
+ * echoed upstream-body fragment beyond a short canned phrase.
+ */
+export interface ProbeStage {
+    name: 'reachable' | 'auth' | 'listing' | 'model_in_list';
+    ok: boolean;
+    error_code?: string;
+    detail?: string;
+}
+export interface ProbeAdvisory {
+    /**
+     * Mirror of the `model_in_list` stage outcome — true when the
+     * configured model.id was found in /v1/models, false when absent.
+     * Undefined when the probe didn't get far enough to check (e.g.
+     * stopped at `auth`).
+     */
+    model_in_list?: boolean;
+    /** Top-N nearby IDs from the listing response, when model_in_list is false. */
+    suggestions?: string[];
+}
+export interface TestResult {
+    ok: boolean;
+    /**
+     * Short, human-readable status. Never carries the secret value.
+     * Legacy callers (r2, brave stubs) still set this; the staged
+     * Anthropic probe also sets it (mirrors the final stage's detail or
+     * a one-liner summary) so a UI that hasn't been taught about
+     * `stages` still has copy to render.
+     */
+    message?: string;
+    /** Wall-clock duration in ms. */
+    durationMs?: number;
+    /**
+     * Ordered probe stages. Present when the probe is staged; absent for
+     * legacy stubs. The Anthropic probe always emits 1–4 entries
+     * depending on how far it got.
+     */
+    stages?: ProbeStage[];
+    /** Advisory hints (model_in_list, did-you-mean suggestions). */
+    advisory?: ProbeAdvisory;
+}
+/**
+ * Optional context passed alongside the probed value. Today only the
+ * configured `model_id` is plumbed in — the API layer reads it from
+ * the secret store and forwards it so stage 4 can verify the listing
+ * contains the user's chosen ID. Stub probes ignore this param.
+ */
+export interface ProbeContext {
+    model_id?: string;
+}
+/**
+ * Pick the top-N closest model IDs to `needle` from `haystack`. Prefix
+ * matches win first, then sort the rest by Levenshtein distance.
+ * Returns at most `limit` entries.
+ */
+export declare function suggestModelIds(needle: string, haystack: readonly string[], limit?: number): string[];
+/**
+ * Anthropic probe entry point.
+ *
+ * Signature is loose so the legacy `(apiKey) => Promise<TestResult>`
+ * call sites in `registry.ts` and the `/api/secrets/:key/test`
+ * dispatcher keep working. When the API layer has a configured
+ * `model.id` it forwards it via `ctx.model_id`; otherwise stage 4
+ * runs without a needle and reports `model_in_list: undefined`.
+ *
+ * The injected `fetchImpl` lets unit tests swap in a mock without
+ * patching the global. Default = the platform `fetch`.
+ */
+export declare function probeAnthropic(apiKey: string, ctx?: ProbeContext, fetchImpl?: typeof fetch): Promise<TestResult>;

package/dist/core/secrets/probes/anthropic.js

@@ -0,0 +1,300 @@
+/**
+ * Test-connection probe for Anthropic API keys.
+ *
+ * Implements the staged-advisory contract: each call walks an ordered
+ * sequence of stages (reachable → auth → listing → model_in_list), and
+ * returns the per-stage outcomes plus an overall ok flag. The overall
+ * flag is true IFF every non-advisory stage passed; the `model_in_list`
+ * stage is advisory, so a missing model.id only surfaces as a hint —
+ * the user might be using a preview-tagged or beta model that isn't in
+ * the public listing yet.
+ *
+ * No upstream error bodies are echoed. Stage details are short,
+ * human-authored strings, and never carry the API key, header values,
+ * or the upstream response payload beyond what's explicitly modeled
+ * here.
+ *
+ * Other providers (r2, brave) still use the legacy stub shape — they
+ * return `{ ok, message, durationMs }` only, no stages. The shared
+ * TestResult type below treats the new fields as optional so both
+ * shapes coexist behind one type until later waves promote the rest
+ * to staged diagnostics.
+ */
+const ANTHROPIC_API_BASE = 'https://api.anthropic.com';
+const REACHABLE_TIMEOUT_MS = 5_000;
+const AUTH_TIMEOUT_MS = 10_000;
+/**
+ * Levenshtein distance, capped — we only need to rank suggestions for
+ * a short user-supplied model.id against a short list. The cap keeps
+ * the function from running away on long strings (model IDs are
+ * typically 10–40 chars).
+ */
+function levenshtein(a, b) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    const v0 = new Array(b.length + 1);
+    const v1 = new Array(b.length + 1);
+    for (let i = 0; i <= b.length; i++)
+        v0[i] = i;
+    for (let i = 0; i < a.length; i++) {
+        v1[0] = i + 1;
+        for (let j = 0; j < b.length; j++) {
+            const cost = a[i] === b[j] ? 0 : 1;
+            v1[j + 1] = Math.min(v1[j] + 1, v0[j + 1] + 1, v0[j] + cost);
+        }
+        for (let j = 0; j <= b.length; j++)
+            v0[j] = v1[j];
+    }
+    return v1[b.length];
+}
+/**
+ * Pick the top-N closest model IDs to `needle` from `haystack`. Prefix
+ * matches win first, then sort the rest by Levenshtein distance.
+ * Returns at most `limit` entries.
+ */
+export function suggestModelIds(needle, haystack, limit = 3) {
+    if (!needle || haystack.length === 0)
+        return haystack.slice(0, limit);
+    const prefixes = [];
+    const rest = [];
+    for (const id of haystack) {
+        if (id === needle)
+            continue;
+        if (id.startsWith(needle) || needle.startsWith(id)) {
+            prefixes.push(id);
+        }
+        else {
+            rest.push({ id, d: levenshtein(id, needle) });
+        }
+    }
+    rest.sort((a, b) => a.d - b.d);
+    return [...prefixes, ...rest.map((r) => r.id)].slice(0, limit);
+}
+/**
+ * Fetch wrapper that honours a per-call timeout via AbortController.
+ * Returns the Response on success; throws the original error on
+ * network failure / abort. Callers convert the throw into a stage
+ * with an error_code rather than propagating raw error text.
+ *
+ * Accepts the fetch impl as an explicit dep so unit tests can swap
+ * in a mock without patching the global.
+ */
+async function fetchWithTimeout(fetchImpl, url, init) {
+    const { timeoutMs, ...rest } = init;
+    const ctl = new AbortController();
+    const handle = setTimeout(() => ctl.abort(), timeoutMs);
+    try {
+        return await fetchImpl(url, { ...rest, signal: ctl.signal });
+    }
+    finally {
+        clearTimeout(handle);
+    }
+}
+/**
+ * Anthropic probe entry point.
+ *
+ * Signature is loose so the legacy `(apiKey) => Promise<TestResult>`
+ * call sites in `registry.ts` and the `/api/secrets/:key/test`
+ * dispatcher keep working. When the API layer has a configured
+ * `model.id` it forwards it via `ctx.model_id`; otherwise stage 4
+ * runs without a needle and reports `model_in_list: undefined`.
+ *
+ * The injected `fetchImpl` lets unit tests swap in a mock without
+ * patching the global. Default = the platform `fetch`.
+ */
+export async function probeAnthropic(apiKey, ctx, fetchImpl = fetch) {
+    const started = Date.now();
+    const stages = [];
+    const advisory = {};
+    if (!apiKey || typeof apiKey !== 'string') {
+        return {
+            ok: false,
+            message: 'No API key provided',
+            durationMs: Date.now() - started,
+            stages: [{ name: 'auth', ok: false, error_code: 'missing_value', detail: 'No API key provided' }],
+        };
+    }
+    // ── Stage 1: reachable ────────────────────────────────────────────────
+    // Cheap network round-trip to verify DNS + TCP + TLS to the API host.
+    // A 404 here is fine — we just need a response. The intent is to
+    // separate "network broken" from "API key bad" so the UI can show
+    // a useful error.
+    try {
+        await fetchWithTimeout(fetchImpl, `${ANTHROPIC_API_BASE}/`, {
+            method: 'GET',
+            timeoutMs: REACHABLE_TIMEOUT_MS,
+            // The bare hostname returns 404 with a small JSON body — we don't
+            // care about status here, only that we reached the server.
+        });
+        stages.push({ name: 'reachable', ok: true });
+    }
+    catch (err) {
+        stages.push({
+            name: 'reachable',
+            ok: false,
+            error_code: 'network',
+            detail: err instanceof Error && err.name === 'AbortError'
+                ? 'Timed out connecting to api.anthropic.com'
+                : 'Could not reach api.anthropic.com',
+        });
+        return {
+            ok: false,
+            message: 'Network unreachable',
+            durationMs: Date.now() - started,
+            stages,
+        };
+    }
+    // ── Stages 2 + 3: auth + listing ─────────────────────────────────────
+    // One request covers both — `GET /v1/models` returns 401/403 on bad
+    // auth and a `{ data: [...] }` envelope on success. We score the
+    // stages separately so the UI can show "auth ok, but listing shape
+    // unexpected" if Anthropic ever changes the response.
+    let listing;
+    try {
+        const resp = await fetchWithTimeout(fetchImpl, `${ANTHROPIC_API_BASE}/v1/models`, {
+            method: 'GET',
+            headers: {
+                'x-api-key': apiKey,
+                'anthropic-version': '2023-06-01',
+            },
+            timeoutMs: AUTH_TIMEOUT_MS,
+        });
+        if (resp.status === 401 || resp.status === 403) {
+            stages.push({
+                name: 'auth',
+                ok: false,
+                error_code: 'unauthorized',
+                detail: 'API key rejected (HTTP ' + resp.status + ')',
+            });
+            return {
+                ok: false,
+                message: 'API key rejected',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        if (resp.status >= 500) {
+            stages.push({
+                name: 'auth',
+                ok: false,
+                error_code: 'upstream_5xx',
+                detail: 'Anthropic returned HTTP ' + resp.status,
+            });
+            return {
+                ok: false,
+                message: 'Upstream error',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        if (resp.status < 200 || resp.status >= 300) {
+            stages.push({
+                name: 'auth',
+                ok: false,
+                error_code: 'unexpected_status',
+                detail: 'Unexpected HTTP ' + resp.status,
+            });
+            return {
+                ok: false,
+                message: 'Unexpected status',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        stages.push({ name: 'auth', ok: true });
+        // Listing — parse the JSON. A network success with a malformed body
+        // gets its own error_code so the UI can distinguish from outright
+        // auth failure.
+        try {
+            listing = await resp.json();
+        }
+        catch {
+            stages.push({
+                name: 'listing',
+                ok: false,
+                error_code: 'invalid_json',
+                detail: 'Could not parse /v1/models response',
+            });
+            return {
+                ok: false,
+                message: 'Invalid response shape',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        if (!listing || !Array.isArray(listing.data)) {
+            stages.push({
+                name: 'listing',
+                ok: false,
+                error_code: 'invalid_shape',
+                detail: 'Listing response missing `data` array',
+            });
+            return {
+                ok: false,
+                message: 'Invalid response shape',
+                durationMs: Date.now() - started,
+                stages,
+            };
+        }
+        stages.push({ name: 'listing', ok: true });
+    }
+    catch (err) {
+        stages.push({
+            name: 'auth',
+            ok: false,
+            error_code: 'network',
+            detail: err instanceof Error && err.name === 'AbortError'
+                ? 'Timed out fetching /v1/models'
+                : 'Network error fetching /v1/models',
+        });
+        return {
+            ok: false,
+            message: 'Network error',
+            durationMs: Date.now() - started,
+            stages,
+        };
+    }
+    // ── Stage 4: model_in_list (ADVISORY) ────────────────────────────────
+    // Only runs when the API caller forwarded a configured model.id.
+    // The stage's ok flag is reported per-stage but does NOT flip the
+    // overall ok: preview / unlisted models are intentionally allowed.
+    const ids = (listing.data ?? [])
+        .map((m) => (m && typeof m.id === 'string') ? m.id : undefined)
+        .filter((s) => !!s);
+    if (ctx?.model_id) {
+        const present = ids.includes(ctx.model_id);
+        if (present) {
+            stages.push({ name: 'model_in_list', ok: true });
+            advisory.model_in_list = true;
+        }
+        else {
+            const suggestions = suggestModelIds(ctx.model_id, ids, 3);
+            stages.push({
+                name: 'model_in_list',
+                ok: false,
+                error_code: 'not_listed',
+                detail: 'Configured model.id not found in /v1/models (advisory — preview models are allowed)',
+            });
+            advisory.model_in_list = false;
+            if (suggestions.length > 0)
+                advisory.suggestions = suggestions;
+        }
+    }
+    // Overall ok = every non-advisory stage passed. By construction we
+    // returned early on any non-advisory failure, so reaching here means
+    // reachable + auth + listing are all green.
+    return {
+        ok: true,
+        message: ctx?.model_id && advisory.model_in_list === false
+            ? 'Key valid; configured model.id not in listing (advisory)'
+            : 'Key valid',
+        durationMs: Date.now() - started,
+        stages,
+        advisory: Object.keys(advisory).length > 0 ? advisory : undefined,
+    };
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/core/secrets/probes/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../../src/core/secrets/probes/anthropic.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+DH,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AACvD,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;;GAKG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAA2B,EAAE,KAAK,GAAG,CAAC;IACpF,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAqC,EAAE,CAAC;IAClD,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,EAAE,KAAK,MAAM;YAAE,SAAS;QAC5B,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,gBAAgB,CAC7B,SAAuB,EACvB,GAAW,EACX,IAAyC;IAEzC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,GAAkB,EAClB,YAA0B,KAAK;IAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;SAClG,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,sEAAsE;IACtE,iEAAiE;IACjE,kEAAkE;IAClE,kBAAkB;IAClB,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,SAAS,EAAE,GAAG,kBAAkB,GAAG,EAAE;YAC1D,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,oBAAoB;YAC/B,kEAAkE;YAClE,2DAA2D;SACrB,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,WAAW;YACjB,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;gBACvD,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,mCAAmC;SACxC,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,MAAM;SACP,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,iEAAiE;IACjE,mEAAmE;IACnE,sDAAsD;IACtD,IAAI,OAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,GAAG,kBAAkB,YAAY,EAAE;YAChF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,WAAW,EAAE,MAAM;gBACnB,mBAAmB,EAAE,YAAY;aAClC;YACD,SAAS,EAAE,eAAe;SACY,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,cAAc;gBAC1B,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG;aACtD,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,cAAc;gBAC1B,MAAM,EAAE,0BAA0B,GAAG,IAAI,CAAC,MAAM;aACjD,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,gBAAgB;gBACzB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,mBAAmB;gBAC/B,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC,MAAM;aACzC,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,mBAAmB;gBAC5B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,oEAAoE;QACpE,kEAAkE;QAClE,gBAAgB;QAChB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAuC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,cAAc;gBAC1B,MAAM,EAAE,qCAAqC;aAC9C,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,wBAAwB;gBACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,SAAS;gBACf,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,eAAe;gBAC3B,MAAM,EAAE,uCAAuC;aAChD,CAAC,CAAC;YACH,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,wBAAwB;gBACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM;aACP,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,KAAK;YACT,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;gBACvD,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,mCAAmC;SACxC,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,MAAM;SACP,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,kEAAkE;IAClE,mEAAmE;IACnE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,GAAG,EAAE,QAAQ,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,eAAe;gBACrB,EAAE,EAAE,KAAK;gBACT,UAAU,EAAE,YAAY;gBACxB,MAAM,EAAE,qFAAqF;aAC9F,CAAC,CAAC;YACH,QAAQ,CAAC,aAAa,GAAG,KAAK,CAAC;YAC/B,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;QACjE,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,4CAA4C;IAC5C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,KAAK;YACxD,CAAC,CAAC,0DAA0D;YAC5D,CAAC,CAAC,WAAW;QACf,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;QAChC,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC;AACJ,CAAC"}

package/dist/core/secrets/probes/brave.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Test-connection probe for Brave Search API.
+ *
+ * Stub-quality: structure + return shape only. A production probe would
+ * call https://api.search.brave.com/res/v1/web/search?q=test with the key
+ * and surface 200 vs 401 vs 429.
+ */
+import type { TestResult } from './anthropic.js';
+export declare function probeBrave(apiKey: string): Promise<TestResult>;

package/dist/core/secrets/probes/brave.js

@@ -0,0 +1,15 @@
+/**
+ * Test-connection probe for Brave Search API.
+ *
+ * Stub-quality: structure + return shape only. A production probe would
+ * call https://api.search.brave.com/res/v1/web/search?q=test with the key
+ * and surface 200 vs 401 vs 429.
+ */
+export async function probeBrave(apiKey) {
+    const started = Date.now();
+    if (!apiKey || typeof apiKey !== 'string') {
+        return { ok: false, message: 'No API key provided', durationMs: Date.now() - started };
+    }
+    return { ok: true, message: 'Probe stub — not contacted upstream', durationMs: Date.now() - started };
+}
+//# sourceMappingURL=brave.js.map

package/dist/core/secrets/probes/brave.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brave.js","sourceRoot":"","sources":["../../../../src/core/secrets/probes/brave.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,qCAAqC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AACxG,CAAC"}

package/dist/core/secrets/probes/r2.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Test-connection probe for R2 / S3-compatible storage.
+ *
+ * Stub-quality: structure + return shape only. A production probe would do a
+ * HeadBucket via the AWS SDK and surface 200 vs 403 vs 404. For Phase -1 we
+ * only need the contract.
+ */
+import type { TestResult } from './anthropic.js';
+export interface R2Probe {
+    endpoint: string;
+    bucket: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+}
+export declare function probeR2(_value: R2Probe | string): Promise<TestResult>;

package/dist/core/secrets/probes/r2.js

@@ -0,0 +1,14 @@
+/**
+ * Test-connection probe for R2 / S3-compatible storage.
+ *
+ * Stub-quality: structure + return shape only. A production probe would do a
+ * HeadBucket via the AWS SDK and surface 200 vs 403 vs 404. For Phase -1 we
+ * only need the contract.
+ */
+export async function probeR2(_value) {
+    const started = Date.now();
+    // Stub: would HeadBucket and inspect status. Returning ok-by-shape avoids
+    // accidentally hitting real R2 buckets in tests.
+    return { ok: true, message: 'Probe stub — not contacted upstream', durationMs: Date.now() - started };
+}
+//# sourceMappingURL=r2.js.map

package/dist/core/secrets/probes/r2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.js","sourceRoot":"","sources":["../../../../src/core/secrets/probes/r2.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAAwB;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,0EAA0E;IAC1E,iDAAiD;IACjD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,qCAAqC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;AACxG,CAAC"}

package/dist/core/secrets/probes/tavily.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Test-connection probe for the Tavily Search API.
+ *
+ * Makes a small real search call against
+ *   POST https://api.tavily.com/search
+ * with the configured key and a fixed probe query. Returns `ok: true`
+ * on HTTP 200, `ok: false` on auth / network / other errors. This is the
+ * same endpoint + request shape the runtime search tool uses
+ * (see agent/tools/web-tools.ts), so a green probe means search will work.
+ *
+ * The probe never echoes the upstream error body — only a generic canned
+ * phrase and the HTTP status code (no headers, no payload).
+ *
+ * `fetchImpl` is injectable so unit tests can exercise the status mapping
+ * without contacting the real upstream (mirrors the Anthropic probe).
+ */
+import type { TestResult } from './anthropic.js';
+export declare function probeTavily(apiKey: string, _ctx?: unknown, fetchImpl?: typeof fetch): Promise<TestResult>;