run402-mcp
Version:
MCP server for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.
43 lines • 2.29 kB
TypeScript
/**
* Safe-echo policy for values that failed local (client-side) validation.
*
* A value rejected by a format/existence check is a value we know nothing
* about — the CLI has only established what it is NOT. The likeliest
* failure is an ordinary typo, but the second likeliest, demonstrated in
* practice, is a credential pasted into the wrong slot: a Base-mainnet
* private key holding real funds lands in `RUN402_WALLET` (which takes a
* wallet NAME, not a key), fails the name check, and is printed verbatim to
* a terminal, a log, and a session transcript.
*
* `describeRejectedValue` is the one place that decides what a rejected
* value is safe to show, so every call site — wallet names, org ids, room
* keys, unknown commands/subcommands, "not found" lookups — gets the same
* answer instead of each reinventing (or forgetting) the judgment call.
*
* Short, low-entropy values (ordinary typos) are returned unchanged — that
* is what makes the resulting error message useful. Long or
* high-entropy-looking values are replaced with a shape-only description
* (character count only), never a substring or prefix of the original:
* even a short prefix of a private key is more than a debugging aid needs
* and more than a leak should give up.
*
* This is a heuristic, not a content-aware secret scanner: treat "returned
* unchanged" as "short and plain enough to be a typo," not as proof the
* value holds no secret. Callers with a value that is never supposed to be
* secret-shaped in the first place (a service key, an admin key) should
* still never echo it at all, redacted or not — this helper is for slots
* that normally hold a plain identifier and occasionally, by mistake,
* don't.
*/
/**
* Return `value` unchanged when it is short and plain enough to be a
* harmless typo; otherwise return a shape-only placeholder (character count
* only — never a substring) that is still safe to embed in a message or a
* structured `details` field.
*
* Never throws. Coerces non-string input the same way template-literal
* interpolation would, so a caller can pass whatever it already has without
* a separate type check.
*/
export declare function describeRejectedValue(value: unknown): string;
//# sourceMappingURL=redact.d.ts.map