run402-mcp/sdk/dist/node/vault-byo-probe.js

MCP server for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.

/**
 * vault-byo-primary-bucket — the allocation-time bucket-policy probe
 * (design D6, task 3.1). Runs BEFORE the allocation request ever reaches
 * the gateway, against the DESTINATION's own root (no `repo_id` exists yet
 * — allocation is what mints one) — so a failed probe means "no vault
 * half-exists", never a partially-created one.
 *
 * Reuses the shipped mirror backend's SigV4 client — no second S3 client.
 */
import { LocalError } from "../errors.js";
import { openVaultDestinationBackend } from "./vault-mirror-backend.js";
import { formatMirrorDestination } from "./vault-mirror-config.js";
function fail(code, message, context, details, nextActions) {
    throw new LocalError(message, context, { code, details, ...(nextActions ? { next_actions: nextActions } : {}) });
}
/**
 * The failing properties, named — never a bundled "the probe failed". Every
 * entry maps 1:1 to one of {@link VaultBucketProbeResult}'s three
 * booleans, so a caller (or a test) can assert on exactly what broke.
 */
export function vaultByoProbeFailingProperties(result) {
    const failing = [];
    if (!result.write_permitted)
        failing.push("write_permitted");
    if (!result.create_only_honored)
        failing.push("create_only_honored");
    if (!result.versioning_off)
        failing.push("versioning_off");
    return failing;
}
/**
 * `repos create --byo`'s pre-allocation gate: open a root-scoped backend at
 * `destination` (no `repo_id` — the probe never collides with any vault's
 * own `source/<repo_id>/` prefix, since it writes under `_byo-probe/`
 * instead) and run {@link VaultMirrorBackend.probeWritePolicy}. A failed
 * property (or a thrown transport error) refuses with
 * `VAULT_BYO_BUCKET_PROBE_FAILED`, naming exactly which propert(y/ies)
 * failed and the underlying fact — the caller MUST NOT proceed to
 * allocation on a failed probe.
 */
export async function probeVaultByoDestination(destination, credential) {
    const backend = openVaultDestinationBackend(destination, credential);
    let result;
    try {
        result = await backend.probeWritePolicy();
    }
    catch (e) {
        const message = e instanceof Error ? e.message : String(e);
        fail("VAULT_BYO_BUCKET_PROBE_FAILED", `the bucket-policy probe against ${formatMirrorDestination(destination)} failed before any property could be confirmed: ${message}`, "probing the BYO destination before allocation", { destination: formatMirrorDestination(destination), failing_properties: ["write_permitted", "create_only_honored", "versioning_off"] }, [{ action: "confirm the destination and credential are correct, and that the bucket policy grants PutObject + GetBucketVersioning to this credential, then retry" }]);
    }
    const failing = vaultByoProbeFailingProperties(result);
    if (failing.length > 0) {
        fail("VAULT_BYO_BUCKET_PROBE_FAILED", `${formatMirrorDestination(destination)} does not satisfy the BYO bucket-policy profile (versioning disabled, create-only if-none-match writes honored, write permitted) — failing: ${failing.join(", ")}${result.detail ? ` (${result.detail})` : ""}`, "probing the BYO destination before allocation", { destination: formatMirrorDestination(destination), failing_properties: failing, probe: result }, [{ action: "disable bucket versioning, confirm the bucket policy enforces s3:if-none-match create-only writes, and confirm PutObject is permitted for this credential, then retry" }]);
    }
    return result;
}
//# sourceMappingURL=vault-byo-probe.js.map