This is an automated email from the ASF dual-hosted git repository.
sciabarracom pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/openserverless-mcp.git
The following commit(s) were added to refs/heads/main by this push:
new 328ff40 Rename trustable -> trustant (issue #1)
328ff40 is described below
commit 328ff401f8790458d0b21400119fdc84b1ab83d4
Author: Michele Sciabarra <[email protected]>
AuthorDate: Fri Sep 25 08:23:33 2026 +0100
Rename trustable -> trustant (issue #1)
Renames the extension file, all exported symbols, the MCP tool names,
the package name and the _meta wire key. The TRUSTANT_MANAGED_RUNTIME /
TRUSTANT_RUNTIME_CONFIG / TRUSTANT_PI_EXTENSION_PATH env vars and the
extensions/trustant-runtime.ts path are a contract with the parent Go
repo, so this must land with the matching parent commit.
The trustable-ai GitHub org is preserved, including the
trustable-ai/templates notebook source.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
README.md | 4 ++--
spec.md | 10 +++++-----
src/index.ts | 2 +-
src/secrets.ts | 10 +++++-----
tests/secrets.test.ts | 4 ++--
5 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/README.md b/README.md
index 5223f9a..e510270 100644
--- a/README.md
+++ b/README.md
@@ -37,11 +37,11 @@ incomplete binding for a successful tool call.
`action_add_secret` remains as
the single-endpoint compatibility tool; use `secret_bind` when several actions
must share one user-configured credential.
-Application `.env` and `.env.production` files are owned by Trustable's
+Application `.env` and `.env.production` files are owned by Trustant's
user-facing configuration flow. The MCP performs only value-free presence
checks needed for binding validation and never creates, edits, imports,
synchronizes, regenerates, or automatically populates those files. A missing
-variable must be added by the user through Trustable.
+variable must be added by the user through Trustant.
Application authentication uses Redis-backed opaque sessions. Create login,
registration, `me`/session, every protected endpoint, and logout, then call
diff --git a/spec.md b/spec.md
index 2f1c6df..6690d5f 100644
--- a/spec.md
+++ b/spec.md
@@ -114,11 +114,11 @@ This tool adds a new secret <MY_SECRET> to an
endpoint/action/function.
First checks the secret is available in `.env`. If it is absent, return an MCP
error with `isError: true` and do not modify the endpoint.
-Trustable-managed runtime variables are not application secrets and must be
+Trustant-managed runtime variables are not application secrets and must be
rejected even when they exist in `.env`: `OPS_USER`, `OPS_PASSWORD`,
`OPS_APIHOST`, `OPS_REPO`, and `OPS_SKILLS`. In particular, the tool must never
generate `#--param OPS_APIHOST "$OPS_APIHOST"`; `OPS_APIHOST` belongs to the
-Trustable/`ops ide` orchestration process, not to action runtime context.
+Trustant/`ops ide` orchestration process, not to action runtime context.
- adds in `__main__.py` after "## build-context ##":
@@ -143,11 +143,11 @@ name exists in `.env` and whether each generated wrapper
contains the matching
parameter binding. Never read or return the value.
Application `.env` and `.env.production` files are owned exclusively by the
-Trustable user-facing configuration flow. This MCP may perform a value-free
+Trustant user-facing configuration flow. This MCP may perform a value-free
presence check needed to validate a binding, but it must not expose a tool that
creates, edits, imports, synchronizes, regenerates, or automatically populates
either file. Missing variables are MCP errors and must be reported to the user
-for configuration through Trustable.
+for configuration through Trustant.
# tool secret-bind
@@ -162,7 +162,7 @@ Receive one bound parameter name and a non-empty endpoint
list. Validate every
generated wrapper before changing anything, then atomically remove only the
exact binding block produced by the secret tools. Do not read or delete the
value from `.env`. The operation is idempotent and is the supported recovery
-path for legacy invalid bindings of Trustable-managed variables such as
+path for legacy invalid bindings of Trustant-managed variables such as
`OPS_APIHOST`. When a binding is removed, the tool must instruct the caller to
recreate every changed endpoint with `ops ide undeploy <endpoint>` followed by
`ops ide deploy <endpoint>`, because updating an existing OpenWhisk action
diff --git a/src/index.ts b/src/index.ts
index 3012662..24379e5 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -48,7 +48,7 @@ const tools: Tool[] = [
secretBind,
secretUnbind,
authSetup,
- // WHY: application env files are owned by Trustable's user-facing
+ // WHY: application env files are owned by Trustant's user-facing
// configuration flow. auth_setup wires Redis only; no registered tool
// generates values or writes .env behind the user's back.
]
diff --git a/src/secrets.ts b/src/secrets.ts
index 7a7de91..b7f3a4a 100644
--- a/src/secrets.ts
+++ b/src/secrets.ts
@@ -19,7 +19,7 @@ import { existsSync, readFileSync, writeFileSync } from
"node:fs"
import { BUILD_CONTEXT_MARKER, parseEndpoint, type Endpoint } from "./lib.ts"
const SECRET_NAME = /^[A-Z_][A-Z0-9_]*$/
-const TRUSTABLE_MANAGED_ENV_NAMES = new Set([
+const TRUSTANT_MANAGED_ENV_NAMES = new Set([
"OPS_USER",
"OPS_PASSWORD",
"OPS_APIHOST",
@@ -52,8 +52,8 @@ function normalizeEnvName(secret: string): string {
export function normalizeSecretName(secret: string): string {
const name = normalizeEnvName(secret)
- if (TRUSTABLE_MANAGED_ENV_NAMES.has(name)) {
- throw new Error(`'${name}' is a Trustable-managed runtime variable and
cannot be used as an application secret or action parameter`)
+ if (TRUSTANT_MANAGED_ENV_NAMES.has(name)) {
+ throw new Error(`'${name}' is a Trustant-managed runtime variable and
cannot be used as an application secret or action parameter`)
}
return name
}
@@ -76,7 +76,7 @@ function envValues(path: string): Map<string, string> {
export function hasEnvSecret(secret: string, path = ".env"): boolean {
const name = normalizeSecretName(secret)
// WHY: this is a value-free existence probe only. Environment mutation is
- // reserved for the Trustable UI and is intentionally absent from this MCP.
+ // reserved for the Trustant UI and is intentionally absent from this MCP.
return Boolean(envValues(path).get(name))
}
@@ -171,7 +171,7 @@ export function bindSecret(secret: string, endpointValues:
string[]): SecretBind
/**
* Remove only the exact wrapper block previously generated by the secret
* binding tools. This is also the supported recovery path for legacy invalid
- * bindings of Trustable-managed variables such as OPS_APIHOST.
+ * bindings of Trustant-managed variables such as OPS_APIHOST.
*/
export function unbindSecret(secret: string, endpointValues: string[]):
SecretUnbindingResult {
const name = normalizeEnvName(secret)
diff --git a/tests/secrets.test.ts b/tests/secrets.test.ts
index 6014f75..5d7906b 100644
--- a/tests/secrets.test.ts
+++ b/tests/secrets.test.ts
@@ -88,7 +88,7 @@ test("action_add_secret reports a real MCP error when the
secret is absent", ()
})
})
-test("secret tools reject Trustable-managed runtime variables", () => {
+test("secret tools reject Trustant-managed runtime variables", () => {
inTemporaryProject(() => {
writeFileSync(".env", "OPS_APIHOST=http://miniops.me\n";)
const original = endpoint("v1/stack-status")
@@ -98,7 +98,7 @@ test("secret tools reject Trustable-managed runtime
variables", () => {
secret: "OPS_APIHOST",
})
assert.equal(bind.isError, true)
- assert.match(resultText(bind), /Trustable-managed runtime variable/)
+ assert.match(resultText(bind), /Trustant-managed runtime variable/)
assert.equal(readFileSync("packages/v1/stack-status/__main__.py",
"utf-8"), original)
assert.equal(readFileSync(".env", "utf-8"),
"OPS_APIHOST=http://miniops.me\n";)
