@blogic-cz/agent-tools 1.15.3 → 1.16.0

package/dist/api-tool/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/api-tool/proxy.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,SAAS,CAAC;AAGzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MACC,CAAC;AASxD,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;IA6PG,SAAS,eAAe,MAAM,KAAG,IAAI;IAGrC,MAAM,WAAW,MAAM,KAAG,IAAI;IAI9B,OAAO,eAAqB,MAAM,SAAS,OAAO,KAAG,OAAO,CAAC,SAAS,CAAC;IAEvE,iBAAiB,eAAqB,MAAM,SAAS,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC;EAGjF"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/api-tool/proxy.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,SAAS,CAAC;AAGzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MACC,CAAC;AAmBxD,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;IA6aG,SAAS,eAAe,MAAM,KAAG,IAAI;IAGrC,MAAM,WAAW,MAAM,KAAG,IAAI;IAO9B,OAAO,eAAqB,MAAM,SAAS,OAAO,KAAG,OAAO,CAAC,SAAS,CAAC;IAEvE,iBAAiB,eAAqB,MAAM,SAAS,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC;EAGjF"}

package/dist/api-tool/types.d.ts

@@ -16,8 +16,21 @@ export declare const ProfileSchema: Schema.Struct<{
     }>, Schema.Struct<{
         readonly kind: Schema.Literal<"login">;
         readonly path: Schema.String;
-        readonly fields: Schema.$Record<Schema.String, Schema.String>;
-        readonly tokenField: Schema.String;
+        readonly fields: Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+            readonly secretRef: Schema.String;
+        }>, Schema.Struct<{
+            readonly literal: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+        }>]>>;
+        readonly tokenField: Schema.optionalKey<Schema.String>;
+        readonly tokenPath: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly tokenReuseMs: Schema.optionalKey<Schema.Number>;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"bodyFields">;
+        readonly fields: Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
+            readonly secretRef: Schema.String;
+        }>, Schema.Struct<{
+            readonly literal: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+        }>]>>;
     }>]>;
     readonly methods: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["GET", "POST", "PUT", "PATCH", "DELETE"]>>>;
     readonly pathPrefixes: Schema.$Array<Schema.String>;
@@ -74,8 +87,21 @@ export declare const OperatorSchema: Schema.Struct<{
         }>, Schema.Struct<{
             readonly kind: Schema.Literal<"login">;
             readonly path: Schema.String;
-            readonly fields: Schema.$Record<Schema.String, Schema.String>;
-            readonly tokenField: Schema.String;
+            readonly fields: Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Struct<{
+                readonly secretRef: Schema.String;
+            }>, Schema.Struct<{
+                readonly literal: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+            }>]>>;
+            readonly tokenField: Schema.optionalKey<Schema.String>;
+            readonly tokenPath: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly tokenReuseMs: Schema.optionalKey<Schema.Number>;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"bodyFields">;
+            readonly fields: Schema.$Record<Schema.String, Schema.Union<readonly [Schema.Struct<{
+                readonly secretRef: Schema.String;
+            }>, Schema.Struct<{
+                readonly literal: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+            }>]>>;
         }>]>;
         readonly methods: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["GET", "POST", "PUT", "PATCH", "DELETE"]>>>;
         readonly pathPrefixes: Schema.$Array<Schema.String>;

package/dist/api-tool/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api-tool/types.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,eAAO,MAAM,MAAM,qEAA6D,CAAC;AAoBjF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcxB,CAAC;AACH,QAAA,MAAM,WAAW;;;;;;;;;EASf,CAAC;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBzB,CAAC;AACH,eAAO,MAAM,YAAY;;;;EAIvB,CAAC;AACH,eAAO,MAAM,aAAa;;;;;;EAMxB,CAAC;AACH,eAAO,MAAM,YAAY;;;EAA8D,CAAC;AACxF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AACpD,MAAM,MAAM,UAAU,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AACnD,MAAM,MAAM,SAAS,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AACjD,MAAM,MAAM,OAAO,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAChD,MAAM,MAAM,KAAK,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;AAE5C,wBAAgB,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAChE,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,OAAO,GACb,CAAC,CAAC,MAAM,CAAC,CAMX;AACD,eAAO,MAAM,cAAc,QAAS,CAAC;AACrC,eAAO,MAAM,yBAAyB,WAAa,CAAC;AACpD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASjD;AACD,eAAO,MAAM,aAAa,SAAU,MAAM,UAAU,MAAM,KAAG,OAG5D,CAAC;AACF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,GAAG,CAgB1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAiE/D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/api-tool/types.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGhC,eAAO,MAAM,MAAM,qEAA6D,CAAC;AAmCjF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcxB,CAAC;AACH,QAAA,MAAM,WAAW;;;;;;;;;EASf,CAAC;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBzB,CAAC;AACH,eAAO,MAAM,YAAY;;;;EAIvB,CAAC;AACH,eAAO,MAAM,aAAa;;;;;;EAMxB,CAAC;AACH,eAAO,MAAM,YAAY;;;EAA8D,CAAC;AACxF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAC;AACxD,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AACpD,MAAM,MAAM,UAAU,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AACnD,MAAM,MAAM,SAAS,GAAG,OAAO,YAAY,CAAC,IAAI,CAAC;AACjD,MAAM,MAAM,OAAO,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAChD,MAAM,MAAM,KAAK,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;AAE5C,wBAAgB,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAChE,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,OAAO,GACb,CAAC,CAAC,MAAM,CAAC,CAMX;AACD,eAAO,MAAM,cAAc,QAAS,CAAC;AACrC,eAAO,MAAM,yBAAyB,WAAa,CAAC;AACpD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASjD;AACD,eAAO,MAAM,aAAa,SAAU,MAAM,UAAU,MAAM,KAAG,OAG5D,CAAC;AACF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,mBAAmB,UAAQ,GAAG,GAAG,CAgB1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CA8G/D"}

package/docs/rest-api-proxy.md

@@ -121,9 +121,17 @@ Supported profile auth shapes:
 { "kind": "apiKey", "header": "x-api-key", "secretRef": "api-key" }
 { "kind": "basic", "usernameRef": "username", "passwordRef": "password" }
 { "kind": "login", "path": "/auth/login", "fields": { "username": "username", "password": "password" }, "tokenField": "access_token" }
+{ "kind": "login", "path": "/auth/login", "fields": { "clientId": { "literal": "sample-client" }, "password": { "secretRef": "password" } }, "tokenPath": ["userInfo", "token"], "tokenReuseMs": 60000 }
+{ "kind": "bodyFields", "fields": { "apiKey": { "secretRef": "api-key" }, "clientId": { "literal": "sample-client" } } }
 ```
 
-Login is one configured JSON POST at the exact profile origin. Its fixed fields reference the private store. The response's configured top-level string token becomes a Bearer header inside the proxy. Login output never goes to callers, and the login path and descendants are denied to client requests. Login and API requests share a single deadline; the budget reserves both requests' maximum bytes. Failed login refuses the operation. Unsupported cookie, OAuth browser, multipart and executable authentication flows refuse configuration instead of executing custom code.
+Login is one configured JSON POST at the exact profile origin. String field values are secret-store references. Object values use either `{ "secretRef": "name" }` or `{ "literal": <JSON value> }`. At least one field must use a secret reference. `tokenField` selects a top-level token and remains the shorthand form. `tokenPath` selects a token through one to eight nested plain-object keys and cannot appear with `tokenField`. A missing key, array traversal or non-string token refuses the operation. Login output never goes to callers, and the login path and descendants are denied to client requests. Login and API requests share a single deadline; the budget reserves both requests' maximum bytes. Failed login refuses the operation.
+
+An optional `tokenReuseMs` reuses the last minted token for that profile during the configured window. It must be a positive integer of at most 24 hours. Concurrent first requests share one login. A 401 clears the cached token and returns the upstream status and JSON body; the proxy does not retry the API request. Tokens remain in the echo-protection set after cache expiry.
+
+`bodyFields` adds configured fields to each client JSON object body. Its profile must list methods and must exclude `GET`. Field names must be unique without regard to letter case, and at least one field must reference a secret. The client must supply an object body and cannot supply any configured field name, even with different letter case. The proxy adds the configured values after checking for collisions and checks the merged body against the request size limit. Secret values stay in echo protection. Literal values do not enter the secret store or echo protection.
+
+Unsupported cookie, OAuth browser, multipart and executable authentication flows refuse configuration instead of executing custom code.
 
 Choose `disclosure: { "kind": "fields", "fields": [...] }` to project top-level object fields. Choose `disclosure: { "kind": "raw" }` only when the operator authorizes the service's complete JSON response. Neither mode promises that application data are nonsensitive. Exact stored-secret and minted-token echoes, including JSON-escaped, URI-component, form URL-encoded and base64 variants, refuse disclosure. URL percent escapes match without regard to their hexadecimal letter case; credential letters remain case-sensitive. This does not detect arbitrary transformed secrets or establish universal privacy. At most 128 distinct stored secrets, deterministic Basic credentials and retained auth tokens are allowed per runtime. Pending logins reserve retention slots before dispatch, and reaching the retention bound refuses new logins. Failed exchanges release their slots; a token already known releases its extra reservation without evicting any credential. An aborted exchange keeps its slot until the transport settles, and any valid token it returns is retained before the operation can continue. Tokens are never evicted from echo checks.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.15.3",
+  "version": "1.16.0",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/api-tool/proxy.ts

@@ -24,6 +24,16 @@ type Budget = {
   active: number;
   startedAt: number;
   revoked: boolean;
+  loginWaiters: Set<() => void>;
+};
+type LoginToken = { value: string; expiresAt: number };
+type LoginFlight = {
+  promise: Promise<string>;
+  waiters: number;
+  settled: boolean;
+  ownerRequest: object;
+  releaseOwnerSlot?: () => void;
+  abort: () => void;
 };
 export function createProxy(options: {
   config: unknown;
@@ -33,10 +43,18 @@ export function createProxy(options: {
 }) {
   const config = validateOperator(options.config);
   const now = options.now ?? Date.now;
-  const budgets = new Map(
-    config.grants.map((grant) => [
+  const budgets = new Map<string, Budget>(
+    config.grants.map((grant): [string, Budget] => [
       grant.digest,
-      { grant, requests: 0, bytes: 0, active: 0, startedAt: now(), revoked: grant.revoked },
+      {
+        grant,
+        requests: 0,
+        bytes: 0,
+        active: 0,
+        startedAt: now(),
+        revoked: grant.revoked,
+        loginWaiters: new Set<() => void>(),
+      },
     ]),
   );
   let active = 0;
@@ -61,13 +79,20 @@ export function createProxy(options: {
       case "basic":
         return [profile.auth.usernameRef, profile.auth.passwordRef];
       case "login":
-        return Object.values(profile.auth.fields);
+        return Object.values(profile.auth.fields).flatMap((value) =>
+          typeof value === "string" ? [value] : "secretRef" in value ? [value.secretRef] : [],
+        );
+      case "bodyFields":
+        return Object.values(profile.auth.fields).flatMap((value) =>
+          "secretRef" in value ? [value.secretRef] : [],
+        );
     }
   };
   if (Object.keys(options.secrets).length > 128) throw apiError("CONFIG_INVALID");
   const initial = Object.keys(options.secrets).map(secret);
   const basicCredentials = new Map<Profile, string>();
   const loginBodies = new Map<Profile, string>();
+  const bodyFields = new Map<Profile, Record<string, unknown>>();
   for (const profile of Object.values(config.profiles)) {
     for (const ref of references(profile)) secret(ref);
     if (profile.auth.kind === "basic") {
@@ -80,14 +105,34 @@ export function createProxy(options: {
     if (profile.auth.kind === "login") {
       const body = JSON.stringify(
         Object.fromEntries(
-          Object.entries(profile.auth.fields).map(([field, ref]) => [field, secret(ref)]),
+          Object.entries(profile.auth.fields).map(([field, value]) => [
+            field,
+            typeof value === "string"
+              ? secret(value)
+              : "secretRef" in value
+                ? secret(value.secretRef)
+                : value.literal,
+          ]),
         ),
       );
       if (Buffer.byteLength(profile.auth.path) + Buffer.byteLength(body) > profile.maxRequestBytes)
         throw apiError("CONFIG_INVALID");
       loginBodies.set(profile, body);
     }
+    if (profile.auth.kind === "bodyFields") {
+      bodyFields.set(
+        profile,
+        Object.fromEntries(
+          Object.entries(profile.auth.fields).map(([field, value]) => [
+            field,
+            "secretRef" in value ? secret(value.secretRef) : value.literal,
+          ]),
+        ),
+      );
+    }
   }
+  const loginTokens = new Map<Profile, LoginToken>();
+  const pendingLogins = new Map<Profile, LoginFlight>();
   const retention = createCredentialRetention(initial);
   const protectedOutput = (result: ApiResult): string => {
     const serialized = JSON.stringify(result);
@@ -124,6 +169,8 @@ export function createProxy(options: {
     input: unknown,
   ): Promise<{ result: ApiResult; serialized: string }> => {
     const budget = authorize(capability);
+    const requestId = {};
+    let loginFlight: LoginFlight | undefined;
     if (
       typeof input === "object" &&
       input !== null &&
@@ -150,7 +197,23 @@ export function createProxy(options: {
       (request.method === "GET" && request.body !== undefined)
     )
       throw apiError("POLICY_DENIED");
-    const body = request.body === undefined ? "" : JSON.stringify(request.body);
+    let bodyValue: unknown = request.body;
+    if (profile.auth.kind === "bodyFields") {
+      if (
+        typeof bodyValue !== "object" ||
+        bodyValue === null ||
+        Array.isArray(bodyValue) ||
+        Object.getPrototypeOf(bodyValue) !== Object.prototype
+      )
+        throw apiError("POLICY_DENIED");
+      const injected = bodyFields.get(profile);
+      if (injected === undefined) throw apiError("CREDENTIAL_UNAVAILABLE");
+      const names = new Set(Object.keys(injected).map((name) => name.toLowerCase()));
+      if (Object.keys(bodyValue).some((name) => names.has(name.toLowerCase())))
+        throw apiError("POLICY_DENIED");
+      bodyValue = { ...bodyValue, ...injected };
+    }
+    const body = bodyValue === undefined ? "" : (JSON.stringify(bodyValue) ?? "");
     const url = new URL(request.path, profile.origin);
     for (const [key, value] of Object.entries(request.query ?? {}))
       url.searchParams.append(key, value);
@@ -174,8 +237,15 @@ export function createProxy(options: {
         if (budget.revoked || now() >= budget.grant.expiresAt) throw apiError("UNAUTHORIZED");
         if (now() - budget.startedAt >= budget.grant.lifetimeMs) throw apiError("BUDGET_EXHAUSTED");
       };
-      const send = (target: URL, method: string, headers: Record<string, string>, data: string) => {
-        checkGrant();
+      const send = (
+        target: URL,
+        method: string,
+        headers: Record<string, string>,
+        data: string,
+        signal = controller.signal,
+        check = checkGrant,
+      ) => {
+        check();
         return options.transport({
           url: target,
           method,
@@ -186,11 +256,12 @@ export function createProxy(options: {
           },
           body: data,
           maxBytes: profile.maxResponseBytes,
-          signal: controller.signal,
+          signal,
           allowedPrivateAddresses: profile.allowedPrivateAddresses,
         });
       };
       const headers: Record<string, string> = {};
+      let usedLoginToken: string | undefined;
       switch (profile.auth.kind) {
         case "bearer":
           headers.authorization = `Bearer ${secret(profile.auth.secretRef)}`;
@@ -204,47 +275,146 @@ export function createProxy(options: {
           headers.authorization = `Basic ${encoded}`;
           break;
         }
+        case "bodyFields":
+          break;
         case "login": {
           const auth = profile.auth;
           const loginBody = loginBodies.get(profile);
           if (loginBody === undefined) throw apiError("CREDENTIAL_UNAVAILABLE");
-          const reservation = retention.reserve();
-          let operation: Promise<string>;
-          try {
-            operation = send(new URL(profile.auth.path, profile.origin), "POST", {}, loginBody)
-              .then((result) => {
-                if (
-                  result.status < 200 ||
-                  result.status >= 300 ||
-                  Buffer.byteLength(result.body) > profile.maxResponseBytes
-                )
-                  throw apiError("UPSTREAM_FAILED");
-                const parsed = decode(
-                  Schema.Record(Schema.String, Schema.Json),
-                  JSON.parse(result.body),
-                );
-                const token = Object.hasOwn(parsed, auth.tokenField)
-                  ? parsed[auth.tokenField]
-                  : undefined;
-                if (
-                  typeof token !== "string" ||
-                  !token ||
-                  token.length > 16384 ||
-                  /[\uD800-\uDFFF]/u.test(token) ||
-                  token.includes("\r") ||
-                  token.includes("\n") ||
-                  token.includes(String.fromCharCode(0))
-                )
-                  throw apiError("UPSTREAM_FAILED");
-                reservation.retain(token);
-                return token;
-              })
-              .finally(reservation.release);
-          } catch (error) {
-            reservation.release();
-            throw error;
-          }
-          headers.authorization = `Bearer ${await beforeAbort(operation, controller.signal)}`;
+          const waitForLogin = (flight: LoginFlight): Promise<string> => {
+            loginFlight = flight;
+            flight.waiters++;
+            return new Promise((resolve, reject) => {
+              let waiting = true;
+              const leave = (): boolean => {
+                if (!waiting) return false;
+                waiting = false;
+                controller.signal.removeEventListener("abort", onAbort);
+                budget.loginWaiters.delete(onRevoke);
+                flight.waiters--;
+                if (flight.waiters === 0 && !flight.settled) {
+                  if (pendingLogins.get(profile) === flight) pendingLogins.delete(profile);
+                  flight.abort();
+                }
+                return true;
+              };
+              const onAbort = () => {
+                if (leave()) reject(apiError("DEADLINE_EXCEEDED"));
+              };
+              const onRevoke = () => {
+                if (leave()) reject(apiError("UNAUTHORIZED"));
+              };
+              controller.signal.addEventListener("abort", onAbort, { once: true });
+              budget.loginWaiters.add(onRevoke);
+              if (controller.signal.aborted) onAbort();
+              else if (budget.revoked) onRevoke();
+              flight.promise.then(
+                (token) => {
+                  if (leave()) resolve(token);
+                  return undefined;
+                },
+                (error: unknown) => {
+                  if (leave()) reject(error);
+                  return undefined;
+                },
+              );
+            });
+          };
+          const getToken = (): Promise<string> => {
+            const reuseMs = auth.tokenReuseMs;
+            if (reuseMs !== undefined) {
+              const cached = loginTokens.get(profile);
+              if (cached && now() < cached.expiresAt) return Promise.resolve(cached.value);
+              const pending = pendingLogins.get(profile);
+              if (pending) return waitForLogin(pending);
+            }
+            const reservation = retention.reserve();
+            const loginController = new AbortController();
+            const loginTimer = setTimeout(() => loginController.abort(), profile.timeoutMs);
+            let flight: LoginFlight;
+            let operation: Promise<string>;
+            try {
+              operation = send(
+                new URL(auth.path, profile.origin),
+                "POST",
+                {},
+                loginBody,
+                loginController.signal,
+                () => undefined,
+              )
+                .then((result) => {
+                  if (
+                    result.status < 200 ||
+                    result.status >= 300 ||
+                    Buffer.byteLength(result.body) > profile.maxResponseBytes
+                  )
+                    throw apiError("UPSTREAM_FAILED");
+                  const parsed = decode(Schema.Json, JSON.parse(result.body));
+                  let token: unknown = parsed;
+                  const tokenPath =
+                    auth.tokenPath ?? (auth.tokenField === undefined ? [] : [auth.tokenField]);
+                  for (const segment of tokenPath) {
+                    if (
+                      typeof token !== "object" ||
+                      token === null ||
+                      Array.isArray(token) ||
+                      Object.getPrototypeOf(token) !== Object.prototype ||
+                      !Object.hasOwn(token, segment)
+                    ) {
+                      token = undefined;
+                      break;
+                    }
+                    token = (token as Record<string, unknown>)[segment];
+                  }
+                  if (
+                    typeof token !== "string" ||
+                    !token ||
+                    token.length > 16384 ||
+                    /[\uD800-\uDFFF]/u.test(token) ||
+                    token.includes("\r") ||
+                    token.includes("\n") ||
+                    token.includes(String.fromCharCode(0))
+                  )
+                    throw apiError("UPSTREAM_FAILED");
+                  reservation.retain(token);
+                  if (reuseMs !== undefined && flight.waiters > 0)
+                    loginTokens.set(profile, { value: token, expiresAt: now() + reuseMs });
+                  return token;
+                })
+                .finally(() => {
+                  clearTimeout(loginTimer);
+                  reservation.release();
+                  flight.settled = true;
+                  if (pendingLogins.get(profile) === flight) pendingLogins.delete(profile);
+                  flight.releaseOwnerSlot?.();
+                });
+            } catch (error) {
+              clearTimeout(loginTimer);
+              reservation.release();
+              throw error;
+            }
+            flight = {
+              promise: operation,
+              waiters: 0,
+              settled: false,
+              ownerRequest: requestId,
+              abort: () => {
+                clearTimeout(loginTimer);
+                loginController.abort();
+              },
+            };
+            if (reuseMs !== undefined) {
+              pendingLogins.set(profile, flight);
+              const clearPending = () => {
+                if (pendingLogins.get(profile) === flight) pendingLogins.delete(profile);
+              };
+              void flight.promise.then(clearPending, clearPending);
+            }
+            return waitForLogin(flight);
+          };
+          const token = await getToken();
+          headers.authorization = `Bearer ${token}`;
+          usedLoginToken = token;
           break;
         }
       }
@@ -252,7 +422,13 @@ export function createProxy(options: {
         send(url, request.method, headers, body),
         controller.signal,
       );
-      if (response.status < 200 || response.status >= 300) throw apiError("UPSTREAM_FAILED");
+      const unauthorizedLogin = profile.auth.kind === "login" && response.status === 401;
+      if (unauthorizedLogin && usedLoginToken !== undefined) {
+        const cached = loginTokens.get(profile);
+        if (cached?.value === usedLoginToken) loginTokens.delete(profile);
+      }
+      if (!unauthorizedLogin && (response.status < 200 || response.status >= 300))
+        throw apiError("UPSTREAM_FAILED");
       if (Buffer.byteLength(response.body) > profile.maxResponseBytes)
         throw apiError("LIMIT_EXCEEDED");
       if (controller.signal.aborted) throw apiError("DEADLINE_EXCEEDED");
@@ -278,8 +454,18 @@ export function createProxy(options: {
       throw safeError(error);
     } finally {
       clearTimeout(timer);
-      budget.active--;
-      active--;
+      if (loginFlight?.ownerRequest === requestId && !loginFlight.settled) {
+        let released = false;
+        loginFlight.releaseOwnerSlot = () => {
+          if (released) return;
+          released = true;
+          budget.active--;
+          active--;
+        };
+      } else {
+        budget.active--;
+        active--;
+      }
     }
   };
   return {
@@ -288,7 +474,10 @@ export function createProxy(options: {
     },
     revoke: (digest: string): void => {
       const budget = budgets.get(digest);
-      if (budget) budget.revoked = true;
+      if (budget) {
+        budget.revoked = true;
+        for (const leave of budget.loginWaiters) leave();
+      }
     },
     request: async (capability: string, input: unknown): Promise<ApiResult> =>
       (await execute(capability, input)).result,

package/src/api-tool/types.ts

@@ -4,6 +4,15 @@ import { Schema } from "effect";
 import { apiError } from "./errors";
 
 export const Method = Schema.Literals(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+const SecretField = Schema.Union([
+  Schema.String,
+  Schema.Struct({ secretRef: Schema.String }),
+  Schema.Struct({ literal: Schema.Json }),
+]);
+const ConfiguredField = Schema.Union([
+  Schema.Struct({ secretRef: Schema.String }),
+  Schema.Struct({ literal: Schema.Json }),
+]);
 const Auth = Schema.Union([
   Schema.Struct({ kind: Schema.Literal("bearer"), secretRef: Schema.String }),
   Schema.Struct({
@@ -19,8 +28,14 @@ const Auth = Schema.Union([
   Schema.Struct({
     kind: Schema.Literal("login"),
     path: Schema.String,
-    fields: Schema.Record(Schema.String, Schema.String),
-    tokenField: Schema.String,
+    fields: Schema.Record(Schema.String, SecretField),
+    tokenField: Schema.optionalKey(Schema.String),
+    tokenPath: Schema.optionalKey(Schema.Array(Schema.String)),
+    tokenReuseMs: Schema.optionalKey(Schema.Number),
+  }),
+  Schema.Struct({
+    kind: Schema.Literal("bodyFields"),
+    fields: Schema.Record(Schema.String, ConfiguredField),
   }),
 ]);
 export const ProfileSchema = Schema.Struct({
@@ -188,8 +203,31 @@ export function validateOperator(value: unknown): OperatorConfig {
       throw apiError("CONFIG_INVALID");
     if (profile.auth.kind === "login") {
       relativePath(profile.auth.path);
+      const fields = Object.values(profile.auth.fields);
+      if (
+        !fields.length ||
+        !fields.some((fieldValue) => typeof fieldValue === "string" || "secretRef" in fieldValue) ||
+        (profile.auth.tokenField !== undefined && profile.auth.tokenPath !== undefined) ||
+        (profile.auth.tokenField === undefined && profile.auth.tokenPath === undefined) ||
+        (profile.auth.tokenField !== undefined && !profile.auth.tokenField) ||
+        (profile.auth.tokenPath !== undefined &&
+          (profile.auth.tokenPath.length < 1 ||
+            profile.auth.tokenPath.length > 8 ||
+            profile.auth.tokenPath.some((segment) => !segment))) ||
+        (profile.auth.tokenReuseMs !== undefined && !bounded(profile.auth.tokenReuseMs, 86400000))
+      )
+        throw apiError("CONFIG_INVALID");
       const minimumBody = JSON.stringify(
-        Object.fromEntries(Object.keys(profile.auth.fields).map((field) => [field, ""])),
+        Object.fromEntries(
+          Object.entries(profile.auth.fields).map(([field, fieldValue]) => [
+            field,
+            typeof fieldValue === "string"
+              ? ""
+              : "secretRef" in fieldValue
+                ? ""
+                : fieldValue.literal,
+          ]),
+        ),
       );
       if (
         Buffer.byteLength(profile.auth.path) + Buffer.byteLength(minimumBody) >
@@ -197,6 +235,28 @@ export function validateOperator(value: unknown): OperatorConfig {
       )
         throw apiError("CONFIG_INVALID");
     }
+    if (profile.auth.kind === "bodyFields") {
+      const fields = Object.entries(profile.auth.fields);
+      const normalized = fields.map(([field]) => field.toLowerCase());
+      if (
+        !fields.length ||
+        !fields.some(([, fieldValue]) => "secretRef" in fieldValue) ||
+        new Set(normalized).size !== normalized.length ||
+        profile.methods === undefined ||
+        profile.methods.includes("GET")
+      )
+        throw apiError("CONFIG_INVALID");
+      const minimumBody = JSON.stringify(
+        Object.fromEntries(
+          fields.map(([field, fieldValue]) => [
+            field,
+            "secretRef" in fieldValue ? "" : fieldValue.literal,
+          ]),
+        ),
+      );
+      if (Buffer.byteLength(minimumBody) > profile.maxRequestBytes)
+        throw apiError("CONFIG_INVALID");
+    }
   }
   return config;
 }