@clawdstrike/broker-client 0.2.6

package/dist/client.d.ts

@@ -0,0 +1,94 @@
+export type BrokerProvider = "openai" | "github" | "slack" | "generic_https";
+export type BrokerHttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+export type BrokerProofBindingMode = "loopback" | "dpop";
+export type BrokerIntentRiskLevel = "low" | "medium" | "high";
+export type BrokerApprovalState = "not_required" | "pending" | "approved" | "rejected";
+export interface BrokerIntentResource {
+    kind: string;
+    value: string;
+}
+export interface BrokerIntentPreview {
+    previewId: string;
+    provider: BrokerProvider;
+    operation: string;
+    summary: string;
+    createdAt: string;
+    riskLevel: BrokerIntentRiskLevel;
+    dataClasses: string[];
+    resources: BrokerIntentResource[];
+    egressHost: string;
+    estimatedCostUsdMicros?: number;
+    approvalRequired: boolean;
+    approvalState: BrokerApprovalState;
+    approvedAt?: string;
+    approver?: string;
+}
+export interface BrokerExecutionIntent {
+    provider: BrokerProvider;
+    secretRef: string;
+    request: {
+        url: string;
+        method: BrokerHttpMethod;
+        headers?: Record<string, string>;
+        body?: string;
+        bodySha256?: string;
+    };
+    sessionId?: string;
+    endpointAgentId?: string;
+    runtimeAgentId?: string;
+    runtimeAgentKind?: string;
+    originFingerprint?: string;
+    previewId?: string;
+    delegationToken?: string;
+}
+export interface BrokerExecutionResponse {
+    executionId: string;
+    capabilityId: string;
+    provider: BrokerProvider;
+    status: number;
+    headers: Record<string, string>;
+    body?: string;
+    contentType?: string;
+}
+export interface BrokerExecutionStreamResponse {
+    executionId: string;
+    capabilityId: string;
+    provider: BrokerProvider;
+    status: number;
+    headers: Record<string, string>;
+    body: ReadableStream<Uint8Array>;
+    contentType?: string;
+}
+export interface SecretBrokerClientOptions {
+    hushdBaseUrl: string;
+    brokerdBaseUrl: string;
+    token?: string;
+    timeoutMs?: number;
+    proofBindingMode?: BrokerProofBindingMode;
+    previewBeforeExecute?: boolean;
+    fetchImpl?: typeof fetch;
+}
+export declare class BrokerPreviewApprovalRequiredError extends Error {
+    readonly preview: BrokerIntentPreview;
+    constructor(preview: BrokerIntentPreview);
+}
+export declare class SecretBrokerClient {
+    private readonly hushdBaseUrl;
+    private readonly brokerdBaseUrl;
+    private readonly token?;
+    private readonly timeoutMs;
+    private readonly proofBindingMode?;
+    private readonly previewBeforeExecute;
+    private readonly fetchImpl;
+    constructor(options: SecretBrokerClientOptions);
+    previewIntent(intent: BrokerExecutionIntent): Promise<BrokerIntentPreview>;
+    execute(intent: BrokerExecutionIntent): Promise<BrokerExecutionResponse>;
+    executeStream(intent: BrokerExecutionIntent): Promise<BrokerExecutionStreamResponse>;
+    private issueCapability;
+    private postJson;
+    private postResponse;
+    private prepareExecution;
+    private requestHeaders;
+}
+export declare function sha256Hex(input: string): string;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,eAAe,CAAC;AAC7E,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAC3E,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,MAAM,CAAC;AACzD,MAAM,MAAM,qBAAqB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAC9D,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAEvF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,qBAAqB,CAAC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,aAAa,EAAE,mBAAmB,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,gBAAgB,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAkED,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAE1B,OAAO,EAAE,mBAAmB;CAKzC;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAyB;IAC3D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAU;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,yBAAyB;IAUxC,aAAa,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAqB1E,OAAO,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAmBxE,aAAa,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC;YAwB5E,eAAe;YA0Bf,QAAQ;YAcR,YAAY;YA8BZ,gBAAgB;IAwD9B,OAAO,CAAC,cAAc;CASvB;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/client.js

@@ -0,0 +1,254 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import * as ed25519 from "@noble/ed25519";
+const BROKER_EXECUTION_ID_HEADER = "x-clawdstrike-execution-id";
+const BROKER_CAPABILITY_ID_HEADER = "x-clawdstrike-capability-id";
+const BROKER_PROVIDER_HEADER = "x-clawdstrike-provider";
+export class BrokerPreviewApprovalRequiredError extends Error {
+    preview;
+    constructor(preview) {
+        super(`BROKER_PREVIEW_APPROVAL_REQUIRED:${preview.previewId}`);
+        this.name = "BrokerPreviewApprovalRequiredError";
+        this.preview = preview;
+    }
+}
+export class SecretBrokerClient {
+    hushdBaseUrl;
+    brokerdBaseUrl;
+    token;
+    timeoutMs;
+    proofBindingMode;
+    previewBeforeExecute;
+    fetchImpl;
+    constructor(options) {
+        this.hushdBaseUrl = options.hushdBaseUrl.replace(/\/+$/, "");
+        this.brokerdBaseUrl = options.brokerdBaseUrl.replace(/\/+$/, "");
+        this.token = options.token;
+        this.timeoutMs = options.timeoutMs ?? 10_000;
+        this.proofBindingMode = options.proofBindingMode;
+        this.previewBeforeExecute = options.previewBeforeExecute ?? true;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+    }
+    async previewIntent(intent) {
+        const payload = await this.postJson(`${this.hushdBaseUrl}/api/v1/broker/previews`, {
+            provider: intent.provider,
+            url: intent.request.url,
+            method: intent.request.method,
+            secret_ref: intent.secretRef,
+            body: intent.request.body,
+            body_sha256: intent.request.bodySha256,
+            session_id: intent.sessionId,
+            endpoint_agent_id: intent.endpointAgentId,
+            runtime_agent_id: intent.runtimeAgentId,
+            runtime_agent_kind: intent.runtimeAgentKind,
+            origin_fingerprint: intent.originFingerprint,
+        }, "BROKER_PREVIEW_REQUEST_FAILED");
+        return normalizePreview(payload.preview);
+    }
+    async execute(intent) {
+        const prepared = await this.prepareExecution(intent);
+        const executed = await this.postJson(`${this.brokerdBaseUrl}/v1/execute`, prepared.executePayload, "BROKER_EXECUTE_FAILED");
+        return {
+            executionId: executed.execution_id,
+            capabilityId: executed.capability_id,
+            provider: executed.provider,
+            status: executed.status,
+            headers: executed.headers ?? {},
+            body: executed.body,
+            contentType: executed.content_type,
+        };
+    }
+    async executeStream(intent) {
+        const prepared = await this.prepareExecution(intent);
+        const response = await this.postResponse(`${this.brokerdBaseUrl}/v1/execute/stream`, prepared.executePayload, "BROKER_EXECUTE_STREAM_FAILED");
+        if (!response.body) {
+            throw new Error("BROKER_EXECUTE_STREAM_EMPTY");
+        }
+        return {
+            executionId: response.headers.get(BROKER_EXECUTION_ID_HEADER) ?? prepared.capabilityId,
+            capabilityId: response.headers.get(BROKER_CAPABILITY_ID_HEADER) ?? prepared.capabilityId,
+            provider: response.headers.get(BROKER_PROVIDER_HEADER) ?? intent.provider,
+            status: response.status,
+            headers: headersToObject(response.headers),
+            body: response.body,
+            contentType: response.headers.get("content-type") ?? undefined,
+        };
+    }
+    async issueCapability(intent, proofBinding, previewId) {
+        return this.postJson(`${this.hushdBaseUrl}/api/v1/broker/capabilities`, {
+            provider: intent.provider,
+            url: intent.request.url,
+            method: intent.request.method,
+            secret_ref: intent.secretRef,
+            body_sha256: intent.request.bodySha256,
+            session_id: intent.sessionId,
+            endpoint_agent_id: intent.endpointAgentId,
+            runtime_agent_id: intent.runtimeAgentId,
+            runtime_agent_kind: intent.runtimeAgentKind,
+            origin_fingerprint: intent.originFingerprint,
+            proof_binding: proofBinding,
+            preview_id: previewId,
+            delegation_token: intent.delegationToken,
+        }, "BROKER_CAPABILITY_REQUEST_FAILED");
+    }
+    async postJson(url, body, errorCode) {
+        const response = await this.postResponse(url, body, errorCode);
+        try {
+            return (await response.json());
+        }
+        catch (error) {
+            const cause = error instanceof Error ? error.message : String(error);
+            throw new Error(`${errorCode}:${cause}`);
+        }
+    }
+    async postResponse(url, body, errorCode) {
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);
+        timeoutId.unref?.();
+        try {
+            const response = await this.fetchImpl(url, {
+                method: "POST",
+                headers: this.requestHeaders(),
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                throw new Error(`${errorCode}:${response.status}`);
+            }
+            return response;
+        }
+        catch (error) {
+            const cause = error instanceof Error ? error.message : String(error);
+            throw new Error(`${errorCode}:${cause}`);
+        }
+        finally {
+            clearTimeout(timeoutId);
+        }
+    }
+    async prepareExecution(intent) {
+        const proofBindingMode = this.proofBindingMode ?? defaultProofBindingMode(this.brokerdBaseUrl);
+        const loopbackBindingSecret = proofBindingMode === "loopback" ? randomUUID() : undefined;
+        const dpopBinding = proofBindingMode === "dpop" ? await createDpopBindingMaterial() : undefined;
+        const preview = intent.previewId || !this.previewBeforeExecute ? undefined : await this.previewIntent(intent);
+        if (preview &&
+            preview.approvalRequired &&
+            preview.approvalState !== "approved" &&
+            preview.approvalState !== "not_required") {
+            throw new BrokerPreviewApprovalRequiredError(preview);
+        }
+        const capability = await this.issueCapability(intent, proofBindingMode === "loopback"
+            ? {
+                mode: "loopback",
+                binding_sha256: sha256Hex(loopbackBindingSecret),
+            }
+            : {
+                mode: "dpop",
+                key_thumbprint: dpopBinding.keyThumbprint,
+            }, intent.previewId ?? preview?.previewId);
+        const executePayload = {
+            capability: capability.capability,
+            request: {
+                url: intent.request.url,
+                method: intent.request.method,
+                headers: intent.request.headers ?? {},
+                body: intent.request.body,
+                body_sha256: intent.request.bodySha256,
+            },
+        };
+        if (loopbackBindingSecret) {
+            executePayload.binding_secret = loopbackBindingSecret;
+        }
+        if (dpopBinding) {
+            executePayload.binding_proof = await createDpopBindingProof(dpopBinding, capability.capability_id, intent.request);
+        }
+        return {
+            capabilityId: capability.capability_id,
+            executePayload,
+        };
+    }
+    requestHeaders() {
+        const headers = {
+            "content-type": "application/json",
+        };
+        if (this.token) {
+            headers.authorization = `Bearer ${this.token}`;
+        }
+        return headers;
+    }
+}
+export function sha256Hex(input) {
+    return createHash("sha256").update(input).digest("hex");
+}
+async function createDpopBindingMaterial() {
+    const privateKey = randomBytes(32);
+    const publicKey = await ed25519.getPublicKeyAsync(privateKey);
+    const publicKeyHex = bytesToHex(publicKey);
+    return {
+        privateKey,
+        publicKeyHex,
+        keyThumbprint: sha256Hex(publicKeyHex),
+    };
+}
+async function createDpopBindingProof(material, capabilityId, request) {
+    const issuedAt = new Date().toISOString();
+    const nonce = randomUUID();
+    const message = bindingProofMessage(capabilityId, request.method, request.url, request.bodySha256, issuedAt, nonce);
+    const signature = await ed25519.signAsync(Buffer.from(message, "utf8"), material.privateKey);
+    return {
+        mode: "dpop",
+        public_key: material.publicKeyHex,
+        signature: bytesToHex(signature),
+        issued_at: issuedAt,
+        nonce,
+    };
+}
+function defaultProofBindingMode(brokerdBaseUrl) {
+    try {
+        const host = new URL(brokerdBaseUrl).hostname;
+        return isLoopbackHost(host) ? "loopback" : "dpop";
+    }
+    catch {
+        return "dpop";
+    }
+}
+function isLoopbackHost(host) {
+    return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function bindingProofMessage(capabilityId, method, url, bodySha256, issuedAt, nonce) {
+    return [
+        `broker-capability:${capabilityId}`,
+        `method:${method}`,
+        `url:${url}`,
+        `body-sha256:${bodySha256 ?? "-"}`,
+        `issued-at:${issuedAt}`,
+        `nonce:${nonce}`,
+    ].join("\n");
+}
+function bytesToHex(value) {
+    return Buffer.from(value).toString("hex");
+}
+function headersToObject(headers) {
+    const result = {};
+    headers.forEach((value, key) => {
+        result[key] = value;
+    });
+    return result;
+}
+function normalizePreview(payload) {
+    return {
+        previewId: payload.preview_id,
+        provider: payload.provider,
+        operation: payload.operation,
+        summary: payload.summary,
+        createdAt: payload.created_at,
+        riskLevel: payload.risk_level,
+        dataClasses: payload.data_classes ?? [],
+        resources: payload.resources ?? [],
+        egressHost: payload.egress_host,
+        estimatedCostUsdMicros: payload.estimated_cost_usd_micros,
+        approvalRequired: payload.approval_required,
+        approvalState: payload.approval_state,
+        approvedAt: payload.approved_at,
+        approver: payload.approver,
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAmH1C,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AAChE,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAClE,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AA0BxD,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAClD,OAAO,CAAsB;IAEtC,YAAY,OAA4B;QACtC,KAAK,CAAC,oCAAoC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,kBAAkB;IACZ,YAAY,CAAS;IACrB,cAAc,CAAS;IACvB,KAAK,CAAU;IACf,SAAS,CAAS;IAClB,gBAAgB,CAA0B;IAC1C,oBAAoB,CAAU;IAC9B,SAAS,CAAe;IAEzC,YAAY,OAAkC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,IAAI,CAAC;QACjE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAA6B;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CACjC,GAAG,IAAI,CAAC,YAAY,yBAAyB,EAC7C;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;YACvB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACtC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,iBAAiB,EAAE,MAAM,CAAC,eAAe;YACzC,gBAAgB,EAAE,MAAM,CAAC,cAAc;YACvC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;YAC3C,kBAAkB,EAAE,MAAM,CAAC,iBAAiB;SAC7C,EACD,+BAA+B,CAChC,CAAC;QACF,OAAO,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAA6B;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAClC,GAAG,IAAI,CAAC,cAAc,aAAa,EACnC,QAAQ,CAAC,cAAc,EACvB,uBAAuB,CACxB,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,YAAY,EAAE,QAAQ,CAAC,aAAa;YACpC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;YAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,YAAY;SACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAA6B;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CACtC,GAAG,IAAI,CAAC,cAAc,oBAAoB,EAC1C,QAAQ,CAAC,cAAc,EACvB,8BAA8B,CAC/B,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,QAAQ,CAAC,YAAY;YACtF,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,QAAQ,CAAC,YAAY;YACxF,QAAQ,EACL,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAA2B,IAAI,MAAM,CAAC,QAAQ;YAC5F,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;SAC/D,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,MAA6B,EAC7B,YAAoC,EACpC,SAAkB;QAElB,OAAO,IAAI,CAAC,QAAQ,CAClB,GAAG,IAAI,CAAC,YAAY,6BAA6B,EACjD;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;YACvB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACtC,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,iBAAiB,EAAE,MAAM,CAAC,eAAe;YACzC,gBAAgB,EAAE,MAAM,CAAC,cAAc;YACvC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;YAC3C,kBAAkB,EAAE,MAAM,CAAC,iBAAiB;YAC5C,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,SAAS;YACrB,gBAAgB,EAAE,MAAM,CAAC,eAAe;SACzC,EACD,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,IAAa,EACb,SAAiB;QAEjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,GAAW,EACX,IAAa,EACb,SAAiB;QAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAEpB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE;gBAC9B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,MAA6B;QAE7B,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/F,MAAM,qBAAqB,GAAG,gBAAgB,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,WAAW,GAAG,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,yBAAyB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAChG,IACE,OAAO;YACP,OAAO,CAAC,gBAAgB;YACxB,OAAO,CAAC,aAAa,KAAK,UAAU;YACpC,OAAO,CAAC,aAAa,KAAK,cAAc,EACxC,CAAC;YACD,MAAM,IAAI,kCAAkC,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAC3C,MAAM,EACN,gBAAgB,KAAK,UAAU;YAC7B,CAAC,CAAC;gBACE,IAAI,EAAE,UAAU;gBAChB,cAAc,EAAE,SAAS,CAAC,qBAAsB,CAAC;aAClD;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,MAAM;gBACZ,cAAc,EAAE,WAAY,CAAC,aAAa;aAC3C,EACL,MAAM,CAAC,SAAS,IAAI,OAAO,EAAE,SAAS,CACvC,CAAC;QACF,MAAM,cAAc,GAA4B;YAC9C,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,OAAO,EAAE;gBACP,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG;gBACvB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;gBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE;gBACrC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;gBACzB,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;aACvC;SACF,CAAC;QACF,IAAI,qBAAqB,EAAE,CAAC;YAC1B,cAAc,CAAC,cAAc,GAAG,qBAAqB,CAAC;QACxD,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,cAAc,CAAC,aAAa,GAAG,MAAM,sBAAsB,CACzD,WAAW,EACX,UAAU,CAAC,aAAa,EACxB,MAAM,CAAC,OAAO,CACf,CAAC;QACJ,CAAC;QAED,OAAO;YACL,YAAY,EAAE,UAAU,CAAC,aAAa;YACtC,cAAc;SACf,CAAC;IACJ,CAAC;IAEO,cAAc;QACpB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,aAAa,GAAG,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,yBAAyB;IACtC,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO;QACL,UAAU;QACV,YAAY;QACZ,aAAa,EAAE,SAAS,CAAC,YAAY,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAA6B,EAC7B,YAAoB,EACpB,OAAyC;IAEzC,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,mBAAmB,CACjC,YAAY,EACZ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,UAAU,EAClB,QAAQ,EACR,KAAK,CACN,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7F,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE,QAAQ,CAAC,YAAY;QACjC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;QAChC,SAAS,EAAE,QAAQ;QACnB,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,cAAsB;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC;QAC9C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED,SAAS,mBAAmB,CAC1B,YAAoB,EACpB,MAAwB,EACxB,GAAW,EACX,UAA8B,EAC9B,QAAgB,EAChB,KAAa;IAEb,OAAO;QACL,qBAAqB,YAAY,EAAE;QACnC,UAAU,MAAM,EAAE;QAClB,OAAO,GAAG,EAAE;QACZ,eAAe,UAAU,IAAI,GAAG,EAAE;QAClC,aAAa,QAAQ,EAAE;QACvB,SAAS,KAAK,EAAE;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAyC;IACjE,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,SAAS,EAAE,OAAO,CAAC,UAAU;QAC7B,WAAW,EAAE,OAAO,CAAC,YAAY,IAAI,EAAE;QACvC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;QAClC,UAAU,EAAE,OAAO,CAAC,WAAW;QAC/B,sBAAsB,EAAE,OAAO,CAAC,yBAAyB;QACzD,gBAAgB,EAAE,OAAO,CAAC,iBAAiB;QAC3C,aAAa,EAAE,OAAO,CAAC,cAAc;QACrC,UAAU,EAAE,OAAO,CAAC,WAAW;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export type { BrokerExecutionIntent, BrokerExecutionResponse, BrokerExecutionStreamResponse, BrokerHttpMethod, BrokerProofBindingMode, BrokerProvider, SecretBrokerClientOptions, } from "./client.js";
+export { SecretBrokerClient } from "./client.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export { SecretBrokerClient } from "./client.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@clawdstrike/broker-client",
+  "version": "0.2.6",
+  "description": "Capability issuance and execute client for the Clawdstrike secret broker",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepare": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "format": "biome check --write src/",
+    "format:check": "biome check src/"
+  },
+  "dependencies": {
+    "@noble/ed25519": "^3.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.2.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "license": "Apache-2.0",
+  "author": "Clawdstrike Contributors",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/backbay-labs/clawdstrike.git",
+    "directory": "packages/adapters/clawdstrike-broker-client"
+  },
+  "homepage": "https://github.com/backbay-labs/clawdstrike",
+  "bugs": {
+    "url": "https://github.com/backbay-labs/clawdstrike/issues"
+  },
+  "keywords": [
+    "clawdstrike",
+    "security",
+    "broker",
+    "secret"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}