@clef-sh/broker 0.1.7-beta.45

package/dist/config.d.ts

@@ -0,0 +1,29 @@
+export declare class ConfigError extends Error {
+    constructor(message: string);
+}
+/** Resolved broker configuration. */
+export interface BrokerConfig {
+    identity: string;
+    environment: string;
+    kmsProvider: string;
+    kmsKeyId: string;
+    kmsRegion?: string;
+    port: number;
+    host: string;
+    handlerConfig: Record<string, string>;
+}
+/**
+ * Resolve broker configuration from environment variables.
+ *
+ * Required:
+ *   CLEF_BROKER_IDENTITY, CLEF_BROKER_ENVIRONMENT,
+ *   CLEF_BROKER_KMS_PROVIDER, CLEF_BROKER_KMS_KEY_ID
+ *
+ * Optional:
+ *   CLEF_BROKER_KMS_REGION, CLEF_BROKER_PORT (default 8080),
+ *   CLEF_BROKER_HOST (default "0.0.0.0")
+ *
+ * Handler config: all CLEF_BROKER_HANDLER_* vars are collected with the prefix stripped.
+ */
+export declare function resolveConfig(env?: Record<string, string | undefined>): BrokerConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED,qCAAqC;AACrC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,YAAY,CAqCjG"}

package/dist/config.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigError = void 0;
+exports.resolveConfig = resolveConfig;
+const VALID_KMS_PROVIDERS = ["aws", "gcp", "azure"];
+const HANDLER_PREFIX = "CLEF_BROKER_HANDLER_";
+class ConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ConfigError";
+    }
+}
+exports.ConfigError = ConfigError;
+/**
+ * Resolve broker configuration from environment variables.
+ *
+ * Required:
+ *   CLEF_BROKER_IDENTITY, CLEF_BROKER_ENVIRONMENT,
+ *   CLEF_BROKER_KMS_PROVIDER, CLEF_BROKER_KMS_KEY_ID
+ *
+ * Optional:
+ *   CLEF_BROKER_KMS_REGION, CLEF_BROKER_PORT (default 8080),
+ *   CLEF_BROKER_HOST (default "0.0.0.0")
+ *
+ * Handler config: all CLEF_BROKER_HANDLER_* vars are collected with the prefix stripped.
+ */
+function resolveConfig(env = process.env) {
+    const identity = env.CLEF_BROKER_IDENTITY;
+    if (!identity)
+        throw new ConfigError("CLEF_BROKER_IDENTITY is required.");
+    const environment = env.CLEF_BROKER_ENVIRONMENT;
+    if (!environment)
+        throw new ConfigError("CLEF_BROKER_ENVIRONMENT is required.");
+    const kmsProvider = env.CLEF_BROKER_KMS_PROVIDER;
+    if (!kmsProvider)
+        throw new ConfigError("CLEF_BROKER_KMS_PROVIDER is required.");
+    if (!VALID_KMS_PROVIDERS.includes(kmsProvider)) {
+        throw new ConfigError(`CLEF_BROKER_KMS_PROVIDER must be one of: ${VALID_KMS_PROVIDERS.join(", ")}. Got: "${kmsProvider}"`);
+    }
+    const kmsKeyId = env.CLEF_BROKER_KMS_KEY_ID;
+    if (!kmsKeyId)
+        throw new ConfigError("CLEF_BROKER_KMS_KEY_ID is required.");
+    const kmsRegion = env.CLEF_BROKER_KMS_REGION;
+    const portStr = env.CLEF_BROKER_PORT ?? "8080";
+    const port = parseInt(portStr, 10);
+    if (isNaN(port) || port < 1 || port > 65535) {
+        throw new ConfigError(`CLEF_BROKER_PORT must be 1-65535. Got: "${portStr}"`);
+    }
+    const host = env.CLEF_BROKER_HOST ?? "0.0.0.0";
+    // Collect handler-specific config from CLEF_BROKER_HANDLER_* env vars
+    const handlerConfig = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (key.startsWith(HANDLER_PREFIX) && value !== undefined) {
+            handlerConfig[key.slice(HANDLER_PREFIX.length)] = value;
+        }
+    }
+    return { identity, environment, kmsProvider, kmsKeyId, kmsRegion, port, host, handlerConfig };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;;AAmCA,sCAqCC;AAxED,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACpD,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAE9C,MAAa,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AALD,kCAKC;AAcD;;;;;;;;;;;;GAYG;AACH,SAAgB,aAAa,CAAC,MAA0C,OAAO,CAAC,GAAG;IACjF,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,mCAAmC,CAAC,CAAC;IAE1E,MAAM,WAAW,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAChD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,WAAW,CAAC,sCAAsC,CAAC,CAAC;IAEhF,MAAM,WAAW,GAAG,GAAG,CAAC,wBAAwB,CAAC;IACjD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,WAAW,CAAC,uCAAuC,CAAC,CAAC;IACjF,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,WAAW,CACnB,4CAA4C,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,WAAW,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAE5E,MAAM,SAAS,GAAG,GAAG,CAAC,sBAAsB,CAAC;IAE7C,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,2CAA2C,OAAO,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,IAAI,SAAS,CAAC;IAE/C,sEAAsE;IACtE,MAAM,aAAa,GAA2B,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1D,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAChG,CAAC"}

package/dist/envelope.d.ts

@@ -0,0 +1,47 @@
+import type { KmsProvider } from "@clef-sh/runtime";
+/** KMS envelope metadata in the artifact. */
+export interface ArtifactEnvelopeField {
+    provider: string;
+    keyId: string;
+    wrappedKey: string;
+    algorithm: string;
+}
+/** JSON envelope produced by the broker. Matches the runtime's expected artifact shape. */
+export interface BrokerArtifact {
+    version: 1;
+    identity: string;
+    environment: string;
+    packedAt: string;
+    revision: string;
+    ciphertextHash: string;
+    ciphertext: string;
+    keys: string[];
+    envelope: ArtifactEnvelopeField;
+    expiresAt: string;
+}
+/** Options for packEnvelope(). */
+export interface PackEnvelopeOptions {
+    /** Service identity name. */
+    identity: string;
+    /** Target environment. */
+    environment: string;
+    /** Generated credentials as key-value pairs. */
+    data: Record<string, string>;
+    /** TTL in seconds — becomes the expiresAt timestamp. */
+    ttl: number;
+    /** KMS provider instance (from createKmsProvider()). */
+    kmsProvider: KmsProvider;
+    /** KMS provider name for the envelope field ("aws", "gcp", "azure"). */
+    kmsProviderName: string;
+    /** KMS key ID/ARN for wrapping. */
+    kmsKeyId: string;
+}
+/**
+ * Pack credentials into a Clef artifact envelope with KMS envelope encryption.
+ *
+ * 1. age-encrypt plaintext with an ephemeral key
+ * 2. Wrap the ephemeral private key via KMS
+ * 3. Return the complete JSON envelope string
+ */
+export declare function packEnvelope(options: PackEnvelopeOptions): Promise<string>;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2FAA2F;AAC3F,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,qBAAqB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,WAAW,EAAE,WAAW,CAAC;IACzB,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8ChF"}

package/dist/envelope.js

@@ -0,0 +1,84 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packEnvelope = packEnvelope;
+const crypto = __importStar(require("crypto"));
+/**
+ * Pack credentials into a Clef artifact envelope with KMS envelope encryption.
+ *
+ * 1. age-encrypt plaintext with an ephemeral key
+ * 2. Wrap the ephemeral private key via KMS
+ * 3. Return the complete JSON envelope string
+ */
+async function packEnvelope(options) {
+    const { identity, environment, data, ttl, kmsProvider, kmsProviderName, kmsKeyId } = options;
+    const plaintext = JSON.stringify(data);
+    // Generate ephemeral age key pair
+    const { generateIdentity, identityToRecipient, Encrypter } = await Promise.resolve(`${
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- dynamic ESM import of CJS-incompatible package
+    "age-encryption"}`).then(s => __importStar(require(s)));
+    const ephemeralPrivateKey = (await generateIdentity());
+    const ephemeralPublicKey = (await identityToRecipient(ephemeralPrivateKey));
+    // age-encrypt plaintext to ephemeral public key
+    const e = new Encrypter();
+    e.addRecipient(ephemeralPublicKey);
+    const encrypted = await e.encrypt(plaintext);
+    const ciphertext = Buffer.from(encrypted).toString("base64");
+    // Wrap the ephemeral private key with KMS
+    const wrapped = await kmsProvider.wrap(kmsKeyId, Buffer.from(ephemeralPrivateKey));
+    const revision = `${Date.now()}-${crypto.randomBytes(4).toString("hex")}`;
+    const ciphertextHash = crypto.createHash("sha256").update(ciphertext).digest("hex");
+    const packedAt = new Date().toISOString();
+    const expiresAt = new Date(Date.now() + ttl * 1000).toISOString();
+    const artifact = {
+        version: 1,
+        identity,
+        environment,
+        packedAt,
+        revision,
+        ciphertextHash,
+        ciphertext,
+        keys: Object.keys(data),
+        envelope: {
+            provider: kmsProviderName,
+            keyId: kmsKeyId,
+            wrappedKey: wrapped.wrappedKey.toString("base64"),
+            algorithm: wrapped.algorithm,
+        },
+        expiresAt,
+    };
+    return JSON.stringify(artifact, null, 2);
+}
+//# sourceMappingURL=envelope.js.map

package/dist/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,oCA8CC;AAhGD,+CAAiC;AA2CjC;;;;;;GAMG;AACI,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE7F,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAEvC,kCAAkC;IAClC,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAAG;IAC3D,gHAAgH;IAChH,gBAAuB,uCACxB,CAAC;IACF,MAAM,mBAAmB,GAAG,CAAC,MAAM,gBAAgB,EAAE,CAAW,CAAC;IACjE,MAAM,kBAAkB,GAAG,CAAC,MAAM,mBAAmB,CAAC,mBAAmB,CAAC,CAAW,CAAC;IAEtF,gDAAgD;IAChD,MAAM,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;IAC1B,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAuB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE3E,0CAA0C;IAC1C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAEnF,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAElE,MAAM,QAAQ,GAAmB;QAC/B,OAAO,EAAE,CAAC;QACV,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,UAAU;QACV,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,QAAQ,EAAE;YACR,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACjD,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B;QACD,SAAS;KACV,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/handler.d.ts

@@ -0,0 +1,24 @@
+import { BrokerHandler, BrokerInvoker, HandleOptions } from "./types";
+/**
+ * Create a broker invoker with built-in caching, revocation, and shutdown.
+ *
+ * Returns a `BrokerInvoker` with `invoke()` and `shutdown()` methods.
+ * State (cache, KMS provider, revocation tracking) lives in the closure
+ * and persists across Lambda warm invocations.
+ *
+ * ```typescript
+ * const broker = createHandler(myBroker);
+ *
+ * // Lambda
+ * export const handler = () => broker.invoke();
+ * process.on("SIGTERM", () => broker.shutdown());
+ *
+ * // Express
+ * app.get('/', async (req, res) => {
+ *   const result = await broker.invoke();
+ *   res.status(result.statusCode).set(result.headers).send(result.body);
+ * });
+ * ```
+ */
+export declare function createHandler(handler: BrokerHandler, options?: Partial<HandleOptions>): BrokerInvoker;
+//# sourceMappingURL=handler.d.ts.map

package/dist/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAkB,aAAa,EAAE,aAAa,EAAS,MAAM,SAAS,CAAC;AAa7F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAC/B,aAAa,CAyHf"}

package/dist/handler.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHandler = createHandler;
+const runtime_1 = require("@clef-sh/runtime");
+const envelope_1 = require("./envelope");
+const config_1 = require("./config");
+const noop = () => { };
+/**
+ * Create a broker invoker with built-in caching, revocation, and shutdown.
+ *
+ * Returns a `BrokerInvoker` with `invoke()` and `shutdown()` methods.
+ * State (cache, KMS provider, revocation tracking) lives in the closure
+ * and persists across Lambda warm invocations.
+ *
+ * ```typescript
+ * const broker = createHandler(myBroker);
+ *
+ * // Lambda
+ * export const handler = () => broker.invoke();
+ * process.on("SIGTERM", () => broker.shutdown());
+ *
+ * // Express
+ * app.get('/', async (req, res) => {
+ *   const result = await broker.invoke();
+ *   res.status(result.statusCode).set(result.headers).send(result.body);
+ * });
+ * ```
+ */
+function createHandler(handler, options) {
+    // Resolve config once at creation time (persists across Lambda warm invocations)
+    const envConfig = (0, config_1.resolveConfig)();
+    const identity = options?.identity ?? envConfig.identity;
+    const environment = options?.environment ?? envConfig.environment;
+    const kmsProviderName = options?.kmsProvider ?? envConfig.kmsProvider;
+    const kmsKeyId = options?.kmsKeyId ?? envConfig.kmsKeyId;
+    const kmsRegion = options?.kmsRegion ?? envConfig.kmsRegion;
+    const handlerConfig = options?.config ?? envConfig.handlerConfig;
+    const onLog = options?.onLog ?? noop;
+    // Create KMS provider once, reuse across invocations
+    const kms = (0, runtime_1.createKmsProvider)(kmsProviderName, { region: kmsRegion });
+    let cached;
+    let inflightPromise;
+    let validated = false;
+    function isCacheValid() {
+        if (!cached)
+            return false;
+        const elapsed = Date.now() - cached.createdAt;
+        return elapsed < cached.ttl * 0.8 * 1000;
+    }
+    async function revokeIfNeeded() {
+        if (handler.revoke && cached?.entityId) {
+            try {
+                await handler.revoke(cached.entityId, handlerConfig);
+                onLog("info", `Revoked credential: ${cached.entityId}`, {
+                    entityId: cached.entityId,
+                });
+            }
+            catch (err) {
+                onLog("warn", `Revoke failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`, {
+                    entityId: cached.entityId,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+        }
+    }
+    async function generateEnvelope() {
+        // Revoke previous credential if handler supports it (Tier 2)
+        await revokeIfNeeded();
+        const result = await handler.create(handlerConfig);
+        const body = await (0, envelope_1.packEnvelope)({
+            identity,
+            environment,
+            data: result.data,
+            ttl: result.ttl,
+            kmsProvider: kms,
+            kmsProviderName,
+            kmsKeyId,
+        });
+        cached = {
+            body,
+            entityId: result.entityId,
+            createdAt: Date.now(),
+            ttl: result.ttl,
+        };
+        return {
+            statusCode: 200,
+            headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
+            body,
+        };
+    }
+    async function invoke() {
+        try {
+            // Validate connection on first invocation
+            if (!validated && handler.validateConnection) {
+                const ok = await handler.validateConnection(handlerConfig);
+                if (!ok) {
+                    throw new Error("Broker handler validateConnection() returned false.");
+                }
+                validated = true;
+            }
+            else {
+                validated = true;
+            }
+            // Return cached response if still valid
+            if (isCacheValid()) {
+                return {
+                    statusCode: 200,
+                    headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
+                    body: cached.body,
+                };
+            }
+            // Mutex: if a generate is already in flight, wait for it
+            if (inflightPromise)
+                return await inflightPromise;
+            inflightPromise = generateEnvelope().finally(() => {
+                inflightPromise = undefined;
+            });
+            return await inflightPromise;
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            onLog("error", `Envelope generation failed: ${message}`, {
+                error: message,
+            });
+            return {
+                statusCode: 500,
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ error: message }),
+            };
+        }
+    }
+    async function shutdown() {
+        await revokeIfNeeded();
+    }
+    return { invoke, shutdown };
+}
+//# sourceMappingURL=handler.js.map

package/dist/handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../src/handler.ts"],"names":[],"mappings":";;AAoCA,sCA4HC;AAhKD,8CAAqD;AAGrD,yCAA0C;AAC1C,qCAAyC;AASzC,MAAM,IAAI,GAAU,GAAG,EAAE,GAAE,CAAC,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,aAAa,CAC3B,OAAsB,EACtB,OAAgC;IAEhC,iFAAiF;IACjF,MAAM,SAAS,GAAG,IAAA,sBAAa,GAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;IACzD,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,SAAS,CAAC,WAAW,CAAC;IAClE,MAAM,eAAe,GAAG,OAAO,EAAE,WAAW,IAAI,SAAS,CAAC,WAAW,CAAC;IACtE,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC;IAC5D,MAAM,aAAa,GAAG,OAAO,EAAE,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC;IACjE,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC;IAErC,qDAAqD;IACrD,MAAM,GAAG,GAAgB,IAAA,2BAAiB,EAAC,eAAe,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAEnF,IAAI,MAAkC,CAAC;IACvC,IAAI,eAAoD,CAAC;IACzD,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,SAAS,YAAY;QACnB,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9C,OAAO,OAAO,GAAG,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;gBACrD,KAAK,CAAC,MAAM,EAAE,uBAAuB,MAAM,CAAC,QAAQ,EAAE,EAAE;oBACtD,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CACH,MAAM,EACN,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAChF;oBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,gBAAgB;QAC7B,6DAA6D;QAC7D,MAAM,cAAc,EAAE,CAAC;QAEvB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,IAAA,uBAAY,EAAC;YAC9B,QAAQ;YACR,WAAW;YACX,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,GAAG;YAChB,eAAe;YACf,QAAQ;SACT,CAAC,CAAC;QAEH,MAAM,GAAG;YACP,IAAI;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,GAAG,EAAE,MAAM,CAAC,GAAG;SAChB,CAAC;QAEF,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;YAC5E,IAAI;SACL,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC;YACH,0CAA0C;YAC1C,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;gBAC3D,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;gBACzE,CAAC;gBACD,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YAED,wCAAwC;YACxC,IAAI,YAAY,EAAE,EAAE,CAAC;gBACnB,OAAO;oBACL,UAAU,EAAE,GAAG;oBACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;oBAC5E,IAAI,EAAE,MAAO,CAAC,IAAI;iBACnB,CAAC;YACJ,CAAC;YAED,yDAAyD;YACzD,IAAI,eAAe;gBAAE,OAAO,MAAM,eAAe,CAAC;YAElD,eAAe,GAAG,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChD,eAAe,GAAG,SAAS,CAAC;YAC9B,CAAC,CAAC,CAAC;YAEH,OAAO,MAAM,eAAe,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,KAAK,CAAC,OAAO,EAAE,+BAA+B,OAAO,EAAE,EAAE;gBACvD,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;YACH,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,QAAQ;QACrB,MAAM,cAAc,EAAE,CAAC;IACzB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export { createHandler } from "./handler";
+export { serve } from "./serve";
+export type { BrokerHandler, BrokerCreateResult, BrokerResponse, BrokerInvoker, LogLevel, LogFn, HandleOptions, ServeOptions, BrokerServerHandle, } from "./types";
+export { resolveConfig, ConfigError } from "./config";
+export type { BrokerConfig } from "./config";
+export { packEnvelope } from "./envelope";
+export type { BrokerArtifact, PackEnvelopeOptions, ArtifactEnvelopeField } from "./envelope";
+export { validateBroker, formatResults } from "./validate";
+export type { CheckResult, ValidationResult } from "./validate";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,QAAQ,EACR,KAAK,EACL,aAAa,EACb,YAAY,EACZ,kBAAkB,GACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACtD,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatResults = exports.validateBroker = exports.packEnvelope = exports.ConfigError = exports.resolveConfig = exports.serve = exports.createHandler = void 0;
+var handler_1 = require("./handler");
+Object.defineProperty(exports, "createHandler", { enumerable: true, get: function () { return handler_1.createHandler; } });
+var serve_1 = require("./serve");
+Object.defineProperty(exports, "serve", { enumerable: true, get: function () { return serve_1.serve; } });
+var config_1 = require("./config");
+Object.defineProperty(exports, "resolveConfig", { enumerable: true, get: function () { return config_1.resolveConfig; } });
+Object.defineProperty(exports, "ConfigError", { enumerable: true, get: function () { return config_1.ConfigError; } });
+var envelope_1 = require("./envelope");
+Object.defineProperty(exports, "packEnvelope", { enumerable: true, get: function () { return envelope_1.packEnvelope; } });
+var validate_1 = require("./validate");
+Object.defineProperty(exports, "validateBroker", { enumerable: true, get: function () { return validate_1.validateBroker; } });
+Object.defineProperty(exports, "formatResults", { enumerable: true, get: function () { return validate_1.formatResults; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,qCAA0C;AAAjC,wGAAA,aAAa,OAAA;AACtB,iCAAgC;AAAvB,8FAAA,KAAK,OAAA;AAYd,mCAAsD;AAA7C,uGAAA,aAAa,OAAA;AAAE,qGAAA,WAAW,OAAA;AAEnC,uCAA0C;AAAjC,wGAAA,YAAY,OAAA;AAErB,uCAA2D;AAAlD,0GAAA,cAAc,OAAA;AAAE,yGAAA,aAAa,OAAA"}

package/dist/serve.d.ts

@@ -0,0 +1,10 @@
+import { BrokerHandler, ServeOptions, BrokerServerHandle } from "./types";
+/**
+ * Start a broker HTTP server that serves Clef artifact envelopes.
+ *
+ * This is a convenience wrapper around `createHandler()` for long-running
+ * processes (containers, VMs). For serverless (Lambda, Cloud Functions),
+ * use `createHandler()` directly.
+ */
+export declare function serve(handler: BrokerHandler, options?: Partial<ServeOptions>): Promise<BrokerServerHandle>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAI1E;;;;;;GAMG;AACH,wBAAsB,KAAK,CACzB,OAAO,EAAE,aAAa,EACtB,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA4D7B"}

package/dist/serve.js

@@ -0,0 +1,101 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serve = serve;
+const http = __importStar(require("http"));
+const handler_1 = require("./handler");
+const config_1 = require("./config");
+/**
+ * Start a broker HTTP server that serves Clef artifact envelopes.
+ *
+ * This is a convenience wrapper around `createHandler()` for long-running
+ * processes (containers, VMs). For serverless (Lambda, Cloud Functions),
+ * use `createHandler()` directly.
+ */
+async function serve(handler, options) {
+    const envConfig = (0, config_1.resolveConfig)();
+    const port = options?.port ?? envConfig.port;
+    const host = options?.host ?? envConfig.host;
+    const onLog = options?.onLog ?? (() => { });
+    const broker = (0, handler_1.createHandler)(handler, options);
+    const server = http.createServer(async (req, res) => {
+        if (req.method !== "GET") {
+            res.writeHead(405, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Method not allowed" }));
+            return;
+        }
+        if (req.url === "/health") {
+            res.writeHead(200, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ status: "ok" }));
+            return;
+        }
+        if (req.url !== "/" && req.url !== "") {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Not found" }));
+            return;
+        }
+        const result = await broker.invoke();
+        res.writeHead(result.statusCode, result.headers);
+        res.end(result.body);
+    });
+    return new Promise((resolve, reject) => {
+        try {
+            server.listen(port, host, () => {
+                const addr = server.address();
+                const boundPort = typeof addr === "object" && addr ? addr.port : port;
+                const url = `http://127.0.0.1:${boundPort}`;
+                onLog("info", `Broker serving at ${url}`, { port: boundPort });
+                resolve({
+                    url,
+                    stop: async () => {
+                        await broker.shutdown();
+                        await new Promise((resolveClose, rejectClose) => {
+                            server.close((err) => (err ? rejectClose(err) : resolveClose()));
+                            const drainTimer = setTimeout(() => {
+                                server.closeAllConnections();
+                            }, 3000);
+                            drainTimer.unref();
+                        });
+                    },
+                });
+            });
+            server.on("error", (err) => reject(err));
+        }
+        catch (err) {
+            reject(err);
+        }
+    });
+}
+//# sourceMappingURL=serve.js.map

package/dist/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,sBA+DC;AA3ED,2CAA6B;AAE7B,uCAA0C;AAC1C,qCAAyC;AAEzC;;;;;;GAMG;AACI,KAAK,UAAU,KAAK,CACzB,OAAsB,EACtB,OAA+B;IAE/B,MAAM,SAAS,GAAG,IAAA,sBAAa,GAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;YACtC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACrC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;gBACtE,MAAM,GAAG,GAAG,oBAAoB,SAAS,EAAE,CAAC;gBAC5C,KAAK,CAAC,MAAM,EAAE,qBAAqB,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/D,OAAO,CAAC;oBACN,GAAG;oBACH,IAAI,EAAE,KAAK,IAAI,EAAE;wBACf,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;wBAExB,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;4BACpD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;4BACjE,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gCACjC,MAAM,CAAC,mBAAmB,EAAE,CAAC;4BAC/B,CAAC,EAAE,IAAI,CAAC,CAAC;4BACT,UAAU,CAAC,KAAK,EAAE,CAAC;wBACrB,CAAC,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,74 @@
+/** Result of a broker's credential generation. */
+export interface BrokerCreateResult {
+    /** Generated credentials as key-value pairs. */
+    data: Record<string, string>;
+    /** Seconds until these credentials expire. */
+    ttl: number;
+    /** Identifier for revocation tracking (Tier 2 brokers). */
+    entityId?: string;
+}
+/**
+ * Handler interface that broker authors implement.
+ *
+ * Only `create` is required. Tier 1 brokers (self-expiring credentials like
+ * STS tokens, RDS IAM tokens, OAuth access tokens) only need `create`.
+ * Tier 2 brokers (stateful credentials like SQL database users) also
+ * implement `revoke`.
+ */
+export interface BrokerHandler {
+    /** Generate fresh credentials from the given configuration. */
+    create(config: Record<string, string>): Promise<BrokerCreateResult>;
+    /** Revoke a previously issued credential (Tier 2). */
+    revoke?(entityId: string, config: Record<string, string>): Promise<void>;
+    /** Validate that the handler can reach its target system. */
+    validateConnection?(config: Record<string, string>): Promise<boolean>;
+}
+/** Log levels for broker operational logging. */
+export type LogLevel = "info" | "warn" | "error";
+/** Structured log callback. */
+export type LogFn = (level: LogLevel, message: string, context?: Record<string, unknown>) => void;
+/** Options for `createHandler()`. */
+export interface HandleOptions {
+    /** Service identity name embedded in the artifact envelope. */
+    identity: string;
+    /** Environment name embedded in the artifact envelope. */
+    environment: string;
+    /** KMS provider name ("aws", "gcp", or "azure"). */
+    kmsProvider: string;
+    /** KMS key ID/ARN for wrapping the ephemeral age private key. */
+    kmsKeyId: string;
+    /** KMS region (AWS only). */
+    kmsRegion?: string;
+    /** Override handler config. Default: collected from CLEF_BROKER_HANDLER_* env vars. */
+    config?: Record<string, string>;
+    /** Structured log callback for operational events. */
+    onLog?: LogFn;
+}
+/** Response from a broker invocation. Maps directly to Lambda/Cloud Function response format. */
+export interface BrokerResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: string;
+}
+/** Handle returned by `createHandler()`. */
+export interface BrokerInvoker {
+    /** Generate or return a cached artifact envelope. */
+    invoke(): Promise<BrokerResponse>;
+    /** Graceful shutdown: revoke the active credential if applicable. */
+    shutdown(): Promise<void>;
+}
+/** Options for the `serve()` HTTP server wrapper. */
+export interface ServeOptions extends HandleOptions {
+    /** Port to listen on. Default: 8080. */
+    port?: number;
+    /** Bind address. Default: "0.0.0.0" (broker serves encrypted envelopes, not plaintext). */
+    host?: string;
+}
+/** Handle to a running broker server. */
+export interface BrokerServerHandle {
+    /** Base URL of the running server (e.g. "http://127.0.0.1:8080"). */
+    url: string;
+    /** Graceful shutdown: revokes active credential if applicable, then closes. */
+    stop: () => Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpE,sDAAsD;IACtD,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,6DAA6D;IAC7D,kBAAkB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAED,iDAAiD;AACjD,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,+BAA+B;AAC/B,MAAM,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAElG,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,6BAA6B;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sDAAsD;IACtD,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAClC,qEAAqE;IACrE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAa,SAAQ,aAAa;IACjD,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,yCAAyC;AACzC,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B"}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/validate.d.ts

@@ -0,0 +1,28 @@
+/** Result of a single validation check. */
+export interface CheckResult {
+    name: string;
+    passed: boolean;
+    message: string;
+}
+/** Result of validating a broker directory. */
+export interface ValidationResult {
+    passed: boolean;
+    checks: CheckResult[];
+}
+/**
+ * Validate a broker directory for registry contribution.
+ *
+ * Checks:
+ * 1. broker.yaml exists and is valid YAML
+ * 2. All required manifest fields are present and valid
+ * 3. handler.ts (or handler.js) exists
+ * 4. README.md exists with required sections
+ * 5. Inputs array structure is valid
+ * 6. Name matches directory name (if inferrable)
+ */
+export declare function validateBroker(brokerDir: string): ValidationResult;
+/**
+ * Format validation results for terminal output.
+ */
+export declare function formatResults(result: ValidationResult): string;
+//# sourceMappingURL=validate.d.ts.map

package/dist/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":"AAIA,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AAuBD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CA2JlE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAc9D"}

package/dist/validate.js

@@ -0,0 +1,237 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateBroker = validateBroker;
+exports.formatResults = formatResults;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml_1 = require("yaml");
+const VALID_PROVIDERS = ["aws", "gcp", "azure", "agnostic"];
+const VALID_TIERS = [1, 2, 3];
+const REQUIRED_MANIFEST_FIELDS = [
+    "name",
+    "version",
+    "description",
+    "author",
+    "license",
+    "provider",
+    "tier",
+    "inputs",
+];
+const REQUIRED_README_HEADINGS = [
+    "description",
+    "prerequisites",
+    "configuration",
+    "deploy",
+];
+/**
+ * Validate a broker directory for registry contribution.
+ *
+ * Checks:
+ * 1. broker.yaml exists and is valid YAML
+ * 2. All required manifest fields are present and valid
+ * 3. handler.ts (or handler.js) exists
+ * 4. README.md exists with required sections
+ * 5. Inputs array structure is valid
+ * 6. Name matches directory name (if inferrable)
+ */
+function validateBroker(brokerDir) {
+    const checks = [];
+    function check(name, fn) {
+        try {
+            const result = fn();
+            if (result === true) {
+                checks.push({ name, passed: true, message: "OK" });
+            }
+            else {
+                checks.push({ name, passed: false, message: result });
+            }
+        }
+        catch (err) {
+            checks.push({
+                name,
+                passed: false,
+                message: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    // ── broker.yaml ──────────────────────────────────────────────────────────
+    const manifestPath = path.join(brokerDir, "broker.yaml");
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- parsed YAML is untyped
+    let manifest;
+    check("broker.yaml exists", () => {
+        if (!fs.existsSync(manifestPath))
+            return "broker.yaml not found";
+        return true;
+    });
+    check("broker.yaml is valid YAML", () => {
+        const raw = fs.readFileSync(manifestPath, "utf-8");
+        manifest = (0, yaml_1.parse)(raw);
+        if (!manifest || typeof manifest !== "object")
+            return "broker.yaml is empty or not an object";
+        return true;
+    });
+    for (const field of REQUIRED_MANIFEST_FIELDS) {
+        check(`manifest.${field} is present`, () => {
+            if (!manifest)
+                return "broker.yaml could not be parsed";
+            if (manifest[field] === undefined || manifest[field] === null) {
+                return `Missing required field: ${field}`;
+            }
+            return true;
+        });
+    }
+    check("manifest.provider is valid", () => {
+        if (!manifest)
+            return "broker.yaml could not be parsed";
+        if (!VALID_PROVIDERS.includes(manifest.provider)) {
+            return `provider must be one of: ${VALID_PROVIDERS.join(", ")}. Got: "${manifest.provider}"`;
+        }
+        return true;
+    });
+    check("manifest.tier is valid", () => {
+        if (!manifest)
+            return "broker.yaml could not be parsed";
+        if (!VALID_TIERS.includes(Number(manifest.tier))) {
+            return `tier must be 1, 2, or 3. Got: ${manifest.tier}`;
+        }
+        return true;
+    });
+    check("manifest.version is semver-like", () => {
+        if (!manifest)
+            return "broker.yaml could not be parsed";
+        if (!/^\d+\.\d+\.\d+/.test(String(manifest.version))) {
+            return `version should be semver (e.g. "1.0.0"). Got: "${manifest.version}"`;
+        }
+        return true;
+    });
+    check("manifest.name is lowercase with hyphens", () => {
+        if (!manifest)
+            return "broker.yaml could not be parsed";
+        if (!/^[a-z][a-z0-9-]*$/.test(String(manifest.name))) {
+            return `name must be lowercase with hyphens (e.g. "rds-iam"). Got: "${manifest.name}"`;
+        }
+        return true;
+    });
+    check("manifest.inputs is an array", () => {
+        if (!manifest)
+            return "broker.yaml could not be parsed";
+        if (!Array.isArray(manifest.inputs)) {
+            return `inputs must be an array. Got: ${typeof manifest.inputs}`;
+        }
+        return true;
+    });
+    check("manifest.inputs entries have name and description", () => {
+        if (!manifest || !Array.isArray(manifest.inputs))
+            return "inputs not available";
+        for (let i = 0; i < manifest.inputs.length; i++) {
+            const input = manifest.inputs[i];
+            if (!input.name)
+                return `inputs[${i}] is missing "name"`;
+            if (!input.description)
+                return `inputs[${i}] is missing "description"`;
+        }
+        return true;
+    });
+    // ── handler file ─────────────────────────────────────────────────────────
+    check("handler file exists", () => {
+        const tsPath = path.join(brokerDir, "handler.ts");
+        const jsPath = path.join(brokerDir, "handler.js");
+        if (!fs.existsSync(tsPath) && !fs.existsSync(jsPath)) {
+            return "handler.ts (or handler.js) not found";
+        }
+        return true;
+    });
+    check("handler exports create function", () => {
+        const tsPath = path.join(brokerDir, "handler.ts");
+        const jsPath = path.join(brokerDir, "handler.js");
+        const handlerPath = fs.existsSync(tsPath) ? tsPath : jsPath;
+        if (!fs.existsSync(handlerPath))
+            return "handler file not found";
+        const source = fs.readFileSync(handlerPath, "utf-8");
+        // Check for create method/property in export — works for both
+        // `export const handler: BrokerHandler = { create: ... }`
+        // and `export default { create: ... }`
+        // and `export { handler }` with create inside
+        if (!source.includes("create")) {
+            return 'handler file does not contain "create" — must export a BrokerHandler with a create method';
+        }
+        return true;
+    });
+    // ── README.md ────────────────────────────────────────────────────────────
+    const readmePath = path.join(brokerDir, "README.md");
+    check("README.md exists", () => {
+        if (!fs.existsSync(readmePath))
+            return "README.md not found";
+        return true;
+    });
+    check("README.md has required sections", () => {
+        if (!fs.existsSync(readmePath))
+            return "README.md not found";
+        const readme = fs.readFileSync(readmePath, "utf-8").toLowerCase();
+        const missing = [];
+        for (const heading of REQUIRED_README_HEADINGS) {
+            // Look for markdown heading containing the keyword
+            if (!readme.includes(`# ${heading}`) && !readme.includes(`## ${heading}`)) {
+                missing.push(heading);
+            }
+        }
+        if (missing.length > 0) {
+            return `README.md is missing required sections: ${missing.join(", ")}`;
+        }
+        return true;
+    });
+    return {
+        passed: checks.every((c) => c.passed),
+        checks,
+    };
+}
+/**
+ * Format validation results for terminal output.
+ */
+function formatResults(result) {
+    const lines = [];
+    for (const check of result.checks) {
+        const icon = check.passed ? "PASS" : "FAIL";
+        lines.push(`  ${icon}  ${check.name}${check.passed ? "" : ` — ${check.message}`}`);
+    }
+    const total = result.checks.length;
+    const passed = result.checks.filter((c) => c.passed).length;
+    const failed = total - passed;
+    lines.push("");
+    lines.push(`  ${passed}/${total} checks passed${failed > 0 ? `, ${failed} failed` : ""}`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=validate.js.map

package/dist/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../src/validate.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiDA,wCA2JC;AAKD,sCAcC;AA/ND,uCAAyB;AACzB,2CAA6B;AAC7B,+BAA0C;AAe1C,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAC5D,MAAM,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAE9B,MAAM,wBAAwB,GAAG;IAC/B,MAAM;IACN,SAAS;IACT,aAAa;IACb,QAAQ;IACR,SAAS;IACT,UAAU;IACV,MAAM;IACN,QAAQ;CACA,CAAC;AAEX,MAAM,wBAAwB,GAAG;IAC/B,aAAa;IACb,eAAe;IACf,eAAe;IACf,QAAQ;CACA,CAAC;AAEX;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAAC,SAAiB;IAC9C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,SAAS,KAAK,CAAC,IAAY,EAAE,EAAuB;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,EAAE,CAAC;YACpB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAE5E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACzD,wFAAwF;IACxF,IAAI,QAAa,CAAC;IAElB,KAAK,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,uBAAuB,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACtC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnD,QAAQ,GAAG,IAAA,YAAS,EAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,uCAAuC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,KAAK,IAAI,wBAAwB,EAAE,CAAC;QAC7C,KAAK,CAAC,YAAY,KAAK,aAAa,EAAE,GAAG,EAAE;YACzC,IAAI,CAAC,QAAQ;gBAAE,OAAO,iCAAiC,CAAC;YACxD,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9D,OAAO,2BAA2B,KAAK,EAAE,CAAC;YAC5C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO,iCAAiC,CAAC;QACxD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,OAAO,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,QAAQ,GAAG,CAAC;QAC/F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACnC,IAAI,CAAC,QAAQ;YAAE,OAAO,iCAAiC,CAAC;QACxD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,iCAAiC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,iCAAiC,CAAC;QACxD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,kDAAkD,QAAQ,CAAC,OAAO,GAAG,CAAC;QAC/E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO,iCAAiC,CAAC;QACxD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,+DAA+D,QAAQ,CAAC,IAAI,GAAG,CAAC;QACzF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,iCAAiC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,iCAAiC,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,sBAAsB,CAAC;QAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,IAAI;gBAAE,OAAO,UAAU,CAAC,qBAAqB,CAAC;YACzD,IAAI,CAAC,KAAK,CAAC,WAAW;gBAAE,OAAO,UAAU,CAAC,4BAA4B,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAE5E,KAAK,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,sCAAsC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,wBAAwB,CAAC;QAEjE,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACrD,8DAA8D;QAC9D,0DAA0D;QAC1D,uCAAuC;QACvC,8CAA8C;QAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,2FAA2F,CAAC;QACrG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAE5E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAErD,KAAK,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC7D,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,wBAAwB,EAAE,CAAC;YAC/C,mDAAmD;YACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACrC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,MAAwB;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC5D,MAAM,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC;IAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,KAAK,iBAAiB,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAE1F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@clef-sh/broker",
+  "version": "0.1.7-beta.45",
+  "description": "Runtime harness for Clef dynamic credential brokers",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/clef-sh/clef",
+    "directory": "packages/broker"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "jest",
+    "test:coverage": "jest --coverage",
+    "test:integration": "jest --config jest.integration.config.js",
+    "test:e2e": "npx tsx --test e2e/broker.e2e.test.ts"
+  },
+  "dependencies": {
+    "@clef-sh/runtime": "*",
+    "age-encryption": "^0.3.0",
+    "yaml": "^2.3.0"
+  },
+  "optionalDependencies": {
+    "@aws-sdk/client-kms": "^3.500.0",
+    "@azure/identity": "^4.0.0",
+    "@azure/keyvault-keys": "^4.8.0",
+    "@google-cloud/kms": "^4.0.0"
+  },
+  "devDependencies": {
+    "@types/jest": "^29.5.0",
+    "@types/node": "^20.11.0",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.1.0",
+    "typescript": "^5.4.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "license": "MIT"
+}