@integrity-labs/cloud-broker 0.7.4 → 0.7.5

package/dist/index.js

@@ -20985,6 +20985,26 @@ var StdioServerTransport = class {
   }
 };
 
+// src/turn-initiator-marker.ts
+import { readFileSync } from "fs";
+var TURN_INITIATOR_MAX_AGE_MS = 5 * 60 * 1e3;
+function readTurnInitiator(maxAgeMs = TURN_INITIATOR_MAX_AGE_MS) {
+  const file = process.env["AGT_TURN_INITIATOR_FILE"];
+  if (!file) return null;
+  try {
+    const raw = readFileSync(file, "utf8");
+    const m = JSON.parse(raw);
+    if (typeof m.channel !== "string" || !m.channel) return null;
+    if (typeof m.sender_id !== "string" || !m.sender_id) return null;
+    if (typeof m.ts !== "number" || !Number.isFinite(m.ts)) return null;
+    const age = Date.now() - m.ts;
+    if (age < 0 || age > maxAgeMs) return null;
+    return { channel: m.channel, sender_id: m.sender_id };
+  } catch {
+    return null;
+  }
+}
+
 // src/broker-client.ts
 function makeBrokerError(status, message, detail) {
   const err = new Error(message);
@@ -21123,7 +21143,15 @@ var BrokerClient = class {
     if (!runId) {
       throw makeBrokerError(400, "BrokerClient.requestAccess requires run_id (pass it in args, or set runId on BrokerClientConfig)");
     }
-    const body = { ...args, agent_id: agentId, run_id: runId };
+    const turnInitiator = readTurnInitiator();
+    const { turn_initiator: _ignoredForged, ...safeArgs } = args;
+    void _ignoredForged;
+    const body = {
+      ...safeArgs,
+      agent_id: agentId,
+      run_id: runId,
+      ...turnInitiator ? { turn_initiator: turnInitiator } : {}
+    };
     return this.request("POST", `${this.apiPathPrefix}/grants`, { body });
   }
   pollGrant(args) {
@@ -21574,7 +21602,7 @@ var supabaseListProjectsShape = supabaseListProjectsSchema.shape;
 // package.json
 var package_default = {
   name: "@integrity-labs/cloud-broker",
-  version: "0.7.4",
+  version: "0.7.5",
   description: "Cloud Access Broker \u2014 MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials \u2014 STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   type: "module",
   bin: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@integrity-labs/cloud-broker",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "Cloud Access Broker — MCP server that mints scoped, TTL-bounded cloud credentials per agent task. Ships AWS support (aws_request_access, aws_poll_grant, aws_release_access, aws_describe_scope, aws_preview_request, aws_get_credentials — STS AssumeRole under the hood); GCP, Azure, and Cloudflare land alongside in the same package as the broker grows.",
   "type": "module",
   "bin": {