@koda-sl/baker-bridge 0.108.0 → 0.109.0-dev.557795bef

package/dist/broker/credential-text.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-text.test.d.ts","sourceRoot":"","sources":["../../src/broker/credential-text.test.ts"],"names":[],"mappings":""}

package/dist/broker/credential-text.test.js

@@ -0,0 +1,54 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+/**
+ * `credential-text.ts` is a hand-copy of the placeholder grammar, host check
+ * and scrub in `packages/api/src/credentials/` — the bridge is published
+ * standalone and cannot depend on the private `@baker/api`. These run both
+ * copies over the same inputs so the copy fails loudly when it falls behind.
+ */
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+import * as local from "./credential-text.js";
+const UPSTREAM = resolve(import.meta.dirname, "../../../api/src/credentials/index.ts");
+async function upstream() {
+    const path = UPSTREAM;
+    return (await import(__rewriteRelativeImportExtension(path)));
+}
+const credentials = [
+    { name: "meta-token", value: "EAAGm0PX4ZCpsBAKZCZ+/x", allowedHosts: ["graph.facebook.com"] },
+    { name: "shop", value: "shpat_0a1b2c3d4e5f", allowedHosts: ["acme.myshopify.com"] },
+    { name: "short", value: "abc", allowedHosts: ["api.example.com"] },
+    { name: "unicode", value: "contraseña-segura-1", allowedHosts: ["api.example.com"] },
+    { name: "quoted", value: 'pa"ss/wo\\rd-9x', allowedHosts: ["api.example.com"] },
+];
+const texts = [
+    " {{credential:meta-token}} ",
+    "Authorization: Bearer {{credential:meta-token}} and {{credential:shop}} and {{credential:missing}}",
+    "{{credential:}} {{credential:Upper}} {credential:x} {{credential:short}}",
+    "echo EAAGm0PX4ZCpsBAKZCZ+/x RUFBR20wUFg0WkNwc0JBS1pDWisveA== shpat_0a1b2c3d4e5f abc",
+    `encoded ${encodeURIComponent("contraseña-segura-1")} ${btoa("shpat_0a1b2c3d4e5f")}`,
+    String.raw `{"password":"pa"ss/wo\rd-9x","php":"pa"ss\/wo\rd-9x"}`,
+];
+const hosts = ["graph.facebook.com", "GRAPH.facebook.com.", "acme.myshopify.com", "myshopify.com", "evil.io"];
+describe("credential-text mirrors @baker/api/credentials", () => {
+    it("parses, substitutes and scrubs exactly like the contract", async () => {
+        const api = await upstream();
+        for (const text of texts) {
+            expect(local.parsePlaceholders(text)).toEqual(api.parsePlaceholders(text));
+            expect(local.credentialNamedBy(text)).toBe(api.credentialNamedBy(text));
+            expect(local.scrub(text, credentials)).toBe(api.scrub(text, credentials));
+            for (const host of hosts) {
+                expect(local.substitute(text, credentials, host)).toEqual(api.substitute(text, credentials, host));
+            }
+        }
+        expect(local.scrubPatterns(credentials)).toEqual(api.scrubPatterns(credentials));
+        expect(local.MIN_SCRUB_LENGTH).toBe(api.MIN_SCRUB_LENGTH);
+    });
+});
+//# sourceMappingURL=credential-text.test.js.map

package/dist/broker/credential-text.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-text.test.js","sourceRoot":"","sources":["../../src/broker/credential-text.test.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAC;AAG9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;AAEvF,KAAK,UAAU,QAAQ;IACrB,MAAM,IAAI,GAAW,QAAQ,CAAC;IAC9B,OAAO,CAAC,MAAM,MAAM,kCAAC,IAAI,EAAC,CAAa,CAAC;AAC1C,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IAC7F,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IACnF,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;IAClE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;IACpF,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;CAChF,CAAC;AAEF,MAAM,KAAK,GAAG;IACZ,6BAA6B;IAC7B,oGAAoG;IACpG,0EAA0E;IAC1E,qFAAqF;IACrF,WAAW,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,EAAE;IACpF,MAAM,CAAC,GAAG,CAAA,uDAAuD;CAClE,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;AAE9G,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/env.d.ts

@@ -0,0 +1,21 @@
+/** The broker's environment, parsed once at startup. */
+import { z } from "zod";
+declare const envSchema: z.ZodObject<{
+    CREDENTIAL_BROKER_TOKEN: z.ZodString;
+    BAKER_CONVEX_SITE_URL: z.ZodURL;
+    BAKER_CREDENTIAL_PROXY_PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    BAKER_CA_DIR: z.ZodDefault<z.ZodString>;
+    BAKER_BROKER_SOCKET: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type BrokerEnv = z.infer<typeof envSchema>;
+export declare function parseBrokerEnv(env?: NodeJS.ProcessEnv): z.ZodSafeParseResult<{
+    CREDENTIAL_BROKER_TOKEN: string;
+    BAKER_CONVEX_SITE_URL: string;
+    BAKER_CREDENTIAL_PROXY_PORT: number;
+    BAKER_CA_DIR: string;
+    BAKER_BROKER_SOCKET: string;
+}>;
+/** The supervisor's own environment for the broker it starts, with `NODE_OPTIONS` set. */
+export declare function brokerChildEnv(nodeOptions: string, env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export {};
+//# sourceMappingURL=env.d.ts.map

package/dist/broker/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/broker/env.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,QAAA,MAAM,SAAS;;;;;;iBAMb,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB;;;;;;GAElE;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAE3G"}

package/dist/broker/env.js

@@ -0,0 +1,20 @@
+/** The broker's environment, parsed once at startup. */
+import { z } from "zod";
+import { DEFAULT_BROKER_SOCKET } from "./broker-client.js";
+import { DEFAULT_CA_DIR } from "./ca.js";
+import { DEFAULT_PROXY_PORT } from "./proxy.js";
+const envSchema = z.object({
+    CREDENTIAL_BROKER_TOKEN: z.string().min(1),
+    BAKER_CONVEX_SITE_URL: z.url(),
+    BAKER_CREDENTIAL_PROXY_PORT: z.coerce.number().int().min(1).max(65_535).default(DEFAULT_PROXY_PORT),
+    BAKER_CA_DIR: z.string().min(1).default(DEFAULT_CA_DIR),
+    BAKER_BROKER_SOCKET: z.string().min(1).default(DEFAULT_BROKER_SOCKET),
+});
+export function parseBrokerEnv(env = process.env) {
+    return envSchema.safeParse(env);
+}
+/** The supervisor's own environment for the broker it starts, with `NODE_OPTIONS` set. */
+export function brokerChildEnv(nodeOptions, env = process.env) {
+    return { ...env, NODE_OPTIONS: nodeOptions };
+}
+//# sourceMappingURL=env.js.map

package/dist/broker/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/broker/env.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE;IAC9B,2BAA2B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;CACtE,CAAC,CAAC;AAIH,MAAM,UAAU,cAAc,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjE,OAAO,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IACtF,OAAO,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;AAC/C,CAAC"}

package/dist/broker/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/broker/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/broker/main.ts"],"names":[],"mappings":""}

package/dist/broker/main.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+/**
+ * `baker-credential-broker` — runs as root inside the Runtime, before the
+ * agent starts. Holds the company's credentials so the agent never does:
+ * the agent writes `{{credential:NAME}}`, the broker swaps the value in for
+ * allowed hosts and swaps it back out of what the agent reads.
+ */
+import { createBakerBrokerApi } from "./baker-api.js";
+import { ensureCertificateAuthority } from "./ca.js";
+import { parseBrokerEnv } from "./env.js";
+import { createBroker } from "./proxy.js";
+import { createSocketService } from "./socket-service.js";
+function log(message) {
+    console.error(`[credential-broker] ${message}`);
+}
+async function main() {
+    const parsed = parseBrokerEnv();
+    if (!parsed.success) {
+        log(`invalid environment: ${parsed.error.issues.map((issue) => issue.path.join(".")).join(", ")}`);
+        process.exit(1);
+    }
+    const env = parsed.data;
+    const api = createBakerBrokerApi({ siteUrl: env.BAKER_CONVEX_SITE_URL, token: env.CREDENTIAL_BROKER_TOKEN });
+    const ca = await ensureCertificateAuthority({
+        dir: env.BAKER_CA_DIR,
+        installSystemTrust: process.getuid?.() === 0,
+        log,
+    });
+    const broker = createBroker({
+        ca,
+        port: env.BAKER_CREDENTIAL_PROXY_PORT,
+        fetchCredentials: api.fetchCredentials,
+        reportUsage: api.reportUsage,
+        log,
+    });
+    const socket = createSocketService({ cache: broker.cache, socketPath: env.BAKER_BROKER_SOCKET, log });
+    const port = await broker.start();
+    await socket.listen();
+    log(`listening on 127.0.0.1:${port}, socket ${env.BAKER_BROKER_SOCKET}`);
+    // A stop signals the broker twice — once directly, once from its supervisor —
+    // and a second signal with no handler would kill it before it removes its socket.
+    let stopping = false;
+    const shutdown = async () => {
+        if (stopping)
+            return;
+        stopping = true;
+        await Promise.allSettled([socket.close(), broker.stop()]);
+        process.exit(0);
+    };
+    process.on("SIGTERM", () => void shutdown());
+    process.on("SIGINT", () => void shutdown());
+}
+main().catch((error) => {
+    log(`failed to start: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/broker/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/broker/main.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,SAAS,GAAG,CAAC,OAAe;IAC1B,OAAO,CAAC,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,wBAAwB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC7G,MAAM,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC1C,GAAG,EAAE,GAAG,CAAC,YAAY;QACrB,kBAAkB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC;QAC5C,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,EAAE;QACF,IAAI,EAAE,GAAG,CAAC,2BAA2B;QACrC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,0BAA0B,IAAI,YAAY,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEzE,8EAA8E;IAC9E,kFAAkF;IAClF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,GAAG,CAAC,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/broker/proxy.d.ts

@@ -0,0 +1,24 @@
+import type { CredentialUse } from "./baker-api.ts";
+import { type CredentialCache, type FetchCredentials } from "./credential-cache.ts";
+export declare const DEFAULT_PROXY_PORT = 8877;
+export type BrokerOptions = {
+    ca: {
+        key: string;
+        cert: string;
+    };
+    fetchCredentials: FetchCredentials;
+    reportUsage: (uses: CredentialUse[]) => Promise<void>;
+    /** 0 picks a free port. */
+    port?: number;
+    /** Extra roots to trust upstream (tests); Node's built-in roots are always trusted. */
+    upstreamCAs?: readonly string[];
+    log?: (message: string) => void;
+};
+export type Broker = {
+    cache: CredentialCache;
+    /** Starts the proxy and returns the port it listens on. */
+    start(): Promise<number>;
+    stop(): Promise<void>;
+};
+export declare function createBroker(options: BrokerOptions): Broker;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/broker/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/broker/proxy.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,KAAK,eAAe,EAAyB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAe3G,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB,CAAC;AA6CF,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAkF3D"}

package/dist/broker/proxy.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=proxy.integration.test.d.ts.map

package/dist/broker/proxy.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.integration.test.d.ts","sourceRoot":"","sources":["../../src/broker/proxy.integration.test.ts"],"names":[],"mappings":""}

package/dist/broker/proxy.integration.test.js

@@ -0,0 +1,197 @@
+import { request as httpRequest } from "node:http";
+import { connect as http2Connect } from "node:http2";
+import { connect as netConnect } from "node:net";
+import { networkInterfaces } from "node:os";
+import { connect as tlsConnect } from "node:tls";
+import { generateCACertificate, getLocal } from "mockttp";
+import { ProxyAgent, request } from "undici";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { createBroker } from "./proxy.js";
+const VALUE = "shpat_0a1b2c3d4e5f6a7b";
+let upstream;
+let broker;
+let agent;
+let metaHosts;
+let brokerPort;
+let brokerCaCert;
+beforeEach(async () => {
+    const upstreamCa = await generateCACertificate();
+    upstream = getLocal({ https: upstreamCa });
+    await upstream.start();
+    await upstream.forAnyRequest().thenCallback((req) => ({
+        statusCode: 200,
+        json: { sawAuthorization: req.headers.authorization ?? null, bodyBytes: req.body.buffer.byteLength },
+    }));
+    metaHosts = ["graph.facebook.com"];
+    const brokerCa = await generateCACertificate();
+    broker = createBroker({
+        ca: brokerCa,
+        port: 0,
+        upstreamCAs: [upstreamCa.cert],
+        fetchCredentials: () => Promise.resolve([
+            { name: "shop", value: VALUE, allowedHosts: ["localhost"] },
+            { name: "meta-token", value: "EAAG-meta-value-1", allowedHosts: [...metaHosts] },
+        ]),
+        reportUsage: () => Promise.resolve(),
+    });
+    const port = await broker.start();
+    brokerPort = port;
+    brokerCaCert = brokerCa.cert;
+    agent = new ProxyAgent({ uri: `http://127.0.0.1:${port}`, requestTls: { ca: brokerCa.cert } });
+});
+afterEach(async () => {
+    await agent.close();
+    await broker.stop();
+    await upstream.stop();
+});
+/** A GET over HTTP/2 through the broker, as curl makes one: CONNECT, then TLS with h2 negotiated. */
+function http2GetThroughBroker(path) {
+    const authority = `localhost:${upstream.port}`;
+    return new Promise((resolve, reject) => {
+        const connect = httpRequest({ host: "127.0.0.1", port: brokerPort, method: "CONNECT", path: authority });
+        connect.on("error", reject);
+        connect.on("connect", (_res, socket) => {
+            const session = http2Connect(`https://${authority}`, {
+                createConnection: () => tlsConnect({ socket, servername: "localhost", ALPNProtocols: ["h2"], ca: brokerCaCert }),
+            });
+            session.on("error", reject);
+            const stream = session.request({ ":method": "GET", ":path": path });
+            let status = 0;
+            let body = "";
+            stream.on("response", (headers) => {
+                status = Number(headers[":status"]);
+            });
+            stream.setEncoding("utf8");
+            stream.on("data", (chunk) => {
+                body += chunk;
+            });
+            stream.on("end", () => {
+                session.close();
+                resolve({ status, body });
+            });
+            stream.on("error", reject);
+            stream.end();
+        });
+        connect.end();
+    });
+}
+describe("credential broker proxy", () => {
+    it("sends a placeholder written in the URL over HTTP/2", async () => {
+        const response = await http2GetThroughBroker("/echo?key={{credential:shop}}");
+        expect(response.status).toBe(200);
+        const [seen] = await upstream.getMockedEndpoints().then((endpoints) => endpoints[0]?.getSeenRequests() ?? []);
+        expect(seen?.url).toContain(`key=${VALUE}`);
+    });
+    it("sends the value to an allowed host and hands the agent back only the placeholder", async () => {
+        const response = await request(`https://localhost:${upstream.port}/echo`, {
+            dispatcher: agent,
+            headers: { authorization: "Bearer {{credential:shop}}" },
+        });
+        const body = await response.body.text();
+        const [seen] = await upstream.getMockedEndpoints().then((endpoints) => endpoints[0]?.getSeenRequests() ?? []);
+        expect(seen?.headers.authorization).toBe(`Bearer ${VALUE}`);
+        expect(JSON.parse(body)).toEqual({ sawAuthorization: "Bearer {{credential:shop}}", bodyBytes: 0 });
+    });
+    it("hands back a Basic auth header an allowed host echoes without the pair it carried", async () => {
+        // base64 of `admin:VALUE` is not base64 of VALUE: the pair has to be scrubbed as sent.
+        const response = await request(`https://localhost:${upstream.port}/echo`, {
+            dispatcher: agent,
+            headers: { authorization: `Basic ${btoa("shop:{{credential:shop}}")}` },
+        });
+        const body = await response.body.text();
+        expect(body).not.toContain(btoa(`shop:${VALUE}`).slice(8));
+        expect(JSON.parse(body)).toMatchObject({ sawAuthorization: "Basic {{credential:shop}}" });
+    });
+    it.each(["application/x-ndjson", "application/yaml", "application/octet-stream"])("hands back a value echoed in a %s response only as its placeholder", async (contentType) => {
+        await upstream
+            .forGet("/typed")
+            .asPriority(2)
+            .thenCallback((req) => ({
+            statusCode: 200,
+            headers: { "content-type": contentType },
+            body: `{"echo":"${String(req.headers.authorization)}"}\n`,
+        }));
+        const response = await request(`https://localhost:${upstream.port}/typed`, {
+            dispatcher: agent,
+            headers: { authorization: "Bearer {{credential:shop}}" },
+        });
+        expect(await response.body.text()).toBe('{"echo":"Bearer {{credential:shop}}"}\n');
+    });
+    it("refuses a credential bound for a host it is not allowed for, before it leaves the sandbox", async () => {
+        const response = await request(`https://localhost:${upstream.port}/echo`, {
+            dispatcher: agent,
+            headers: { authorization: "Bearer {{credential:meta-token}}" },
+        });
+        const body = await response.body.text();
+        expect(response.statusCode).toBe(403);
+        expect(body).toContain('Baker credential "meta-token" is not allowed for host "localhost"');
+        const seen = await upstream.getMockedEndpoints().then((endpoints) => endpoints[0]?.getSeenRequests() ?? []);
+        expect(seen).toEqual([]);
+    });
+    it("sends a credential to a host the user allowed since the broker last fetched the table", async () => {
+        await request(`https://localhost:${upstream.port}/warm`, {
+            dispatcher: agent,
+            headers: { authorization: "Bearer {{credential:shop}}" },
+        }).then((response) => response.body.text());
+        metaHosts = ["graph.facebook.com", "localhost"];
+        const response = await request(`https://localhost:${upstream.port}/echo`, {
+            dispatcher: agent,
+            headers: { authorization: "Bearer {{credential:meta-token}}" },
+        });
+        expect(response.statusCode).toBe(200);
+        expect(await response.body.json()).toMatchObject({ sawAuthorization: "Bearer {{credential:meta-token}}" });
+    });
+    it("streams an upload larger than the broker reads through intact", async () => {
+        const upload = Buffer.alloc(12 * 1024 * 1024, "a");
+        const response = await request(`https://localhost:${upstream.port}/upload`, {
+            dispatcher: agent,
+            method: "POST",
+            headers: { "content-type": "text/plain" },
+            body: upload,
+        });
+        expect(await response.body.json()).toEqual({ sawAuthorization: null, bodyBytes: upload.byteLength });
+    });
+});
+/** This machine's address on a real network: what a stranger reaching the sandbox's port would appear as. */
+function externalAddress() {
+    const address = Object.values(networkInterfaces())
+        .flat()
+        .find((candidate) => candidate !== undefined && !candidate.internal && candidate.family === "IPv4");
+    if (address === undefined)
+        throw new Error("this test needs a network interface besides loopback");
+    return address.address;
+}
+/** Asks the broker, from `host`, to relay a WebSocket to `target`; resolves with its first response line, or "" when it hangs up. */
+function upgradeThroughBroker(host, target) {
+    return new Promise((resolve, reject) => {
+        const socket = netConnect({ host, port: brokerPort });
+        let received = "";
+        socket.setTimeout(3_000, () => socket.destroy());
+        socket.on("connect", () => socket.write(`GET ${target} HTTP/1.1\r\nHost: ${new URL(target).host}\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n`));
+        socket.on("data", (chunk) => {
+            received += chunk.toString("latin1");
+            if (received.includes("\r\n"))
+                socket.destroy();
+        });
+        socket.on("close", () => resolve(received.split("\r\n")[0] ?? ""));
+        socket.on("error", (error) => error.code === "ECONNRESET" || error.code === "ECONNREFUSED" ? resolve("") : reject(error));
+    });
+}
+describe("the broker's reach", () => {
+    let echo;
+    beforeEach(async () => {
+        echo = getLocal();
+        await echo.start();
+        await echo.forAnyWebSocket().thenEcho();
+    });
+    afterEach(async () => {
+        await echo.stop();
+    });
+    it("relays a WebSocket for this machine", async () => {
+        expect(await upgradeThroughBroker("127.0.0.1", `http://localhost:${echo.port}/`)).toContain("101");
+    });
+    it("relays no WebSocket for anyone else who reaches its port", async () => {
+        expect(await upgradeThroughBroker(externalAddress(), `http://localhost:${echo.port}/`)).not.toContain("101");
+    });
+});
+//# sourceMappingURL=proxy.integration.test.js.map

package/dist/broker/proxy.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.integration.test.js","sourceRoot":"","sources":["../../src/broker/proxy.integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAgB,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAe,YAAY,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,IAAI,QAAiB,CAAC;AACtB,IAAI,MAAc,CAAC;AACnB,IAAI,KAAiB,CAAC;AACtB,IAAI,SAAmB,CAAC;AACxB,IAAI,UAAkB,CAAC;AACvB,IAAI,YAAoB,CAAC;AAEzB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,UAAU,GAAG,MAAM,qBAAqB,EAAE,CAAC;IACjD,QAAQ,GAAG,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpD,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;KACrG,CAAC,CAAC,CAAC;IAEJ,SAAS,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC/C,MAAM,GAAG,YAAY,CAAC;QACpB,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,CAAC;QACP,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9B,gBAAgB,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC;YACd,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE;YAC3D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE;SACjF,CAAC;QACJ,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAClC,UAAU,GAAG,IAAI,CAAC;IAClB,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,EAAE,oBAAoB,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACpB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,SAAS,GAAG,aAAa,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACzG,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,SAAS,EAAE,EAAE;gBACnD,gBAAgB,EAAE,GAAG,EAAE,CACrB,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;aAC3F,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE;gBAChC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAClC,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACpB,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;QAE9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAExC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,IAAI,CAAC,0BAA0B,CAAC,EAAE,EAAE;SACxE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAExC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,CAC/E,oEAAoE,EACpE,KAAK,EAAE,WAAW,EAAE,EAAE;QACpB,MAAM,QAAQ;aACX,MAAM,CAAC,QAAQ,CAAC;aAChB,UAAU,CAAC,CAAC,CAAC;aACb,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;YACxC,IAAI,EAAE,YAAY,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM;SAC1D,CAAC,CAAC,CAAC;QAEN,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,QAAQ,EAAE;YACzE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACrF,CAAC,CACF,CAAC;IAEF,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAExC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mEAAmE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5G,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACvD,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,SAAS,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE;SAC/D,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,SAAS,EAAE;YAC1E,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;YACzC,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,6GAA6G;AAC7G,SAAS,eAAe;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;SAC/C,IAAI,EAAE;SACN,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACtG,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACnG,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,qIAAqI;AACrI,SAAS,oBAAoB,CAAC,IAAY,EAAE,MAAc;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CACxB,MAAM,CAAC,KAAK,CACV,OAAO,MAAM,sBAAsB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,mIAAmI,CAC3L,CACF,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE,CAClD,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,IAAa,CAAC;IAClB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,GAAG,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,CAAC,MAAM,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,CAAC,MAAM,oBAAoB,CAAC,eAAe,EAAE,EAAE,oBAAoB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/proxy.js

@@ -0,0 +1,147 @@
+/**
+ * The credential broker: an explicit HTTP(S) proxy (mockttp, TLS intercepted
+ * with the broker's own CA) that swaps `{{credential:NAME}}` for the value on
+ * the way out and swaps the value back to the placeholder on the way in.
+ *
+ * Two rules, in order:
+ * - A request carrying a placeholder is rewritten by `rewriteRequest` and its
+ *   response is scrubbed. mockttp's `beforeResponse` buffers the whole
+ *   response, so these responses — event streams included — arrive in one
+ *   piece. Headers are always scrubbed; a UTF-8 body, whatever its content
+ *   type, is scrubbed up to 10 MB, and anything larger or binary passes through as-is.
+ * - Every other request passes straight through, streamed and untouched: no
+ *   value was put into it, so there is nothing of ours to take out.
+ *
+ * Memory: the placeholder check reads each request body in full, and a
+ * credential-carrying request's response is buffered in full by mockttp
+ * before it is scrubbed (over 10 MB it then passes through unscrubbed).
+ * mockttp's `maxBodySize` cannot bound this: in 4.6.3 a body over the limit
+ * that a callback matcher has read is forwarded empty, so a large upload would
+ * hang or arrive truncated (see the upload test in `proxy.integration.test.ts`).
+ */
+import { getLocal } from "mockttp";
+import { createCredentialCache } from "./credential-cache.js";
+import { scrub } from "./credential-text.js";
+import { carriesPlaceholder, MAX_REWRITE_BODY_BYTES, rewriteRequest, sentBasicPairs, } from "./rewrite.js";
+import { createUsageReporter } from "./usage-reporter.js";
+export const DEFAULT_PROXY_PORT = 8877;
+const LOOPBACK_ADDRESSES = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+/** Anyone but this machine: the sandbox's ports are reachable from outside it. */
+function fromElsewhere(req) {
+    return !LOOPBACK_ADDRESSES.has(req.remoteIpAddress ?? "");
+}
+async function outgoing(req) {
+    return { url: req.url, headers: req.headers, body: (await req.body.getDecodedBuffer()) ?? null };
+}
+function scrubHeaders(headers, credentials) {
+    let changed = false;
+    const out = {};
+    for (const [name, value] of Object.entries(headers)) {
+        const scrubbed = Array.isArray(value)
+            ? value.map((item) => scrub(item, credentials))
+            : value === undefined
+                ? undefined
+                : scrub(value, credentials);
+        if (JSON.stringify(scrubbed) !== JSON.stringify(value))
+            changed = true;
+        out[name] = scrubbed;
+    }
+    return changed ? out : undefined;
+}
+/**
+ * The scrubbed body, or undefined when it is not UTF-8 text, over 10 MB, or
+ * holds no value. Any content type: a value echoed as NDJSON, YAML or JSON sent
+ * as `application/octet-stream` reaches the agent all the same.
+ */
+function scrubBody(raw, credentials) {
+    if (raw === undefined || raw.byteLength > MAX_REWRITE_BODY_BYTES)
+        return undefined;
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(raw);
+    }
+    catch {
+        return undefined;
+    }
+    const scrubbed = scrub(text, credentials);
+    return scrubbed === text ? undefined : scrubbed;
+}
+export function createBroker(options) {
+    const log = options.log ?? (() => undefined);
+    const cache = createCredentialCache({ fetchCredentials: options.fetchCredentials, log });
+    const usage = createUsageReporter({ reportUsage: options.reportUsage, log });
+    const server = getLocal({
+        https: { key: options.ca.key, cert: options.ca.cert },
+        recordTraffic: false,
+    });
+    const upstreamTrust = { additionalTrustedCAs: (options.upstreamCAs ?? []).map((cert) => ({ cert })) };
+    let stopUsage = () => undefined;
+    async function decide(req) {
+        const request = await outgoing(req);
+        let decision = rewriteRequest(request, await cache.get());
+        if (decision.kind === "reject" && decision.stale && cache.refresh()) {
+            decision = rewriteRequest(request, await cache.get());
+        }
+        return decision;
+    }
+    async function beforeRequest(req) {
+        const decision = await decide(req);
+        const host = new URL(req.url).hostname;
+        if (decision.kind === "pass")
+            return undefined;
+        if (decision.kind === "reject") {
+            log(`refused ${decision.status} for ${host}`);
+            return {
+                response: {
+                    statusCode: decision.status,
+                    headers: { "content-type": "text/plain; charset=utf-8", "x-baker-credential-broker": "refused" },
+                    body: decision.message,
+                },
+            };
+        }
+        for (const name of decision.used)
+            usage.record(name, host);
+        log(`sent ${decision.used.join(", ")} to ${host}`);
+        return {
+            url: decision.url,
+            headers: decision.headers,
+            ...(decision.body === undefined ? {} : { body: decision.body }),
+        };
+    }
+    async function beforeResponse(res, req) {
+        const resolved = await cache.scrubbable();
+        const credentials = [...resolved, ...sentBasicPairs(req.headers, resolved)];
+        const headers = scrubHeaders(res.headers, credentials);
+        const body = scrubBody(await res.body.getDecodedBuffer(), credentials);
+        if (headers === undefined && body === undefined)
+            return undefined;
+        return { ...(headers === undefined ? {} : { headers }), ...(body === undefined ? {} : { body }) };
+    }
+    async function registerRules() {
+        await server.forAnyRequest().matching(fromElsewhere).always().thenCloseConnection();
+        // mockttp listens on every interface, and WebSocket upgrades take their own rule set.
+        await server.forAnyWebSocket().matching(fromElsewhere).always().thenCloseConnection();
+        await server
+            .forAnyRequest()
+            .matching(async (req) => carriesPlaceholder(await outgoing(req)))
+            .always()
+            .thenPassThrough({ ...upstreamTrust, beforeRequest, beforeResponse });
+        await server.forAnyRequest().always().thenPassThrough(upstreamTrust);
+        await server.forAnyWebSocket().always().thenPassThrough(upstreamTrust);
+    }
+    return {
+        cache,
+        async start() {
+            await server.start(options.port ?? DEFAULT_PROXY_PORT);
+            await registerRules();
+            stopUsage = usage.start();
+            return server.port;
+        },
+        async stop() {
+            stopUsage();
+            await usage.flush();
+            await server.stop();
+        },
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/broker/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/broker/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAyB,QAAQ,EAAiD,MAAM,SAAS,CAAC;AAEzG,OAAO,EAAwB,qBAAqB,EAAyB,MAAM,uBAAuB,CAAC;AAC3G,OAAO,EAA6B,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EAEtB,cAAc,EACd,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAoBvC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAE7E,kFAAkF;AAClF,SAAS,aAAa,CAAC,GAAqB;IAC1C,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAqB;IAC3C,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB,EAAE,WAA4C;IAClF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/C,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,WAA4C;IACtF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,GAAG,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACnF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1C,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAsB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAY,QAAQ,CAAC;QAC/B,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QACrD,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,EAAE,oBAAoB,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACtG,IAAI,SAAS,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;IAE5C,KAAK,UAAU,MAAM,CAAC,GAAqB;QACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACpE,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAqB;QAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAC/C,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,GAAG,CAAC,WAAW,QAAQ,CAAC,MAAM,QAAQ,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO;gBACL,QAAQ,EAAE;oBACR,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,SAAS,EAAE;oBAChG,IAAI,EAAE,QAAQ,CAAC,OAAO;iBACvB;aACF,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,GAAG,CAAC,QAAQ,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACnD,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,cAAc,CAC3B,GAAwB,EACxB,GAAqB;QAErB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAClE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC;IAED,KAAK,UAAU,aAAa;QAC1B,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,mBAAmB,EAAE,CAAC;QACpF,sFAAsF;QACtF,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,mBAAmB,EAAE,CAAC;QACtF,MAAM,MAAM;aACT,aAAa,EAAE;aACf,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;aAChE,MAAM,EAAE;aACR,eAAe,CAAC,EAAE,GAAG,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC;YACvD,MAAM,aAAa,EAAE,CAAC;YACtB,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,SAAS,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}