@koda-sl/baker-bridge 0.109.0-dev.f28c07bd2 → 0.109.0-dev.f7ef4c7e1

package/dist/broker/socket-service.js

@@ -0,0 +1,113 @@
+/**
+ * The broker's local service for the bridge, over a unix socket the agent user
+ * can reach: scrub values out of text, and health. It
+ * never returns a value — `/scrub` only ever turns values into placeholders.
+ *
+ * The agent writes the text it asks to have scrubbed, so a scrub is an answer
+ * to "is any of these my password?". `/scrub` therefore leaves alone a value a
+ * wordlist could reach (`resistsGuessing`); the proxy still scrubs it from
+ * what a website sends back, where the agent does not choose the text.
+ */
+import { chmod, mkdir, rm } from "node:fs/promises";
+import { createServer } from "node:http";
+import { dirname } from "node:path";
+import { z } from "zod";
+import { scrub } from "./credential-text.js";
+import { createTokenBucket } from "./token-bucket.js";
+export const MAX_SCRUB_REQUEST_BYTES = 2 * 1024 * 1024;
+/**
+ * Sized for dozens of agents reading at once, not for one: every agent's tool
+ * results share this budget. It only bounds runaway use; what keeps the socket
+ * from being an oracle is that it confirms no value a wordlist could reach
+ * (`resistsGuessing`). At 256 KB/s a 20-agent run withheld 40% of its results.
+ */
+const DEFAULT_SCRUB_BYTES = { capacity: 256 * 1024 * 1024, perSecond: 64 * 1024 * 1024 };
+const DEFAULT_REQUESTS_PER_SECOND = 1_000;
+const scrubRequestSchema = z.object({ text: z.string() });
+/** Bits a value must carry — its length times its per-character entropy — before `/scrub` may confirm it. */
+const MIN_SCRUB_BITS = 64;
+function resistsGuessing(value) {
+    const counts = new Map();
+    for (const char of value)
+        counts.set(char, (counts.get(char) ?? 0) + 1);
+    let perChar = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        perChar -= p * Math.log2(p);
+    }
+    return perChar * value.length >= MIN_SCRUB_BITS;
+}
+class BodyTooLarge extends Error {
+}
+async function readBody(req, limit) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+        size += buffer.byteLength;
+        if (size > limit)
+            throw new BodyTooLarge();
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+function parseJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function send(res, status, body) {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+}
+export function createSocketService(options) {
+    const bucket = createTokenBucket({
+        ratePerSecond: options.ratePerSecond ?? DEFAULT_REQUESTS_PER_SECOND,
+        burst: options.ratePerSecond ?? DEFAULT_REQUESTS_PER_SECOND,
+    });
+    const scrubBytes = options.scrubBytes ?? DEFAULT_SCRUB_BYTES;
+    const bytes = createTokenBucket({ ratePerSecond: scrubBytes.perSecond, burst: scrubBytes.capacity });
+    async function handle(req, res) {
+        if (req.method === "GET" && req.url === "/health") {
+            return send(res, 200, { ok: true, credentials: options.cache.size() });
+        }
+        if (req.method !== "POST" || req.url !== "/scrub")
+            return send(res, 404, { error: "not found" });
+        if (!bucket.take())
+            return send(res, 429, { error: "too many scrub requests" });
+        const raw = await readBody(req, MAX_SCRUB_REQUEST_BYTES);
+        if (!bytes.take(Buffer.byteLength(raw)))
+            return send(res, 429, { error: "too much text scrubbed, slow down" });
+        const parsed = scrubRequestSchema.safeParse(parseJson(raw));
+        if (!parsed.success)
+            return send(res, 400, { error: "expected {text}" });
+        const credentials = (await options.cache.scrubbable()).filter((credential) => resistsGuessing(credential.value));
+        return send(res, 200, { text: scrub(parsed.data.text, credentials) });
+    }
+    const server = createServer((req, res) => {
+        handle(req, res).catch((error) => {
+            if (error instanceof BodyTooLarge)
+                return send(res, 413, { error: "text too large to scrub" });
+            options.log?.(`socket request failed: ${error instanceof Error ? error.name : "unknown"}`);
+            send(res, 500, { error: "scrub failed" });
+        });
+    });
+    return {
+        async listen() {
+            await mkdir(dirname(options.socketPath), { recursive: true });
+            await rm(options.socketPath, { force: true });
+            await new Promise((resolve, reject) => {
+                server.once("error", reject);
+                server.listen(options.socketPath, () => resolve());
+            });
+            await chmod(options.socketPath, 0o666);
+        },
+        async close() {
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+//# sourceMappingURL=socket-service.js.map

package/dist/broker/socket-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-service.js","sourceRoot":"","sources":["../../src/broker/socket-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACvD;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,EAAE,QAAQ,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AACzF,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAE1C,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE1D,6GAA6G;AAC7G,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC;AAClD,CAAC;AAID,MAAM,YAAa,SAAQ,KAAK;CAAG;AAEnC,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,KAAa;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAOnC;IACC,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,2BAA2B;QACnE,KAAK,EAAE,OAAO,CAAC,aAAa,IAAI,2BAA2B;KAC5D,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IAErG,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACjH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxC,IAAI,KAAK,YAAY,YAAY;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,EAAE,CAAC,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/socket-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=socket-service.test.d.ts.map

package/dist/broker/socket-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-service.test.d.ts","sourceRoot":"","sources":["../../src/broker/socket-service.test.ts"],"names":[],"mappings":""}

package/dist/broker/socket-service.test.js

@@ -0,0 +1,80 @@
+import { mkdtempSync } from "node:fs";
+import { request } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { scrubViaBroker } from "./broker-client.js";
+import { createCredentialCache } from "./credential-cache.js";
+import { createSocketService } from "./socket-service.js";
+const VALUE = "shpat_0a1b2c3d4e5f6a7b";
+const WEAK_PASSWORD = ["Hunter", "2024!"].join("");
+let service = null;
+afterEach(async () => {
+    await service?.close();
+    service = null;
+});
+async function start(limits = {}) {
+    const socketPath = join(mkdtempSync(join(tmpdir(), "broker-")), "broker.sock");
+    const cache = createCredentialCache({
+        fetchCredentials: () => Promise.resolve([
+            { name: "shop", value: VALUE, allowedHosts: ["acme.myshopify.com"] },
+            { name: "login", value: WEAK_PASSWORD, allowedHosts: ["app.example.com"] },
+        ]),
+    });
+    service = createSocketService({ cache, socketPath, ...limits });
+    await service.listen();
+    return { socketPath };
+}
+function get(socketPath, path) {
+    return new Promise((resolve, reject) => {
+        const req = request({ socketPath, path, method: "GET" }, (res) => {
+            let body = "";
+            res.setEncoding("utf8");
+            res.on("data", (chunk) => {
+                body += chunk;
+            });
+            res.on("end", () => resolve(body));
+        });
+        req.on("error", reject);
+        req.end();
+    });
+}
+describe("broker socket service", () => {
+    it("scrubs a value back to its placeholder for the bridge", async () => {
+        const { socketPath } = await start();
+        const out = await scrubViaBroker(`tool said ${VALUE} and ${btoa(VALUE)}`, { socketPath });
+        expect(out).toBe("tool said {{credential:shop}} and {{credential:shop}}");
+    });
+    it("never confirms a guess at a value a wordlist could reach", async () => {
+        // The agent writes the text it asks to have scrubbed: scrubbing a guessable
+        // password would tell it which of a million guesses was right.
+        const { socketPath } = await start();
+        const out = await scrubViaBroker(`guesses: password1 ${WEAK_PASSWORD} letmein`, { socketPath });
+        expect(out).toBe(`guesses: password1 ${WEAK_PASSWORD} letmein`);
+    });
+    it("reports how many credentials it holds, never what they are", async () => {
+        const { socketPath } = await start();
+        await scrubViaBroker("warm the cache", { socketPath });
+        const health = await get(socketPath, "/health");
+        expect(JSON.parse(health)).toEqual({ ok: true, credentials: 2 });
+        expect(health).not.toContain(VALUE);
+    });
+    it("keeps up with dozens of agents whose tool results all arrive at once", async () => {
+        // A 20-researcher run withheld 40% of its results on a 256 KB/s budget, with the broker healthy.
+        const { socketPath } = await start();
+        const result = `${"r".repeat(1024 * 1024 - 64)} ${VALUE}`;
+        const scrubbed = await Promise.all(Array.from({ length: 80 }, () => scrubViaBroker(result, { socketPath, timeoutMs: 30_000 })));
+        expect(scrubbed.every((text) => text.endsWith(" {{credential:shop}}"))).toBe(true);
+    });
+    it("answers 429 once a caller has sent more text than its byte budget allows", async () => {
+        const { socketPath } = await start({ scrubBytes: { capacity: 100, perSecond: 1 } });
+        const text = "x".repeat(60);
+        await scrubViaBroker(text, { socketPath });
+        await expect(scrubViaBroker(text, { socketPath })).rejects.toThrow("429");
+    });
+    it("returns the text unchanged when no broker is running", async () => {
+        const socketPath = join(mkdtempSync(join(tmpdir(), "broker-")), "missing.sock");
+        expect(await scrubViaBroker(`raw ${VALUE}`, { socketPath })).toBe(`raw ${VALUE}`);
+    });
+});
+//# sourceMappingURL=socket-service.test.js.map

package/dist/broker/socket-service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-service.test.js","sourceRoot":"","sources":["../../src/broker/socket-service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAE9E,MAAM,KAAK,GAAG,wBAAwB,CAAC;AACvC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnD,IAAI,OAAO,GAAyB,IAAI,CAAC;AAEzC,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACvB,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,KAAK,CAAC,MAAM,GAA6D,EAAE;IACxF,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,qBAAqB,CAAC;QAClC,gBAAgB,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC;YACd,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;YACpE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC3E,CAAC;KACL,CAAC,CAAC;IACH,OAAO,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAChE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,GAAG,CAAC,UAAkB,EAAE,IAAY;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC/D,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAErC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE1F,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,4EAA4E;QAC5E,+DAA+D;QAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAErC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,sBAAsB,aAAa,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAEhG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,aAAa,UAAU,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACrC,MAAM,cAAc,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEhD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,iGAAiG;QACjG,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAE1D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAC5F,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAE5B,MAAM,cAAc,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE3C,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAEhF,MAAM,CAAC,MAAM,cAAc,CAAC,OAAO,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/supervisor-main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=supervisor-main.d.ts.map

package/dist/broker/supervisor-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-main.d.ts","sourceRoot":"","sources":["../../src/broker/supervisor-main.ts"],"names":[],"mappings":""}

package/dist/broker/supervisor-main.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+/**
+ * `baker-credential-broker-supervisor` — what Runtime activation starts, as
+ * root: it runs `baker-credential-broker` and starts it again whenever it
+ * exits or stops answering on its socket (`superviseBroker`). Its command line
+ * names the same install as the broker's, so the activation's stop reaches both.
+ */
+import { writeFileSync } from "node:fs";
+import { request } from "node:http";
+import { fileURLToPath } from "node:url";
+import { spawnBroker } from "./broker-process.js";
+import { brokerChildEnv, parseBrokerEnv } from "./env.js";
+import { superviseBroker } from "./supervisor.js";
+const BROKER_MAIN = fileURLToPath(new URL("./main.js", import.meta.url));
+const HEALTH_TIMEOUT_MS = 2_000;
+function log(message) {
+    console.error(`[credential-broker-supervisor] ${message}`);
+}
+// Parsed only for the socket path; the broker it starts inherits this environment and parses it again.
+const parsed = parseBrokerEnv();
+if (!parsed.success) {
+    log(`invalid environment: ${parsed.error.issues.map((issue) => issue.path.join(".")).join(", ")}`);
+    process.exit(1);
+}
+const SOCKET = parsed.data.BAKER_BROKER_SOCKET;
+/**
+ * Out of the OOM killer's reach, and its brokers with it (the setting is
+ * inherited). With every process at the same score the kernel kills the
+ * biggest, and a busy broker was it: a 20-agent run filled the sandbox's 8 GB
+ * with the agent's own commands, the broker died, and the turn could read
+ * nothing more. The bridge marks the agent's commands as the ones to kill.
+ */
+try {
+    writeFileSync("/proc/self/oom_score_adj", "-1000");
+}
+catch (error) {
+    log(`could not leave the OOM killer's reach: ${error instanceof Error ? error.message : String(error)}`);
+}
+/**
+ * Its heap, capped: V8 otherwise lets garbage pile up to hundreds of MB before
+ * collecting, and memory the broker holds is memory the agent's commands lack.
+ * 40 agents scrubbing at once fit in a 64 MB heap; a 10 MB proxied body needs room too.
+ */
+const BROKER_NODE_OPTIONS = "--max-old-space-size=192";
+function healthy() {
+    return new Promise((resolve) => {
+        const req = request({ socketPath: SOCKET, path: "/health", method: "GET", timeout: HEALTH_TIMEOUT_MS }, (res) => {
+            res.resume();
+            resolve(res.statusCode === 200);
+        });
+        req.on("timeout", () => req.destroy());
+        req.on("error", () => resolve(false));
+        req.end();
+    });
+}
+const supervisor = superviseBroker({
+    start: () => spawnBroker(process.execPath, [BROKER_MAIN], brokerChildEnv(BROKER_NODE_OPTIONS), log),
+    healthy,
+    log,
+});
+let stopping = false;
+for (const signal of ["SIGTERM", "SIGINT"]) {
+    process.on(signal, () => {
+        if (stopping)
+            return;
+        stopping = true;
+        void supervisor.stop(signal).then(() => process.exit(0));
+    });
+}
+//# sourceMappingURL=supervisor-main.js.map

package/dist/broker/supervisor-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-main.js","sourceRoot":"","sources":["../../src/broker/supervisor-main.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEhC,SAAS,GAAG,CAAC,OAAe;IAC1B,OAAO,CAAC,KAAK,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,uGAAuG;AACvG,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;AAChC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACpB,GAAG,CAAC,wBAAwB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC;AAE/C;;;;;;GAMG;AACH,IAAI,CAAC;IACH,aAAa,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,GAAG,CAAC,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAEvD,SAAS,OAAO;IACd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC9G,GAAG,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG,eAAe,CAAC;IACjC,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC;IACnG,OAAO;IACP,GAAG;CACJ,CAAC,CAAC;AAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/broker/supervisor.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Keeps the credential broker running for the life of the Runtime.
+ *
+ * The bridge withholds every tool result it cannot have scrubbed, and it takes
+ * the socket file's existence to mean a broker is running. A broker that dies
+ * hard (the kernel's OOM killer, a crash) leaves that file behind, and one that
+ * hangs keeps it open; either way, without a supervisor every result is
+ * withheld until the next activation — a whole turn.
+ */
+export type BrokerExit = {
+    code: number | null;
+    signal: NodeJS.Signals | null;
+};
+export type BrokerProcess = {
+    exited: Promise<BrokerExit>;
+    kill(signal: NodeJS.Signals): void;
+};
+export declare function superviseBroker(options: {
+    start: () => BrokerProcess;
+    healthy: () => Promise<boolean>;
+    log?: (message: string) => void;
+}): {
+    stop(signal: NodeJS.Signals): Promise<BrokerExit>;
+};
+//# sourceMappingURL=supervisor.d.ts.map

package/dist/broker/supervisor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../../src/broker/supervisor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAAE,CAAC;AAChF,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;CAAE,CAAC;AAkBhG,wBAAgB,eAAe,CAAC,OAAO,EAAE;IACvC,KAAK,EAAE,MAAM,aAAa,CAAC;IAC3B,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG;IAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAuExD"}

package/dist/broker/supervisor.js

@@ -0,0 +1,88 @@
+const HEALTH_INTERVAL_MS = 5_000;
+/** Consecutive missed health checks before a live broker is taken for hung. */
+const UNHEALTHY_AFTER = 3;
+/** A broker that has never answered gets this long to start (a first start writes its CA). */
+const STARTUP_GRACE_MS = 30_000;
+/** Pauses before each restart in a row; a broker that exits as soon as it starts is retried ever more slowly, never given up on. */
+const RESTART_DELAYS_MS = [250, 1_000, 2_000, 5_000, 10_000, 30_000];
+/** A broker still running this long after the stop signal is killed. */
+const STOP_GRACE_MS = 5_000;
+/** A broker that ran this long was not crash-looping: the next restart is quick again. */
+const STABLE_AFTER_MS = 60_000;
+function describeExit(exit) {
+    return exit.signal === null ? `code ${exit.code}` : `signal ${exit.signal}`;
+}
+export function superviseBroker(options) {
+    let stopping = false;
+    let restarts = 0;
+    /** A broker that could not be spawned (ENOMEM, EAGAIN under memory pressure) is one that exited at once. */
+    function startOrFail() {
+        try {
+            return options.start();
+        }
+        catch (error) {
+            options.log?.(`could not start broker: ${error instanceof Error ? error.message : String(error)}`);
+            return { exited: Promise.resolve({ code: null, signal: null }), kill: () => undefined };
+        }
+    }
+    function run() {
+        const broker = startOrFail();
+        const startedAt = Date.now();
+        let answered = false;
+        let missed = 0;
+        let probing = false;
+        const watchdog = setInterval(() => {
+            if (probing)
+                return;
+            probing = true;
+            void options
+                .healthy()
+                .catch(() => false)
+                .then((ok) => {
+                probing = false;
+                if (ok) {
+                    answered = true;
+                    missed = 0;
+                    return;
+                }
+                if (!answered && Date.now() - startedAt < STARTUP_GRACE_MS)
+                    return;
+                missed += 1;
+                if (missed >= UNHEALTHY_AFTER) {
+                    options.log?.(`broker missed ${missed} health checks in a row; killing it`);
+                    broker.kill("SIGKILL");
+                }
+            });
+        }, HEALTH_INTERVAL_MS);
+        void broker.exited.then((exit) => {
+            clearInterval(watchdog);
+            if (stopping)
+                return;
+            const ranMs = Date.now() - startedAt;
+            if (ranMs >= STABLE_AFTER_MS)
+                restarts = 0;
+            const delay = RESTART_DELAYS_MS[Math.min(restarts, RESTART_DELAYS_MS.length - 1)];
+            restarts += 1;
+            options.log?.(`broker exited (${describeExit(exit)}) after ${Math.round(ranMs / 1000)}s; restarting in ${delay}ms`);
+            setTimeout(() => {
+                if (!stopping)
+                    current = run();
+            }, delay);
+        });
+        return broker;
+    }
+    let current = run();
+    return {
+        stop(signal) {
+            stopping = true;
+            const broker = current;
+            broker.kill(signal);
+            const escalate = setTimeout(() => {
+                options.log?.(`broker still running ${STOP_GRACE_MS}ms after ${signal}; killing it`);
+                broker.kill("SIGKILL");
+            }, STOP_GRACE_MS);
+            return broker.exited.finally(() => clearTimeout(escalate));
+        },
+    };
+}
+//# sourceMappingURL=supervisor.js.map

package/dist/broker/supervisor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../../src/broker/supervisor.ts"],"names":[],"mappings":"AAYA,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,+EAA+E;AAC/E,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,8FAA8F;AAC9F,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,oIAAoI;AACpI,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAC9E,wEAAwE;AACxE,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,0FAA0F;AAC1F,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,SAAS,YAAY,CAAC,IAAgB;IACpC,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAI/B;IACC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,4GAA4G;IAC5G,SAAS,WAAW;QAClB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,EAAE,CAAC,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,SAAS,GAAG;QACV,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,OAAO;iBACT,OAAO,EAAE;iBACT,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;iBAClB,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;gBACX,OAAO,GAAG,KAAK,CAAC;gBAChB,IAAI,EAAE,EAAE,CAAC;oBACP,QAAQ,GAAG,IAAI,CAAC;oBAChB,MAAM,GAAG,CAAC,CAAC;oBACX,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,gBAAgB;oBAAE,OAAO;gBACnE,MAAM,IAAI,CAAC,CAAC;gBACZ,IAAI,MAAM,IAAI,eAAe,EAAE,CAAC;oBAC9B,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,MAAM,qCAAqC,CAAC,CAAC;oBAC5E,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC,CAAC,CAAC;QACP,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,aAAa,CAAC,QAAQ,CAAC,CAAC;YACxB,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACrC,IAAI,KAAK,IAAI,eAAe;gBAAE,QAAQ,GAAG,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAClF,QAAQ,IAAI,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,EAAE,CACX,kBAAkB,YAAY,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,oBAAoB,KAAK,IAAI,CACrG,CAAC;YACF,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,CAAC,QAAQ;oBAAE,OAAO,GAAG,GAAG,EAAE,CAAC;YACjC,CAAC,EAAE,KAAK,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;IACpB,OAAO;QACL,IAAI,CAAC,MAAM;YACT,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,MAAM,GAAG,OAAO,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC/B,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,aAAa,YAAY,MAAM,cAAc,CAAC,CAAC;gBACrF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzB,CAAC,EAAE,aAAa,CAAC,CAAC;YAClB,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/supervisor.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=supervisor.test.d.ts.map

package/dist/broker/supervisor.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.test.d.ts","sourceRoot":"","sources":["../../src/broker/supervisor.test.ts"],"names":[],"mappings":""}

package/dist/broker/supervisor.test.js

@@ -0,0 +1,161 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { superviseBroker } from "./supervisor.js";
+function fakeBroker() {
+    const settle = [];
+    const exited = new Promise((resolve) => settle.push(resolve));
+    const resolveExit = (exit) => settle[0]?.(exit);
+    const signals = [];
+    return {
+        exited,
+        signals,
+        kill(signal) {
+            signals.push(signal);
+            resolveExit({ code: null, signal });
+        },
+        die: (exit) => resolveExit(exit),
+    };
+}
+function launcher() {
+    const started = [];
+    return {
+        started,
+        start: () => {
+            const broker = fakeBroker();
+            started.push(broker);
+            return broker;
+        },
+    };
+}
+beforeEach(() => {
+    vi.useFakeTimers();
+});
+afterEach(() => {
+    vi.useRealTimers();
+});
+describe("superviseBroker", () => {
+    it("starts a new broker when the running one is killed", async () => {
+        const brokers = launcher();
+        superviseBroker({ start: brokers.start, healthy: async () => true });
+        brokers.started[0]?.die({ code: null, signal: "SIGKILL" });
+        await vi.advanceTimersByTimeAsync(1_000);
+        expect(brokers.started).toHaveLength(2);
+    });
+    it("kills and replaces a broker that stays alive but stops answering", async () => {
+        const brokers = launcher();
+        let answering = true;
+        superviseBroker({ start: brokers.start, healthy: async () => answering });
+        await vi.advanceTimersByTimeAsync(10_000);
+        answering = false;
+        await vi.advanceTimersByTimeAsync(20_000);
+        expect(brokers.started[0]?.signals).toEqual(["SIGKILL"]);
+        expect(brokers.started).toHaveLength(2);
+    });
+    // A first start writes the broker's CA before it can answer.
+    it("gives a broker that has never answered 30 seconds to start before taking it for hung", async () => {
+        const brokers = launcher();
+        superviseBroker({ start: brokers.start, healthy: async () => false });
+        await vi.advanceTimersByTimeAsync(29_000);
+        const killedDuringStartup = [...(brokers.started[0]?.signals ?? [])];
+        await vi.advanceTimersByTimeAsync(20_000);
+        expect(killedDuringStartup).toEqual([]);
+        expect(brokers.started[0]?.signals).toEqual(["SIGKILL"]);
+    });
+    it("stops the broker and starts no other once told to stop — an activation's stop revokes its token", async () => {
+        const brokers = launcher();
+        const supervisor = superviseBroker({ start: brokers.start, healthy: async () => true });
+        await supervisor.stop("SIGTERM");
+        await vi.advanceTimersByTimeAsync(60_000);
+        expect(brokers.started).toHaveLength(1);
+        expect(brokers.started[0]?.signals).toEqual(["SIGTERM"]);
+    });
+    it("starts no broker when told to stop while waiting to restart one", async () => {
+        const brokers = launcher();
+        const supervisor = superviseBroker({ start: brokers.start, healthy: async () => true });
+        brokers.started[0]?.die({ code: 1, signal: null });
+        await vi.advanceTimersByTimeAsync(100);
+        await supervisor.stop("SIGTERM");
+        await vi.advanceTimersByTimeAsync(60_000);
+        expect(brokers.started).toHaveLength(1);
+    });
+    // A broker hung in its own shutdown would keep the supervisor, a root process, alive past its token's revocation.
+    it("kills a broker that has not stopped five seconds after being told to", async () => {
+        const signals = [];
+        let settle = () => undefined;
+        const exited = new Promise((resolve) => {
+            settle = resolve;
+        });
+        const supervisor = superviseBroker({
+            start: () => ({
+                exited,
+                kill(signal) {
+                    signals.push(signal);
+                    if (signal === "SIGKILL")
+                        settle({ code: null, signal });
+                },
+            }),
+            healthy: async () => true,
+        });
+        const stopped = supervisor.stop("SIGTERM");
+        await vi.advanceTimersByTimeAsync(5_000);
+        await expect(stopped).resolves.toEqual({ code: null, signal: "SIGKILL" });
+        expect(signals).toEqual(["SIGTERM", "SIGKILL"]);
+    });
+    it("backs off from a broker that exits as soon as it starts, and keeps trying", async () => {
+        const started = [];
+        superviseBroker({
+            start: () => {
+                const broker = fakeBroker();
+                started.push(broker);
+                broker.die({ code: 1, signal: null });
+                return broker;
+            },
+            healthy: async () => false,
+        });
+        await vi.advanceTimersByTimeAsync(120_000);
+        const afterTwoMinutes = started.length;
+        await vi.advanceTimersByTimeAsync(120_000);
+        expect(afterTwoMinutes).toBeLessThan(15);
+        expect(started.length).toBeGreaterThan(afterTwoMinutes);
+    });
+    // Memory pressure, the case the supervisor exists for, is when a spawn fails.
+    it("retries a broker that could not even be started", async () => {
+        const brokers = launcher();
+        let attempts = 0;
+        const log = [];
+        superviseBroker({
+            start: () => {
+                attempts += 1;
+                if (attempts === 1)
+                    throw new Error("spawn ENOMEM");
+                return brokers.start();
+            },
+            healthy: async () => true,
+            log: (line) => log.push(line),
+        });
+        await vi.advanceTimersByTimeAsync(1_000);
+        expect(brokers.started).toHaveLength(1);
+        expect(log[0]).toContain("spawn ENOMEM");
+    });
+    it("restarts quickly again after a broker that ran for a minute, however slow the restarts before it", async () => {
+        const brokers = launcher();
+        const log = [];
+        superviseBroker({ start: brokers.start, healthy: async () => true, log: (line) => log.push(line) });
+        for (const index of [0, 1, 2]) {
+            brokers.started[index]?.die({ code: 1, signal: null });
+            await vi.advanceTimersByTimeAsync(3_000);
+        }
+        await vi.advanceTimersByTimeAsync(60_000);
+        brokers.started[3]?.die({ code: null, signal: "SIGKILL" });
+        await vi.advanceTimersByTimeAsync(0);
+        expect(log.map((line) => line.split("restarting in ")[1])).toEqual(["250ms", "1000ms", "2000ms", "250ms"]);
+    });
+    it("logs how each broker ended and when the next one starts", async () => {
+        const brokers = launcher();
+        const log = [];
+        superviseBroker({ start: brokers.start, healthy: async () => true, log: (line) => log.push(line) });
+        brokers.started[0]?.die({ code: null, signal: "SIGKILL" });
+        await vi.advanceTimersByTimeAsync(1_000);
+        expect(log).toEqual(["broker exited (signal SIGKILL) after 0s; restarting in 250ms"]);
+    });
+});
+//# sourceMappingURL=supervisor.test.js.map

package/dist/broker/supervisor.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor.test.js","sourceRoot":"","sources":["../../src/broker/supervisor.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAuC,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAIvF,SAAS,UAAU;IACjB,MAAM,MAAM,GAAmC,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,MAAM,WAAW,GAAG,CAAC,IAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,OAAO;QACL,MAAM;QACN,OAAO;QACP,IAAI,CAAC,MAAM;YACT,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,OAAO;QACL,OAAO;QACP,KAAK,EAAE,GAAG,EAAE;YACV,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAErE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAEzC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAE1C,SAAS,GAAG,KAAK,CAAC;QAClB,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAE1C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,6DAA6D;IAC7D,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAEtE,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,mBAAmB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAE1C,MAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAExF,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAE1C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAEvC,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAE1C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,kHAAkH;IAClH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,IAAI,MAAM,GAA+B,GAAG,EAAE,CAAC,SAAS,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YACjD,MAAM,GAAG,OAAO,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,eAAe,CAAC;YACjC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACZ,MAAM;gBACN,IAAI,CAAC,MAAM;oBACT,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACrB,IAAI,MAAM,KAAK,SAAS;wBAAE,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC3D,CAAC;aACF,CAAC;YACF,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;SAC1B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAEzC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,eAAe,CAAC;YACd,KAAK,EAAE,GAAG,EAAE;gBACV,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;SAC3B,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;QACvC,MAAM,EAAE,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,eAAe,CAAC;YACd,KAAK,EAAE,GAAG,EAAE;gBACV,QAAQ,IAAI,CAAC,CAAC;gBACd,IAAI,QAAQ,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;gBACpD,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC;YACzB,CAAC;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;YACzB,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;SAC9B,CAAC,CAAC;QAEH,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAEzC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;QAChH,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEpG,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,EAAE,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC;QAErC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEpG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAEzC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,8DAA8D,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/token-bucket.d.ts

@@ -0,0 +1,9 @@
+/** A token bucket: up to `burst` tokens at once, refilled at `ratePerSecond`; a take may cost more than one. */
+export declare function createTokenBucket(options: {
+    ratePerSecond: number;
+    burst: number;
+    now?: () => number;
+}): {
+    take(cost?: number): boolean;
+};
+//# sourceMappingURL=token-bucket.d.ts.map

package/dist/broker/token-bucket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-bucket.d.ts","sourceRoot":"","sources":["../../src/broker/token-bucket.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;IAKnG,IAAI,iBAAY,OAAO;EAS1B"}