@koda-sl/baker-bridge 0.118.0-dev.4a0a40cc5 → 0.118.0-dev.fc1af4da8

package/README.md

@@ -51,10 +51,27 @@ await server.start();
 | `NO_COLOR` | Set to `1` on every Agent SDK subprocess so `baker --help` output carries no ANSI escapes — see [Session surface](#session-surface) |
 | `BAKER_AGENT_MODEL` | Optional. Runs every turn in this runtime on the named model instead of the default, and is forwarded to subagents as `CLAUDE_CODE_SUBAGENT_MODEL`. Ignored unless it names a model with a known context window — see [Model selection](#model-selection) |
 | `CLAUDE_CODE_SUBAGENT_MODEL`, `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` | Set on the Agent SDK subprocess only when `BAKER_AGENT_MODEL` is set. Together they override the `model:` each subagent pins in its own frontmatter |
+| `BAKER_CREDENTIALS` | Set to `1` in a Runtime with Credentials (the credential broker is running). Only then is `request_credential` offered to the agent; otherwise a call to it is refused |
 | `LATITUDE_API_KEY` / `LATITUDE_PROJECT` | Optional, both or neither. When set, every turn is traced to that Latitude project — see [Latitude tracing](#latitude-tracing) |
 
 All variables are validated at startup via `@t3-oss/env-core` + `zod`.
 
+## Credential broker (`baker-credential-broker`)
+
+A second bin, run as root in the sandbox before the agent starts, so the agent can use the user's stored credentials without ever seeing them. The agent writes `{{credential:NAME}}` in a request; the broker is an HTTP(S) proxy on `127.0.0.1` that swaps in the real value and swaps it back out of the response.
+
+| Variable | Description |
+|---|---|
+| `CREDENTIAL_BROKER_TOKEN` | Required. Authenticates the broker to Baker's credential routes |
+| `BAKER_CONVEX_SITE_URL` | Required. Baker's site URL |
+| `BAKER_CREDENTIAL_PROXY_PORT` | Proxy port (default `8877`) |
+| `BAKER_CA_DIR` | Where the broker's CA key (0600) and cert live (default `/etc/baker-ca`); run as root it also installs the cert into the system bundle |
+| `BAKER_BROKER_SOCKET` | Unix socket for the bridge (default `/run/baker/broker.sock`): `POST /scrub`, `GET /health` |
+
+The agent's processes get `agentProxyEnv()`: `HTTP(S)_PROXY` pointing at the broker, `NO_PROXY` for loopback plus the model gateway, `NODE_USE_ENV_PROXY=1`, `NODE_EXTRA_CA_CERTS` set to the broker's CA, and `REQUESTS_CA_BUNDLE` / `SSL_CERT_FILE` / `CURL_CA_BUNDLE` set to the system bundle.
+
+Security model: a value is only substituted over https, and only for a host the user allowed for that credential. A placeholder in the URL or a header that is not allowed for the host, or that names no stored credential, is refused (403 / 404, or 503 while credentials can't be fetched) before anything leaves the sandbox. A placeholder that appears only in the body is left as plain text unless it names a credential allowed for that host. Response headers and text bodies up to 10 MB are scrubbed back to placeholders; those responses arrive buffered rather than streamed. The socket never returns a value.
+
 ## Session surface
 
 The Agent SDK ships developer-facing surfaces a marketer's session can never
@@ -278,8 +295,6 @@ Its second tool, `request_flow_input`, is the **blocking form-configuration form
 
 Its third tool, `request_connection`, is the **blocking connection request**: the agent invokes it when a data platform the task needs — Google Ads, LinkedIn Ads, Meta Ads, X Ads, Google Analytics 4, Google Search Console, or Google Tag Manager — is not connected yet, instead of telling the user to go to Settings. Same `canUseTool` park pattern: the bridge POSTs `/api/chat/connection-input-request`, the dashboard renders one tab per platform with the OAuth connect button and the account/property/site/container picker, and on submit Convex delivers the outcome to `POST /connection-input-decision`. Nothing confidential passes through the bridge or the model: the dashboard writes the selection onto the company's connection, and the resolution carries only `{ status, platform, accountLabel?, selected[] }`. A Google Drive tab may add `choose: "media-folder"` (kept only on Google Drive): the user picks a folder that Baker imports as a media source, and the connected result also carries its `mediaSourceKey`. Live wait matches `AskUserQuestion` (15 min).
 
-The same card adds tools. A `{ server: { name, url, auth?, keyHeader?, scope? } }` entry opens a remote MCP server filled in from the user's instructions (`auth`: `none` \| `key` \| `sign-in`; the key is typed into the card, never into the chat), and an `{ app }` entry connects a managed app from `baker mcp catalog` — the fallback for a vendor with no server of its own. When an app or server comes through, the bridge fetches the turn's MCP servers afresh (`McpServersProvider` with `{ fresh: true }`) and loads them into the running query with `setMcpServers` — `baker_ui` included, since the SDK drops any in-process server left out — before the tool answers, and adds `toolsReady` to the resolution. The provider keeps that set for the next turn, so the tool list changes once. A platform-only resolution never reloads.
-
 Its fourth tool, `request_avatar_casting`, is the **blocking face picker**: an avatar invented from a description gets several casting portraits rendered, the user picks one in the dashboard, and the identity sheet every later render grounds on is fused from that one. Same `canUseTool` park pattern — the bridge POSTs `/api/chat/avatar-casting-request`, Convex renders the candidates and parks the thread, and the pick is delivered to `POST /avatar-casting-decision` as `{ status: "cast", avatarHandle, imageId }` or `{ status: "declined", avatarHandle, reason? }`.
 
 It is also the one blocking tool the bridge opens **on its own**. The agent forgot to call it in every recorded run, in a new way each time, so the trigger is the EVENT rather than the prose around it: a `baker avatars create` for a synthetic avatar registers a pending casting, and it opens before whatever the agent does next. The create is read off the **assistant message** as well as off `canUseTool`, because `canUseTool` is raised only for the ask path and the scaffold allows `Bash(baker:*)` — so every create the product actually runs bypassed the permission callback entirely, and the avatar sat in `generating` with no portraits and no sheet while the agent reported the picker was open. When the create is the turn's last tool call there is no next call to open it before, so the request is posted at turn end and the thread parks on it. An unattended Session has nobody to ask, so the create is rewritten to `--face auto` instead and nothing is left pending — the flag is inserted right after `avatars create` rather than appended, so a piped or redirected command does not hand it to the next program, and an explicit `--face ask` is replaced rather than joined.

package/dist/broker/baker-api.d.ts

@@ -0,0 +1,14 @@
+import type { ResolvedCredential } from "./credential-text.ts";
+export type CredentialUse = {
+    name: string;
+    host: string;
+};
+export type BakerBrokerApi = {
+    fetchCredentials(): Promise<ResolvedCredential[]>;
+    reportUsage(uses: CredentialUse[]): Promise<void>;
+};
+export declare function createBakerBrokerApi(options: {
+    siteUrl: string;
+    token: string;
+}): BakerBrokerApi;
+//# sourceMappingURL=baker-api.d.ts.map

package/dist/broker/baker-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baker-api.d.ts","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAS/D,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClD,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD,CAAC;AAIF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAyBhG"}

package/dist/broker/baker-api.js

@@ -0,0 +1,41 @@
+/**
+ * The broker's two calls to Baker: fetch the company's credentials (the only
+ * route that ever returns a value) and report which were used where. The
+ * shapes mirror `brokerResolveResponseSchema` / `brokerUsageRequestSchema` in
+ * `@baker/api/credentials`, which the published bridge cannot import.
+ * Success is `{ ok: true, data }`; a failure is any non-2xx status with
+ * `{ code, error }`.
+ */
+import { z } from "zod";
+const resolveResponseSchema = z.object({
+    credentials: z.array(z.object({ name: z.string(), value: z.string(), allowedHosts: z.array(z.string()) })),
+});
+const successSchema = z.object({ ok: z.literal(true), data: z.unknown().optional() });
+const failureSchema = z.object({ code: z.string() });
+const TIMEOUT_MS = 10_000;
+export function createBakerBrokerApi(options) {
+    async function post(path, body) {
+        const response = await fetch(new URL(path, options.siteUrl), {
+            method: "POST",
+            headers: { authorization: `Broker ${options.token}`, "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        const payload = await response.json().catch(() => null);
+        if (!response.ok) {
+            const code = failureSchema.safeParse(payload).data?.code ?? "UNKNOWN";
+            throw new Error(`${path} answered ${response.status} ${code}`);
+        }
+        return successSchema.parse(payload).data;
+    }
+    return {
+        async fetchCredentials() {
+            const data = resolveResponseSchema.parse(await post("/api/runtime/credentials/resolve", {}));
+            return data.credentials;
+        },
+        async reportUsage(uses) {
+            await post("/api/runtime/credentials/usage", { uses });
+        },
+    };
+}
+//# sourceMappingURL=baker-api.js.map

package/dist/broker/baker-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baker-api.js","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;CAC3G,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AASrD,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAAC,OAA2C;IAC9E,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAa;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB;YACpB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI;YACpB,MAAM,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/broker-client.d.ts

@@ -0,0 +1,10 @@
+export declare const DEFAULT_BROKER_SOCKET = "/run/baker/broker.sock";
+export type BrokerClientOptions = {
+    socketPath?: string;
+    timeoutMs?: number;
+};
+/** Whether a broker runs in this sandbox: its socket exists. */
+export declare function brokerRunning(options?: BrokerClientOptions): boolean;
+/** `text` with every stored credential value replaced by its placeholder. */
+export declare function scrubViaBroker(text: string, options?: BrokerClientOptions): Promise<string>;
+//# sourceMappingURL=broker-client.d.ts.map

package/dist/broker/broker-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-client.d.ts","sourceRoot":"","sources":["../../src/broker/broker-client.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAG9D,MAAM,MAAM,mBAAmB,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAM9E,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAExE;AA+BD,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrG"}

package/dist/broker/broker-client.js

@@ -0,0 +1,60 @@
+/**
+ * The bridge's side of the broker socket. Dependency-free on purpose: the
+ * bridge imports it on the hot path of every tool result.
+ *
+ * When no broker runs (no socket file — local dev, or a Runtime without
+ * credentials) every call is a fast no-op and `scrubViaBroker` returns the
+ * text unchanged. Any other failure (timeout, 413, 429, a crashed broker) is
+ * thrown so the caller decides whether to hold the text back.
+ */
+import { existsSync } from "node:fs";
+import { request } from "node:http";
+export const DEFAULT_BROKER_SOCKET = "/run/baker/broker.sock";
+const DEFAULT_TIMEOUT_MS = 2_000;
+function isMissingSocket(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+/** Whether a broker runs in this sandbox: its socket exists. */
+export function brokerRunning(options = {}) {
+    return existsSync(options.socketPath ?? DEFAULT_BROKER_SOCKET);
+}
+function call(path, body, options) {
+    const socketPath = options.socketPath ?? DEFAULT_BROKER_SOCKET;
+    if (!brokerRunning(options))
+        return Promise.resolve(null);
+    return new Promise((resolve, reject) => {
+        const req = request({
+            socketPath,
+            path,
+            method: "POST",
+            headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) },
+            timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => {
+                const text = Buffer.concat(chunks).toString("utf8");
+                if (res.statusCode === 200)
+                    resolve(text);
+                else
+                    reject(new Error(`credential broker ${path} answered ${res.statusCode}`));
+            });
+            res.on("error", reject);
+        });
+        req.on("timeout", () => req.destroy(new Error(`credential broker ${path} timed out`)));
+        req.on("error", (error) => (isMissingSocket(error) ? resolve(null) : reject(error)));
+        req.end(body);
+    });
+}
+/** `text` with every stored credential value replaced by its placeholder. */
+export async function scrubViaBroker(text, options = {}) {
+    const response = await call("/scrub", JSON.stringify({ text }), options);
+    if (response === null)
+        return text;
+    const parsed = JSON.parse(response);
+    if (typeof parsed === "object" && parsed !== null && "text" in parsed && typeof parsed.text === "string") {
+        return parsed.text;
+    }
+    throw new Error("credential broker /scrub answered without text");
+}
+//# sourceMappingURL=broker-client.js.map

package/dist/broker/broker-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-client.js","sourceRoot":"","sources":["../../src/broker/broker-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAC9D,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAIjC,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,OAAO,GAAwB,EAAE;IAC7D,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY,EAAE,OAA4B;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CACjB;YACE,UAAU;YACV,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YAC1F,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;SACjD,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;;oBACrC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,aAAa,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;QACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,OAAO,GAAwB,EAAE;IAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzG,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC"}

package/dist/broker/ca.d.ts

@@ -0,0 +1,30 @@
+export declare const DEFAULT_CA_DIR = "/etc/baker-ca";
+export declare const SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+export type CertificateAuthority = {
+    keyPath: string;
+    certPath: string;
+    key: string;
+    cert: string;
+};
+/**
+ * Env for every process the agent runs. `NODE_EXTRA_CA_CERTS` adds our CA to
+ * Node's roots; the other three *replace* a client's bundle, so they name the
+ * system bundle, which carries our CA once `update-ca-certificates` ran.
+ */
+export declare function agentProxyEnv(options: {
+    port: number;
+    caCertPath: string;
+    /** Hosts that bypass the broker entirely, e.g. the model gateway carrying the agent's own conversation. */
+    noProxyHosts: readonly string[];
+}): Record<string, string>;
+/**
+ * Reuses the CA in `dir`, or creates one (key 0600, cert 0644). With
+ * `installSystemTrust`, also adds the cert to the system bundle — needs root;
+ * a failure is logged, not thrown, so the proxy still starts.
+ */
+export declare function ensureCertificateAuthority(options: {
+    dir?: string;
+    installSystemTrust: boolean;
+    log?: (message: string) => void;
+}): Promise<CertificateAuthority>;
+//# sourceMappingURL=ca.d.ts.map

package/dist/broker/ca.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAC9C,eAAO,MAAM,gBAAgB,uCAAuC,CAAC;AAKrE,MAAM,MAAM,oBAAoB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBzB;AASD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAahC"}

package/dist/broker/ca.js

@@ -0,0 +1,69 @@
+/**
+ * The broker's certificate authority — what lets it read HTTPS the agent sends
+ * through it — and the environment that points the agent's clients at it.
+ */
+import { execFile } from "node:child_process";
+import { copyFile, mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { generateCACertificate } from "mockttp";
+export const DEFAULT_CA_DIR = "/etc/baker-ca";
+export const SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+/** By absolute path: the broker runs as root and must never resolve a binary through PATH. */
+const UPDATE_CA_CERTIFICATES = "/usr/sbin/update-ca-certificates";
+const SYSTEM_TRUST_PATH = "/usr/local/share/ca-certificates/baker-credential-broker.crt";
+/**
+ * Env for every process the agent runs. `NODE_EXTRA_CA_CERTS` adds our CA to
+ * Node's roots; the other three *replace* a client's bundle, so they name the
+ * system bundle, which carries our CA once `update-ca-certificates` ran.
+ */
+export function agentProxyEnv(options) {
+    const proxy = `http://127.0.0.1:${options.port}`;
+    const noProxy = ["localhost", "127.0.0.1", "::1", ...options.noProxyHosts].join(",");
+    return {
+        HTTPS_PROXY: proxy,
+        HTTP_PROXY: proxy,
+        https_proxy: proxy,
+        http_proxy: proxy,
+        NO_PROXY: noProxy,
+        no_proxy: noProxy,
+        NODE_USE_ENV_PROXY: "1",
+        NODE_EXTRA_CA_CERTS: options.caCertPath,
+        REQUESTS_CA_BUNDLE: SYSTEM_CA_BUNDLE,
+        SSL_CERT_FILE: SYSTEM_CA_BUNDLE,
+        CURL_CA_BUNDLE: SYSTEM_CA_BUNDLE,
+    };
+}
+function exists(path) {
+    return stat(path).then(() => true, () => false);
+}
+/**
+ * Reuses the CA in `dir`, or creates one (key 0600, cert 0644). With
+ * `installSystemTrust`, also adds the cert to the system bundle — needs root;
+ * a failure is logged, not thrown, so the proxy still starts.
+ */
+export async function ensureCertificateAuthority(options) {
+    const dir = options.dir ?? DEFAULT_CA_DIR;
+    const keyPath = join(dir, "ca.key");
+    const certPath = join(dir, "ca.pem");
+    if (!(await exists(keyPath)) || !(await exists(certPath))) {
+        const ca = await generateCACertificate({ subject: { commonName: "Baker Credential Broker" }, bits: 2048 });
+        await mkdir(dir, { recursive: true, mode: 0o755 });
+        await writeFile(keyPath, ca.key, { mode: 0o600 });
+        await writeFile(certPath, ca.cert, { mode: 0o644 });
+        options.log?.(`created certificate authority in ${dir}`);
+    }
+    if (options.installSystemTrust)
+        await installSystemTrust(certPath, options.log);
+    return { keyPath, certPath, key: await readFile(keyPath, "utf8"), cert: await readFile(certPath, "utf8") };
+}
+async function installSystemTrust(certPath, log) {
+    try {
+        await copyFile(certPath, SYSTEM_TRUST_PATH);
+        await promisify(execFile)(UPDATE_CA_CERTIFICATES);
+    }
+    catch (error) {
+        log?.(`could not add the certificate authority to the system bundle: ${String(error)}`);
+    }
+}
+//# sourceMappingURL=ca.js.map

package/dist/broker/ca.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.js","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AACrE,8FAA8F;AAC9F,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AAIzF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAK7B;IACC,MAAM,KAAK,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,OAAO;QACjB,kBAAkB,EAAE,GAAG;QACvB,mBAAmB,EAAE,OAAO,CAAC,UAAU;QACvC,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,gBAAgB;QAC/B,cAAc,EAAE,gBAAgB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAIhD;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,GAA+B;IACjF,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,CAAC,iEAAiE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/broker/ca.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ca.test.d.ts.map

package/dist/broker/ca.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.test.d.ts","sourceRoot":"","sources":["../../src/broker/ca.test.ts"],"names":[],"mappings":""}

package/dist/broker/ca.test.js

@@ -0,0 +1,42 @@
+import { mkdtempSync, readFileSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { agentProxyEnv, ensureCertificateAuthority } from "./ca.js";
+describe("agentProxyEnv", () => {
+    it("routes every client through the broker and trusts its CA without dropping the system roots", () => {
+        const env = agentProxyEnv({ port: 8877, caCertPath: "/etc/baker-ca/ca.pem", noProxyHosts: [] });
+        expect(env).toEqual({
+            HTTPS_PROXY: "http://127.0.0.1:8877",
+            HTTP_PROXY: "http://127.0.0.1:8877",
+            https_proxy: "http://127.0.0.1:8877",
+            http_proxy: "http://127.0.0.1:8877",
+            NO_PROXY: "localhost,127.0.0.1,::1",
+            no_proxy: "localhost,127.0.0.1,::1",
+            NODE_USE_ENV_PROXY: "1",
+            NODE_EXTRA_CA_CERTS: "/etc/baker-ca/ca.pem",
+            REQUESTS_CA_BUNDLE: "/etc/ssl/certs/ca-certificates.crt",
+            SSL_CERT_FILE: "/etc/ssl/certs/ca-certificates.crt",
+            CURL_CA_BUNDLE: "/etc/ssl/certs/ca-certificates.crt",
+        });
+    });
+    it("keeps the named hosts off the broker, so the agent's own model traffic is never rewritten", () => {
+        const env = agentProxyEnv({ port: 8877, caCertPath: "/etc/baker-ca/ca.pem", noProxyHosts: ["openrouter.ai"] });
+        expect([env.NO_PROXY, env.no_proxy]).toEqual([
+            "localhost,127.0.0.1,::1,openrouter.ai",
+            "localhost,127.0.0.1,::1,openrouter.ai",
+        ]);
+    });
+});
+describe("ensureCertificateAuthority", () => {
+    it("creates a private key once and reuses it on the next start", async () => {
+        const dir = join(mkdtempSync(join(tmpdir(), "baker-ca-")), "ca");
+        const first = await ensureCertificateAuthority({ dir, installSystemTrust: false });
+        const second = await ensureCertificateAuthority({ dir, installSystemTrust: false });
+        expect(second).toEqual(first);
+        expect(statSync(first.keyPath).mode & 0o777).toBe(0o600);
+        expect(statSync(first.certPath).mode & 0o777).toBe(0o644);
+        expect(readFileSync(first.certPath, "utf8")).toContain("BEGIN CERTIFICATE");
+    });
+});
+//# sourceMappingURL=ca.test.js.map

package/dist/broker/ca.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.test.js","sourceRoot":"","sources":["../../src/broker/ca.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAEpE,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,kBAAkB,EAAE,GAAG;YACvB,mBAAmB,EAAE,sBAAsB;YAC3C,kBAAkB,EAAE,oCAAoC;YACxD,aAAa,EAAE,oCAAoC;YACnD,cAAc,EAAE,oCAAoC;SACrD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAE/G,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,uCAAuC;YACvC,uCAAuC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/credential-cache.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The broker's copy of the company's credentials, fetched from Baker on first
+ * need and kept for 10 seconds. Concurrent reads share one fetch. A failed
+ * fetch keeps the last good table until the next refresh; before any fetch
+ * has succeeded there is no table (null), which callers must treat as
+ * "credentials unavailable", not "no credentials".
+ */
+import type { ResolvedCredential } from "./credential-text.ts";
+export declare const CREDENTIAL_TTL_MS = 10000;
+/** Each fetch decrypts every credential the company has; a refusal loop may force one this often at most. */
+export declare const MIN_REFRESH_INTERVAL_MS = 5000;
+export type FetchCredentials = () => Promise<ResolvedCredential[]>;
+export type CredentialCache = {
+    get(): Promise<ResolvedCredential[] | null>;
+    /**
+     * Drops the table so the next read fetches it again — unless an early
+     * refresh already happened within 5 seconds. Returns whether it dropped it.
+     */
+    refresh(): boolean;
+    /** How many credentials the last fetch returned (0 before the first). */
+    size(): number;
+};
+export declare function createCredentialCache(options: {
+    fetchCredentials: FetchCredentials;
+    now?: () => number;
+    ttlMs?: number;
+    log?: (message: string) => void;
+}): CredentialCache;
+//# sourceMappingURL=credential-cache.d.ts.map

package/dist/broker/credential-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cache.d.ts","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,iBAAiB,QAAS,CAAC;AACxC,6GAA6G;AAC7G,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,IAAI,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC;IACnB,yEAAyE;IACzE,IAAI,IAAI,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,eAAe,CAiClB"}

package/dist/broker/credential-cache.js

@@ -0,0 +1,36 @@
+export const CREDENTIAL_TTL_MS = 10_000;
+/** Each fetch decrypts every credential the company has; a refusal loop may force one this often at most. */
+export const MIN_REFRESH_INTERVAL_MS = 5_000;
+export function createCredentialCache(options) {
+    const now = options.now ?? Date.now;
+    const ttlMs = options.ttlMs ?? CREDENTIAL_TTL_MS;
+    let entry = null;
+    let lastGood = null;
+    let lastRefreshAt = Number.NEGATIVE_INFINITY;
+    return {
+        get() {
+            if (entry === null || now() - entry.at >= ttlMs) {
+                const table = options.fetchCredentials().then((credentials) => {
+                    lastGood = credentials;
+                    return credentials;
+                }, (error) => {
+                    options.log?.(`credential fetch failed, keeping ${lastGood?.length ?? 0} cached: ${String(error)}`);
+                    return lastGood;
+                });
+                entry = { at: now(), table };
+            }
+            return entry.table;
+        },
+        refresh() {
+            if (now() - lastRefreshAt < MIN_REFRESH_INTERVAL_MS)
+                return false;
+            lastRefreshAt = now();
+            entry = null;
+            return true;
+        },
+        size() {
+            return lastGood?.length ?? 0;
+        },
+    };
+}
+//# sourceMappingURL=credential-cache.js.map

package/dist/broker/credential-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cache.js","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAe7C,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IACjD,IAAI,KAAK,GAAuE,IAAI,CAAC;IACrF,IAAI,QAAQ,GAAgC,IAAI,CAAC;IACjD,IAAI,aAAa,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC7C,OAAO;QACL,GAAG;YACD,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAC3C,CAAC,WAAW,EAAE,EAAE;oBACd,QAAQ,GAAG,WAAW,CAAC;oBACvB,OAAO,WAAW,CAAC;gBACrB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;oBACjB,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,QAAQ,EAAE,MAAM,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpG,OAAO,QAAQ,CAAC;gBAClB,CAAC,CACF,CAAC;gBACF,KAAK,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,OAAO;YACL,IAAI,GAAG,EAAE,GAAG,aAAa,GAAG,uBAAuB;gBAAE,OAAO,KAAK,CAAC;YAClE,aAAa,GAAG,GAAG,EAAE,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI;YACF,OAAO,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/credential-cache.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credential-cache.test.d.ts.map

package/dist/broker/credential-cache.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cache.test.d.ts","sourceRoot":"","sources":["../../src/broker/credential-cache.test.ts"],"names":[],"mappings":""}

package/dist/broker/credential-cache.test.js

@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+import { createCredentialCache } from "./credential-cache.js";
+function fetcher() {
+    let calls = 0;
+    return {
+        get calls() {
+            return calls;
+        },
+        fetchCredentials: async () => {
+            await Promise.resolve();
+            calls += 1;
+            return [{ name: `v${calls}`, value: "secret-value", allowedHosts: ["api.example.com"] }];
+        },
+    };
+}
+describe("createCredentialCache", () => {
+    it("reuses the table for 10 seconds, then fetches it again", async () => {
+        let clock = 0;
+        const source = fetcher();
+        const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => clock });
+        await cache.get();
+        clock = 9_999;
+        await cache.get();
+        clock = 10_000;
+        const table = await cache.get();
+        expect(source.calls).toBe(2);
+        expect(table?.map((credential) => credential.name)).toEqual(["v2"]);
+    });
+    it("keeps the last good table when a refresh fails, and has none when no fetch ever succeeded", async () => {
+        let clock = 0;
+        let failing = true;
+        const cache = createCredentialCache({
+            fetchCredentials: async () => {
+                await Promise.resolve();
+                if (failing)
+                    throw new Error("401 UNAUTHORIZED");
+                return [{ name: "shop", value: "secret-value", allowedHosts: ["api.example.com"] }];
+            },
+            now: () => clock,
+        });
+        expect(await cache.get()).toBeNull();
+        failing = false;
+        clock = 10_000;
+        await cache.get();
+        failing = true;
+        clock = 20_000;
+        expect((await cache.get())?.map((credential) => credential.name)).toEqual(["shop"]);
+    });
+    it("fetches again on the next read after a refresh", async () => {
+        const source = fetcher();
+        const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => 0 });
+        await cache.get();
+        cache.refresh();
+        await cache.get();
+        expect(source.calls).toBe(2);
+    });
+    it("refreshes early at most once every 5 seconds, so refused retries cannot make it fetch on every request", async () => {
+        let clock = 0;
+        const source = fetcher();
+        const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => clock });
+        await cache.get();
+        const refreshed = [];
+        for (clock = 0; clock < 5_000; clock += 500) {
+            refreshed.push(cache.refresh());
+            await cache.get();
+        }
+        clock = 5_000;
+        refreshed.push(cache.refresh());
+        await cache.get();
+        expect(refreshed.filter(Boolean)).toHaveLength(2);
+        expect(source.calls).toBe(3);
+    });
+});
+//# sourceMappingURL=credential-cache.test.js.map

package/dist/broker/credential-cache.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cache.test.js","sourceRoot":"","sources":["../../src/broker/credential-cache.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS,OAAO;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACjD,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QAEf,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAEjG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACrG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC;YAC5C,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,GAAG,KAAK,CAAC;QACd,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/credential-text.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Hand-copy of the placeholder grammar, host check and scrub in
+ * `packages/api/src/credentials/{placeholder,hosts,scrub}.ts`. The bridge is
+ * published standalone to npm and cannot depend on the private `@baker/api`,
+ * so these are copied rather than imported; `credential-text.test.ts` runs both
+ * copies over the same inputs and fails when this one drifts.
+ */
+export type CredentialPlaceholder = {
+    name: string;
+    start: number;
+    end: number;
+};
+export type ResolvedCredential = {
+    name: string;
+    value: string;
+    allowedHosts: readonly string[];
+};
+export type ScrubbableCredential = {
+    name: string;
+    value: string;
+};
+export type Substitution = {
+    out: string;
+    used: string[];
+    denied: {
+        name: string;
+        allowedHosts: readonly string[];
+    }[];
+    unknown: string[];
+};
+/** Below this length a value is too likely to occur in unrelated text to be scrubbed. */
+export declare const MIN_SCRUB_LENGTH = 6;
+export declare function renderPlaceholder(name: string): string;
+export declare function parsePlaceholders(text: string): CredentialPlaceholder[];
+/** The credential a value stands for when the whole value is one placeholder, as a tag's secret field holds it. */
+export declare function credentialNamedBy(value: string): string | null;
+export declare function hostAllowed(host: string, patterns: readonly string[]): boolean;
+export declare function substitute(text: string, credentials: readonly ResolvedCredential[], host: string): Substitution;
+/** Every form of a credential a scrub must catch, longest first, so a longer value is never half-replaced by a shorter one. */
+export declare function scrubPatterns(credentials: readonly ScrubbableCredential[]): {
+    needle: string;
+    name: string;
+}[];
+export declare function scrub(text: string, credentials: readonly ScrubbableCredential[]): string;
+//# sourceMappingURL=credential-text.d.ts.map

package/dist/broker/credential-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-text.d.ts","sourceRoot":"","sources":["../../src/broker/credential-text.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,MAAM,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AACjF,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAClG,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,EAAE,CAMvE;AAID,mHAAmH;AACnH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE9D;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM9E;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CA4B/G;AAoBD,+HAA+H;AAC/H,wBAAgB,aAAa,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAK9G;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAMxF"}