@koda-sl/baker-bridge 0.118.0-dev.fc1af4da8 → 0.118.0

package/README.md

@@ -295,6 +295,8 @@ Its second tool, `request_flow_input`, is the **blocking form-configuration form
 
 Its third tool, `request_connection`, is the **blocking connection request**: the agent invokes it when a data platform the task needs — Google Ads, LinkedIn Ads, Meta Ads, X Ads, Google Analytics 4, Google Search Console, or Google Tag Manager — is not connected yet, instead of telling the user to go to Settings. Same `canUseTool` park pattern: the bridge POSTs `/api/chat/connection-input-request`, the dashboard renders one tab per platform with the OAuth connect button and the account/property/site/container picker, and on submit Convex delivers the outcome to `POST /connection-input-decision`. Nothing confidential passes through the bridge or the model: the dashboard writes the selection onto the company's connection, and the resolution carries only `{ status, platform, accountLabel?, selected[] }`. A Google Drive tab may add `choose: "media-folder"` (kept only on Google Drive): the user picks a folder that Baker imports as a media source, and the connected result also carries its `mediaSourceKey`. Live wait matches `AskUserQuestion` (15 min).
 
+The same card adds tools. A `{ server: { name, url, auth?, keyHeader?, scope? } }` entry opens a remote MCP server filled in from the user's instructions (`auth`: `none` \| `key` \| `sign-in`; the key is typed into the card, never into the chat), and an `{ app }` entry connects a managed app from `baker mcp catalog` — the fallback for a vendor with no server of its own. When an app or server comes through, the bridge fetches the turn's MCP servers afresh (`McpServersProvider` with `{ fresh: true }`) and loads them into the running query with `setMcpServers` — `baker_ui` included, since the SDK drops any in-process server left out — before the tool answers, and adds `toolsReady` to the resolution. The provider keeps that set for the next turn, so the tool list changes once. A platform-only resolution never reloads.
+
 Its fourth tool, `request_avatar_casting`, is the **blocking face picker**: an avatar invented from a description gets several casting portraits rendered, the user picks one in the dashboard, and the identity sheet every later render grounds on is fused from that one. Same `canUseTool` park pattern — the bridge POSTs `/api/chat/avatar-casting-request`, Convex renders the candidates and parks the thread, and the pick is delivered to `POST /avatar-casting-decision` as `{ status: "cast", avatarHandle, imageId }` or `{ status: "declined", avatarHandle, reason? }`.
 
 It is also the one blocking tool the bridge opens **on its own**. The agent forgot to call it in every recorded run, in a new way each time, so the trigger is the EVENT rather than the prose around it: a `baker avatars create` for a synthetic avatar registers a pending casting, and it opens before whatever the agent does next. The create is read off the **assistant message** as well as off `canUseTool`, because `canUseTool` is raised only for the ask path and the scaffold allows `Bash(baker:*)` — so every create the product actually runs bypassed the permission callback entirely, and the avatar sat in `generating` with no portraits and no sheet while the agent reported the picker was open. When the create is the turn's last tool call there is no next call to open it before, so the request is posted at turn end and the thread parks on it. An unattended Session has nobody to ask, so the create is rewritten to `--face auto` instead and nothing is left pending — the flag is inserted right after `avatars create` rather than appended, so a piped or redirected command does not hand it to the next program, and an explicit `--face ask` is replaced rather than joined.

package/dist/broker/baker-api.d.ts

@@ -3,6 +3,15 @@ export type CredentialUse = {
     name: string;
     host: string;
 };
+/**
+ * Baker refused the broker's token: Credentials were switched off, the company
+ * suspended, or the Runtime is no longer active. Unlike a failed request, this
+ * is an answer — the broker must stop using what it holds.
+ */
+export declare class CredentialsRefused extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
 export type BakerBrokerApi = {
     fetchCredentials(): Promise<ResolvedCredential[]>;
     reportUsage(uses: CredentialUse[]): Promise<void>;

package/dist/broker/baker-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"baker-api.d.ts","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAS/D,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClD,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD,CAAC;AAIF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAyBhG"}
+{"version":3,"file":"baker-api.d.ts","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAS/D,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAnC,YAAqB,MAAM,EAAE,MAAM,EAElC;CACF;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClD,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD,CAAC;AAIF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CA0BhG"}

package/dist/broker/baker-api.js

@@ -12,6 +12,18 @@ const resolveResponseSchema = z.object({
 });
 const successSchema = z.object({ ok: z.literal(true), data: z.unknown().optional() });
 const failureSchema = z.object({ code: z.string() });
+/**
+ * Baker refused the broker's token: Credentials were switched off, the company
+ * suspended, or the Runtime is no longer active. Unlike a failed request, this
+ * is an answer — the broker must stop using what it holds.
+ */
+export class CredentialsRefused extends Error {
+    status;
+    constructor(status) {
+        super(`Baker refused the broker (${status})`);
+        this.status = status;
+    }
+}
 const TIMEOUT_MS = 10_000;
 export function createBakerBrokerApi(options) {
     async function post(path, body) {
@@ -22,6 +34,8 @@ export function createBakerBrokerApi(options) {
             signal: AbortSignal.timeout(TIMEOUT_MS),
         });
         const payload = await response.json().catch(() => null);
+        if (response.status === 401 || response.status === 403)
+            throw new CredentialsRefused(response.status);
         if (!response.ok) {
             const code = failureSchema.safeParse(payload).data?.code ?? "UNKNOWN";
             throw new Error(`${path} answered ${response.status} ${code}`);

package/dist/broker/baker-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"baker-api.js","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;CAC3G,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AASrD,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAAC,OAA2C;IAC9E,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAa;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB;YACpB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI;YACpB,MAAM,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"baker-api.js","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;CAC3G,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAIrD;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB,MAAM;IAA3B,YAAqB,MAAc;QACjC,KAAK,CAAC,6BAA6B,MAAM,GAAG,CAAC,CAAC;sBAD3B,MAAM;IAE3B,CAAC;CACF;AAOD,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAAC,OAA2C;IAC9E,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAa;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB;YACpB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI;YACpB,MAAM,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/ca.d.ts

@@ -27,4 +27,12 @@ export declare function ensureCertificateAuthority(options: {
     installSystemTrust: boolean;
     log?: (message: string) => void;
 }): Promise<CertificateAuthority>;
+/**
+ * Writes the certificate to `target` as a new file. The system trust directory
+ * is under /usr/local, which the agent can write, and the broker is root: a
+ * copy would follow a link the agent planted there onto any file. Removing the
+ * name first drops such a link, and an exclusive create refuses one planted
+ * again in between rather than following it.
+ */
+export declare function placeTrustedCert(certPath: string, target: string): Promise<void>;
 //# sourceMappingURL=ca.d.ts.map

package/dist/broker/ca.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAC9C,eAAO,MAAM,gBAAgB,uCAAuC,CAAC;AAKrE,MAAM,MAAM,oBAAoB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBzB;AASD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAahC"}
+{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAC9C,eAAO,MAAM,gBAAgB,uCAAuC,CAAC;AAKrE,MAAM,MAAM,oBAAoB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBzB;AASD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAahC;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGtF"}

package/dist/broker/ca.js

@@ -3,7 +3,7 @@
  * through it — and the environment that points the agent's clients at it.
  */
 import { execFile } from "node:child_process";
-import { copyFile, mkdir, readFile, stat, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { promisify } from "node:util";
 import { generateCACertificate } from "mockttp";
@@ -57,9 +57,20 @@ export async function ensureCertificateAuthority(options) {
         await installSystemTrust(certPath, options.log);
     return { keyPath, certPath, key: await readFile(keyPath, "utf8"), cert: await readFile(certPath, "utf8") };
 }
+/**
+ * Writes the certificate to `target` as a new file. The system trust directory
+ * is under /usr/local, which the agent can write, and the broker is root: a
+ * copy would follow a link the agent planted there onto any file. Removing the
+ * name first drops such a link, and an exclusive create refuses one planted
+ * again in between rather than following it.
+ */
+export async function placeTrustedCert(certPath, target) {
+    await rm(target, { force: true });
+    await writeFile(target, await readFile(certPath), { flag: "wx", mode: 0o644 });
+}
 async function installSystemTrust(certPath, log) {
     try {
-        await copyFile(certPath, SYSTEM_TRUST_PATH);
+        await placeTrustedCert(certPath, SYSTEM_TRUST_PATH);
         await promisify(execFile)(UPDATE_CA_CERTIFICATES);
     }
     catch (error) {

package/dist/broker/ca.js.map

@@ -1 +1 @@
-{"version":3,"file":"ca.js","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AACrE,8FAA8F;AAC9F,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AAIzF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAK7B;IACC,MAAM,KAAK,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,OAAO;QACjB,kBAAkB,EAAE,GAAG;QACvB,mBAAmB,EAAE,OAAO,CAAC,UAAU;QACvC,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,gBAAgB;QAC/B,cAAc,EAAE,gBAAgB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAIhD;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,GAA+B;IACjF,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,CAAC,iEAAiE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}
+{"version":3,"file":"ca.js","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AACrE,8FAA8F;AAC9F,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AAIzF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAK7B;IACC,MAAM,KAAK,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,OAAO;QACjB,kBAAkB,EAAE,GAAG;QACvB,mBAAmB,EAAE,OAAO,CAAC,UAAU;QACvC,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,gBAAgB;QAC/B,cAAc,EAAE,gBAAgB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAIhD;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IACrE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,GAA+B;IACjF,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,CAAC,iEAAiE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/broker/ca.test.js

@@ -1,8 +1,8 @@
-import { mkdtempSync, readFileSync, statSync } from "node:fs";
+import { lstatSync, mkdtempSync, readFileSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
-import { agentProxyEnv, ensureCertificateAuthority } from "./ca.js";
+import { agentProxyEnv, ensureCertificateAuthority, placeTrustedCert } from "./ca.js";
 describe("agentProxyEnv", () => {
     it("routes every client through the broker and trusts its CA without dropping the system roots", () => {
         const env = agentProxyEnv({ port: 8877, caCertPath: "/etc/baker-ca/ca.pem", noProxyHosts: [] });
@@ -39,4 +39,20 @@ describe("ensureCertificateAuthority", () => {
         expect(readFileSync(first.certPath, "utf8")).toContain("BEGIN CERTIFICATE");
     });
 });
+describe("placeTrustedCert", () => {
+    it("replaces a link the agent planted where the certificate goes, and never writes through it", async () => {
+        // The trust directory is under /usr/local, which the agent can write; the broker is root.
+        const dir = mkdtempSync(join(tmpdir(), "baker-trust-"));
+        const victim = join(dir, "sudoers");
+        writeFileSync(victim, "user ALL=(ALL) ALL\n");
+        const target = join(dir, "baker-credential-broker.crt");
+        symlinkSync(victim, target);
+        const cert = join(dir, "ca.pem");
+        writeFileSync(cert, "-----BEGIN CERTIFICATE-----\n");
+        await placeTrustedCert(cert, target);
+        expect(readFileSync(victim, "utf8")).toBe("user ALL=(ALL) ALL\n");
+        expect(lstatSync(target).isSymbolicLink()).toBe(false);
+        expect(readFileSync(target, "utf8")).toBe("-----BEGIN CERTIFICATE-----\n");
+    });
+});
 //# sourceMappingURL=ca.test.js.map

package/dist/broker/ca.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"ca.test.js","sourceRoot":"","sources":["../../src/broker/ca.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AAEpE,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,kBAAkB,EAAE,GAAG;YACvB,mBAAmB,EAAE,sBAAsB;YAC3C,kBAAkB,EAAE,oCAAoC;YACxD,aAAa,EAAE,oCAAoC;YACnD,cAAc,EAAE,oCAAoC;SACrD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAE/G,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,uCAAuC;YACvC,uCAAuC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"ca.test.js","sourceRoot":"","sources":["../../src/broker/ca.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEtF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,kBAAkB,EAAE,GAAG;YACvB,mBAAmB,EAAE,sBAAsB;YAC3C,kBAAkB,EAAE,oCAAoC;YACxD,aAAa,EAAE,oCAAoC;YACnD,cAAc,EAAE,oCAAoC;SACrD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAE/G,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,uCAAuC;YACvC,uCAAuC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,0FAA0F;QAC1F,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,aAAa,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QACxD,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjC,aAAa,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;QAErD,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAClE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/credential-cache.d.ts

@@ -1,10 +1,3 @@
-/**
- * The broker's copy of the company's credentials, fetched from Baker on first
- * need and kept for 10 seconds. Concurrent reads share one fetch. A failed
- * fetch keeps the last good table until the next refresh; before any fetch
- * has succeeded there is no table (null), which callers must treat as
- * "credentials unavailable", not "no credentials".
- */
 import type { ResolvedCredential } from "./credential-text.ts";
 export declare const CREDENTIAL_TTL_MS = 10000;
 /** Each fetch decrypts every credential the company has; a refusal loop may force one this often at most. */
@@ -12,6 +5,8 @@ export declare const MIN_REFRESH_INTERVAL_MS = 5000;
 export type FetchCredentials = () => Promise<ResolvedCredential[]>;
 export type CredentialCache = {
     get(): Promise<ResolvedCredential[] | null>;
+    /** Every value to scrub: the current table plus any value that has left it. */
+    scrubbable(): Promise<ResolvedCredential[]>;
     /**
      * Drops the table so the next read fetches it again — unless an early
      * refresh already happened within 5 seconds. Returns whether it dropped it.

package/dist/broker/credential-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-cache.d.ts","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,iBAAiB,QAAS,CAAC;AACxC,6GAA6G;AAC7G,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,IAAI,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC;IACnB,yEAAyE;IACzE,IAAI,IAAI,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,eAAe,CAiClB"}
+{"version":3,"file":"credential-cache.d.ts","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,iBAAiB,QAAS,CAAC;AACxC,6GAA6G;AAC7G,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,IAAI,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,UAAU,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5C;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC;IACnB,yEAAyE;IACzE,IAAI,IAAI,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,eAAe,CAsDlB"}

package/dist/broker/credential-cache.js

@@ -1,3 +1,16 @@
+/**
+ * The broker's copy of the company's credentials, fetched from Baker on first
+ * need and kept for 10 seconds. Concurrent reads share one fetch. A failed
+ * fetch keeps the last good table until the next refresh, but a refusal
+ * (`CredentialsRefused`) drops it: Baker has said no. Before any fetch
+ * has succeeded there is no table (null), which callers must treat as
+ * "credentials unavailable", not "no credentials".
+ *
+ * A value that leaves the table — refused or removed — may still be on its
+ * way back in a response to a request that carried it, so `scrubbable()`
+ * keeps scrubbing it for the broker's lifetime. It is never sent again.
+ */
+import { CredentialsRefused } from "./baker-api.js";
 export const CREDENTIAL_TTL_MS = 10_000;
 /** Each fetch decrypts every credential the company has; a refusal loop may force one this often at most. */
 export const MIN_REFRESH_INTERVAL_MS = 5_000;
@@ -7,19 +20,39 @@ export function createCredentialCache(options) {
     let entry = null;
     let lastGood = null;
     let lastRefreshAt = Number.NEGATIVE_INFINITY;
+    const retired = new Map();
+    function replaceTable(next) {
+        const kept = new Set(next?.map((credential) => credential.value));
+        for (const credential of lastGood ?? []) {
+            if (!kept.has(credential.value))
+                retired.set(credential.value, credential);
+        }
+        for (const value of kept)
+            retired.delete(value);
+        lastGood = next;
+    }
+    function get() {
+        if (entry === null || now() - entry.at >= ttlMs) {
+            const table = options.fetchCredentials().then((credentials) => {
+                replaceTable(credentials);
+                return credentials;
+            }, (error) => {
+                if (error instanceof CredentialsRefused) {
+                    options.log?.(`${error.message}; dropping ${lastGood?.length ?? 0} cached credentials`);
+                    replaceTable(null);
+                    return null;
+                }
+                options.log?.(`credential fetch failed, keeping ${lastGood?.length ?? 0} cached: ${String(error)}`);
+                return lastGood;
+            });
+            entry = { at: now(), table };
+        }
+        return entry.table;
+    }
     return {
-        get() {
-            if (entry === null || now() - entry.at >= ttlMs) {
-                const table = options.fetchCredentials().then((credentials) => {
-                    lastGood = credentials;
-                    return credentials;
-                }, (error) => {
-                    options.log?.(`credential fetch failed, keeping ${lastGood?.length ?? 0} cached: ${String(error)}`);
-                    return lastGood;
-                });
-                entry = { at: now(), table };
-            }
-            return entry.table;
+        get,
+        async scrubbable() {
+            return [...((await get()) ?? []), ...retired.values()];
         },
         refresh() {
             if (now() - lastRefreshAt < MIN_REFRESH_INTERVAL_MS)

package/dist/broker/credential-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-cache.js","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAe7C,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IACjD,IAAI,KAAK,GAAuE,IAAI,CAAC;IACrF,IAAI,QAAQ,GAAgC,IAAI,CAAC;IACjD,IAAI,aAAa,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC7C,OAAO;QACL,GAAG;YACD,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAC3C,CAAC,WAAW,EAAE,EAAE;oBACd,QAAQ,GAAG,WAAW,CAAC;oBACvB,OAAO,WAAW,CAAC;gBACrB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;oBACjB,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,QAAQ,EAAE,MAAM,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpG,OAAO,QAAQ,CAAC;gBAClB,CAAC,CACF,CAAC;gBACF,KAAK,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC;QACD,OAAO;YACL,IAAI,GAAG,EAAE,GAAG,aAAa,GAAG,uBAAuB;gBAAE,OAAO,KAAK,CAAC;YAClE,aAAa,GAAG,GAAG,EAAE,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI;YACF,OAAO,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"credential-cache.js","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAiB7C,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IACjD,IAAI,KAAK,GAAuE,IAAI,CAAC;IACrF,IAAI,QAAQ,GAAgC,IAAI,CAAC;IACjD,IAAI,aAAa,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEtD,SAAS,YAAY,CAAC,IAAiC;QACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,KAAK,MAAM,UAAU,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,SAAS,GAAG;QACV,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAC3C,CAAC,WAAW,EAAE,EAAE;gBACd,YAAY,CAAC,WAAW,CAAC,CAAC;gBAC1B,OAAO,WAAW,CAAC;YACrB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBACjB,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,cAAc,QAAQ,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC;oBACxF,YAAY,CAAC,IAAI,CAAC,CAAC;oBACnB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,QAAQ,EAAE,MAAM,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACpG,OAAO,QAAQ,CAAC;YAClB,CAAC,CACF,CAAC;YACF,KAAK,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO;QACL,GAAG;QACH,KAAK,CAAC,UAAU;YACd,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;YACL,IAAI,GAAG,EAAE,GAAG,aAAa,GAAG,uBAAuB;gBAAE,OAAO,KAAK,CAAC;YAClE,aAAa,GAAG,GAAG,EAAE,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI;YACF,OAAO,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/credential-cache.test.js

@@ -1,4 +1,5 @@
 import { describe, expect, it } from "vitest";
+import { CredentialsRefused } from "./baker-api.js";
 import { createCredentialCache } from "./credential-cache.js";
 function fetcher() {
     let calls = 0;
@@ -33,7 +34,7 @@ describe("createCredentialCache", () => {
             fetchCredentials: async () => {
                 await Promise.resolve();
                 if (failing)
-                    throw new Error("401 UNAUTHORIZED");
+                    throw new Error("502 upstream");
                 return [{ name: "shop", value: "secret-value", allowedHosts: ["api.example.com"] }];
             },
             now: () => clock,
@@ -46,6 +47,51 @@ describe("createCredentialCache", () => {
         clock = 20_000;
         expect((await cache.get())?.map((credential) => credential.name)).toEqual(["shop"]);
     });
+    it("drops the table once Baker refuses the broker, so no value is sent after Credentials are switched off", async () => {
+        let clock = 0;
+        let refused = false;
+        const cache = createCredentialCache({
+            fetchCredentials: async () => {
+                await Promise.resolve();
+                if (refused)
+                    throw new CredentialsRefused(401);
+                return [{ name: "shop", value: "secret-value", allowedHosts: ["api.example.com"] }];
+            },
+            now: () => clock,
+        });
+        await cache.get();
+        refused = true;
+        clock = 10_000;
+        expect(await cache.get()).toBeNull();
+        expect(cache.size()).toBe(0);
+    });
+    it("still scrubs a value it may have sent after Baker refuses the broker or the credential is removed", async () => {
+        let clock = 0;
+        let table = [
+            { name: "shop", value: "shop-secret-value", allowedHosts: ["api.example.com"] },
+            { name: "ads", value: "ads-secret-value", allowedHosts: ["api.example.com"] },
+        ];
+        let refused = false;
+        const cache = createCredentialCache({
+            fetchCredentials: async () => {
+                await Promise.resolve();
+                if (refused)
+                    throw new CredentialsRefused(401);
+                return table;
+            },
+            now: () => clock,
+        });
+        await cache.get();
+        table = table.slice(0, 1);
+        clock = 10_000;
+        const afterRemoval = (await cache.scrubbable()).map((credential) => credential.value);
+        refused = true;
+        clock = 20_000;
+        const afterRefusal = (await cache.scrubbable()).map((credential) => credential.value);
+        expect(afterRemoval.sort()).toEqual(["ads-secret-value", "shop-secret-value"]);
+        expect(afterRefusal.sort()).toEqual(["ads-secret-value", "shop-secret-value"]);
+        expect(await cache.get()).toBeNull();
+    });
     it("fetches again on the next read after a refresh", async () => {
         const source = fetcher();
         const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => 0 });

package/dist/broker/credential-cache.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-cache.test.js","sourceRoot":"","sources":["../../src/broker/credential-cache.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS,OAAO;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACjD,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QAEf,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAEjG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACrG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC;YAC5C,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,GAAG,KAAK,CAAC;QACd,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"credential-cache.test.js","sourceRoot":"","sources":["../../src/broker/credential-cache.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS,OAAO;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;gBAC7C,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QAEf,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;QACrH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAC/C,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QAEf,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mGAAmG,EAAE,KAAK,IAAI,EAAE;QACjH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAG;YACV,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;YAC/E,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC9E,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAC/C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtF,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEtF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAEjG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACrG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC;YAC5C,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,GAAG,KAAK,CAAC;QACd,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/credential-text.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-text.d.ts","sourceRoot":"","sources":["../../src/broker/credential-text.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,MAAM,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AACjF,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAClG,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,EAAE,CAMvE;AAID,mHAAmH;AACnH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE9D;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM9E;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CA4B/G;AAoBD,+HAA+H;AAC/H,wBAAgB,aAAa,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAK9G;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAMxF"}
+{"version":3,"file":"credential-text.d.ts","sourceRoot":"","sources":["../../src/broker/credential-text.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,MAAM,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AACjF,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAClG,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,EAAE,CAMvE;AAID,mHAAmH;AACnH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE9D;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM9E;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CA4B/G;AAuBD,+HAA+H;AAC/H,wBAAgB,aAAa,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAK9G;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAMxF"}

package/dist/broker/credential-text.js

@@ -79,6 +79,9 @@ function encodings(value) {
         standard.replace(/=+$/, ""),
         standard.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""),
         encodeURIComponent(value),
+        // Inside a JSON string, and as PHP's json_encode writes it (`/` as `\/`), as WordPress echoes it.
+        JSON.stringify(value).slice(1, -1),
+        JSON.stringify(value).slice(1, -1).replaceAll("/", "\\/"),
     ];
     return [...new Set(variants)].filter((variant) => variant.length >= MIN_SCRUB_LENGTH);
 }

package/dist/broker/credential-text.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-text.js","sourceRoot":"","sources":["../../src/broker/credential-text.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,kBAAkB,GAAG,qBAAqB,uBAAuB,SAAS,CAAC;AAYjF,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,gBAAgB,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;KACnC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAEnE,mHAAmH;AACnH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAA2B;IACnE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,WAA0C,EAAE,IAAY;IAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACtD,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC;QAC3D,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;IAC3B,CAAC;IACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO;QACL,GAAG;QACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG;QACf,KAAK;QACL,QAAQ;QACR,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnE,kBAAkB,CAAC,KAAK,CAAC;KAC1B,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;AACxF,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,aAAa,CAAC,WAA4C;IACxE,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;SACnE,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACzG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,WAA4C;IAC9E,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"credential-text.js","sourceRoot":"","sources":["../../src/broker/credential-text.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,kBAAkB,GAAG,qBAAqB,uBAAuB,SAAS,CAAC;AAYjF,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,gBAAgB,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;KACnC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAEnE,mHAAmH;AACnH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAA2B;IACnE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,WAA0C,EAAE,IAAY;IAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACtD,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC;QAC3D,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;IAC3B,CAAC;IACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO;QACL,GAAG;QACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG;QACf,KAAK;QACL,QAAQ;QACR,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnE,kBAAkB,CAAC,KAAK,CAAC;QACzB,kGAAkG;QAClG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC;KAC1D,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;AACxF,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,aAAa,CAAC,WAA4C;IACxE,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;SACnE,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACzG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,WAA4C;IAC9E,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/broker/credential-text.test.js

@@ -25,6 +25,7 @@ const credentials = [
     { name: "shop", value: "shpat_0a1b2c3d4e5f", allowedHosts: ["acme.myshopify.com"] },
     { name: "short", value: "abc", allowedHosts: ["api.example.com"] },
     { name: "unicode", value: "contraseña-segura-1", allowedHosts: ["api.example.com"] },
+    { name: "quoted", value: 'pa"ss/wo\\rd-9x', allowedHosts: ["api.example.com"] },
 ];
 const texts = [
     " {{credential:meta-token}} ",
@@ -32,6 +33,7 @@ const texts = [
     "{{credential:}} {{credential:Upper}} {credential:x} {{credential:short}}",
     "echo EAAGm0PX4ZCpsBAKZCZ+/x RUFBR20wUFg0WkNwc0JBS1pDWisveA== shpat_0a1b2c3d4e5f abc",
     `encoded ${encodeURIComponent("contraseña-segura-1")} ${btoa("shpat_0a1b2c3d4e5f")}`,
+    String.raw `{"password":"pa"ss/wo\rd-9x","php":"pa"ss\/wo\rd-9x"}`,
 ];
 const hosts = ["graph.facebook.com", "GRAPH.facebook.com.", "acme.myshopify.com", "myshopify.com", "evil.io"];
 describe("credential-text mirrors @baker/api/credentials", () => {

package/dist/broker/credential-text.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-text.test.js","sourceRoot":"","sources":["../../src/broker/credential-text.test.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAC;AAG9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;AAEvF,KAAK,UAAU,QAAQ;IACrB,MAAM,IAAI,GAAW,QAAQ,CAAC;IAC9B,OAAO,CAAC,MAAM,MAAM,kCAAC,IAAI,EAAC,CAAa,CAAC;AAC1C,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IAC7F,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IACnF,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;IAClE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;CACrF,CAAC;AAEF,MAAM,KAAK,GAAG;IACZ,6BAA6B;IAC7B,oGAAoG;IACpG,0EAA0E;IAC1E,qFAAqF;IACrF,WAAW,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,EAAE;CACrF,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;AAE9G,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"credential-text.test.js","sourceRoot":"","sources":["../../src/broker/credential-text.test.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAC;AAG9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;AAEvF,KAAK,UAAU,QAAQ;IACrB,MAAM,IAAI,GAAW,QAAQ,CAAC;IAC9B,OAAO,CAAC,MAAM,MAAM,kCAAC,IAAI,EAAC,CAAa,CAAC;AAC1C,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IAC7F,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IACnF,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;IAClE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;IACpF,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;CAChF,CAAC;AAEF,MAAM,KAAK,GAAG;IACZ,6BAA6B;IAC7B,oGAAoG;IACpG,0EAA0E;IAC1E,qFAAqF;IACrF,WAAW,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,EAAE;IACpF,MAAM,CAAC,GAAG,CAAA,uDAAuD;CAClE,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;AAE9G,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/broker/proxy.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,KAAK,eAAe,EAAyB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAe3G,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB,CAAC;AAuCF,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAgF3D"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/broker/proxy.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,KAAK,eAAe,EAAyB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAe3G,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB,CAAC;AA6CF,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAkF3D"}

package/dist/broker/proxy.integration.test.js

@@ -1,5 +1,7 @@
 import { request as httpRequest } from "node:http";
 import { connect as http2Connect } from "node:http2";
+import { connect as netConnect } from "node:net";
+import { networkInterfaces } from "node:os";
 import { connect as tlsConnect } from "node:tls";
 import { generateCACertificate, getLocal } from "mockttp";
 import { ProxyAgent, request } from "undici";
@@ -90,6 +92,35 @@ describe("credential broker proxy", () => {
         expect(seen?.headers.authorization).toBe(`Bearer ${VALUE}`);
         expect(JSON.parse(body)).toEqual({ sawAuthorization: "Bearer {{credential:shop}}", bodyBytes: 0 });
     });
+    it("hands back a Basic auth header an allowed host echoes without the pair it carried", async () => {
+        // base64 of `admin:VALUE` is not base64 of VALUE: the pair has to be scrubbed as sent.
+        const response = await request(`https://localhost:${upstream.port}/echo`, {
+            dispatcher: agent,
+            headers: { authorization: `Basic ${btoa("shop:{{credential:shop}}")}` },
+        });
+        const body = await response.body.text();
+        expect(body).not.toContain(btoa(`shop:${VALUE}`).slice(8));
+        expect(JSON.parse(body)).toMatchObject({ sawAuthorization: "Basic {{credential:shop}}" });
+    });
+    it.each([
+        "application/x-ndjson",
+        "application/yaml",
+        "application/octet-stream",
+    ])("hands back a value echoed in a %s response only as its placeholder", async (contentType) => {
+        await upstream
+            .forGet("/typed")
+            .asPriority(2)
+            .thenCallback((req) => ({
+            statusCode: 200,
+            headers: { "content-type": contentType },
+            body: `{"echo":"${String(req.headers.authorization)}"}\n`,
+        }));
+        const response = await request(`https://localhost:${upstream.port}/typed`, {
+            dispatcher: agent,
+            headers: { authorization: "Bearer {{credential:shop}}" },
+        });
+        expect(await response.body.text()).toBe('{"echo":"Bearer {{credential:shop}}"}\n');
+    });
     it("refuses a credential bound for a host it is not allowed for, before it leaves the sandbox", async () => {
         const response = await request(`https://localhost:${upstream.port}/echo`, {
             dispatcher: agent,
@@ -125,4 +156,46 @@ describe("credential broker proxy", () => {
         expect(await response.body.json()).toEqual({ sawAuthorization: null, bodyBytes: upload.byteLength });
     });
 });
+/** This machine's address on a real network: what a stranger reaching the sandbox's port would appear as. */
+function externalAddress() {
+    const address = Object.values(networkInterfaces())
+        .flat()
+        .find((candidate) => candidate !== undefined && !candidate.internal && candidate.family === "IPv4");
+    if (address === undefined)
+        throw new Error("this test needs a network interface besides loopback");
+    return address.address;
+}
+/** Asks the broker, from `host`, to relay a WebSocket to `target`; resolves with its first response line, or "" when it hangs up. */
+function upgradeThroughBroker(host, target) {
+    return new Promise((resolve, reject) => {
+        const socket = netConnect({ host, port: brokerPort });
+        let received = "";
+        socket.setTimeout(3_000, () => socket.destroy());
+        socket.on("connect", () => socket.write(`GET ${target} HTTP/1.1\r\nHost: ${new URL(target).host}\r\nConnection: Upgrade\r\nUpgrade: websocket\r\nSec-WebSocket-Version: 13\r\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\r\n`));
+        socket.on("data", (chunk) => {
+            received += chunk.toString("latin1");
+            if (received.includes("\r\n"))
+                socket.destroy();
+        });
+        socket.on("close", () => resolve(received.split("\r\n")[0] ?? ""));
+        socket.on("error", (error) => error.code === "ECONNRESET" || error.code === "ECONNREFUSED" ? resolve("") : reject(error));
+    });
+}
+describe("the broker's reach", () => {
+    let echo;
+    beforeEach(async () => {
+        echo = getLocal();
+        await echo.start();
+        await echo.forAnyWebSocket().thenEcho();
+    });
+    afterEach(async () => {
+        await echo.stop();
+    });
+    it("relays a WebSocket for this machine", async () => {
+        expect(await upgradeThroughBroker("127.0.0.1", `http://localhost:${echo.port}/`)).toContain("101");
+    });
+    it("relays no WebSocket for anyone else who reaches its port", async () => {
+        expect(await upgradeThroughBroker(externalAddress(), `http://localhost:${echo.port}/`)).not.toContain("101");
+    });
+});
 //# sourceMappingURL=proxy.integration.test.js.map

package/dist/broker/proxy.integration.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.integration.test.js","sourceRoot":"","sources":["../../src/broker/proxy.integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAgB,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAe,YAAY,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,IAAI,QAAiB,CAAC;AACtB,IAAI,MAAc,CAAC;AACnB,IAAI,KAAiB,CAAC;AACtB,IAAI,SAAmB,CAAC;AACxB,IAAI,UAAkB,CAAC;AACvB,IAAI,YAAoB,CAAC;AAEzB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,UAAU,GAAG,MAAM,qBAAqB,EAAE,CAAC;IACjD,QAAQ,GAAG,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpD,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;KACrG,CAAC,CAAC,CAAC;IAEJ,SAAS,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC/C,MAAM,GAAG,YAAY,CAAC;QACpB,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,CAAC;QACP,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9B,gBAAgB,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC;YACd,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE;YAC3D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE;SACjF,CAAC;QACJ,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAClC,UAAU,GAAG,IAAI,CAAC;IAClB,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,EAAE,oBAAoB,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACpB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,SAAS,GAAG,aAAa,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACzG,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,SAAS,EAAE,EAAE;gBACnD,gBAAgB,EAAE,GAAG,EAAE,CACrB,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;aAC3F,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE;gBAChC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAClC,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACpB,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;QAE9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAExC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAExC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mEAAmE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5G,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACvD,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,SAAS,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE;SAC/D,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,SAAS,EAAE;YAC1E,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;YACzC,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"proxy.integration.test.js","sourceRoot":"","sources":["../../src/broker/proxy.integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAgB,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAe,YAAY,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,KAAK,GAAG,wBAAwB,CAAC;AAEvC,IAAI,QAAiB,CAAC;AACtB,IAAI,MAAc,CAAC;AACnB,IAAI,KAAiB,CAAC;AACtB,IAAI,SAAmB,CAAC;AACxB,IAAI,UAAkB,CAAC;AACvB,IAAI,YAAoB,CAAC;AAEzB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,MAAM,UAAU,GAAG,MAAM,qBAAqB,EAAE,CAAC;IACjD,QAAQ,GAAG,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpD,UAAU,EAAE,GAAG;QACf,IAAI,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;KACrG,CAAC,CAAC,CAAC;IAEJ,SAAS,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC/C,MAAM,GAAG,YAAY,CAAC;QACpB,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,CAAC;QACP,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9B,gBAAgB,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC;YACd,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE;YAC3D,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE;SACjF,CAAC;QACJ,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;KACrC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAClC,UAAU,GAAG,IAAI,CAAC;IAClB,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC7B,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,EAAE,oBAAoB,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACpB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,SAAS,GAAG,aAAa,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACzG,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,SAAS,EAAE,EAAE;gBACnD,gBAAgB,EAAE,GAAG,EAAE,CACrB,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC;aAC3F,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE;gBAChC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAClC,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACpB,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,+BAA+B,CAAC,CAAC;QAE9E,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAExC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,IAAI,CAAC,0BAA0B,CAAC,EAAE,EAAE;SACxE,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAExC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,sBAAsB;QACtB,kBAAkB;QAClB,0BAA0B;KAC3B,CAAC,CAAC,oEAAoE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE;QAC7F,MAAM,QAAQ;aACX,MAAM,CAAC,QAAQ,CAAC;aAChB,UAAU,CAAC,CAAC,CAAC;aACb,YAAY,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;YACxC,IAAI,EAAE,YAAY,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM;SAC1D,CAAC,CAAC,CAAC;QAEN,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,QAAQ,EAAE;YACzE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAExC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,mEAAmE,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5G,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACvD,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5C,SAAS,GAAG,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,OAAO,EAAE;YACxE,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE;SAC/D,CAAC,CAAC;QAEH,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QAEnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,qBAAqB,QAAQ,CAAC,IAAI,SAAS,EAAE;YAC1E,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;YACzC,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,6GAA6G;AAC7G,SAAS,eAAe;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;SAC/C,IAAI,EAAE;SACN,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACtG,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACnG,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,qIAAqI;AACrI,SAAS,oBAAoB,CAAC,IAAY,EAAE,MAAc;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CACxB,MAAM,CAAC,KAAK,CACV,OAAO,MAAM,sBAAsB,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,mIAAmI,CAC3L,CACF,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE,CAClD,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAC3F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,IAAI,IAAa,CAAC;IAClB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,GAAG,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,CAAC,MAAM,oBAAoB,CAAC,WAAW,EAAE,oBAAoB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,CAAC,MAAM,oBAAoB,CAAC,eAAe,EAAE,EAAE,oBAAoB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}