@koda-sl/baker-bridge 0.119.0 → 0.121.0-dev.ba3f112da

package/dist/broker/rewrite.test.js

@@ -1,171 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { rewriteRequest } from "./rewrite.js";
-const credentials = [
-    { name: "meta-token", value: "EAAG-secret/value+1", allowedHosts: ["graph.facebook.com"] },
-    { name: "shop", value: 'shpat_"quoted"&x=1', allowedHosts: ["acme.myshopify.com"] },
-    { name: "nowhere", value: "unscoped-secret-1", allowedHosts: [] },
-];
-function request(overrides = {}) {
-    return {
-        url: "https://graph.facebook.com/v21.0/me",
-        headers: { accept: "application/json" },
-        body: null,
-        ...overrides,
-    };
-}
-const text = (value) => new TextEncoder().encode(value);
-describe("rewriteRequest", () => {
-    it("passes a request that carries no placeholder untouched", () => {
-        expect(rewriteRequest(request({ body: text('{"a":1}') }), credentials)).toEqual({ kind: "pass" });
-    });
-    it("swaps a placeholder in a header for the value when the host is allowed", () => {
-        const decision = rewriteRequest(request({ headers: { authorization: "Bearer {{credential:meta-token}}", accept: "*/*" } }), credentials);
-        expect(decision).toEqual({
-            kind: "rewrite",
-            url: "https://graph.facebook.com/v21.0/me",
-            headers: { authorization: "Bearer EAAG-secret/value+1", accept: "*/*" },
-            used: ["meta-token"],
-        });
-    });
-    it("swaps a placeholder in a JSON body, escaped so the body stays valid JSON", () => {
-        const decision = rewriteRequest(request({
-            url: "https://acme.myshopify.com/admin/graphql.json",
-            headers: { "content-type": "application/json; charset=utf-8" },
-            body: text('{"token":"{{credential:shop}}"}'),
-        }), credentials);
-        expect(decision).toMatchObject({ kind: "rewrite", used: ["shop"] });
-        const body = decision.kind === "rewrite" ? (decision.body ?? "") : "";
-        expect(JSON.parse(body)).toEqual({ token: 'shpat_"quoted"&x=1' });
-    });
-    it("swaps a placeholder in a form body, form-encoded", () => {
-        const decision = rewriteRequest(request({
-            url: "https://acme.myshopify.com/oauth",
-            headers: { "content-type": "application/x-www-form-urlencoded" },
-            body: text("grant=x&secret=%7B%7Bcredential%3Ashop%7D%7D"),
-        }), credentials);
-        expect(decision).toMatchObject({ kind: "rewrite", used: ["shop"] });
-        const body = decision.kind === "rewrite" ? (decision.body ?? "") : "";
-        expect(new URLSearchParams(body).get("secret")).toBe('shpat_"quoted"&x=1');
-    });
-    it.each([
-        ["a text body over 10 MB", "text/plain", text(`{{credential:shop}}${"x".repeat(10 * 1024 * 1024)}`)],
-        ["a binary body", "application/octet-stream", text("\u0000\u0001{{credential:shop}}")],
-    ])("refuses a placeholder in %s with 413", (_kind, contentType, body) => {
-        const decision = rewriteRequest(request({ url: "https://acme.myshopify.com/upload", headers: { "content-type": contentType }, body }), credentials);
-        expect(decision).toMatchObject({ kind: "reject", status: 413 });
-    });
-    it("refuses to put a credential on plain http, even to an allowed host", () => {
-        const decision = rewriteRequest(request({ url: "http://graph.facebook.com/me", headers: { authorization: "Bearer {{credential:meta-token}}" } }), credentials);
-        expect(decision).toMatchObject({ kind: "reject", status: 403 });
-        expect(decision.kind === "reject" && decision.message).toContain("only sent over https");
-    });
-    it("swaps a placeholder hidden inside Basic auth, re-encoding the pair", () => {
-        const basic = `Basic ${btoa("admin:{{credential:shop}}")}`;
-        const decision = rewriteRequest(request({ url: "https://acme.myshopify.com/admin", headers: { authorization: basic } }), credentials);
-        expect(decision).toMatchObject({
-            kind: "rewrite",
-            headers: { authorization: `Basic ${Buffer.from('admin:shpat_"quoted"&x=1').toString("base64")}` },
-            used: ["shop"],
-        });
-    });
-    it.each([
-        ["literally", "https://acme.myshopify.com/admin?token={{credential:shop}}"],
-        ["percent-encoded", "https://acme.myshopify.com/admin?token=%7B%7Bcredential%3Ashop%7D%7D"],
-        ["percent-encoded in lower case", "https://acme.myshopify.com/admin?token=%7b%7bcredential%3ashop%7d%7d"],
-    ])("swaps a placeholder written %s in the URL for the URL-encoded value", (_form, url) => {
-        const decision = rewriteRequest(request({ url }), credentials);
-        expect(decision).toMatchObject({
-            kind: "rewrite",
-            url: `https://acme.myshopify.com/admin?token=${encodeURIComponent('shpat_"quoted"&x=1')}`,
-            used: ["shop"],
-        });
-    });
-    it("leaves HTTP/2 pseudo-headers as they came, since the proxy refuses a changed :path", () => {
-        const path = "/admin?token={{credential:shop}}";
-        const decision = rewriteRequest(request({ url: `https://acme.myshopify.com${path}`, headers: { ":method": "GET", ":path": path } }), credentials);
-        expect(decision).toMatchObject({
-            kind: "rewrite",
-            url: `https://acme.myshopify.com/admin?token=${encodeURIComponent('shpat_"quoted"&x=1')}`,
-            headers: { ":method": "GET", ":path": path },
-        });
-    });
-    it.each([
-        ["Host", "host"],
-        ["HTTP/2 :authority", ":authority"],
-    ])("refuses a credential when the %s header names a different site than the one checked", (_kind, header) => {
-        const decision = rewriteRequest(request({ headers: { [header]: "attacker.io", authorization: "Bearer {{credential:meta-token}}" } }), credentials);
-        expect(decision).toMatchObject({
-            kind: "reject",
-            status: 403,
-            message: expect.stringContaining("Host header names another website"),
-        });
-    });
-    it("accepts a Host header that names the checked site with a port and in any case", () => {
-        const decision = rewriteRequest(request({ headers: { host: "Graph.Facebook.com:443", authorization: "Bearer {{credential:meta-token}}" } }), credentials);
-        expect(decision).toMatchObject({ kind: "rewrite", used: ["meta-token"] });
-    });
-    it("refuses to send a credential to a host it is not allowed for, and says where it may go", () => {
-        const decision = rewriteRequest(request({ url: "https://attacker.io/collect", headers: { authorization: "Bearer {{credential:shop}}" } }), credentials);
-        expect(decision).toEqual({
-            kind: "reject",
-            status: 403,
-            message: 'Baker credential "shop" is not allowed for host "attacker.io". Allowed: acme.myshopify.com. Ask the user to add this website to the credential in Settings → Credentials.',
-            stale: true,
-        });
-    });
-    it("tells the agent to ask for websites when a credential has none yet", () => {
-        const decision = rewriteRequest(request({ headers: { "x-key": "{{credential:nowhere}}" } }), credentials);
-        expect(decision).toEqual({
-            kind: "reject",
-            status: 403,
-            message: 'Baker credential "nowhere" has no websites it may be sent to yet. Ask the user to choose them in Settings → Credentials.',
-            stale: true,
-        });
-    });
-    it.each([
-        ["not allowed for the host", "{{credential:shop}}"],
-        ["naming no stored credential", "{{credential:typo}}"],
-    ])("passes a body-only placeholder %s through untouched, as text", (_case, placeholder) => {
-        const decision = rewriteRequest(request({
-            url: "https://openrouter.ai/api/v1/chat/completions",
-            headers: { "content-type": "application/json" },
-            body: text(`{"messages":[{"content":"use ${placeholder}"}]}`),
-        }), credentials);
-        expect(decision).toEqual({ kind: "pass" });
-    });
-    it("answers 503 for a placeholder in a header when the credentials could not be fetched", () => {
-        const decision = rewriteRequest(request({ headers: { authorization: "Bearer {{credential:meta-token}}" } }), null);
-        expect(decision).toEqual({
-            kind: "reject",
-            status: 503,
-            message: "Baker credentials are unavailable right now — try again in a minute.",
-        });
-    });
-    it("passes a body-only placeholder when the credentials could not be fetched", () => {
-        const decision = rewriteRequest(request({ headers: { "content-type": "text/plain" }, body: text("{{credential:meta-token}}") }), null);
-        expect(decision).toEqual({ kind: "pass" });
-    });
-    it("answers 404 for a placeholder naming no stored credential", () => {
-        const decision = rewriteRequest(request({ headers: { "x-key": "{{credential:typo}}" } }), credentials);
-        expect(decision).toEqual({
-            kind: "reject",
-            status: 404,
-            message: 'No Baker credential named "typo". Run `baker credentials list` to see the names you can use.',
-            stale: true,
-        });
-    });
-    it("refuses a host whose name another URL parser would read differently", () => {
-        // mockttp re-parses the URL it is handed with url.parse(), which cuts a host at `{`, while the
-        // check reads the whole name: the credential must never go to a host the check did not see.
-        const decision = rewriteRequest(request({
-            url: "https://attacker.io{.acme.myshopify.com/admin",
-            headers: { authorization: "Bearer {{credential:shop}}" },
-        }), credentials);
-        expect(decision).toMatchObject({ kind: "reject", status: 403 });
-    });
-    it("refuses to put a credential into the address of the website itself", () => {
-        const decision = rewriteRequest(request({ url: "https://{{credential:shop}}.myshopify.com/admin" }), credentials);
-        expect(decision).toMatchObject({ kind: "reject", status: 403 });
-    });
-});
-//# sourceMappingURL=rewrite.test.js.map

package/dist/broker/rewrite.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rewrite.test.js","sourceRoot":"","sources":["../../src/broker/rewrite.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAwB,cAAc,EAAE,MAAM,cAAc,CAAC;AAEpE,MAAM,WAAW,GAAG;IAClB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IAC1F,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IACnF,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,EAAE,EAAE;CAClE,CAAC;AAEF,SAAS,OAAO,CAAC,SAAS,GAA6B,EAAE;IACvD,OAAO;QACL,GAAG,EAAE,qCAAqC;QAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,IAAI,EAAE,IAAI;QACV,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEhE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,EAC1F,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,qCAAqC;YAC1C,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE;YACvE,IAAI,EAAE,CAAC,YAAY,CAAC;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC;YACN,GAAG,EAAE,+CAA+C;YACpD,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE;YAC9D,IAAI,EAAE,IAAI,CAAC,iCAAiC,CAAC;SAC9C,CAAC,EACF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC;YACN,GAAG,EAAE,kCAAkC;YACvC,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,8CAA8C,CAAC;SAC3D,CAAC,EACF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,wBAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,sBAAsB,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC,eAAe,EAAE,0BAA0B,EAAE,IAAI,CAAC,iCAAiC,CAAC,CAAC;KACvF,CAAC,CAAC,sCAAsC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,mCAAmC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,EACrG,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,8BAA8B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,CAAC,EAChH,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAE3D,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,kCAAkC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,EACvF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE;YACjG,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,WAAW,EAAE,4DAA4D,CAAC;QAC3E,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;QAC3F,CAAC,+BAA+B,EAAE,sEAAsE,CAAC;KAC1G,CAAC,CAAC,qEAAqE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,0CAA0C,kBAAkB,CAAC,oBAAoB,CAAC,EAAE;YACzF,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,IAAI,GAAG,kCAAkC,CAAC;QAEhD,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,6BAA6B,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,EACnG,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,0CAA0C,kBAAkB,CAAC,oBAAoB,CAAC,EAAE;YACzF,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,MAAM,EAAE,MAAM,CAAC;QAChB,CAAC,mBAAmB,EAAE,YAAY,CAAC;KACpC,CAAC,CAAC,qFAAqF,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1G,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,CAAC,EACpG,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,mCAAmC,CAAC;SACtE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,CAAC,EAC3G,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE,EAAE,CAAC,EACzG,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EACL,2KAA2K;YAC7K,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAE1G,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EACL,0HAA0H;YAC5H,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;QACnD,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;KACvD,CAAC,CAAC,8DAA8D,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QACxF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC;YACN,GAAG,EAAE,+CAA+C;YACpD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,gCAAgC,WAAW,MAAM,CAAC;SAC9D,CAAC,EACF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAEnH,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAC/F,IAAI,CACL,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAEvG,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,8FAA8F;YACvG,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,+FAA+F;QAC/F,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC;YACN,GAAG,EAAE,+CAA+C;YACpD,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,EACF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,iDAAiD,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAElH,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/socket-service.d.ts

@@ -1,18 +0,0 @@
-import type { CredentialCache } from "./credential-cache.ts";
-export declare const MAX_SCRUB_REQUEST_BYTES: number;
-export type SocketService = {
-    listen(): Promise<void>;
-    close(): Promise<void>;
-};
-export declare function createSocketService(options: {
-    cache: CredentialCache;
-    socketPath: string;
-    ratePerSecond?: number;
-    /** Bytes of text a caller may have scrubbed: slows using /scrub as an oracle for guessing a value. */
-    scrubBytes?: {
-        capacity: number;
-        perSecond: number;
-    };
-    log?: (message: string) => void;
-}): SocketService;
-//# sourceMappingURL=socket-service.d.ts.map

package/dist/broker/socket-service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"socket-service.d.ts","sourceRoot":"","sources":["../../src/broker/socket-service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,eAAO,MAAM,uBAAuB,QAAkB,CAAC;AAmBvD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AA6BhF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sGAAsG;IACtG,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,aAAa,CAyChB"}

package/dist/broker/socket-service.js

@@ -1,103 +0,0 @@
-/**
- * The broker's local service for the bridge, over a unix socket the agent user
- * can reach: scrub values out of text, and health. It
- * never returns a value — `/scrub` only ever turns values into placeholders.
- *
- * The agent writes the text it asks to have scrubbed, so a scrub is an answer
- * to "is any of these my password?". `/scrub` therefore leaves alone a value a
- * wordlist could reach (`resistsGuessing`); the proxy still scrubs it from
- * what a website sends back, where the agent does not choose the text.
- */
-import { chmod, mkdir, rm } from "node:fs/promises";
-import { createServer } from "node:http";
-import { dirname } from "node:path";
-import { z } from "zod";
-import { scrub } from "./credential-text.js";
-import { createTokenBucket } from "./token-bucket.js";
-export const MAX_SCRUB_REQUEST_BYTES = 2 * 1024 * 1024;
-const DEFAULT_SCRUB_BYTES = { capacity: 8 * 1024 * 1024, perSecond: 256 * 1024 };
-const scrubRequestSchema = z.object({ text: z.string() });
-/** Bits a value must carry — its length times its per-character entropy — before `/scrub` may confirm it. */
-const MIN_SCRUB_BITS = 64;
-function resistsGuessing(value) {
-    const counts = new Map();
-    for (const char of value)
-        counts.set(char, (counts.get(char) ?? 0) + 1);
-    let perChar = 0;
-    for (const count of counts.values()) {
-        const p = count / value.length;
-        perChar -= p * Math.log2(p);
-    }
-    return perChar * value.length >= MIN_SCRUB_BITS;
-}
-class BodyTooLarge extends Error {
-}
-async function readBody(req, limit) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of req) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
-        size += buffer.byteLength;
-        if (size > limit)
-            throw new BodyTooLarge();
-        chunks.push(buffer);
-    }
-    return Buffer.concat(chunks).toString("utf8");
-}
-function parseJson(raw) {
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-function send(res, status, body) {
-    res.writeHead(status, { "content-type": "application/json" });
-    res.end(JSON.stringify(body));
-}
-export function createSocketService(options) {
-    const bucket = createTokenBucket({ ratePerSecond: options.ratePerSecond ?? 50, burst: options.ratePerSecond ?? 50 });
-    const scrubBytes = options.scrubBytes ?? DEFAULT_SCRUB_BYTES;
-    const bytes = createTokenBucket({ ratePerSecond: scrubBytes.perSecond, burst: scrubBytes.capacity });
-    async function handle(req, res) {
-        if (req.method === "GET" && req.url === "/health") {
-            return send(res, 200, { ok: true, credentials: options.cache.size() });
-        }
-        if (req.method !== "POST" || req.url !== "/scrub")
-            return send(res, 404, { error: "not found" });
-        if (!bucket.take())
-            return send(res, 429, { error: "too many scrub requests" });
-        const raw = await readBody(req, MAX_SCRUB_REQUEST_BYTES);
-        if (!bytes.take(Buffer.byteLength(raw)))
-            return send(res, 429, { error: "too much text scrubbed, slow down" });
-        const parsed = scrubRequestSchema.safeParse(parseJson(raw));
-        if (!parsed.success)
-            return send(res, 400, { error: "expected {text}" });
-        const credentials = (await options.cache.scrubbable()).filter((credential) => resistsGuessing(credential.value));
-        return send(res, 200, { text: scrub(parsed.data.text, credentials) });
-    }
-    const server = createServer((req, res) => {
-        handle(req, res).catch((error) => {
-            if (error instanceof BodyTooLarge)
-                return send(res, 413, { error: "text too large to scrub" });
-            options.log?.(`socket request failed: ${error instanceof Error ? error.name : "unknown"}`);
-            send(res, 500, { error: "scrub failed" });
-        });
-    });
-    return {
-        async listen() {
-            await mkdir(dirname(options.socketPath), { recursive: true });
-            await rm(options.socketPath, { force: true });
-            await new Promise((resolve, reject) => {
-                server.once("error", reject);
-                server.listen(options.socketPath, () => resolve());
-            });
-            await chmod(options.socketPath, 0o666);
-        },
-        async close() {
-            await new Promise((resolve) => server.close(() => resolve()));
-        },
-    };
-}
-//# sourceMappingURL=socket-service.js.map

package/dist/broker/socket-service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"socket-service.js","sourceRoot":"","sources":["../../src/broker/socket-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACvD,MAAM,mBAAmB,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;AAEjF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE1D,6GAA6G;AAC7G,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC;AAClD,CAAC;AAID,MAAM,YAAa,SAAQ,KAAK;CAAG;AAEnC,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,KAAa;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAOnC;IACC,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IACrH,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IAErG,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACjH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxC,IAAI,KAAK,YAAY,YAAY;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,EAAE,CAAC,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/socket-service.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=socket-service.test.d.ts.map

package/dist/broker/socket-service.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"socket-service.test.d.ts","sourceRoot":"","sources":["../../src/broker/socket-service.test.ts"],"names":[],"mappings":""}

package/dist/broker/socket-service.test.js

@@ -1,73 +0,0 @@
-import { mkdtempSync } from "node:fs";
-import { request } from "node:http";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, describe, expect, it } from "vitest";
-import { scrubViaBroker } from "./broker-client.js";
-import { createCredentialCache } from "./credential-cache.js";
-import { createSocketService } from "./socket-service.js";
-const VALUE = "shpat_0a1b2c3d4e5f6a7b";
-const WEAK_PASSWORD = ["Hunter", "2024!"].join("");
-let service = null;
-afterEach(async () => {
-    await service?.close();
-    service = null;
-});
-async function start(limits = {}) {
-    const socketPath = join(mkdtempSync(join(tmpdir(), "broker-")), "broker.sock");
-    const cache = createCredentialCache({
-        fetchCredentials: () => Promise.resolve([
-            { name: "shop", value: VALUE, allowedHosts: ["acme.myshopify.com"] },
-            { name: "login", value: WEAK_PASSWORD, allowedHosts: ["app.example.com"] },
-        ]),
-    });
-    service = createSocketService({ cache, socketPath, ...limits });
-    await service.listen();
-    return { socketPath };
-}
-function get(socketPath, path) {
-    return new Promise((resolve, reject) => {
-        const req = request({ socketPath, path, method: "GET" }, (res) => {
-            let body = "";
-            res.setEncoding("utf8");
-            res.on("data", (chunk) => {
-                body += chunk;
-            });
-            res.on("end", () => resolve(body));
-        });
-        req.on("error", reject);
-        req.end();
-    });
-}
-describe("broker socket service", () => {
-    it("scrubs a value back to its placeholder for the bridge", async () => {
-        const { socketPath } = await start();
-        const out = await scrubViaBroker(`tool said ${VALUE} and ${btoa(VALUE)}`, { socketPath });
-        expect(out).toBe("tool said {{credential:shop}} and {{credential:shop}}");
-    });
-    it("never confirms a guess at a value a wordlist could reach", async () => {
-        // The agent writes the text it asks to have scrubbed: scrubbing a guessable
-        // password would tell it which of a million guesses was right.
-        const { socketPath } = await start();
-        const out = await scrubViaBroker(`guesses: password1 ${WEAK_PASSWORD} letmein`, { socketPath });
-        expect(out).toBe(`guesses: password1 ${WEAK_PASSWORD} letmein`);
-    });
-    it("reports how many credentials it holds, never what they are", async () => {
-        const { socketPath } = await start();
-        await scrubViaBroker("warm the cache", { socketPath });
-        const health = await get(socketPath, "/health");
-        expect(JSON.parse(health)).toEqual({ ok: true, credentials: 2 });
-        expect(health).not.toContain(VALUE);
-    });
-    it("answers 429 once a caller has sent more text than its byte budget allows", async () => {
-        const { socketPath } = await start({ scrubBytes: { capacity: 100, perSecond: 1 } });
-        const text = "x".repeat(60);
-        await scrubViaBroker(text, { socketPath });
-        await expect(scrubViaBroker(text, { socketPath })).rejects.toThrow("429");
-    });
-    it("returns the text unchanged when no broker is running", async () => {
-        const socketPath = join(mkdtempSync(join(tmpdir(), "broker-")), "missing.sock");
-        expect(await scrubViaBroker(`raw ${VALUE}`, { socketPath })).toBe(`raw ${VALUE}`);
-    });
-});
-//# sourceMappingURL=socket-service.test.js.map

package/dist/broker/socket-service.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"socket-service.test.js","sourceRoot":"","sources":["../../src/broker/socket-service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAE9E,MAAM,KAAK,GAAG,wBAAwB,CAAC;AACvC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnD,IAAI,OAAO,GAAyB,IAAI,CAAC;AAEzC,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACvB,OAAO,GAAG,IAAI,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,KAAK,CAAC,MAAM,GAA6D,EAAE;IACxF,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,qBAAqB,CAAC;QAClC,gBAAgB,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,OAAO,CAAC;YACd,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;YACpE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC3E,CAAC;KACL,CAAC,CAAC;IACH,OAAO,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAChE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,GAAG,CAAC,UAAkB,EAAE,IAAY;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC/D,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,IAAI,KAAK,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAErC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE1F,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,4EAA4E;QAC5E,+DAA+D;QAC/D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAErC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,sBAAsB,aAAa,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAEhG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,aAAa,UAAU,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACrC,MAAM,cAAc,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEhD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAE5B,MAAM,cAAc,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE3C,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAEhF,MAAM,CAAC,MAAM,cAAc,CAAC,OAAO,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/token-bucket.d.ts

@@ -1,9 +0,0 @@
-/** A token bucket: up to `burst` tokens at once, refilled at `ratePerSecond`; a take may cost more than one. */
-export declare function createTokenBucket(options: {
-    ratePerSecond: number;
-    burst: number;
-    now?: () => number;
-}): {
-    take(cost?: number): boolean;
-};
-//# sourceMappingURL=token-bucket.d.ts.map

package/dist/broker/token-bucket.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-bucket.d.ts","sourceRoot":"","sources":["../../src/broker/token-bucket.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;IAKnG,IAAI,iBAAY,OAAO;EAS1B"}

package/dist/broker/token-bucket.js

@@ -1,18 +0,0 @@
-/** A token bucket: up to `burst` tokens at once, refilled at `ratePerSecond`; a take may cost more than one. */
-export function createTokenBucket(options) {
-    const now = options.now ?? Date.now;
-    let tokens = options.burst;
-    let last = now();
-    return {
-        take(cost = 1) {
-            const at = now();
-            tokens = Math.min(options.burst, tokens + ((at - last) / 1000) * options.ratePerSecond);
-            last = at;
-            if (tokens < cost)
-                return false;
-            tokens -= cost;
-            return true;
-        },
-    };
-}
-//# sourceMappingURL=token-bucket.js.map

package/dist/broker/token-bucket.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-bucket.js","sourceRoot":"","sources":["../../src/broker/token-bucket.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,MAAM,UAAU,iBAAiB,CAAC,OAAqE;IACrG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,IAAI,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC3B,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;IACjB,OAAO;QACL,IAAI,CAAC,IAAI,GAAG,CAAC;YACX,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;YACxF,IAAI,GAAG,EAAE,CAAC;YACV,IAAI,MAAM,GAAG,IAAI;gBAAE,OAAO,KAAK,CAAC;YAChC,MAAM,IAAI,IAAI,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/usage-reporter.d.ts

@@ -1,18 +0,0 @@
-/**
- * Batches "credential X was sent to host Y" so Baker can show when each
- * credential was last used, without a call per request: at most one report
- * every 30 seconds, each pair once, 100 pairs per call (the contract's cap).
- */
-import type { CredentialUse } from "./baker-api.ts";
-export declare const USAGE_FLUSH_INTERVAL_MS = 30000;
-export type UsageReporter = {
-    record(name: string, host: string): void;
-    flush(): Promise<void>;
-    /** Starts the periodic flush; returns a function that stops it. */
-    start(intervalMs?: number): () => void;
-};
-export declare function createUsageReporter(options: {
-    reportUsage: (uses: CredentialUse[]) => Promise<void>;
-    log?: (message: string) => void;
-}): UsageReporter;
-//# sourceMappingURL=usage-reporter.d.ts.map

package/dist/broker/usage-reporter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"usage-reporter.d.ts","sourceRoot":"","sources":["../../src/broker/usage-reporter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAG9C,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,mEAAmE;IACnE,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC;CACxC,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,aAAa,CA2BhB"}

package/dist/broker/usage-reporter.js

@@ -1,31 +0,0 @@
-export const USAGE_FLUSH_INTERVAL_MS = 30_000;
-const MAX_USES_PER_REPORT = 100;
-export function createUsageReporter(options) {
-    const pending = new Map();
-    async function flush() {
-        while (pending.size > 0) {
-            const batch = [...pending.entries()].slice(0, MAX_USES_PER_REPORT);
-            for (const [key] of batch)
-                pending.delete(key);
-            try {
-                await options.reportUsage(batch.map(([, use]) => use));
-            }
-            catch (error) {
-                options.log?.(`usage report failed, dropping ${batch.length} uses: ${String(error)}`);
-                return;
-            }
-        }
-    }
-    return {
-        record(name, host) {
-            pending.set(`${name}\u0000${host}`, { name, host });
-        },
-        flush,
-        start(intervalMs = USAGE_FLUSH_INTERVAL_MS) {
-            const timer = setInterval(() => void flush(), intervalMs);
-            timer.unref();
-            return () => clearInterval(timer);
-        },
-    };
-}
-//# sourceMappingURL=usage-reporter.js.map

package/dist/broker/usage-reporter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"usage-reporter.js","sourceRoot":"","sources":["../../src/broker/usage-reporter.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAShC,MAAM,UAAU,mBAAmB,CAAC,OAGnC;IACC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEjD,KAAK,UAAU,KAAK;QAClB,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACnE,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK;gBAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,EAAE,CAAC,iCAAiC,KAAK,CAAC,MAAM,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtF,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM,CAAC,IAAI,EAAE,IAAI;YACf,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,SAAS,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,KAAK;QACL,KAAK,CAAC,UAAU,GAAG,uBAAuB;YACxC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;YAC1D,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/usage-reporter.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=usage-reporter.test.d.ts.map

package/dist/broker/usage-reporter.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"usage-reporter.test.d.ts","sourceRoot":"","sources":["../../src/broker/usage-reporter.test.ts"],"names":[],"mappings":""}

package/dist/broker/usage-reporter.test.js

@@ -1,20 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { createUsageReporter } from "./usage-reporter.js";
-describe("createUsageReporter", () => {
-    it("reports each credential and host once per flush, and nothing when idle", async () => {
-        const batches = [];
-        const reporter = createUsageReporter({ reportUsage: async (uses) => void batches.push(uses) });
-        reporter.record("shop", "acme.myshopify.com");
-        reporter.record("shop", "acme.myshopify.com");
-        reporter.record("meta-token", "graph.facebook.com");
-        await reporter.flush();
-        await reporter.flush();
-        expect(batches).toEqual([
-            [
-                { name: "shop", host: "acme.myshopify.com" },
-                { name: "meta-token", host: "graph.facebook.com" },
-            ],
-        ]);
-    });
-});
-//# sourceMappingURL=usage-reporter.test.js.map

package/dist/broker/usage-reporter.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"usage-reporter.test.js","sourceRoot":"","sources":["../../src/broker/usage-reporter.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE/F,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC9C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;QAC9C,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACpD,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEvB,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;YACtB;gBACE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE;gBAC5C,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,oBAAoB,EAAE;aACnD;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/hono/credential-input.d.ts

@@ -1,39 +0,0 @@
-import { z } from "zod";
-export declare const CREDENTIAL_INPUT_TOOL_NAME = "mcp__baker_ui__request_credential";
-declare const credentialRequestShape: z.ZodObject<{
-    label: z.ZodString;
-    reason: z.ZodString;
-    allowedHosts: z.ZodArray<z.ZodString>;
-    name: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
-export declare const credentialInputToolShape: {
-    label: z.ZodString;
-    reason: z.ZodString;
-    allowedHosts: z.ZodArray<z.ZodString>;
-    name: z.ZodOptional<z.ZodString>;
-    resolution: z.ZodOptional<z.ZodObject<{}, z.core.$catchall<z.ZodUnknown>>>;
-};
-export type CredentialInputRequest = z.infer<typeof credentialRequestShape>;
-export declare const credentialInputResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    status: z.ZodLiteral<"stored">;
-    name: z.ZodString;
-    placeholder: z.ZodString;
-    allowedHosts: z.ZodArray<z.ZodString>;
-}, z.core.$strip>, z.ZodObject<{
-    status: z.ZodLiteral<"declined">;
-    reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>], "status">;
-export type CredentialInputResult = z.infer<typeof credentialInputResultSchema>;
-/** Parse-at-boundary for the result posted to `POST /credential-input-decision`. */
-export declare function parseCredentialInputResult(value: unknown): CredentialInputResult | null;
-/** `canUseTool` sees the raw model input, before MCP validation. */
-export declare function normalizeCredentialInputToolInput(input: unknown): CredentialInputRequest | null;
-export declare function createCredentialInputTool(): import("@anthropic-ai/claude-agent-sdk").SdkMcpToolDefinition<{
-    label: z.ZodString;
-    reason: z.ZodString;
-    allowedHosts: z.ZodArray<z.ZodString>;
-    name: z.ZodOptional<z.ZodString>;
-    resolution: z.ZodOptional<z.ZodObject<{}, z.core.$catchall<z.ZodUnknown>>>;
-}>;
-export {};
-//# sourceMappingURL=credential-input.d.ts.map

package/dist/hono/credential-input.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-input.d.ts","sourceRoot":"","sources":["../../src/hono/credential-input.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,0BAA0B,sCAAsC,CAAC;AAE9E,QAAA,MAAM,sBAAsB;;;;;iBAwB1B,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;CAOpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,2BAA2B;;;;;;;;6BAQtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,oFAAoF;AACpF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAGvF;AAED,oEAAoE;AACpE,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAG/F;AAUD,wBAAgB,yBAAyB;;;;;;GAYxC"}