@koda-sl/baker-bridge 0.119.0 → 0.121.0-dev.ba3f112da

package/dist/broker/baker-api.js

@@ -1,55 +0,0 @@
-/**
- * The broker's two calls to Baker: fetch the company's credentials (the only
- * route that ever returns a value) and report which were used where. The
- * shapes mirror `brokerResolveResponseSchema` / `brokerUsageRequestSchema` in
- * `@baker/api/credentials`, which the published bridge cannot import.
- * Success is `{ ok: true, data }`; a failure is any non-2xx status with
- * `{ code, error }`.
- */
-import { z } from "zod";
-const resolveResponseSchema = z.object({
-    credentials: z.array(z.object({ name: z.string(), value: z.string(), allowedHosts: z.array(z.string()) })),
-});
-const successSchema = z.object({ ok: z.literal(true), data: z.unknown().optional() });
-const failureSchema = z.object({ code: z.string() });
-/**
- * Baker refused the broker's token: Credentials were switched off, the company
- * suspended, or the Runtime is no longer active. Unlike a failed request, this
- * is an answer — the broker must stop using what it holds.
- */
-export class CredentialsRefused extends Error {
-    status;
-    constructor(status) {
-        super(`Baker refused the broker (${status})`);
-        this.status = status;
-    }
-}
-const TIMEOUT_MS = 10_000;
-export function createBakerBrokerApi(options) {
-    async function post(path, body) {
-        const response = await fetch(new URL(path, options.siteUrl), {
-            method: "POST",
-            headers: { authorization: `Broker ${options.token}`, "content-type": "application/json" },
-            body: JSON.stringify(body),
-            signal: AbortSignal.timeout(TIMEOUT_MS),
-        });
-        const payload = await response.json().catch(() => null);
-        if (response.status === 401 || response.status === 403)
-            throw new CredentialsRefused(response.status);
-        if (!response.ok) {
-            const code = failureSchema.safeParse(payload).data?.code ?? "UNKNOWN";
-            throw new Error(`${path} answered ${response.status} ${code}`);
-        }
-        return successSchema.parse(payload).data;
-    }
-    return {
-        async fetchCredentials() {
-            const data = resolveResponseSchema.parse(await post("/api/runtime/credentials/resolve", {}));
-            return data.credentials;
-        },
-        async reportUsage(uses) {
-            await post("/api/runtime/credentials/usage", { uses });
-        },
-    };
-}
-//# sourceMappingURL=baker-api.js.map

package/dist/broker/baker-api.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"baker-api.js","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;CAC3G,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAIrD;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB,MAAM;IAA3B,YAAqB,MAAc;QACjC,KAAK,CAAC,6BAA6B,MAAM,GAAG,CAAC,CAAC;sBAD3B,MAAM;IAE3B,CAAC;CACF;AAOD,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAAC,OAA2C;IAC9E,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAa;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB;YACpB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI;YACpB,MAAM,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/broker-client.d.ts

@@ -1,10 +0,0 @@
-export declare const DEFAULT_BROKER_SOCKET = "/run/baker/broker.sock";
-export type BrokerClientOptions = {
-    socketPath?: string;
-    timeoutMs?: number;
-};
-/** Whether a broker runs in this sandbox: its socket exists. */
-export declare function brokerRunning(options?: BrokerClientOptions): boolean;
-/** `text` with every stored credential value replaced by its placeholder. */
-export declare function scrubViaBroker(text: string, options?: BrokerClientOptions): Promise<string>;
-//# sourceMappingURL=broker-client.d.ts.map

package/dist/broker/broker-client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"broker-client.d.ts","sourceRoot":"","sources":["../../src/broker/broker-client.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAG9D,MAAM,MAAM,mBAAmB,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAM9E,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAExE;AA+BD,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrG"}

package/dist/broker/broker-client.js

@@ -1,60 +0,0 @@
-/**
- * The bridge's side of the broker socket. Dependency-free on purpose: the
- * bridge imports it on the hot path of every tool result.
- *
- * When no broker runs (no socket file — local dev, or a Runtime without
- * credentials) every call is a fast no-op and `scrubViaBroker` returns the
- * text unchanged. Any other failure (timeout, 413, 429, a crashed broker) is
- * thrown so the caller decides whether to hold the text back.
- */
-import { existsSync } from "node:fs";
-import { request } from "node:http";
-export const DEFAULT_BROKER_SOCKET = "/run/baker/broker.sock";
-const DEFAULT_TIMEOUT_MS = 2_000;
-function isMissingSocket(error) {
-    return error instanceof Error && "code" in error && error.code === "ENOENT";
-}
-/** Whether a broker runs in this sandbox: its socket exists. */
-export function brokerRunning(options = {}) {
-    return existsSync(options.socketPath ?? DEFAULT_BROKER_SOCKET);
-}
-function call(path, body, options) {
-    const socketPath = options.socketPath ?? DEFAULT_BROKER_SOCKET;
-    if (!brokerRunning(options))
-        return Promise.resolve(null);
-    return new Promise((resolve, reject) => {
-        const req = request({
-            socketPath,
-            path,
-            method: "POST",
-            headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) },
-            timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
-        }, (res) => {
-            const chunks = [];
-            res.on("data", (chunk) => chunks.push(chunk));
-            res.on("end", () => {
-                const text = Buffer.concat(chunks).toString("utf8");
-                if (res.statusCode === 200)
-                    resolve(text);
-                else
-                    reject(new Error(`credential broker ${path} answered ${res.statusCode}`));
-            });
-            res.on("error", reject);
-        });
-        req.on("timeout", () => req.destroy(new Error(`credential broker ${path} timed out`)));
-        req.on("error", (error) => (isMissingSocket(error) ? resolve(null) : reject(error)));
-        req.end(body);
-    });
-}
-/** `text` with every stored credential value replaced by its placeholder. */
-export async function scrubViaBroker(text, options = {}) {
-    const response = await call("/scrub", JSON.stringify({ text }), options);
-    if (response === null)
-        return text;
-    const parsed = JSON.parse(response);
-    if (typeof parsed === "object" && parsed !== null && "text" in parsed && typeof parsed.text === "string") {
-        return parsed.text;
-    }
-    throw new Error("credential broker /scrub answered without text");
-}
-//# sourceMappingURL=broker-client.js.map

package/dist/broker/broker-client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"broker-client.js","sourceRoot":"","sources":["../../src/broker/broker-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAC9D,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAIjC,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,OAAO,GAAwB,EAAE;IAC7D,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY,EAAE,OAA4B;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CACjB;YACE,UAAU;YACV,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YAC1F,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;SACjD,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;;oBACrC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,aAAa,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;QACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,OAAO,GAAwB,EAAE;IAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzG,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC"}

package/dist/broker/ca.d.ts

@@ -1,38 +0,0 @@
-export declare const DEFAULT_CA_DIR = "/etc/baker-ca";
-export declare const SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
-export type CertificateAuthority = {
-    keyPath: string;
-    certPath: string;
-    key: string;
-    cert: string;
-};
-/**
- * Env for every process the agent runs. `NODE_EXTRA_CA_CERTS` adds our CA to
- * Node's roots; the other three *replace* a client's bundle, so they name the
- * system bundle, which carries our CA once `update-ca-certificates` ran.
- */
-export declare function agentProxyEnv(options: {
-    port: number;
-    caCertPath: string;
-    /** Hosts that bypass the broker entirely, e.g. the model gateway carrying the agent's own conversation. */
-    noProxyHosts: readonly string[];
-}): Record<string, string>;
-/**
- * Reuses the CA in `dir`, or creates one (key 0600, cert 0644). With
- * `installSystemTrust`, also adds the cert to the system bundle — needs root;
- * a failure is logged, not thrown, so the proxy still starts.
- */
-export declare function ensureCertificateAuthority(options: {
-    dir?: string;
-    installSystemTrust: boolean;
-    log?: (message: string) => void;
-}): Promise<CertificateAuthority>;
-/**
- * Writes the certificate to `target` as a new file. The system trust directory
- * is under /usr/local, which the agent can write, and the broker is root: a
- * copy would follow a link the agent planted there onto any file. Removing the
- * name first drops such a link, and an exclusive create refuses one planted
- * again in between rather than following it.
- */
-export declare function placeTrustedCert(certPath: string, target: string): Promise<void>;
-//# sourceMappingURL=ca.d.ts.map

package/dist/broker/ca.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAC9C,eAAO,MAAM,gBAAgB,uCAAuC,CAAC;AAKrE,MAAM,MAAM,oBAAoB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBzB;AASD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAahC;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGtF"}

package/dist/broker/ca.js

@@ -1,80 +0,0 @@
-/**
- * The broker's certificate authority — what lets it read HTTPS the agent sends
- * through it — and the environment that points the agent's clients at it.
- */
-import { execFile } from "node:child_process";
-import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { promisify } from "node:util";
-import { generateCACertificate } from "mockttp";
-export const DEFAULT_CA_DIR = "/etc/baker-ca";
-export const SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
-/** By absolute path: the broker runs as root and must never resolve a binary through PATH. */
-const UPDATE_CA_CERTIFICATES = "/usr/sbin/update-ca-certificates";
-const SYSTEM_TRUST_PATH = "/usr/local/share/ca-certificates/baker-credential-broker.crt";
-/**
- * Env for every process the agent runs. `NODE_EXTRA_CA_CERTS` adds our CA to
- * Node's roots; the other three *replace* a client's bundle, so they name the
- * system bundle, which carries our CA once `update-ca-certificates` ran.
- */
-export function agentProxyEnv(options) {
-    const proxy = `http://127.0.0.1:${options.port}`;
-    const noProxy = ["localhost", "127.0.0.1", "::1", ...options.noProxyHosts].join(",");
-    return {
-        HTTPS_PROXY: proxy,
-        HTTP_PROXY: proxy,
-        https_proxy: proxy,
-        http_proxy: proxy,
-        NO_PROXY: noProxy,
-        no_proxy: noProxy,
-        NODE_USE_ENV_PROXY: "1",
-        NODE_EXTRA_CA_CERTS: options.caCertPath,
-        REQUESTS_CA_BUNDLE: SYSTEM_CA_BUNDLE,
-        SSL_CERT_FILE: SYSTEM_CA_BUNDLE,
-        CURL_CA_BUNDLE: SYSTEM_CA_BUNDLE,
-    };
-}
-function exists(path) {
-    return stat(path).then(() => true, () => false);
-}
-/**
- * Reuses the CA in `dir`, or creates one (key 0600, cert 0644). With
- * `installSystemTrust`, also adds the cert to the system bundle — needs root;
- * a failure is logged, not thrown, so the proxy still starts.
- */
-export async function ensureCertificateAuthority(options) {
-    const dir = options.dir ?? DEFAULT_CA_DIR;
-    const keyPath = join(dir, "ca.key");
-    const certPath = join(dir, "ca.pem");
-    if (!(await exists(keyPath)) || !(await exists(certPath))) {
-        const ca = await generateCACertificate({ subject: { commonName: "Baker Credential Broker" }, bits: 2048 });
-        await mkdir(dir, { recursive: true, mode: 0o755 });
-        await writeFile(keyPath, ca.key, { mode: 0o600 });
-        await writeFile(certPath, ca.cert, { mode: 0o644 });
-        options.log?.(`created certificate authority in ${dir}`);
-    }
-    if (options.installSystemTrust)
-        await installSystemTrust(certPath, options.log);
-    return { keyPath, certPath, key: await readFile(keyPath, "utf8"), cert: await readFile(certPath, "utf8") };
-}
-/**
- * Writes the certificate to `target` as a new file. The system trust directory
- * is under /usr/local, which the agent can write, and the broker is root: a
- * copy would follow a link the agent planted there onto any file. Removing the
- * name first drops such a link, and an exclusive create refuses one planted
- * again in between rather than following it.
- */
-export async function placeTrustedCert(certPath, target) {
-    await rm(target, { force: true });
-    await writeFile(target, await readFile(certPath), { flag: "wx", mode: 0o644 });
-}
-async function installSystemTrust(certPath, log) {
-    try {
-        await placeTrustedCert(certPath, SYSTEM_TRUST_PATH);
-        await promisify(execFile)(UPDATE_CA_CERTIFICATES);
-    }
-    catch (error) {
-        log?.(`could not add the certificate authority to the system bundle: ${String(error)}`);
-    }
-}
-//# sourceMappingURL=ca.js.map

package/dist/broker/ca.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ca.js","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AACrE,8FAA8F;AAC9F,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AAIzF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAK7B;IACC,MAAM,KAAK,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,OAAO;QACjB,kBAAkB,EAAE,GAAG;QACvB,mBAAmB,EAAE,OAAO,CAAC,UAAU;QACvC,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,gBAAgB;QAC/B,cAAc,EAAE,gBAAgB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAIhD;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IACrE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,GAA+B;IACjF,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,CAAC,iEAAiE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/broker/ca.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=ca.test.d.ts.map

package/dist/broker/ca.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ca.test.d.ts","sourceRoot":"","sources":["../../src/broker/ca.test.ts"],"names":[],"mappings":""}

package/dist/broker/ca.test.js

@@ -1,58 +0,0 @@
-import { lstatSync, mkdtempSync, readFileSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { describe, expect, it } from "vitest";
-import { agentProxyEnv, ensureCertificateAuthority, placeTrustedCert } from "./ca.js";
-describe("agentProxyEnv", () => {
-    it("routes every client through the broker and trusts its CA without dropping the system roots", () => {
-        const env = agentProxyEnv({ port: 8877, caCertPath: "/etc/baker-ca/ca.pem", noProxyHosts: [] });
-        expect(env).toEqual({
-            HTTPS_PROXY: "http://127.0.0.1:8877",
-            HTTP_PROXY: "http://127.0.0.1:8877",
-            https_proxy: "http://127.0.0.1:8877",
-            http_proxy: "http://127.0.0.1:8877",
-            NO_PROXY: "localhost,127.0.0.1,::1",
-            no_proxy: "localhost,127.0.0.1,::1",
-            NODE_USE_ENV_PROXY: "1",
-            NODE_EXTRA_CA_CERTS: "/etc/baker-ca/ca.pem",
-            REQUESTS_CA_BUNDLE: "/etc/ssl/certs/ca-certificates.crt",
-            SSL_CERT_FILE: "/etc/ssl/certs/ca-certificates.crt",
-            CURL_CA_BUNDLE: "/etc/ssl/certs/ca-certificates.crt",
-        });
-    });
-    it("keeps the named hosts off the broker, so the agent's own model traffic is never rewritten", () => {
-        const env = agentProxyEnv({ port: 8877, caCertPath: "/etc/baker-ca/ca.pem", noProxyHosts: ["openrouter.ai"] });
-        expect([env.NO_PROXY, env.no_proxy]).toEqual([
-            "localhost,127.0.0.1,::1,openrouter.ai",
-            "localhost,127.0.0.1,::1,openrouter.ai",
-        ]);
-    });
-});
-describe("ensureCertificateAuthority", () => {
-    it("creates a private key once and reuses it on the next start", async () => {
-        const dir = join(mkdtempSync(join(tmpdir(), "baker-ca-")), "ca");
-        const first = await ensureCertificateAuthority({ dir, installSystemTrust: false });
-        const second = await ensureCertificateAuthority({ dir, installSystemTrust: false });
-        expect(second).toEqual(first);
-        expect(statSync(first.keyPath).mode & 0o777).toBe(0o600);
-        expect(statSync(first.certPath).mode & 0o777).toBe(0o644);
-        expect(readFileSync(first.certPath, "utf8")).toContain("BEGIN CERTIFICATE");
-    });
-});
-describe("placeTrustedCert", () => {
-    it("replaces a link the agent planted where the certificate goes, and never writes through it", async () => {
-        // The trust directory is under /usr/local, which the agent can write; the broker is root.
-        const dir = mkdtempSync(join(tmpdir(), "baker-trust-"));
-        const victim = join(dir, "sudoers");
-        writeFileSync(victim, "user ALL=(ALL) ALL\n");
-        const target = join(dir, "baker-credential-broker.crt");
-        symlinkSync(victim, target);
-        const cert = join(dir, "ca.pem");
-        writeFileSync(cert, "-----BEGIN CERTIFICATE-----\n");
-        await placeTrustedCert(cert, target);
-        expect(readFileSync(victim, "utf8")).toBe("user ALL=(ALL) ALL\n");
-        expect(lstatSync(target).isSymbolicLink()).toBe(false);
-        expect(readFileSync(target, "utf8")).toBe("-----BEGIN CERTIFICATE-----\n");
-    });
-});
-//# sourceMappingURL=ca.test.js.map

package/dist/broker/ca.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ca.test.js","sourceRoot":"","sources":["../../src/broker/ca.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEtF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,kBAAkB,EAAE,GAAG;YACvB,mBAAmB,EAAE,sBAAsB;YAC3C,kBAAkB,EAAE,oCAAoC;YACxD,aAAa,EAAE,oCAAoC;YACnD,cAAc,EAAE,oCAAoC;SACrD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAE/G,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,uCAAuC;YACvC,uCAAuC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,0FAA0F;QAC1F,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,aAAa,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QACxD,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjC,aAAa,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;QAErD,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAClE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/credential-cache.d.ts

@@ -1,24 +0,0 @@
-import type { ResolvedCredential } from "./credential-text.ts";
-export declare const CREDENTIAL_TTL_MS = 10000;
-/** Each fetch decrypts every credential the company has; a refusal loop may force one this often at most. */
-export declare const MIN_REFRESH_INTERVAL_MS = 5000;
-export type FetchCredentials = () => Promise<ResolvedCredential[]>;
-export type CredentialCache = {
-    get(): Promise<ResolvedCredential[] | null>;
-    /** Every value to scrub: the current table plus any value that has left it. */
-    scrubbable(): Promise<ResolvedCredential[]>;
-    /**
-     * Drops the table so the next read fetches it again — unless an early
-     * refresh already happened within 5 seconds. Returns whether it dropped it.
-     */
-    refresh(): boolean;
-    /** How many credentials the last fetch returned (0 before the first). */
-    size(): number;
-};
-export declare function createCredentialCache(options: {
-    fetchCredentials: FetchCredentials;
-    now?: () => number;
-    ttlMs?: number;
-    log?: (message: string) => void;
-}): CredentialCache;
-//# sourceMappingURL=credential-cache.d.ts.map

package/dist/broker/credential-cache.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-cache.d.ts","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,iBAAiB,QAAS,CAAC;AACxC,6GAA6G;AAC7G,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,IAAI,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,UAAU,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5C;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC;IACnB,yEAAyE;IACzE,IAAI,IAAI,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,eAAe,CAsDlB"}

package/dist/broker/credential-cache.js

@@ -1,69 +0,0 @@
-/**
- * The broker's copy of the company's credentials, fetched from Baker on first
- * need and kept for 10 seconds. Concurrent reads share one fetch. A failed
- * fetch keeps the last good table until the next refresh, but a refusal
- * (`CredentialsRefused`) drops it: Baker has said no. Before any fetch
- * has succeeded there is no table (null), which callers must treat as
- * "credentials unavailable", not "no credentials".
- *
- * A value that leaves the table — refused or removed — may still be on its
- * way back in a response to a request that carried it, so `scrubbable()`
- * keeps scrubbing it for the broker's lifetime. It is never sent again.
- */
-import { CredentialsRefused } from "./baker-api.js";
-export const CREDENTIAL_TTL_MS = 10_000;
-/** Each fetch decrypts every credential the company has; a refusal loop may force one this often at most. */
-export const MIN_REFRESH_INTERVAL_MS = 5_000;
-export function createCredentialCache(options) {
-    const now = options.now ?? Date.now;
-    const ttlMs = options.ttlMs ?? CREDENTIAL_TTL_MS;
-    let entry = null;
-    let lastGood = null;
-    let lastRefreshAt = Number.NEGATIVE_INFINITY;
-    const retired = new Map();
-    function replaceTable(next) {
-        const kept = new Set(next?.map((credential) => credential.value));
-        for (const credential of lastGood ?? []) {
-            if (!kept.has(credential.value))
-                retired.set(credential.value, credential);
-        }
-        for (const value of kept)
-            retired.delete(value);
-        lastGood = next;
-    }
-    function get() {
-        if (entry === null || now() - entry.at >= ttlMs) {
-            const table = options.fetchCredentials().then((credentials) => {
-                replaceTable(credentials);
-                return credentials;
-            }, (error) => {
-                if (error instanceof CredentialsRefused) {
-                    options.log?.(`${error.message}; dropping ${lastGood?.length ?? 0} cached credentials`);
-                    replaceTable(null);
-                    return null;
-                }
-                options.log?.(`credential fetch failed, keeping ${lastGood?.length ?? 0} cached: ${String(error)}`);
-                return lastGood;
-            });
-            entry = { at: now(), table };
-        }
-        return entry.table;
-    }
-    return {
-        get,
-        async scrubbable() {
-            return [...((await get()) ?? []), ...retired.values()];
-        },
-        refresh() {
-            if (now() - lastRefreshAt < MIN_REFRESH_INTERVAL_MS)
-                return false;
-            lastRefreshAt = now();
-            entry = null;
-            return true;
-        },
-        size() {
-            return lastGood?.length ?? 0;
-        },
-    };
-}
-//# sourceMappingURL=credential-cache.js.map

package/dist/broker/credential-cache.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-cache.js","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAiB7C,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IACjD,IAAI,KAAK,GAAuE,IAAI,CAAC;IACrF,IAAI,QAAQ,GAAgC,IAAI,CAAC;IACjD,IAAI,aAAa,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEtD,SAAS,YAAY,CAAC,IAAiC;QACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,KAAK,MAAM,UAAU,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,SAAS,GAAG;QACV,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAC3C,CAAC,WAAW,EAAE,EAAE;gBACd,YAAY,CAAC,WAAW,CAAC,CAAC;gBAC1B,OAAO,WAAW,CAAC;YACrB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBACjB,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,cAAc,QAAQ,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC;oBACxF,YAAY,CAAC,IAAI,CAAC,CAAC;oBACnB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,QAAQ,EAAE,MAAM,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACpG,OAAO,QAAQ,CAAC;YAClB,CAAC,CACF,CAAC;YACF,KAAK,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO;QACL,GAAG;QACH,KAAK,CAAC,UAAU;YACd,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;YACL,IAAI,GAAG,EAAE,GAAG,aAAa,GAAG,uBAAuB;gBAAE,OAAO,KAAK,CAAC;YAClE,aAAa,GAAG,GAAG,EAAE,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI;YACF,OAAO,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/credential-cache.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=credential-cache.test.d.ts.map

package/dist/broker/credential-cache.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-cache.test.d.ts","sourceRoot":"","sources":["../../src/broker/credential-cache.test.ts"],"names":[],"mappings":""}

package/dist/broker/credential-cache.test.js

@@ -1,120 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { CredentialsRefused } from "./baker-api.js";
-import { createCredentialCache } from "./credential-cache.js";
-function fetcher() {
-    let calls = 0;
-    return {
-        get calls() {
-            return calls;
-        },
-        fetchCredentials: async () => {
-            await Promise.resolve();
-            calls += 1;
-            return [{ name: `v${calls}`, value: "secret-value", allowedHosts: ["api.example.com"] }];
-        },
-    };
-}
-describe("createCredentialCache", () => {
-    it("reuses the table for 10 seconds, then fetches it again", async () => {
-        let clock = 0;
-        const source = fetcher();
-        const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => clock });
-        await cache.get();
-        clock = 9_999;
-        await cache.get();
-        clock = 10_000;
-        const table = await cache.get();
-        expect(source.calls).toBe(2);
-        expect(table?.map((credential) => credential.name)).toEqual(["v2"]);
-    });
-    it("keeps the last good table when a refresh fails, and has none when no fetch ever succeeded", async () => {
-        let clock = 0;
-        let failing = true;
-        const cache = createCredentialCache({
-            fetchCredentials: async () => {
-                await Promise.resolve();
-                if (failing)
-                    throw new Error("502 upstream");
-                return [{ name: "shop", value: "secret-value", allowedHosts: ["api.example.com"] }];
-            },
-            now: () => clock,
-        });
-        expect(await cache.get()).toBeNull();
-        failing = false;
-        clock = 10_000;
-        await cache.get();
-        failing = true;
-        clock = 20_000;
-        expect((await cache.get())?.map((credential) => credential.name)).toEqual(["shop"]);
-    });
-    it("drops the table once Baker refuses the broker, so no value is sent after Credentials are switched off", async () => {
-        let clock = 0;
-        let refused = false;
-        const cache = createCredentialCache({
-            fetchCredentials: async () => {
-                await Promise.resolve();
-                if (refused)
-                    throw new CredentialsRefused(401);
-                return [{ name: "shop", value: "secret-value", allowedHosts: ["api.example.com"] }];
-            },
-            now: () => clock,
-        });
-        await cache.get();
-        refused = true;
-        clock = 10_000;
-        expect(await cache.get()).toBeNull();
-        expect(cache.size()).toBe(0);
-    });
-    it("still scrubs a value it may have sent after Baker refuses the broker or the credential is removed", async () => {
-        let clock = 0;
-        let table = [
-            { name: "shop", value: "shop-secret-value", allowedHosts: ["api.example.com"] },
-            { name: "ads", value: "ads-secret-value", allowedHosts: ["api.example.com"] },
-        ];
-        let refused = false;
-        const cache = createCredentialCache({
-            fetchCredentials: async () => {
-                await Promise.resolve();
-                if (refused)
-                    throw new CredentialsRefused(401);
-                return table;
-            },
-            now: () => clock,
-        });
-        await cache.get();
-        table = table.slice(0, 1);
-        clock = 10_000;
-        const afterRemoval = (await cache.scrubbable()).map((credential) => credential.value);
-        refused = true;
-        clock = 20_000;
-        const afterRefusal = (await cache.scrubbable()).map((credential) => credential.value);
-        expect(afterRemoval.sort()).toEqual(["ads-secret-value", "shop-secret-value"]);
-        expect(afterRefusal.sort()).toEqual(["ads-secret-value", "shop-secret-value"]);
-        expect(await cache.get()).toBeNull();
-    });
-    it("fetches again on the next read after a refresh", async () => {
-        const source = fetcher();
-        const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => 0 });
-        await cache.get();
-        cache.refresh();
-        await cache.get();
-        expect(source.calls).toBe(2);
-    });
-    it("refreshes early at most once every 5 seconds, so refused retries cannot make it fetch on every request", async () => {
-        let clock = 0;
-        const source = fetcher();
-        const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => clock });
-        await cache.get();
-        const refreshed = [];
-        for (clock = 0; clock < 5_000; clock += 500) {
-            refreshed.push(cache.refresh());
-            await cache.get();
-        }
-        clock = 5_000;
-        refreshed.push(cache.refresh());
-        await cache.get();
-        expect(refreshed.filter(Boolean)).toHaveLength(2);
-        expect(source.calls).toBe(3);
-    });
-});
-//# sourceMappingURL=credential-cache.test.js.map

package/dist/broker/credential-cache.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-cache.test.js","sourceRoot":"","sources":["../../src/broker/credential-cache.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS,OAAO;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;gBAC7C,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QAEf,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;QACrH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAC/C,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QAEf,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mGAAmG,EAAE,KAAK,IAAI,EAAE;QACjH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAG;YACV,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;YAC/E,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC9E,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAC/C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtF,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEtF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAEjG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACrG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC;YAC5C,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,GAAG,KAAK,CAAC;QACd,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/credential-text.d.ts

@@ -1,45 +0,0 @@
-/**
- * Hand-copy of the placeholder grammar, host check and scrub in
- * `packages/api/src/credentials/{placeholder,hosts,scrub}.ts`. The bridge is
- * published standalone to npm and cannot depend on the private `@baker/api`,
- * so these are copied rather than imported; `credential-text.test.ts` runs both
- * copies over the same inputs and fails when this one drifts.
- */
-export type CredentialPlaceholder = {
-    name: string;
-    start: number;
-    end: number;
-};
-export type ResolvedCredential = {
-    name: string;
-    value: string;
-    allowedHosts: readonly string[];
-};
-export type ScrubbableCredential = {
-    name: string;
-    value: string;
-};
-export type Substitution = {
-    out: string;
-    used: string[];
-    denied: {
-        name: string;
-        allowedHosts: readonly string[];
-    }[];
-    unknown: string[];
-};
-/** Below this length a value is too likely to occur in unrelated text to be scrubbed. */
-export declare const MIN_SCRUB_LENGTH = 6;
-export declare function renderPlaceholder(name: string): string;
-export declare function parsePlaceholders(text: string): CredentialPlaceholder[];
-/** The credential a value stands for when the whole value is one placeholder, as a tag's secret field holds it. */
-export declare function credentialNamedBy(value: string): string | null;
-export declare function hostAllowed(host: string, patterns: readonly string[]): boolean;
-export declare function substitute(text: string, credentials: readonly ResolvedCredential[], host: string): Substitution;
-/** Every form of a credential a scrub must catch, longest first, so a longer value is never half-replaced by a shorter one. */
-export declare function scrubPatterns(credentials: readonly ScrubbableCredential[]): {
-    needle: string;
-    name: string;
-}[];
-export declare function scrub(text: string, credentials: readonly ScrubbableCredential[]): string;
-//# sourceMappingURL=credential-text.d.ts.map