@koda-sl/baker-bridge 0.119.0 → 0.121.0-dev.ba3f112da

package/dist/broker/proxy.js

@@ -1,147 +0,0 @@
-/**
- * The credential broker: an explicit HTTP(S) proxy (mockttp, TLS intercepted
- * with the broker's own CA) that swaps `{{credential:NAME}}` for the value on
- * the way out and swaps the value back to the placeholder on the way in.
- *
- * Two rules, in order:
- * - A request carrying a placeholder is rewritten by `rewriteRequest` and its
- *   response is scrubbed. mockttp's `beforeResponse` buffers the whole
- *   response, so these responses — event streams included — arrive in one
- *   piece. Headers are always scrubbed; a UTF-8 body, whatever its content
- *   type, is scrubbed up to 10 MB, and anything larger or binary passes through as-is.
- * - Every other request passes straight through, streamed and untouched: no
- *   value was put into it, so there is nothing of ours to take out.
- *
- * Memory: the placeholder check reads each request body in full, and a
- * credential-carrying request's response is buffered in full by mockttp
- * before it is scrubbed (over 10 MB it then passes through unscrubbed).
- * mockttp's `maxBodySize` cannot bound this: in 4.6.3 a body over the limit
- * that a callback matcher has read is forwarded empty, so a large upload would
- * hang or arrive truncated (see the upload test in `proxy.integration.test.ts`).
- */
-import { getLocal } from "mockttp";
-import { createCredentialCache } from "./credential-cache.js";
-import { scrub } from "./credential-text.js";
-import { carriesPlaceholder, MAX_REWRITE_BODY_BYTES, rewriteRequest, sentBasicPairs, } from "./rewrite.js";
-import { createUsageReporter } from "./usage-reporter.js";
-export const DEFAULT_PROXY_PORT = 8877;
-const LOOPBACK_ADDRESSES = new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
-/** Anyone but this machine: the sandbox's ports are reachable from outside it. */
-function fromElsewhere(req) {
-    return !LOOPBACK_ADDRESSES.has(req.remoteIpAddress ?? "");
-}
-async function outgoing(req) {
-    return { url: req.url, headers: req.headers, body: (await req.body.getDecodedBuffer()) ?? null };
-}
-function scrubHeaders(headers, credentials) {
-    let changed = false;
-    const out = {};
-    for (const [name, value] of Object.entries(headers)) {
-        const scrubbed = Array.isArray(value)
-            ? value.map((item) => scrub(item, credentials))
-            : value === undefined
-                ? undefined
-                : scrub(value, credentials);
-        if (JSON.stringify(scrubbed) !== JSON.stringify(value))
-            changed = true;
-        out[name] = scrubbed;
-    }
-    return changed ? out : undefined;
-}
-/**
- * The scrubbed body, or undefined when it is not UTF-8 text, over 10 MB, or
- * holds no value. Any content type: a value echoed as NDJSON, YAML or JSON sent
- * as `application/octet-stream` reaches the agent all the same.
- */
-function scrubBody(raw, credentials) {
-    if (raw === undefined || raw.byteLength > MAX_REWRITE_BODY_BYTES)
-        return undefined;
-    let text;
-    try {
-        text = new TextDecoder("utf-8", { fatal: true }).decode(raw);
-    }
-    catch {
-        return undefined;
-    }
-    const scrubbed = scrub(text, credentials);
-    return scrubbed === text ? undefined : scrubbed;
-}
-export function createBroker(options) {
-    const log = options.log ?? (() => undefined);
-    const cache = createCredentialCache({ fetchCredentials: options.fetchCredentials, log });
-    const usage = createUsageReporter({ reportUsage: options.reportUsage, log });
-    const server = getLocal({
-        https: { key: options.ca.key, cert: options.ca.cert },
-        recordTraffic: false,
-    });
-    const upstreamTrust = { additionalTrustedCAs: (options.upstreamCAs ?? []).map((cert) => ({ cert })) };
-    let stopUsage = () => undefined;
-    async function decide(req) {
-        const request = await outgoing(req);
-        let decision = rewriteRequest(request, await cache.get());
-        if (decision.kind === "reject" && decision.stale && cache.refresh()) {
-            decision = rewriteRequest(request, await cache.get());
-        }
-        return decision;
-    }
-    async function beforeRequest(req) {
-        const decision = await decide(req);
-        const host = new URL(req.url).hostname;
-        if (decision.kind === "pass")
-            return undefined;
-        if (decision.kind === "reject") {
-            log(`refused ${decision.status} for ${host}`);
-            return {
-                response: {
-                    statusCode: decision.status,
-                    headers: { "content-type": "text/plain; charset=utf-8", "x-baker-credential-broker": "refused" },
-                    body: decision.message,
-                },
-            };
-        }
-        for (const name of decision.used)
-            usage.record(name, host);
-        log(`sent ${decision.used.join(", ")} to ${host}`);
-        return {
-            url: decision.url,
-            headers: decision.headers,
-            ...(decision.body === undefined ? {} : { body: decision.body }),
-        };
-    }
-    async function beforeResponse(res, req) {
-        const resolved = await cache.scrubbable();
-        const credentials = [...resolved, ...sentBasicPairs(req.headers, resolved)];
-        const headers = scrubHeaders(res.headers, credentials);
-        const body = scrubBody(await res.body.getDecodedBuffer(), credentials);
-        if (headers === undefined && body === undefined)
-            return undefined;
-        return { ...(headers === undefined ? {} : { headers }), ...(body === undefined ? {} : { body }) };
-    }
-    async function registerRules() {
-        await server.forAnyRequest().matching(fromElsewhere).always().thenCloseConnection();
-        // mockttp listens on every interface, and WebSocket upgrades take their own rule set.
-        await server.forAnyWebSocket().matching(fromElsewhere).always().thenCloseConnection();
-        await server
-            .forAnyRequest()
-            .matching(async (req) => carriesPlaceholder(await outgoing(req)))
-            .always()
-            .thenPassThrough({ ...upstreamTrust, beforeRequest, beforeResponse });
-        await server.forAnyRequest().always().thenPassThrough(upstreamTrust);
-        await server.forAnyWebSocket().always().thenPassThrough(upstreamTrust);
-    }
-    return {
-        cache,
-        async start() {
-            await server.start(options.port ?? DEFAULT_PROXY_PORT);
-            await registerRules();
-            stopUsage = usage.start();
-            return server.port;
-        },
-        async stop() {
-            stopUsage();
-            await usage.flush();
-            await server.stop();
-        },
-    };
-}
-//# sourceMappingURL=proxy.js.map

package/dist/broker/proxy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/broker/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAyB,QAAQ,EAAiD,MAAM,SAAS,CAAC;AAEzG,OAAO,EAAwB,qBAAqB,EAAyB,MAAM,uBAAuB,CAAC;AAC3G,OAAO,EAA6B,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EAEtB,cAAc,EACd,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAoBvC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAE7E,kFAAkF;AAClF,SAAS,aAAa,CAAC,GAAqB;IAC1C,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAqB;IAC3C,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB,EAAE,WAA4C;IAClF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/C,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,GAAuB,EAAE,WAA4C;IACtF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,GAAG,sBAAsB;QAAE,OAAO,SAAS,CAAC;IACnF,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC1C,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAsB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,mBAAmB,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAY,QAAQ,CAAC;QAC/B,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QACrD,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,EAAE,oBAAoB,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IACtG,IAAI,SAAS,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;IAE5C,KAAK,UAAU,MAAM,CAAC,GAAqB;QACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACpE,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAqB;QAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAC/C,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,GAAG,CAAC,WAAW,QAAQ,CAAC,MAAM,QAAQ,IAAI,EAAE,CAAC,CAAC;YAC9C,OAAO;gBACL,QAAQ,EAAE;oBACR,UAAU,EAAE,QAAQ,CAAC,MAAM;oBAC3B,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,SAAS,EAAE;oBAChG,IAAI,EAAE,QAAQ,CAAC,OAAO;iBACvB;aACF,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,GAAG,CAAC,QAAQ,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACnD,OAAO;YACL,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,cAAc,CAC3B,GAAwB,EACxB,GAAqB;QAErB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAClE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC;IAED,KAAK,UAAU,aAAa;QAC1B,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,mBAAmB,EAAE,CAAC;QACpF,sFAAsF;QACtF,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,mBAAmB,EAAE,CAAC;QACtF,MAAM,MAAM;aACT,aAAa,EAAE;aACf,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;aAChE,MAAM,EAAE;aACR,eAAe,CAAC,EAAE,GAAG,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACrE,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAC,CAAC;YACvD,MAAM,aAAa,EAAE,CAAC;YACtB,SAAS,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,IAAI;YACR,SAAS,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/rewrite.d.ts

@@ -1,44 +0,0 @@
-import { type ResolvedCredential, type ScrubbableCredential } from "./credential-text.ts";
-export type RequestHeaders = Record<string, string | string[] | undefined>;
-export type OutgoingRequest = {
-    url: string;
-    headers: RequestHeaders;
-    /** The decoded (content-encoding removed) body, or null when there is none. */
-    body: Uint8Array | null;
-};
-export type RewriteDecision = {
-    kind: "pass";
-} | {
-    kind: "rewrite";
-    url: string;
-    headers: RequestHeaders;
-    body?: string;
-    used: string[];
-} | {
-    kind: "reject";
-    status: 403 | 404 | 413 | 503;
-    message: string;
-    /** Set when a fresher credential table could change the answer (a name or website added since the last fetch). */
-    stale?: true;
-};
-/** The largest body the broker reads for placeholders or scrubs values out of. */
-export declare const MAX_REWRITE_BODY_BYTES: number;
-/**
- * The `user:value` pairs a request's Basic auth headers carry, as sent. A
- * response that echoes the header holds the pair's base64, which is not the
- * base64 of the value alone, so each is scrubbed as a credential of its own.
- */
-export declare function sentBasicPairs(headers: RequestHeaders, credentials: readonly ScrubbableCredential[]): ScrubbableCredential[];
-/** Whether a body is text the broker may read and rewrite (by content type, or valid UTF-8 when there is none). */
-export declare function isTextBody(contentType: string | undefined, body: Uint8Array): boolean;
-/** Whether a placeholder appears anywhere the broker looks — the URL, a header or the body. */
-export declare function carriesPlaceholder(request: OutgoingRequest): boolean;
-/**
- * `credentials` is null when the table could not be fetched. Only a
- * placeholder in the URL or a header — where the agent clearly meant to
- * authenticate — is ever refused; one that appears only in the body is text
- * (a chat message, a prompt) and passes through unless it names a credential
- * this host may receive.
- */
-export declare function rewriteRequest(request: OutgoingRequest, credentials: readonly ResolvedCredential[] | null): RewriteDecision;
-//# sourceMappingURL=rewrite.d.ts.map

package/dist/broker/rewrite.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../src/broker/rewrite.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,oBAAoB,EAAc,MAAM,sBAAsB,CAAC;AAEtG,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAE3E,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,cAAc,CAAC;IACxB,+EAA+E;IAC/E,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,cAAc,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GACxF;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,kHAAkH;IAClH,KAAK,CAAC,EAAE,IAAI,CAAC;CACd,CAAC;AAEN,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AAoDvD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAC3C,oBAAoB,EAAE,CAUxB;AAwDD,mHAAmH;AACnH,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAErF;AA0GD,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAEpE;AAsCD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,eAAe,EACxB,WAAW,EAAE,SAAS,kBAAkB,EAAE,GAAG,IAAI,GAChD,eAAe,CA4BjB"}

package/dist/broker/rewrite.js

@@ -1,291 +0,0 @@
-/**
- * The decision the credential broker makes for one outgoing request: send it
- * as-is, send it with placeholders swapped for values, or answer it itself
- * with a refusal the agent can act on. Pure — the proxy wiring lives in
- * `proxy.ts`.
- */
-import { parse as legacyParseUrl } from "node:url";
-import { substitute } from "./credential-text.js";
-/** The largest body the broker reads for placeholders or scrubs values out of. */
-export const MAX_REWRITE_BODY_BYTES = 10 * 1024 * 1024;
-const PLACEHOLDER_MARKER = "{{credential:";
-const ENCODED_PLACEHOLDER = /%7B%7Bcredential%3A([a-z0-9_-]{1,64})%7D%7D/gi;
-/** `%7B%7Bcredential%3Aname%7D%7D` — what an HTTP client makes of a placeholder in a URL — back to `{{credential:name}}`. */
-function decodePlaceholders(text) {
-    return text.replace(ENCODED_PLACEHOLDER, (_match, name) => `{{credential:${name}}}`);
-}
-/** Collects what every substitution in one request used, was refused, or could not find. */
-function createSubstituter(credentials, host) {
-    const used = new Set();
-    const denied = new Map();
-    const unknown = new Set();
-    return {
-        used,
-        denied,
-        unknown,
-        apply(text, encode = (value) => value) {
-            const encoded = credentials.map((credential) => ({ ...credential, value: encode(credential.value) }));
-            const result = substitute(text, encoded, host);
-            for (const name of result.used)
-                used.add(name);
-            for (const { name, allowedHosts } of result.denied)
-                denied.set(name, allowedHosts);
-            for (const name of result.unknown)
-                unknown.add(name);
-            return result.out;
-        },
-    };
-}
-const BASIC_AUTH = /^(Basic\s+)([A-Za-z0-9+/=_-]+)\s*$/i;
-/** The `user:password` a Basic auth header carries. */
-function basicCredentials(value) {
-    const match = BASIC_AUTH.exec(value);
-    return match === null ? null : Buffer.from(match[2] ?? "", "base64").toString("utf8");
-}
-/** The `user:password` inside a Basic auth header, when it carries a placeholder. */
-function basicPair(value) {
-    const pair = basicCredentials(value);
-    return pair?.includes(PLACEHOLDER_MARKER) ? { scheme: BASIC_AUTH.exec(value)?.[1] ?? "Basic ", pair } : null;
-}
-function rewriteHeaderValue(value, substituter) {
-    const basic = basicPair(value);
-    if (basic === null)
-        return substituter.apply(value);
-    return basic.scheme + Buffer.from(substituter.apply(basic.pair), "utf8").toString("base64");
-}
-/**
- * The `user:value` pairs a request's Basic auth headers carry, as sent. A
- * response that echoes the header holds the pair's base64, which is not the
- * base64 of the value alone, so each is scrubbed as a credential of its own.
- */
-export function sentBasicPairs(headers, credentials) {
-    return Object.entries(headers).flatMap(([name, values]) => name.startsWith(":")
-        ? []
-        : [values ?? []].flat().flatMap((value) => {
-            const pair = basicCredentials(value);
-            const credential = pair === null ? undefined : credentials.find((c) => pair.includes(c.value));
-            return pair === null || credential === undefined ? [] : [{ name: credential.name, value: pair }];
-        }));
-}
-/**
- * HTTP/2 pseudo-headers (`:path`, `:authority`) are returned as they came:
- * mockttp regenerates them from the URL, which is rewritten on its own, and
- * refuses a request whose `:path` was changed.
- */
-function rewriteHeaders(headers, substituter) {
-    const out = {};
-    for (const [name, value] of Object.entries(headers)) {
-        if (value === undefined)
-            continue;
-        if (name.startsWith(":")) {
-            out[name] = value;
-            continue;
-        }
-        out[name] = Array.isArray(value)
-            ? value.map((item) => rewriteHeaderValue(item, substituter))
-            : rewriteHeaderValue(value, substituter);
-    }
-    return out;
-}
-function headerValue(headers, name) {
-    const value = headers[name];
-    return Array.isArray(value) ? value[0] : value;
-}
-function isUtf8(bytes) {
-    try {
-        new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-/** How a value must be escaped to sit inside this body, or null when the body is not text. */
-function bodyFormat(contentType, body) {
-    const type = contentType?.split(";")[0]?.trim().toLowerCase();
-    if (type === undefined || type === "")
-        return isUtf8(body) ? "text" : null;
-    if (type === "application/json" || type.endsWith("+json"))
-        return "json";
-    if (type === "application/x-www-form-urlencoded")
-        return "form";
-    if (type.startsWith("text/") ||
-        type.endsWith("/xml") ||
-        type.endsWith("+xml") ||
-        type === "application/graphql" ||
-        type === "application/javascript") {
-        return "text";
-    }
-    return null;
-}
-/** Whether a body is text the broker may read and rewrite (by content type, or valid UTF-8 when there is none). */
-export function isTextBody(contentType, body) {
-    return bodyFormat(contentType, body) !== null;
-}
-const ENCODE_FOR = {
-    json: (value) => JSON.stringify(value).slice(1, -1),
-    form: encodeURIComponent,
-    text: (value) => value,
-};
-function headerText(headers) {
-    return Object.values(headers)
-        .flat()
-        .map((value) => (value === undefined ? "" : (basicPair(value)?.pair ?? value)))
-        .join("\n");
-}
-const BODY_TOO_LARGE = {
-    kind: "reject",
-    status: 413,
-    message: "Baker credentials can only be placed in text request bodies (JSON, form, text, XML or GraphQL) up to 10 MB. Put the placeholder in a header or the URL instead.",
-};
-function hasPlaceholder(text) {
-    return text.includes(PLACEHOLDER_MARKER) || decodePlaceholders(text) !== text;
-}
-const UNAVAILABLE = {
-    kind: "reject",
-    status: 503,
-    message: "Baker credentials are unavailable right now — try again in a minute.",
-};
-const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
-/** A DNS name as the WHATWG parser emits it (IDNs arrive as `xn--`). Anything else could parse differently elsewhere. */
-const PLAIN_HOSTNAME = /^[a-z0-9.-]+$/;
-/**
- * mockttp connects to `url.parse(<returned url>).hostname`, not to the name
- * the check read. The two parsers disagree on unusual characters, so a
- * credential is only substituted when both see the same host.
- */
-function upstreamHostMatches(url, host) {
-    return PLAIN_HOSTNAME.test(host) && legacyParseUrl(url).hostname === host;
-}
-const HOST_MISMATCH = {
-    kind: "reject",
-    status: 403,
-    message: "Baker credentials are only sent to a plain website address, and never inside the address itself. Put the credential in a header, the query string or the body.",
-};
-/** The host a `Host` / `:authority` value names, port stripped and lower-cased; null when it is not a host. */
-function authorityHost(value) {
-    const candidate = `http://${value.trim()}`;
-    return URL.canParse(candidate) ? new URL(candidate).hostname.toLowerCase() : null;
-}
-/**
- * The value goes to the site the check read, not to whatever site the agent's
- * own `Host` or `:authority` names — on a shared CDN those can differ, and
- * both headers are forwarded unchanged.
- */
-function hostHeadersMatch(headers, host) {
-    return ["host", ":authority"].every((name) => {
-        const values = headers[name];
-        if (values === undefined)
-            return true;
-        return [values].flat().every((value) => authorityHost(value) === host.toLowerCase());
-    });
-}
-function hostHeaderRefusal(headers, host, used) {
-    if (used.size === 0 || hostHeadersMatch(headers, host))
-        return null;
-    return {
-        kind: "reject",
-        status: 403,
-        message: `This request goes to "${host}" but its Host header names another website, so Baker did not send the credential. Remove the Host header.`,
-    };
-}
-const SETTINGS = "Settings → Credentials";
-function refuse(substituter, host) {
-    const [unknown] = substituter.unknown;
-    if (unknown !== undefined) {
-        return {
-            kind: "reject",
-            status: 404,
-            message: `No Baker credential named "${unknown}". Run \`baker credentials list\` to see the names you can use.`,
-            stale: true,
-        };
-    }
-    const [denied] = substituter.denied;
-    if (denied === undefined)
-        return null;
-    const [name, allowedHosts] = denied;
-    const message = allowedHosts.length === 0
-        ? `Baker credential "${name}" has no websites it may be sent to yet. Ask the user to choose them in ${SETTINGS}.`
-        : `Baker credential "${name}" is not allowed for host "${host}". Allowed: ${allowedHosts.join(", ")}. Ask the user to add this website to the credential in ${SETTINGS}.`;
-    return { kind: "reject", status: 403, message, stale: true };
-}
-function bodyText(body) {
-    return body === null ? "" : Buffer.from(body).toString("latin1");
-}
-/** Whether a placeholder appears anywhere the broker looks — the URL, a header or the body. */
-export function carriesPlaceholder(request) {
-    return [request.url, headerText(request.headers), bodyText(request.body)].some(hasPlaceholder);
-}
-/** Whether any placeholder in the body names a credential this host may receive — only then is the body rewritten. */
-function bodyUsesCredential(body, credentials, host) {
-    if (body === null)
-        return false;
-    const text = decodePlaceholders(bodyText(body));
-    return hasPlaceholder(text) && substitute(text, credentials, host).used.length > 0;
-}
-/** The body with every placeholder for a credential this host may receive swapped in, escaped for its format. */
-function rewriteBody(request, credentials, host) {
-    const raw = request.body ?? new Uint8Array();
-    const format = bodyFormat(headerValue(request.headers, "content-type"), raw);
-    if (format === null || raw.byteLength > MAX_REWRITE_BODY_BYTES)
-        return BODY_TOO_LARGE;
-    const substituter = createSubstituter(credentials, host);
-    const decoded = Buffer.from(raw).toString("utf8");
-    const text = substituter.apply(format === "form" ? decodePlaceholders(decoded) : decoded, ENCODE_FOR[format]);
-    return { kind: "body", text, used: substituter.used };
-}
-/** A refusal for plain http to anything but this machine. */
-function insecureRefusal(target) {
-    if (target.protocol === "https:" || LOOPBACK_HOSTS.has(target.hostname))
-        return null;
-    return {
-        kind: "reject",
-        status: 403,
-        message: `Baker credentials are only sent over https. Use https://${target.host}${target.pathname} instead.`,
-    };
-}
-/**
- * `credentials` is null when the table could not be fetched. Only a
- * placeholder in the URL or a header — where the agent clearly meant to
- * authenticate — is ever refused; one that appears only in the body is text
- * (a chat message, a prompt) and passes through unless it names a credential
- * this host may receive.
- */
-export function rewriteRequest(request, credentials) {
-    if (!carriesPlaceholder(request))
-        return { kind: "pass" };
-    const url = decodePlaceholders(request.url);
-    if (!URL.canParse(request.url))
-        return HOST_MISMATCH;
-    const target = new URL(request.url);
-    const host = target.hostname;
-    const authPlaceholder = [url, headerText(request.headers)].some(hasPlaceholder);
-    if (credentials === null)
-        return authPlaceholder ? UNAVAILABLE : { kind: "pass" };
-    const bodyCarriesCredential = bodyUsesCredential(request.body, credentials, host);
-    if (!authPlaceholder && !bodyCarriesCredential)
-        return { kind: "pass" };
-    const insecure = insecureRefusal(target);
-    if (insecure !== null)
-        return insecure;
-    const substituter = createSubstituter(credentials, host);
-    const rewrittenUrl = substituter.apply(url, encodeURIComponent);
-    if (!upstreamHostMatches(rewrittenUrl, host))
-        return HOST_MISMATCH;
-    const headers = rewriteHeaders(request.headers, substituter);
-    const body = bodyCarriesCredential ? rewriteBody(request, credentials, host) : undefined;
-    if (body?.kind === "reject")
-        return body;
-    const used = new Set([...substituter.used, ...(body?.used ?? [])]);
-    const refusal = refuse(substituter, host) ?? hostHeaderRefusal(request.headers, host, used);
-    if (refusal !== null)
-        return refusal;
-    return {
-        kind: "rewrite",
-        url: rewrittenUrl,
-        headers,
-        ...(body === undefined ? {} : { body: body.text }),
-        used: [...used],
-    };
-}
-//# sourceMappingURL=rewrite.js.map

package/dist/broker/rewrite.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../src/broker/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAsD,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAsBtG,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvD,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAE5E,6HAA6H;AAC7H,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,WAA0C,EAAE,IAAY;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO;QACL,IAAI;QACJ,MAAM;QACN,OAAO;QACP,KAAK,CAAC,IAAY,EAAE,MAAM,GAA8B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;YACtE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACtG,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,KAAK,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACnF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAEzD,uDAAuD;AACvD,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxF,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/G,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,WAAwB;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAuB,EACvB,WAA4C;IAE5C,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CACxD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/F,OAAO,IAAI,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC,CAAC,CACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAuB,EAAE,WAAwB;IACvE,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAC9B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC5D,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAID,SAAS,WAAW,CAAC,OAAuB,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,WAA+B,EAAE,IAAgB;IACnE,MAAM,IAAI,GAAG,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IACzE,IAAI,IAAI,KAAK,mCAAmC;QAAE,OAAO,MAAM,CAAC;IAChE,IACE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,KAAK,qBAAqB;QAC9B,IAAI,KAAK,wBAAwB,EACjC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,UAAU,CAAC,WAA+B,EAAE,IAAgB;IAC1E,OAAO,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,GAAkD;IAChE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;CACvB,CAAC;AAEF,SAAS,UAAU,CAAC,OAAuB;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC1B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;SAC9E,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,cAAc,GAAyC;IAC3D,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,GAAG;IACX,OAAO,EACL,iKAAiK;CACpK,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAChF,CAAC;AAED,MAAM,WAAW,GAAoB;IACnC,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,sEAAsE;CAChF,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE,yHAAyH;AACzH,MAAM,cAAc,GAAG,eAAe,CAAC;AAEvC;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,IAAY;IACpD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC5E,CAAC;AAED,MAAM,aAAa,GAAoB;IACrC,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,GAAG;IACX,OAAO,EACL,gKAAgK;CACnK,CAAC;AAEF,+GAA+G;AAC/G,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,SAAS,GAAG,UAAU,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3C,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAuB,EAAE,IAAY;IAC7D,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB,EAAE,IAAY,EAAE,IAAyB;IACzF,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,yBAAyB,IAAI,4GAA4G;KACnJ,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAE1C,SAAS,MAAM,CAAC,WAAwB,EAAE,IAAY;IACpD,MAAM,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,8BAA8B,OAAO,iEAAiE;YAC/G,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,MAAM,CAAC;IACpC,MAAM,OAAO,GACX,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,qBAAqB,IAAI,2EAA2E,QAAQ,GAAG;QACjH,CAAC,CAAC,qBAAqB,IAAI,8BAA8B,IAAI,eAAe,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,2DAA2D,QAAQ,GAAG,CAAC;IAC9K,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB;IACvC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACzD,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACjG,CAAC;AAED,sHAAsH;AACtH,SAAS,kBAAkB,CACzB,IAAuB,EACvB,WAA0C,EAC1C,IAAY;IAEZ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,iHAAiH;AACjH,SAAS,WAAW,CAClB,OAAwB,EACxB,WAA0C,EAC1C,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,sBAAsB;QAAE,OAAO,cAAc,CAAC;IACtF,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9G,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,6DAA6D;AAC7D,SAAS,eAAe,CAAC,MAAW;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,2DAA2D,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,WAAW;KAC7G,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAwB,EACxB,WAAiD;IAEjD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChF,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClF,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,eAAe,IAAI,CAAC,qBAAqB;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAChE,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,YAAY;QACjB,OAAO;QACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;KAChB,CAAC;AACJ,CAAC"}

package/dist/broker/rewrite.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=rewrite.test.d.ts.map

package/dist/broker/rewrite.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rewrite.test.d.ts","sourceRoot":"","sources":["../../src/broker/rewrite.test.ts"],"names":[],"mappings":""}