@koda-sl/baker-bridge 0.122.0-dev.3613db443 → 0.122.0-dev.42b55fa66

package/README.md

@@ -51,10 +51,27 @@ await server.start();
 | `NO_COLOR` | Set to `1` on every Agent SDK subprocess so `baker --help` output carries no ANSI escapes — see [Session surface](#session-surface) |
 | `BAKER_AGENT_MODEL` | Optional. Runs every turn in this runtime on the named model instead of the default, and is forwarded to subagents as `CLAUDE_CODE_SUBAGENT_MODEL`. Ignored unless it names a model with a known context window — see [Model selection](#model-selection) |
 | `CLAUDE_CODE_SUBAGENT_MODEL`, `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` | Set on the Agent SDK subprocess only when `BAKER_AGENT_MODEL` is set. Together they override the `model:` each subagent pins in its own frontmatter |
+| `BAKER_CREDENTIALS` | Set to `1` in a Runtime with Credentials (the credential broker is running). Only then is `request_credential` offered to the agent; otherwise a call to it is refused |
 | `LATITUDE_API_KEY` / `LATITUDE_PROJECT` | Optional, both or neither. When set, every turn is traced to that Latitude project — see [Latitude tracing](#latitude-tracing) |
 
 All variables are validated at startup via `@t3-oss/env-core` + `zod`.
 
+## Credential broker (`baker-credential-broker`)
+
+A second bin, run as root in the sandbox before the agent starts, so the agent can use the user's stored credentials without ever seeing them. The agent writes `{{credential:NAME}}` in a request; the broker is an HTTP(S) proxy on `127.0.0.1` that swaps in the real value and swaps it back out of the response.
+
+| Variable | Description |
+|---|---|
+| `CREDENTIAL_BROKER_TOKEN` | Required. Authenticates the broker to Baker's credential routes |
+| `BAKER_CONVEX_SITE_URL` | Required. Baker's site URL |
+| `BAKER_CREDENTIAL_PROXY_PORT` | Proxy port (default `8877`) |
+| `BAKER_CA_DIR` | Where the broker's CA key (0600) and cert live (default `/etc/baker-ca`); run as root it also installs the cert into the system bundle |
+| `BAKER_BROKER_SOCKET` | Unix socket for the bridge (default `/run/baker/broker.sock`): `POST /scrub`, `GET /health` |
+
+The agent's processes get `agentProxyEnv()`: `HTTP(S)_PROXY` pointing at the broker, `NO_PROXY` for loopback plus the model gateway, `NODE_USE_ENV_PROXY=1`, `NODE_EXTRA_CA_CERTS` set to the broker's CA, and `REQUESTS_CA_BUNDLE` / `SSL_CERT_FILE` / `CURL_CA_BUNDLE` set to the system bundle.
+
+Security model: a value is only substituted over https, and only for a host the user allowed for that credential. A placeholder in the URL or a header that is not allowed for the host, or that names no stored credential, is refused (403 / 404, or 503 while credentials can't be fetched) before anything leaves the sandbox. A placeholder that appears only in the body is left as plain text unless it names a credential allowed for that host. Response headers and text bodies up to 10 MB are scrubbed back to placeholders; those responses arrive buffered rather than streamed. The socket never returns a value.
+
 ## Session surface
 
 The Agent SDK ships developer-facing surfaces a marketer's session can never
@@ -240,7 +257,8 @@ its tokens, every tool call with its result, subagents and auto-memory. Each
 trace carries the workspace's git repo (`metadata.git.repo`, the company) and
 branch (`metadata.git.branch`, the chat); the Latitude session is the Claude
 session. Session reviews are not traced. Without both
-variables nothing is registered. Content is sent in full; mask attributes with
+variables nothing is registered, and Baker's backend does not set them today:
+the transcript may hold a secret the credential scrub did not rewrite. Content is sent in full; mask attributes with
 `LATITUDE_REDACT_ATTRIBUTES` if needed.
 
 ## Endpoints
@@ -276,7 +294,7 @@ A ChatGPT Ads tag pre-fills its Pixel ID and requests the optional Conversions A
 
 Its second tool, `request_flow_input`, is the **blocking form-configuration form**: the agent invokes it to configure the confidential parts of a flow ("Form") it cannot author itself — side-effect credentials/connections (`encryptedConfig`, `oauthProviderId`) and widget third-party field definitions (`nodeData.form.external` for HubSpot/Calendly/HighLevel/SavvyCal). The agent authors the surrounding structure in `_data.json` and references it by `nodeId`/`sideEffectId`. Same `canUseTool` park pattern: the bridge POSTs `/api/chat/flow-input-request`, the dashboard renders a tabbed form (secret inputs / OAuth connect+account picker / live resource picker), and on submit Convex delivers the resolved values to `POST /flow-input-decision`. Unlike tags, the resolved values are written **into the branch flow file** through the encrypting `writeFlow` (read → patch node/side-effect → write); the model only ever sees a redacted result: `{ status, nodeId, sideEffectId?, secretFieldsSet, destination?, connected?, fields?, note? }`. `destination` is the non-secret half of what the user chose — the spreadsheet, the sheet, the portal, the Calendly event — so an agent that has just configured an integration does not have to spend a turn on `baker flows show --full` to learn what it configured, and does not map columns against a guess. For a widget node, `fields` carries the autofill keys the picked resource accepts — literally the left-hand side of an `autofilledFields` entry, adapter prefix included, so a SavvyCal custom field arrives as `questions.<id>` because that is what its adapter reads. They come from each provider's own field container (`fieldGroups[].fields[]`, `customQuestions[]`, `customParams.formFields[]`, `customFormFields[]`, `fields[]`, `customFields[]`) rather than from a search for name-shaped strings, so a select's option labels and the resource's own title are not among them (a HubSpot form's `name` is "Contact us"; it is reported under `destination`). A widget with no field list of its own returns none rather than a guess. Both targets go through the same filter: only plain strings and numbers are echoed, and anything in that type's secret list is redacted to a name in `secretFieldsSet`. A few non-secret keys are withheld from `destination` on top of that, because they are not an answer either — an `httpWebhook`'s basic-auth `username` is not a typed credential, so it is not in the secret list, but echoing it hands the model half a credential and nothing on the side effect is addressed by it. Leaked secret values in `prefilledConfig` are stripped bridge-side (and again backend-side). Live wait matches `AskUserQuestion` (15 min); like all blocking prompts, the form itself never expires — the thread parks and a later submission recovers the turn.
 
-Its third tool, `request_connection`, is the **blocking connection request**: the agent invokes it when a data platform the task needs — Google Ads, LinkedIn Ads, Meta Ads, X Ads, Google Analytics 4, Google Search Console, or Google Tag Manager — is not connected yet, instead of telling the user to go to Settings. Same `canUseTool` park pattern: the bridge POSTs `/api/chat/connection-input-request`, the dashboard renders one tab per platform with the OAuth connect button and the account/property/site/container picker, and on submit Convex delivers the outcome to `POST /connection-input-decision`. Nothing confidential passes through the bridge or the model: the dashboard writes the selection onto the company's connection, and the resolution carries only `{ status, platform, accountLabel?, selected[] }`. A Google Drive tab may add `choose: "media-folder"` (kept only on Google Drive): the user picks a folder that Baker imports as a media source, and the connected result also carries its `mediaSourceKey`. Live wait matches `AskUserQuestion` (15 min).
+Its third tool, `request_connection`, is the **blocking connection request**: the agent invokes it when a data platform the task needs — Google Ads, LinkedIn Ads, Meta Ads, X Ads, Google Analytics 4, Google Search Console, or Google Tag Manager — is not connected yet, instead of telling the user to go to Settings. Same `canUseTool` park pattern: the bridge POSTs `/api/chat/connection-input-request`, the dashboard renders one tab per platform with the OAuth connect button and the account/property/site/container picker, and on submit Convex delivers the outcome to `POST /connection-input-decision`. Nothing confidential passes through the bridge or the model: the dashboard writes the selection onto the company's connection, and the resolution carries only `{ status, platform, accountLabel?, selected[] }`. A Google Drive tab may add `choose: "media-folder"` (kept only on Google Drive): the user picks a folder that Baker imports as a media source, and the connected result also carries its `mediaSourceKey`. An ad or data platform tab may add `pick: true` (kept only on platforms with accounts to choose): when the platform is already connected, the card opens its account picker straight away, for the agent that found the account it needs is not selected. Live wait matches `AskUserQuestion` (15 min).
 
 The same card adds tools. A `{ server: { name, url, auth?, keyHeader?, scope? } }` entry opens a remote MCP server filled in from the user's instructions (`auth`: `none` \| `key` \| `sign-in`; the key is typed into the card, never into the chat), and an `{ app }` entry connects a managed app from `baker mcp catalog` — the fallback for a vendor with no server of its own. When an app or server comes through, the bridge fetches the turn's MCP servers afresh (`McpServersProvider` with `{ fresh: true }`) and loads them into the running query with `setMcpServers` — `baker_ui` included, since the SDK drops any in-process server left out — before the tool answers, and adds `toolsReady` to the resolution. The provider keeps that set for the next turn, so the tool list changes once. A platform-only resolution never reloads.
 
@@ -284,6 +302,8 @@ Its fourth tool, `request_avatar_casting`, is the **blocking face picker**: an a
 
 It is also the one blocking tool the bridge opens **on its own**. The agent forgot to call it in every recorded run, in a new way each time, so the trigger is the EVENT rather than the prose around it: a `baker avatars create` for a synthetic avatar registers a pending casting, and it opens before whatever the agent does next. The create is read off the **assistant message** as well as off `canUseTool`, because `canUseTool` is raised only for the ask path and the scaffold allows `Bash(baker:*)` — so every create the product actually runs bypassed the permission callback entirely, and the avatar sat in `generating` with no portraits and no sheet while the agent reported the picker was open. When the create is the turn's last tool call there is no next call to open it before, so the request is posted at turn end and the thread parks on it. An unattended Session has nobody to ask, so the create is rewritten to `--face auto` instead and nothing is left pending — the flag is inserted right after `avatars create` rather than appended, so a piped or redirected command does not hand it to the next program, and an explicit `--face ask` is replaced rather than joined.
 
+The picker does not wait forever. Once every face is on screen, Convex schedules a pick 30 seconds out: if the user has not chosen (or pressed "Give me more time", which clears the deadline), the first face is kept and delivered as `{ status: "cast", avatarHandle, imageId, chosenBy: "auto" }`. The pick runs server-side, so a tab left in the background never stalls the job, and the result text tells the agent nobody chose that face so it never credits the user with it.
+
 A decline comes back to the agent with the remedy attached, not as a bare `{"status":"declined"}`. The tool's description says to sharpen the subject with `baker avatars update` and call it again, but that text sits thousands of tokens up the context and was written before the turn began; read against the bare object, the agent replied "the casting portraits should be showing on your screen right now" to a user who had just rejected all four and whose picker was gone. The result now states the outcome and the next move together, the way a CLI `error.fix` does, and says to ask what to change when no reason was given.
 
 When the agent *does* call `request_avatar_casting` for the avatar a pending casting is already owed to — the tool's description says the picker opens by itself, but the call is tolerated — that call becomes the casting rather than triggering a second one, so the pick is returned to the tool that asked for it. Every other blocking prompt that follows a create still reaches its own handler; the auto-cast runs first, then the original call is routed normally.
@@ -775,8 +795,11 @@ or path is data, not a second command; anything it cannot parse is refused.
   ends input itself once the turn is really over: a clean result with no
   in-flight tasks, re-checked when the last task settles (a settle isn't
   guaranteed to wake the model into a second result). Turns that ran tasks get
-  a 1s settle window so a just-settled task's queued wake isn't cut off; only
-  genuine model activity cancels it. Model activity after a result also retires
+  a 1s settle window after a result so a just-settled task's queued wake isn't
+  cut off, and a 45s window after the last task settles, because the CLI streams
+  nothing between that settle and the woken turn's first token; only genuine
+  model activity cancels either. The agent's Bash calls may run 30 minutes
+  (`BASH_MAX_TIMEOUT_MS`), the longest the workspace's timeout hook grants. Model activity after a result also retires
   that result: the CLI has woken into a new turn, so the settle re-check waits
   for the woken turn's own result rather than closing stdin under a model that
   is still on time-to-first-token. A 60s exit guard closes the query if the

package/dist/broker/baker-api.d.ts

@@ -0,0 +1,23 @@
+import type { ResolvedCredential } from "./credential-text.ts";
+export type CredentialUse = {
+    name: string;
+    host: string;
+};
+/**
+ * Baker refused the broker's token: Credentials were switched off, the company
+ * suspended, or the Runtime is no longer active. Unlike a failed request, this
+ * is an answer — the broker must stop using what it holds.
+ */
+export declare class CredentialsRefused extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+export type BakerBrokerApi = {
+    fetchCredentials(): Promise<ResolvedCredential[]>;
+    reportUsage(uses: CredentialUse[]): Promise<void>;
+};
+export declare function createBakerBrokerApi(options: {
+    siteUrl: string;
+    token: string;
+}): BakerBrokerApi;
+//# sourceMappingURL=baker-api.d.ts.map

package/dist/broker/baker-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baker-api.d.ts","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAS/D,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAnC,YAAqB,MAAM,EAAE,MAAM,EAElC;CACF;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,gBAAgB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAClD,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD,CAAC;AAIF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CA0BhG"}

package/dist/broker/baker-api.js

@@ -0,0 +1,55 @@
+/**
+ * The broker's two calls to Baker: fetch the company's credentials (the only
+ * route that ever returns a value) and report which were used where. The
+ * shapes mirror `brokerResolveResponseSchema` / `brokerUsageRequestSchema` in
+ * `@baker/api/credentials`, which the published bridge cannot import.
+ * Success is `{ ok: true, data }`; a failure is any non-2xx status with
+ * `{ code, error }`.
+ */
+import { z } from "zod";
+const resolveResponseSchema = z.object({
+    credentials: z.array(z.object({ name: z.string(), value: z.string(), allowedHosts: z.array(z.string()) })),
+});
+const successSchema = z.object({ ok: z.literal(true), data: z.unknown().optional() });
+const failureSchema = z.object({ code: z.string() });
+/**
+ * Baker refused the broker's token: Credentials were switched off, the company
+ * suspended, or the Runtime is no longer active. Unlike a failed request, this
+ * is an answer — the broker must stop using what it holds.
+ */
+export class CredentialsRefused extends Error {
+    status;
+    constructor(status) {
+        super(`Baker refused the broker (${status})`);
+        this.status = status;
+    }
+}
+const TIMEOUT_MS = 10_000;
+export function createBakerBrokerApi(options) {
+    async function post(path, body) {
+        const response = await fetch(new URL(path, options.siteUrl), {
+            method: "POST",
+            headers: { authorization: `Broker ${options.token}`, "content-type": "application/json" },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        const payload = await response.json().catch(() => null);
+        if (response.status === 401 || response.status === 403)
+            throw new CredentialsRefused(response.status);
+        if (!response.ok) {
+            const code = failureSchema.safeParse(payload).data?.code ?? "UNKNOWN";
+            throw new Error(`${path} answered ${response.status} ${code}`);
+        }
+        return successSchema.parse(payload).data;
+    }
+    return {
+        async fetchCredentials() {
+            const data = resolveResponseSchema.parse(await post("/api/runtime/credentials/resolve", {}));
+            return data.credentials;
+        },
+        async reportUsage(uses) {
+            await post("/api/runtime/credentials/usage", { uses });
+        },
+    };
+}
+//# sourceMappingURL=baker-api.js.map

package/dist/broker/baker-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baker-api.js","sourceRoot":"","sources":["../../src/broker/baker-api.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;CAC3G,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACtF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAIrD;;;;GAIG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB,MAAM;IAA3B,YAAqB,MAAc;QACjC,KAAK,CAAC,6BAA6B,MAAM,GAAG,CAAC,CAAC;sBAD3B,MAAM;IAE3B,CAAC;CACF;AAOD,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,MAAM,UAAU,oBAAoB,CAAC,OAA2C;IAC9E,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAa;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,OAAO;QACL,KAAK,CAAC,gBAAgB;YACpB,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,kCAAkC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,IAAI;YACpB,MAAM,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/broker-client.d.ts

@@ -0,0 +1,10 @@
+export declare const DEFAULT_BROKER_SOCKET = "/run/baker/broker.sock";
+export type BrokerClientOptions = {
+    socketPath?: string;
+    timeoutMs?: number;
+};
+/** Whether a broker runs in this sandbox: its socket exists. */
+export declare function brokerRunning(options?: BrokerClientOptions): boolean;
+/** `text` with every stored credential value replaced by its placeholder. */
+export declare function scrubViaBroker(text: string, options?: BrokerClientOptions): Promise<string>;
+//# sourceMappingURL=broker-client.d.ts.map

package/dist/broker/broker-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-client.d.ts","sourceRoot":"","sources":["../../src/broker/broker-client.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,qBAAqB,2BAA2B,CAAC;AAG9D,MAAM,MAAM,mBAAmB,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAM9E,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAExE;AA+BD,6EAA6E;AAC7E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrG"}

package/dist/broker/broker-client.js

@@ -0,0 +1,60 @@
+/**
+ * The bridge's side of the broker socket. Dependency-free on purpose: the
+ * bridge imports it on the hot path of every tool result.
+ *
+ * When no broker runs (no socket file — local dev, or a Runtime without
+ * credentials) every call is a fast no-op and `scrubViaBroker` returns the
+ * text unchanged. Any other failure (timeout, 413, 429, a crashed broker) is
+ * thrown so the caller decides whether to hold the text back.
+ */
+import { existsSync } from "node:fs";
+import { request } from "node:http";
+export const DEFAULT_BROKER_SOCKET = "/run/baker/broker.sock";
+const DEFAULT_TIMEOUT_MS = 2_000;
+function isMissingSocket(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+/** Whether a broker runs in this sandbox: its socket exists. */
+export function brokerRunning(options = {}) {
+    return existsSync(options.socketPath ?? DEFAULT_BROKER_SOCKET);
+}
+function call(path, body, options) {
+    const socketPath = options.socketPath ?? DEFAULT_BROKER_SOCKET;
+    if (!brokerRunning(options))
+        return Promise.resolve(null);
+    return new Promise((resolve, reject) => {
+        const req = request({
+            socketPath,
+            path,
+            method: "POST",
+            headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) },
+            timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (chunk) => chunks.push(chunk));
+            res.on("end", () => {
+                const text = Buffer.concat(chunks).toString("utf8");
+                if (res.statusCode === 200)
+                    resolve(text);
+                else
+                    reject(new Error(`credential broker ${path} answered ${res.statusCode}`));
+            });
+            res.on("error", reject);
+        });
+        req.on("timeout", () => req.destroy(new Error(`credential broker ${path} timed out`)));
+        req.on("error", (error) => (isMissingSocket(error) ? resolve(null) : reject(error)));
+        req.end(body);
+    });
+}
+/** `text` with every stored credential value replaced by its placeholder. */
+export async function scrubViaBroker(text, options = {}) {
+    const response = await call("/scrub", JSON.stringify({ text }), options);
+    if (response === null)
+        return text;
+    const parsed = JSON.parse(response);
+    if (typeof parsed === "object" && parsed !== null && "text" in parsed && typeof parsed.text === "string") {
+        return parsed.text;
+    }
+    throw new Error("credential broker /scrub answered without text");
+}
+//# sourceMappingURL=broker-client.js.map

package/dist/broker/broker-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-client.js","sourceRoot":"","sources":["../../src/broker/broker-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAC9D,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAIjC,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,OAAO,GAAwB,EAAE;IAC7D,OAAO,UAAU,CAAC,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,IAAY,EAAE,OAA4B;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,qBAAqB,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CACjB;YACE,UAAU;YACV,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YAC1F,OAAO,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;SACjD,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACpD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;;oBACrC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,aAAa,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,qBAAqB,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;QACvF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,OAAO,GAAwB,EAAE;IAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzG,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC"}

package/dist/broker/ca.d.ts

@@ -0,0 +1,38 @@
+export declare const DEFAULT_CA_DIR = "/etc/baker-ca";
+export declare const SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+export type CertificateAuthority = {
+    keyPath: string;
+    certPath: string;
+    key: string;
+    cert: string;
+};
+/**
+ * Env for every process the agent runs. `NODE_EXTRA_CA_CERTS` adds our CA to
+ * Node's roots; the other three *replace* a client's bundle, so they name the
+ * system bundle, which carries our CA once `update-ca-certificates` ran.
+ */
+export declare function agentProxyEnv(options: {
+    port: number;
+    caCertPath: string;
+    /** Hosts that bypass the broker entirely, e.g. the model gateway carrying the agent's own conversation. */
+    noProxyHosts: readonly string[];
+}): Record<string, string>;
+/**
+ * Reuses the CA in `dir`, or creates one (key 0600, cert 0644). With
+ * `installSystemTrust`, also adds the cert to the system bundle — needs root;
+ * a failure is logged, not thrown, so the proxy still starts.
+ */
+export declare function ensureCertificateAuthority(options: {
+    dir?: string;
+    installSystemTrust: boolean;
+    log?: (message: string) => void;
+}): Promise<CertificateAuthority>;
+/**
+ * Writes the certificate to `target` as a new file. The system trust directory
+ * is under /usr/local, which the agent can write, and the broker is root: a
+ * copy would follow a link the agent planted there onto any file. Removing the
+ * name first drops such a link, and an exclusive create refuses one planted
+ * again in between rather than following it.
+ */
+export declare function placeTrustedCert(certPath: string, target: string): Promise<void>;
+//# sourceMappingURL=ca.d.ts.map

package/dist/broker/ca.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAC9C,eAAO,MAAM,gBAAgB,uCAAuC,CAAC;AAKrE,MAAM,MAAM,oBAAoB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBzB;AASD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kBAAkB,EAAE,OAAO,CAAC;IAC5B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAahC;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGtF"}

package/dist/broker/ca.js

@@ -0,0 +1,80 @@
+/**
+ * The broker's certificate authority — what lets it read HTTPS the agent sends
+ * through it — and the environment that points the agent's clients at it.
+ */
+import { execFile } from "node:child_process";
+import { mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { generateCACertificate } from "mockttp";
+export const DEFAULT_CA_DIR = "/etc/baker-ca";
+export const SYSTEM_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+/** By absolute path: the broker runs as root and must never resolve a binary through PATH. */
+const UPDATE_CA_CERTIFICATES = "/usr/sbin/update-ca-certificates";
+const SYSTEM_TRUST_PATH = "/usr/local/share/ca-certificates/baker-credential-broker.crt";
+/**
+ * Env for every process the agent runs. `NODE_EXTRA_CA_CERTS` adds our CA to
+ * Node's roots; the other three *replace* a client's bundle, so they name the
+ * system bundle, which carries our CA once `update-ca-certificates` ran.
+ */
+export function agentProxyEnv(options) {
+    const proxy = `http://127.0.0.1:${options.port}`;
+    const noProxy = ["localhost", "127.0.0.1", "::1", ...options.noProxyHosts].join(",");
+    return {
+        HTTPS_PROXY: proxy,
+        HTTP_PROXY: proxy,
+        https_proxy: proxy,
+        http_proxy: proxy,
+        NO_PROXY: noProxy,
+        no_proxy: noProxy,
+        NODE_USE_ENV_PROXY: "1",
+        NODE_EXTRA_CA_CERTS: options.caCertPath,
+        REQUESTS_CA_BUNDLE: SYSTEM_CA_BUNDLE,
+        SSL_CERT_FILE: SYSTEM_CA_BUNDLE,
+        CURL_CA_BUNDLE: SYSTEM_CA_BUNDLE,
+    };
+}
+function exists(path) {
+    return stat(path).then(() => true, () => false);
+}
+/**
+ * Reuses the CA in `dir`, or creates one (key 0600, cert 0644). With
+ * `installSystemTrust`, also adds the cert to the system bundle — needs root;
+ * a failure is logged, not thrown, so the proxy still starts.
+ */
+export async function ensureCertificateAuthority(options) {
+    const dir = options.dir ?? DEFAULT_CA_DIR;
+    const keyPath = join(dir, "ca.key");
+    const certPath = join(dir, "ca.pem");
+    if (!(await exists(keyPath)) || !(await exists(certPath))) {
+        const ca = await generateCACertificate({ subject: { commonName: "Baker Credential Broker" }, bits: 2048 });
+        await mkdir(dir, { recursive: true, mode: 0o755 });
+        await writeFile(keyPath, ca.key, { mode: 0o600 });
+        await writeFile(certPath, ca.cert, { mode: 0o644 });
+        options.log?.(`created certificate authority in ${dir}`);
+    }
+    if (options.installSystemTrust)
+        await installSystemTrust(certPath, options.log);
+    return { keyPath, certPath, key: await readFile(keyPath, "utf8"), cert: await readFile(certPath, "utf8") };
+}
+/**
+ * Writes the certificate to `target` as a new file. The system trust directory
+ * is under /usr/local, which the agent can write, and the broker is root: a
+ * copy would follow a link the agent planted there onto any file. Removing the
+ * name first drops such a link, and an exclusive create refuses one planted
+ * again in between rather than following it.
+ */
+export async function placeTrustedCert(certPath, target) {
+    await rm(target, { force: true });
+    await writeFile(target, await readFile(certPath), { flag: "wx", mode: 0o644 });
+}
+async function installSystemTrust(certPath, log) {
+    try {
+        await placeTrustedCert(certPath, SYSTEM_TRUST_PATH);
+        await promisify(execFile)(UPDATE_CA_CERTIFICATES);
+    }
+    catch (error) {
+        log?.(`could not add the certificate authority to the system bundle: ${String(error)}`);
+    }
+}
+//# sourceMappingURL=ca.js.map

package/dist/broker/ca.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.js","sourceRoot":"","sources":["../../src/broker/ca.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AACrE,8FAA8F;AAC9F,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,iBAAiB,GAAG,8DAA8D,CAAC;AAIzF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAK7B;IACC,MAAM,KAAK,GAAG,oBAAoB,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,OAAO;QACjB,kBAAkB,EAAE,GAAG;QACvB,mBAAmB,EAAE,OAAO,CAAC,UAAU;QACvC,kBAAkB,EAAE,gBAAgB;QACpC,aAAa,EAAE,gBAAgB;QAC/B,cAAc,EAAE,gBAAgB;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CACpB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAIhD;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB;QAAE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IACrE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,GAA+B;IACjF,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACpD,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,EAAE,CAAC,iEAAiE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/broker/ca.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ca.test.d.ts.map

package/dist/broker/ca.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.test.d.ts","sourceRoot":"","sources":["../../src/broker/ca.test.ts"],"names":[],"mappings":""}

package/dist/broker/ca.test.js

@@ -0,0 +1,58 @@
+import { lstatSync, mkdtempSync, readFileSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { agentProxyEnv, ensureCertificateAuthority, placeTrustedCert } from "./ca.js";
+describe("agentProxyEnv", () => {
+    it("routes every client through the broker and trusts its CA without dropping the system roots", () => {
+        const env = agentProxyEnv({ port: 8877, caCertPath: "/etc/baker-ca/ca.pem", noProxyHosts: [] });
+        expect(env).toEqual({
+            HTTPS_PROXY: "http://127.0.0.1:8877",
+            HTTP_PROXY: "http://127.0.0.1:8877",
+            https_proxy: "http://127.0.0.1:8877",
+            http_proxy: "http://127.0.0.1:8877",
+            NO_PROXY: "localhost,127.0.0.1,::1",
+            no_proxy: "localhost,127.0.0.1,::1",
+            NODE_USE_ENV_PROXY: "1",
+            NODE_EXTRA_CA_CERTS: "/etc/baker-ca/ca.pem",
+            REQUESTS_CA_BUNDLE: "/etc/ssl/certs/ca-certificates.crt",
+            SSL_CERT_FILE: "/etc/ssl/certs/ca-certificates.crt",
+            CURL_CA_BUNDLE: "/etc/ssl/certs/ca-certificates.crt",
+        });
+    });
+    it("keeps the named hosts off the broker, so the agent's own model traffic is never rewritten", () => {
+        const env = agentProxyEnv({ port: 8877, caCertPath: "/etc/baker-ca/ca.pem", noProxyHosts: ["openrouter.ai"] });
+        expect([env.NO_PROXY, env.no_proxy]).toEqual([
+            "localhost,127.0.0.1,::1,openrouter.ai",
+            "localhost,127.0.0.1,::1,openrouter.ai",
+        ]);
+    });
+});
+describe("ensureCertificateAuthority", () => {
+    it("creates a private key once and reuses it on the next start", async () => {
+        const dir = join(mkdtempSync(join(tmpdir(), "baker-ca-")), "ca");
+        const first = await ensureCertificateAuthority({ dir, installSystemTrust: false });
+        const second = await ensureCertificateAuthority({ dir, installSystemTrust: false });
+        expect(second).toEqual(first);
+        expect(statSync(first.keyPath).mode & 0o777).toBe(0o600);
+        expect(statSync(first.certPath).mode & 0o777).toBe(0o644);
+        expect(readFileSync(first.certPath, "utf8")).toContain("BEGIN CERTIFICATE");
+    });
+});
+describe("placeTrustedCert", () => {
+    it("replaces a link the agent planted where the certificate goes, and never writes through it", async () => {
+        // The trust directory is under /usr/local, which the agent can write; the broker is root.
+        const dir = mkdtempSync(join(tmpdir(), "baker-trust-"));
+        const victim = join(dir, "sudoers");
+        writeFileSync(victim, "user ALL=(ALL) ALL\n");
+        const target = join(dir, "baker-credential-broker.crt");
+        symlinkSync(victim, target);
+        const cert = join(dir, "ca.pem");
+        writeFileSync(cert, "-----BEGIN CERTIFICATE-----\n");
+        await placeTrustedCert(cert, target);
+        expect(readFileSync(victim, "utf8")).toBe("user ALL=(ALL) ALL\n");
+        expect(lstatSync(target).isSymbolicLink()).toBe(false);
+        expect(readFileSync(target, "utf8")).toBe("-----BEGIN CERTIFICATE-----\n");
+    });
+});
+//# sourceMappingURL=ca.test.js.map

package/dist/broker/ca.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ca.test.js","sourceRoot":"","sources":["../../src/broker/ca.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEtF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACpG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAEhG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YAClB,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,uBAAuB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,QAAQ,EAAE,yBAAyB;YACnC,kBAAkB,EAAE,GAAG;YACvB,mBAAmB,EAAE,sBAAsB;YAC3C,kBAAkB,EAAE,oCAAoC;YACxD,aAAa,EAAE,oCAAoC;YACnD,cAAc,EAAE,oCAAoC;SACrD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAsB,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAE/G,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,uCAAuC;YACvC,uCAAuC;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QAEpF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,0FAA0F;QAC1F,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpC,aAAa,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QACxD,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjC,aAAa,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAC;QAErD,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAErC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAClE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/credential-cache.d.ts

@@ -0,0 +1,24 @@
+import type { ResolvedCredential } from "./credential-text.ts";
+export declare const CREDENTIAL_TTL_MS = 10000;
+/** Each fetch decrypts every credential the company has; a refusal loop may force one this often at most. */
+export declare const MIN_REFRESH_INTERVAL_MS = 5000;
+export type FetchCredentials = () => Promise<ResolvedCredential[]>;
+export type CredentialCache = {
+    get(): Promise<ResolvedCredential[] | null>;
+    /** Every value to scrub: the current table plus any value that has left it. */
+    scrubbable(): Promise<ResolvedCredential[]>;
+    /**
+     * Drops the table so the next read fetches it again — unless an early
+     * refresh already happened within 5 seconds. Returns whether it dropped it.
+     */
+    refresh(): boolean;
+    /** How many credentials the last fetch returned (0 before the first). */
+    size(): number;
+};
+export declare function createCredentialCache(options: {
+    fetchCredentials: FetchCredentials;
+    now?: () => number;
+    ttlMs?: number;
+    log?: (message: string) => void;
+}): CredentialCache;
+//# sourceMappingURL=credential-cache.d.ts.map

package/dist/broker/credential-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cache.d.ts","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,eAAO,MAAM,iBAAiB,QAAS,CAAC;AACxC,6GAA6G;AAC7G,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;AAEnE,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,IAAI,OAAO,CAAC,kBAAkB,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,UAAU,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC5C;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC;IACnB,yEAAyE;IACzE,IAAI,IAAI,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,eAAe,CAsDlB"}

package/dist/broker/credential-cache.js

@@ -0,0 +1,69 @@
+/**
+ * The broker's copy of the company's credentials, fetched from Baker on first
+ * need and kept for 10 seconds. Concurrent reads share one fetch. A failed
+ * fetch keeps the last good table until the next refresh, but a refusal
+ * (`CredentialsRefused`) drops it: Baker has said no. Before any fetch
+ * has succeeded there is no table (null), which callers must treat as
+ * "credentials unavailable", not "no credentials".
+ *
+ * A value that leaves the table — refused or removed — may still be on its
+ * way back in a response to a request that carried it, so `scrubbable()`
+ * keeps scrubbing it for the broker's lifetime. It is never sent again.
+ */
+import { CredentialsRefused } from "./baker-api.js";
+export const CREDENTIAL_TTL_MS = 10_000;
+/** Each fetch decrypts every credential the company has; a refusal loop may force one this often at most. */
+export const MIN_REFRESH_INTERVAL_MS = 5_000;
+export function createCredentialCache(options) {
+    const now = options.now ?? Date.now;
+    const ttlMs = options.ttlMs ?? CREDENTIAL_TTL_MS;
+    let entry = null;
+    let lastGood = null;
+    let lastRefreshAt = Number.NEGATIVE_INFINITY;
+    const retired = new Map();
+    function replaceTable(next) {
+        const kept = new Set(next?.map((credential) => credential.value));
+        for (const credential of lastGood ?? []) {
+            if (!kept.has(credential.value))
+                retired.set(credential.value, credential);
+        }
+        for (const value of kept)
+            retired.delete(value);
+        lastGood = next;
+    }
+    function get() {
+        if (entry === null || now() - entry.at >= ttlMs) {
+            const table = options.fetchCredentials().then((credentials) => {
+                replaceTable(credentials);
+                return credentials;
+            }, (error) => {
+                if (error instanceof CredentialsRefused) {
+                    options.log?.(`${error.message}; dropping ${lastGood?.length ?? 0} cached credentials`);
+                    replaceTable(null);
+                    return null;
+                }
+                options.log?.(`credential fetch failed, keeping ${lastGood?.length ?? 0} cached: ${String(error)}`);
+                return lastGood;
+            });
+            entry = { at: now(), table };
+        }
+        return entry.table;
+    }
+    return {
+        get,
+        async scrubbable() {
+            return [...((await get()) ?? []), ...retired.values()];
+        },
+        refresh() {
+            if (now() - lastRefreshAt < MIN_REFRESH_INTERVAL_MS)
+                return false;
+            lastRefreshAt = now();
+            entry = null;
+            return true;
+        },
+        size() {
+            return lastGood?.length ?? 0;
+        },
+    };
+}
+//# sourceMappingURL=credential-cache.js.map

package/dist/broker/credential-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cache.js","sourceRoot":"","sources":["../../src/broker/credential-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAiB7C,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,iBAAiB,CAAC;IACjD,IAAI,KAAK,GAAuE,IAAI,CAAC;IACrF,IAAI,QAAQ,GAAgC,IAAI,CAAC;IACjD,IAAI,aAAa,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEtD,SAAS,YAAY,CAAC,IAAiC;QACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,KAAK,MAAM,UAAU,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,SAAS,GAAG;QACV,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAC3C,CAAC,WAAW,EAAE,EAAE;gBACd,YAAY,CAAC,WAAW,CAAC,CAAC;gBAC1B,OAAO,WAAW,CAAC;YACrB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBACjB,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;oBACxC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,cAAc,QAAQ,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,CAAC;oBACxF,YAAY,CAAC,IAAI,CAAC,CAAC;oBACnB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,GAAG,EAAE,CAAC,oCAAoC,QAAQ,EAAE,MAAM,IAAI,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACpG,OAAO,QAAQ,CAAC;YAClB,CAAC,CACF,CAAC;YACF,KAAK,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,OAAO;QACL,GAAG;QACH,KAAK,CAAC,UAAU;YACd,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;YACL,IAAI,GAAG,EAAE,GAAG,aAAa,GAAG,uBAAuB;gBAAE,OAAO,KAAK,CAAC;YAClE,aAAa,GAAG,GAAG,EAAE,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI;YACF,OAAO,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/broker/credential-cache.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credential-cache.test.d.ts.map

package/dist/broker/credential-cache.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cache.test.d.ts","sourceRoot":"","sources":["../../src/broker/credential-cache.test.ts"],"names":[],"mappings":""}