@koda-sl/baker-bridge 0.122.0-dev.3613db443 → 0.122.0-dev.71ff4e44a

package/dist/broker/credential-cache.test.js

@@ -0,0 +1,120 @@
+import { describe, expect, it } from "vitest";
+import { CredentialsRefused } from "./baker-api.js";
+import { createCredentialCache } from "./credential-cache.js";
+function fetcher() {
+    let calls = 0;
+    return {
+        get calls() {
+            return calls;
+        },
+        fetchCredentials: async () => {
+            await Promise.resolve();
+            calls += 1;
+            return [{ name: `v${calls}`, value: "secret-value", allowedHosts: ["api.example.com"] }];
+        },
+    };
+}
+describe("createCredentialCache", () => {
+    it("reuses the table for 10 seconds, then fetches it again", async () => {
+        let clock = 0;
+        const source = fetcher();
+        const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => clock });
+        await cache.get();
+        clock = 9_999;
+        await cache.get();
+        clock = 10_000;
+        const table = await cache.get();
+        expect(source.calls).toBe(2);
+        expect(table?.map((credential) => credential.name)).toEqual(["v2"]);
+    });
+    it("keeps the last good table when a refresh fails, and has none when no fetch ever succeeded", async () => {
+        let clock = 0;
+        let failing = true;
+        const cache = createCredentialCache({
+            fetchCredentials: async () => {
+                await Promise.resolve();
+                if (failing)
+                    throw new Error("502 upstream");
+                return [{ name: "shop", value: "secret-value", allowedHosts: ["api.example.com"] }];
+            },
+            now: () => clock,
+        });
+        expect(await cache.get()).toBeNull();
+        failing = false;
+        clock = 10_000;
+        await cache.get();
+        failing = true;
+        clock = 20_000;
+        expect((await cache.get())?.map((credential) => credential.name)).toEqual(["shop"]);
+    });
+    it("drops the table once Baker refuses the broker, so no value is sent after Credentials are switched off", async () => {
+        let clock = 0;
+        let refused = false;
+        const cache = createCredentialCache({
+            fetchCredentials: async () => {
+                await Promise.resolve();
+                if (refused)
+                    throw new CredentialsRefused(401);
+                return [{ name: "shop", value: "secret-value", allowedHosts: ["api.example.com"] }];
+            },
+            now: () => clock,
+        });
+        await cache.get();
+        refused = true;
+        clock = 10_000;
+        expect(await cache.get()).toBeNull();
+        expect(cache.size()).toBe(0);
+    });
+    it("still scrubs a value it may have sent after Baker refuses the broker or the credential is removed", async () => {
+        let clock = 0;
+        let table = [
+            { name: "shop", value: "shop-secret-value", allowedHosts: ["api.example.com"] },
+            { name: "ads", value: "ads-secret-value", allowedHosts: ["api.example.com"] },
+        ];
+        let refused = false;
+        const cache = createCredentialCache({
+            fetchCredentials: async () => {
+                await Promise.resolve();
+                if (refused)
+                    throw new CredentialsRefused(401);
+                return table;
+            },
+            now: () => clock,
+        });
+        await cache.get();
+        table = table.slice(0, 1);
+        clock = 10_000;
+        const afterRemoval = (await cache.scrubbable()).map((credential) => credential.value);
+        refused = true;
+        clock = 20_000;
+        const afterRefusal = (await cache.scrubbable()).map((credential) => credential.value);
+        expect(afterRemoval.sort()).toEqual(["ads-secret-value", "shop-secret-value"]);
+        expect(afterRefusal.sort()).toEqual(["ads-secret-value", "shop-secret-value"]);
+        expect(await cache.get()).toBeNull();
+    });
+    it("fetches again on the next read after a refresh", async () => {
+        const source = fetcher();
+        const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => 0 });
+        await cache.get();
+        cache.refresh();
+        await cache.get();
+        expect(source.calls).toBe(2);
+    });
+    it("refreshes early at most once every 5 seconds, so refused retries cannot make it fetch on every request", async () => {
+        let clock = 0;
+        const source = fetcher();
+        const cache = createCredentialCache({ fetchCredentials: source.fetchCredentials, now: () => clock });
+        await cache.get();
+        const refreshed = [];
+        for (clock = 0; clock < 5_000; clock += 500) {
+            refreshed.push(cache.refresh());
+            await cache.get();
+        }
+        clock = 5_000;
+        refreshed.push(cache.refresh());
+        await cache.get();
+        expect(refreshed.filter(Boolean)).toHaveLength(2);
+        expect(source.calls).toBe(3);
+    });
+});
+//# sourceMappingURL=credential-cache.test.js.map

package/dist/broker/credential-cache.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cache.test.js","sourceRoot":"","sources":["../../src/broker/credential-cache.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,SAAS,OAAO;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,KAAK,CAAC;QACd,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAEhC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;gBAC7C,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QAEf,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uGAAuG,EAAE,KAAK,IAAI,EAAE;QACrH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAC/C,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QAEf,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mGAAmG,EAAE,KAAK,IAAI,EAAE;QACjH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAG;YACV,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;YAC/E,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC9E,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,OAAO;oBAAE,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;gBAC/C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtF,OAAO,GAAG,IAAI,CAAC;QACf,KAAK,GAAG,MAAM,CAAC;QACf,MAAM,YAAY,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEtF,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAEjG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,qBAAqB,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACrG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC;YAC5C,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,GAAG,KAAK,CAAC;QACd,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;QAElB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/credential-text.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Hand-copy of the placeholder grammar, host check and scrub in
+ * `packages/api/src/credentials/{placeholder,hosts,scrub}.ts`. The bridge is
+ * published standalone to npm and cannot depend on the private `@baker/api`,
+ * so these are copied rather than imported; `credential-text.test.ts` runs both
+ * copies over the same inputs and fails when this one drifts.
+ */
+export type CredentialPlaceholder = {
+    name: string;
+    start: number;
+    end: number;
+};
+export type ResolvedCredential = {
+    name: string;
+    value: string;
+    allowedHosts: readonly string[];
+};
+export type ScrubbableCredential = {
+    name: string;
+    value: string;
+};
+export type Substitution = {
+    out: string;
+    used: string[];
+    denied: {
+        name: string;
+        allowedHosts: readonly string[];
+    }[];
+    unknown: string[];
+};
+/** Below this length a value is too likely to occur in unrelated text to be scrubbed. */
+export declare const MIN_SCRUB_LENGTH = 6;
+export declare function renderPlaceholder(name: string): string;
+export declare function parsePlaceholders(text: string): CredentialPlaceholder[];
+/** The credential a value stands for when the whole value is one placeholder, as a tag's secret field holds it. */
+export declare function credentialNamedBy(value: string): string | null;
+export declare function hostAllowed(host: string, patterns: readonly string[]): boolean;
+export declare function substitute(text: string, credentials: readonly ResolvedCredential[], host: string): Substitution;
+/** Every form of a credential a scrub must catch, longest first, so a longer value is never half-replaced by a shorter one. */
+export declare function scrubPatterns(credentials: readonly ScrubbableCredential[]): {
+    needle: string;
+    name: string;
+}[];
+export declare function scrub(text: string, credentials: readonly ScrubbableCredential[]): string;
+//# sourceMappingURL=credential-text.d.ts.map

package/dist/broker/credential-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-text.d.ts","sourceRoot":"","sources":["../../src/broker/credential-text.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,MAAM,MAAM,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AACjF,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAClG,MAAM,MAAM,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC5D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB,EAAE,CAMvE;AAID,mHAAmH;AACnH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE9D;AAMD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAM9E;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CA4B/G;AAuBD,+HAA+H;AAC/H,wBAAgB,aAAa,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAK9G;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAMxF"}

package/dist/broker/credential-text.js

@@ -0,0 +1,103 @@
+/**
+ * Hand-copy of the placeholder grammar, host check and scrub in
+ * `packages/api/src/credentials/{placeholder,hosts,scrub}.ts`. The bridge is
+ * published standalone to npm and cannot depend on the private `@baker/api`,
+ * so these are copied rather than imported; `credential-text.test.ts` runs both
+ * copies over the same inputs and fails when this one drifts.
+ */
+const CREDENTIAL_NAME_PATTERN = "[a-z0-9][a-z0-9_-]{0,63}";
+const PLACEHOLDER_SOURCE = `\\{\\{credential:(${CREDENTIAL_NAME_PATTERN})\\}\\}`;
+/** Below this length a value is too likely to occur in unrelated text to be scrubbed. */
+export const MIN_SCRUB_LENGTH = 6;
+export function renderPlaceholder(name) {
+    return `{{credential:${name}}}`;
+}
+export function parsePlaceholders(text) {
+    return [...text.matchAll(new RegExp(PLACEHOLDER_SOURCE, "g"))].map((match) => ({
+        name: match[1] ?? "",
+        start: match.index,
+        end: match.index + match[0].length,
+    }));
+}
+const WHOLE_PLACEHOLDER_RE = new RegExp(`^${PLACEHOLDER_SOURCE}$`);
+/** The credential a value stands for when the whole value is one placeholder, as a tag's secret field holds it. */
+export function credentialNamedBy(value) {
+    return WHOLE_PLACEHOLDER_RE.exec(value.trim())?.[1] ?? null;
+}
+function normaliseHost(host) {
+    return host.trim().toLowerCase().replace(/\.$/, "");
+}
+export function hostAllowed(host, patterns) {
+    const target = normaliseHost(host);
+    return patterns.some((raw) => {
+        const pattern = normaliseHost(raw);
+        return pattern.startsWith("*.") ? target.endsWith(pattern.slice(1)) : target === pattern;
+    });
+}
+export function substitute(text, credentials, host) {
+    const byName = new Map(credentials.map((credential) => [credential.name, credential]));
+    const used = new Set();
+    const denied = new Map();
+    const unknown = new Set();
+    let out = "";
+    let cursor = 0;
+    for (const placeholder of parsePlaceholders(text)) {
+        const credential = byName.get(placeholder.name);
+        let replacement = text.slice(placeholder.start, placeholder.end);
+        if (credential === undefined) {
+            unknown.add(placeholder.name);
+        }
+        else if (hostAllowed(host, credential.allowedHosts)) {
+            replacement = credential.value;
+            used.add(credential.name);
+        }
+        else {
+            denied.set(credential.name, credential.allowedHosts);
+        }
+        out += text.slice(cursor, placeholder.start) + replacement;
+        cursor = placeholder.end;
+    }
+    out += text.slice(cursor);
+    return {
+        out,
+        used: [...used],
+        denied: [...denied].map(([name, allowedHosts]) => ({ name, allowedHosts })),
+        unknown: [...unknown],
+    };
+}
+function base64(value) {
+    let binary = "";
+    for (const byte of new TextEncoder().encode(value))
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+function encodings(value) {
+    const standard = base64(value);
+    const variants = [
+        value,
+        standard,
+        standard.replace(/=+$/, ""),
+        standard.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""),
+        encodeURIComponent(value),
+        // Inside a JSON string, and as PHP's json_encode writes it (`/` as `\/`), as WordPress echoes it.
+        JSON.stringify(value).slice(1, -1),
+        JSON.stringify(value).slice(1, -1).replaceAll("/", "\\/"),
+    ];
+    return [...new Set(variants)].filter((variant) => variant.length >= MIN_SCRUB_LENGTH);
+}
+/** Every form of a credential a scrub must catch, longest first, so a longer value is never half-replaced by a shorter one. */
+export function scrubPatterns(credentials) {
+    return credentials
+        .filter((credential) => credential.value.length >= MIN_SCRUB_LENGTH)
+        .flatMap((credential) => encodings(credential.value).map((needle) => ({ needle, name: credential.name })))
+        .sort((a, b) => b.needle.length - a.needle.length);
+}
+export function scrub(text, credentials) {
+    let out = text;
+    for (const { needle, name } of scrubPatterns(credentials)) {
+        if (out.includes(needle))
+            out = out.split(needle).join(renderPlaceholder(name));
+    }
+    return out;
+}
+//# sourceMappingURL=credential-text.js.map

package/dist/broker/credential-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-text.js","sourceRoot":"","sources":["../../src/broker/credential-text.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAC3D,MAAM,kBAAkB,GAAG,qBAAqB,uBAAuB,SAAS,CAAC;AAYjF,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,gBAAgB,IAAI,IAAI,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;KACnC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,MAAM,CAAC,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAEnE,mHAAmH;AACnH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAA2B;IACnE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,WAA0C,EAAE,IAAY;IAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,WAAW,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACtD,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC;QAC3D,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;IAC3B,CAAC;IACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO;QACL,GAAG;QACH,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG;QACf,KAAK;QACL,QAAQ;QACR,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACnE,kBAAkB,CAAC,KAAK,CAAC;QACzB,kGAAkG;QAClG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC;KAC1D,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC,CAAC;AACxF,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,aAAa,CAAC,WAA4C;IACxE,OAAO,WAAW;SACf,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;SACnE,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;SACzG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,WAA4C;IAC9E,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/broker/credential-text.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credential-text.test.d.ts.map

package/dist/broker/credential-text.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-text.test.d.ts","sourceRoot":"","sources":["../../src/broker/credential-text.test.ts"],"names":[],"mappings":""}

package/dist/broker/credential-text.test.js

@@ -0,0 +1,54 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+/**
+ * `credential-text.ts` is a hand-copy of the placeholder grammar, host check
+ * and scrub in `packages/api/src/credentials/` — the bridge is published
+ * standalone and cannot depend on the private `@baker/api`. These run both
+ * copies over the same inputs so the copy fails loudly when it falls behind.
+ */
+import { resolve } from "node:path";
+import { describe, expect, it } from "vitest";
+import * as local from "./credential-text.js";
+const UPSTREAM = resolve(import.meta.dirname, "../../../api/src/credentials/index.ts");
+async function upstream() {
+    const path = UPSTREAM;
+    return (await import(__rewriteRelativeImportExtension(path)));
+}
+const credentials = [
+    { name: "meta-token", value: "EAAGm0PX4ZCpsBAKZCZ+/x", allowedHosts: ["graph.facebook.com"] },
+    { name: "shop", value: "shpat_0a1b2c3d4e5f", allowedHosts: ["acme.myshopify.com"] },
+    { name: "short", value: "abc", allowedHosts: ["api.example.com"] },
+    { name: "unicode", value: "contraseña-segura-1", allowedHosts: ["api.example.com"] },
+    { name: "quoted", value: 'pa"ss/wo\\rd-9x', allowedHosts: ["api.example.com"] },
+];
+const texts = [
+    " {{credential:meta-token}} ",
+    "Authorization: Bearer {{credential:meta-token}} and {{credential:shop}} and {{credential:missing}}",
+    "{{credential:}} {{credential:Upper}} {credential:x} {{credential:short}}",
+    "echo EAAGm0PX4ZCpsBAKZCZ+/x RUFBR20wUFg0WkNwc0JBS1pDWisveA== shpat_0a1b2c3d4e5f abc",
+    `encoded ${encodeURIComponent("contraseña-segura-1")} ${btoa("shpat_0a1b2c3d4e5f")}`,
+    String.raw `{"password":"pa"ss/wo\rd-9x","php":"pa"ss\/wo\rd-9x"}`,
+];
+const hosts = ["graph.facebook.com", "GRAPH.facebook.com.", "acme.myshopify.com", "myshopify.com", "evil.io"];
+describe("credential-text mirrors @baker/api/credentials", () => {
+    it("parses, substitutes and scrubs exactly like the contract", async () => {
+        const api = await upstream();
+        for (const text of texts) {
+            expect(local.parsePlaceholders(text)).toEqual(api.parsePlaceholders(text));
+            expect(local.credentialNamedBy(text)).toBe(api.credentialNamedBy(text));
+            expect(local.scrub(text, credentials)).toBe(api.scrub(text, credentials));
+            for (const host of hosts) {
+                expect(local.substitute(text, credentials, host)).toEqual(api.substitute(text, credentials, host));
+            }
+        }
+        expect(local.scrubPatterns(credentials)).toEqual(api.scrubPatterns(credentials));
+        expect(local.MIN_SCRUB_LENGTH).toBe(api.MIN_SCRUB_LENGTH);
+    });
+});
+//# sourceMappingURL=credential-text.test.js.map

package/dist/broker/credential-text.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-text.test.js","sourceRoot":"","sources":["../../src/broker/credential-text.test.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAC;AAG9C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;AAEvF,KAAK,UAAU,QAAQ;IACrB,MAAM,IAAI,GAAW,QAAQ,CAAC;IAC9B,OAAO,CAAC,MAAM,MAAM,kCAAC,IAAI,EAAC,CAAa,CAAC;AAC1C,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,wBAAwB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IAC7F,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IACnF,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;IAClE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;IACpF,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;CAChF,CAAC;AAEF,MAAM,KAAK,GAAG;IACZ,6BAA6B;IAC7B,oGAAoG;IACpG,0EAA0E;IAC1E,qFAAqF;IACrF,WAAW,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,EAAE;IACpF,MAAM,CAAC,GAAG,CAAA,uDAAuD;CAClE,CAAC;AACF,MAAM,KAAK,GAAG,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;AAE9G,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/env.d.ts

@@ -0,0 +1,19 @@
+/** The broker's environment, parsed once at startup. */
+import { z } from "zod";
+declare const envSchema: z.ZodObject<{
+    CREDENTIAL_BROKER_TOKEN: z.ZodString;
+    BAKER_CONVEX_SITE_URL: z.ZodURL;
+    BAKER_CREDENTIAL_PROXY_PORT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    BAKER_CA_DIR: z.ZodDefault<z.ZodString>;
+    BAKER_BROKER_SOCKET: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type BrokerEnv = z.infer<typeof envSchema>;
+export declare function parseBrokerEnv(env?: NodeJS.ProcessEnv): z.ZodSafeParseResult<{
+    CREDENTIAL_BROKER_TOKEN: string;
+    BAKER_CONVEX_SITE_URL: string;
+    BAKER_CREDENTIAL_PROXY_PORT: number;
+    BAKER_CA_DIR: string;
+    BAKER_BROKER_SOCKET: string;
+}>;
+export {};
+//# sourceMappingURL=env.d.ts.map

package/dist/broker/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/broker/env.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,QAAA,MAAM,SAAS;;;;;;iBAMb,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB;;;;;;GAElE"}

package/dist/broker/env.js

@@ -0,0 +1,16 @@
+/** The broker's environment, parsed once at startup. */
+import { z } from "zod";
+import { DEFAULT_BROKER_SOCKET } from "./broker-client.js";
+import { DEFAULT_CA_DIR } from "./ca.js";
+import { DEFAULT_PROXY_PORT } from "./proxy.js";
+const envSchema = z.object({
+    CREDENTIAL_BROKER_TOKEN: z.string().min(1),
+    BAKER_CONVEX_SITE_URL: z.url(),
+    BAKER_CREDENTIAL_PROXY_PORT: z.coerce.number().int().min(1).max(65_535).default(DEFAULT_PROXY_PORT),
+    BAKER_CA_DIR: z.string().min(1).default(DEFAULT_CA_DIR),
+    BAKER_BROKER_SOCKET: z.string().min(1).default(DEFAULT_BROKER_SOCKET),
+});
+export function parseBrokerEnv(env = process.env) {
+    return envSchema.safeParse(env);
+}
+//# sourceMappingURL=env.js.map

package/dist/broker/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/broker/env.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE;IAC9B,2BAA2B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IACvD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;CACtE,CAAC,CAAC;AAIH,MAAM,UAAU,cAAc,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjE,OAAO,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC"}

package/dist/broker/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/broker/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/broker/main.ts"],"names":[],"mappings":""}

package/dist/broker/main.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/**
+ * `baker-credential-broker` — runs as root inside the Runtime, before the
+ * agent starts. Holds the company's credentials so the agent never does:
+ * the agent writes `{{credential:NAME}}`, the broker swaps the value in for
+ * allowed hosts and swaps it back out of what the agent reads.
+ */
+import { createBakerBrokerApi } from "./baker-api.js";
+import { ensureCertificateAuthority } from "./ca.js";
+import { parseBrokerEnv } from "./env.js";
+import { createBroker } from "./proxy.js";
+import { createSocketService } from "./socket-service.js";
+function log(message) {
+    console.error(`[credential-broker] ${message}`);
+}
+async function main() {
+    const parsed = parseBrokerEnv();
+    if (!parsed.success) {
+        log(`invalid environment: ${parsed.error.issues.map((issue) => issue.path.join(".")).join(", ")}`);
+        process.exit(1);
+    }
+    const env = parsed.data;
+    const api = createBakerBrokerApi({ siteUrl: env.BAKER_CONVEX_SITE_URL, token: env.CREDENTIAL_BROKER_TOKEN });
+    const ca = await ensureCertificateAuthority({
+        dir: env.BAKER_CA_DIR,
+        installSystemTrust: process.getuid?.() === 0,
+        log,
+    });
+    const broker = createBroker({
+        ca,
+        port: env.BAKER_CREDENTIAL_PROXY_PORT,
+        fetchCredentials: api.fetchCredentials,
+        reportUsage: api.reportUsage,
+        log,
+    });
+    const socket = createSocketService({ cache: broker.cache, socketPath: env.BAKER_BROKER_SOCKET, log });
+    const port = await broker.start();
+    await socket.listen();
+    log(`listening on 127.0.0.1:${port}, socket ${env.BAKER_BROKER_SOCKET}`);
+    const shutdown = async () => {
+        await Promise.allSettled([socket.close(), broker.stop()]);
+        process.exit(0);
+    };
+    process.once("SIGTERM", () => void shutdown());
+    process.once("SIGINT", () => void shutdown());
+}
+main().catch((error) => {
+    log(`failed to start: ${error instanceof Error ? error.message : String(error)}`);
+    process.exit(1);
+});
+//# sourceMappingURL=main.js.map

package/dist/broker/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/broker/main.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,SAAS,GAAG,CAAC,OAAe;IAC1B,OAAO,CAAC,KAAK,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,wBAAwB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC;IACxB,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,CAAC,uBAAuB,EAAE,CAAC,CAAC;IAC7G,MAAM,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC1C,GAAG,EAAE,GAAG,CAAC,YAAY;QACrB,kBAAkB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC;QAC5C,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,EAAE;QACF,IAAI,EAAE,GAAG,CAAC,2BAA2B;QACrC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACtB,GAAG,CAAC,0BAA0B,IAAI,YAAY,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,GAAG,CAAC,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/broker/proxy.d.ts

@@ -0,0 +1,24 @@
+import type { CredentialUse } from "./baker-api.ts";
+import { type CredentialCache, type FetchCredentials } from "./credential-cache.ts";
+export declare const DEFAULT_PROXY_PORT = 8877;
+export type BrokerOptions = {
+    ca: {
+        key: string;
+        cert: string;
+    };
+    fetchCredentials: FetchCredentials;
+    reportUsage: (uses: CredentialUse[]) => Promise<void>;
+    /** 0 picks a free port. */
+    port?: number;
+    /** Extra roots to trust upstream (tests); Node's built-in roots are always trusted. */
+    upstreamCAs?: readonly string[];
+    log?: (message: string) => void;
+};
+export type Broker = {
+    cache: CredentialCache;
+    /** Starts the proxy and returns the port it listens on. */
+    start(): Promise<number>;
+    stop(): Promise<void>;
+};
+export declare function createBroker(options: BrokerOptions): Broker;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/broker/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/broker/proxy.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,KAAK,eAAe,EAAyB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAe3G,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,WAAW,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,2DAA2D;IAC3D,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB,CAAC;AA6CF,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAkF3D"}

package/dist/broker/proxy.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=proxy.integration.test.d.ts.map

package/dist/broker/proxy.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.integration.test.d.ts","sourceRoot":"","sources":["../../src/broker/proxy.integration.test.ts"],"names":[],"mappings":""}