@koda-sl/baker-bridge 0.123.0-dev.f9f855bf1 → 0.124.0-dev.7e3937022

package/dist/broker/rewrite.js

@@ -0,0 +1,291 @@
+/**
+ * The decision the credential broker makes for one outgoing request: send it
+ * as-is, send it with placeholders swapped for values, or answer it itself
+ * with a refusal the agent can act on. Pure — the proxy wiring lives in
+ * `proxy.ts`.
+ */
+import { parse as legacyParseUrl } from "node:url";
+import { substitute } from "./credential-text.js";
+/** The largest body the broker reads for placeholders or scrubs values out of. */
+export const MAX_REWRITE_BODY_BYTES = 10 * 1024 * 1024;
+const PLACEHOLDER_MARKER = "{{credential:";
+const ENCODED_PLACEHOLDER = /%7B%7Bcredential%3A([a-z0-9_-]{1,64})%7D%7D/gi;
+/** `%7B%7Bcredential%3Aname%7D%7D` — what an HTTP client makes of a placeholder in a URL — back to `{{credential:name}}`. */
+function decodePlaceholders(text) {
+    return text.replace(ENCODED_PLACEHOLDER, (_match, name) => `{{credential:${name}}}`);
+}
+/** Collects what every substitution in one request used, was refused, or could not find. */
+function createSubstituter(credentials, host) {
+    const used = new Set();
+    const denied = new Map();
+    const unknown = new Set();
+    return {
+        used,
+        denied,
+        unknown,
+        apply(text, encode = (value) => value) {
+            const encoded = credentials.map((credential) => ({ ...credential, value: encode(credential.value) }));
+            const result = substitute(text, encoded, host);
+            for (const name of result.used)
+                used.add(name);
+            for (const { name, allowedHosts } of result.denied)
+                denied.set(name, allowedHosts);
+            for (const name of result.unknown)
+                unknown.add(name);
+            return result.out;
+        },
+    };
+}
+const BASIC_AUTH = /^(Basic\s+)([A-Za-z0-9+/=_-]+)\s*$/i;
+/** The `user:password` a Basic auth header carries. */
+function basicCredentials(value) {
+    const match = BASIC_AUTH.exec(value);
+    return match === null ? null : Buffer.from(match[2] ?? "", "base64").toString("utf8");
+}
+/** The `user:password` inside a Basic auth header, when it carries a placeholder. */
+function basicPair(value) {
+    const pair = basicCredentials(value);
+    return pair?.includes(PLACEHOLDER_MARKER) ? { scheme: BASIC_AUTH.exec(value)?.[1] ?? "Basic ", pair } : null;
+}
+function rewriteHeaderValue(value, substituter) {
+    const basic = basicPair(value);
+    if (basic === null)
+        return substituter.apply(value);
+    return basic.scheme + Buffer.from(substituter.apply(basic.pair), "utf8").toString("base64");
+}
+/**
+ * The `user:value` pairs a request's Basic auth headers carry, as sent. A
+ * response that echoes the header holds the pair's base64, which is not the
+ * base64 of the value alone, so each is scrubbed as a credential of its own.
+ */
+export function sentBasicPairs(headers, credentials) {
+    return Object.entries(headers).flatMap(([name, values]) => name.startsWith(":")
+        ? []
+        : [values ?? []].flat().flatMap((value) => {
+            const pair = basicCredentials(value);
+            const credential = pair === null ? undefined : credentials.find((c) => pair.includes(c.value));
+            return pair === null || credential === undefined ? [] : [{ name: credential.name, value: pair }];
+        }));
+}
+/**
+ * HTTP/2 pseudo-headers (`:path`, `:authority`) are returned as they came:
+ * mockttp regenerates them from the URL, which is rewritten on its own, and
+ * refuses a request whose `:path` was changed.
+ */
+function rewriteHeaders(headers, substituter) {
+    const out = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        if (name.startsWith(":")) {
+            out[name] = value;
+            continue;
+        }
+        out[name] = Array.isArray(value)
+            ? value.map((item) => rewriteHeaderValue(item, substituter))
+            : rewriteHeaderValue(value, substituter);
+    }
+    return out;
+}
+function headerValue(headers, name) {
+    const value = headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+function isUtf8(bytes) {
+    try {
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** How a value must be escaped to sit inside this body, or null when the body is not text. */
+function bodyFormat(contentType, body) {
+    const type = contentType?.split(";")[0]?.trim().toLowerCase();
+    if (type === undefined || type === "")
+        return isUtf8(body) ? "text" : null;
+    if (type === "application/json" || type.endsWith("+json"))
+        return "json";
+    if (type === "application/x-www-form-urlencoded")
+        return "form";
+    if (type.startsWith("text/") ||
+        type.endsWith("/xml") ||
+        type.endsWith("+xml") ||
+        type === "application/graphql" ||
+        type === "application/javascript") {
+        return "text";
+    }
+    return null;
+}
+/** Whether a body is text the broker may read and rewrite (by content type, or valid UTF-8 when there is none). */
+export function isTextBody(contentType, body) {
+    return bodyFormat(contentType, body) !== null;
+}
+const ENCODE_FOR = {
+    json: (value) => JSON.stringify(value).slice(1, -1),
+    form: encodeURIComponent,
+    text: (value) => value,
+};
+function headerText(headers) {
+    return Object.values(headers)
+        .flat()
+        .map((value) => (value === undefined ? "" : (basicPair(value)?.pair ?? value)))
+        .join("\n");
+}
+const BODY_TOO_LARGE = {
+    kind: "reject",
+    status: 413,
+    message: "Baker credentials can only be placed in text request bodies (JSON, form, text, XML or GraphQL) up to 10 MB. Put the placeholder in a header or the URL instead.",
+};
+function hasPlaceholder(text) {
+    return text.includes(PLACEHOLDER_MARKER) || decodePlaceholders(text) !== text;
+}
+const UNAVAILABLE = {
+    kind: "reject",
+    status: 503,
+    message: "Baker credentials are unavailable right now — try again in a minute.",
+};
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+/** A DNS name as the WHATWG parser emits it (IDNs arrive as `xn--`). Anything else could parse differently elsewhere. */
+const PLAIN_HOSTNAME = /^[a-z0-9.-]+$/;
+/**
+ * mockttp connects to `url.parse(<returned url>).hostname`, not to the name
+ * the check read. The two parsers disagree on unusual characters, so a
+ * credential is only substituted when both see the same host.
+ */
+function upstreamHostMatches(url, host) {
+    return PLAIN_HOSTNAME.test(host) && legacyParseUrl(url).hostname === host;
+}
+const HOST_MISMATCH = {
+    kind: "reject",
+    status: 403,
+    message: "Baker credentials are only sent to a plain website address, and never inside the address itself. Put the credential in a header, the query string or the body.",
+};
+/** The host a `Host` / `:authority` value names, port stripped and lower-cased; null when it is not a host. */
+function authorityHost(value) {
+    const candidate = `http://${value.trim()}`;
+    return URL.canParse(candidate) ? new URL(candidate).hostname.toLowerCase() : null;
+}
+/**
+ * The value goes to the site the check read, not to whatever site the agent's
+ * own `Host` or `:authority` names — on a shared CDN those can differ, and
+ * both headers are forwarded unchanged.
+ */
+function hostHeadersMatch(headers, host) {
+    return ["host", ":authority"].every((name) => {
+        const values = headers[name];
+        if (values === undefined)
+            return true;
+        return [values].flat().every((value) => authorityHost(value) === host.toLowerCase());
+    });
+}
+function hostHeaderRefusal(headers, host, used) {
+    if (used.size === 0 || hostHeadersMatch(headers, host))
+        return null;
+    return {
+        kind: "reject",
+        status: 403,
+        message: `This request goes to "${host}" but its Host header names another website, so Baker did not send the credential. Remove the Host header.`,
+    };
+}
+const SETTINGS = "Settings → Credentials";
+function refuse(substituter, host) {
+    const [unknown] = substituter.unknown;
+    if (unknown !== undefined) {
+        return {
+            kind: "reject",
+            status: 404,
+            message: `No Baker credential named "${unknown}". Run \`baker credentials list\` to see the names you can use.`,
+            stale: true,
+        };
+    }
+    const [denied] = substituter.denied;
+    if (denied === undefined)
+        return null;
+    const [name, allowedHosts] = denied;
+    const message = allowedHosts.length === 0
+        ? `Baker credential "${name}" has no websites it may be sent to yet. Ask the user to choose them in ${SETTINGS}.`
+        : `Baker credential "${name}" is not allowed for host "${host}". Allowed: ${allowedHosts.join(", ")}. Ask the user to add this website to the credential in ${SETTINGS}.`;
+    return { kind: "reject", status: 403, message, stale: true };
+}
+function bodyText(body) {
+    return body === null ? "" : Buffer.from(body).toString("latin1");
+}
+/** Whether a placeholder appears anywhere the broker looks — the URL, a header or the body. */
+export function carriesPlaceholder(request) {
+    return [request.url, headerText(request.headers), bodyText(request.body)].some(hasPlaceholder);
+}
+/** Whether any placeholder in the body names a credential this host may receive — only then is the body rewritten. */
+function bodyUsesCredential(body, credentials, host) {
+    if (body === null)
+        return false;
+    const text = decodePlaceholders(bodyText(body));
+    return hasPlaceholder(text) && substitute(text, credentials, host).used.length > 0;
+}
+/** The body with every placeholder for a credential this host may receive swapped in, escaped for its format. */
+function rewriteBody(request, credentials, host) {
+    const raw = request.body ?? new Uint8Array();
+    const format = bodyFormat(headerValue(request.headers, "content-type"), raw);
+    if (format === null || raw.byteLength > MAX_REWRITE_BODY_BYTES)
+        return BODY_TOO_LARGE;
+    const substituter = createSubstituter(credentials, host);
+    const decoded = Buffer.from(raw).toString("utf8");
+    const text = substituter.apply(format === "form" ? decodePlaceholders(decoded) : decoded, ENCODE_FOR[format]);
+    return { kind: "body", text, used: substituter.used };
+}
+/** A refusal for plain http to anything but this machine. */
+function insecureRefusal(target) {
+    if (target.protocol === "https:" || LOOPBACK_HOSTS.has(target.hostname))
+        return null;
+    return {
+        kind: "reject",
+        status: 403,
+        message: `Baker credentials are only sent over https. Use https://${target.host}${target.pathname} instead.`,
+    };
+}
+/**
+ * `credentials` is null when the table could not be fetched. Only a
+ * placeholder in the URL or a header — where the agent clearly meant to
+ * authenticate — is ever refused; one that appears only in the body is text
+ * (a chat message, a prompt) and passes through unless it names a credential
+ * this host may receive.
+ */
+export function rewriteRequest(request, credentials) {
+    if (!carriesPlaceholder(request))
+        return { kind: "pass" };
+    const url = decodePlaceholders(request.url);
+    if (!URL.canParse(request.url))
+        return HOST_MISMATCH;
+    const target = new URL(request.url);
+    const host = target.hostname;
+    const authPlaceholder = [url, headerText(request.headers)].some(hasPlaceholder);
+    if (credentials === null)
+        return authPlaceholder ? UNAVAILABLE : { kind: "pass" };
+    const bodyCarriesCredential = bodyUsesCredential(request.body, credentials, host);
+    if (!authPlaceholder && !bodyCarriesCredential)
+        return { kind: "pass" };
+    const insecure = insecureRefusal(target);
+    if (insecure !== null)
+        return insecure;
+    const substituter = createSubstituter(credentials, host);
+    const rewrittenUrl = substituter.apply(url, encodeURIComponent);
+    if (!upstreamHostMatches(rewrittenUrl, host))
+        return HOST_MISMATCH;
+    const headers = rewriteHeaders(request.headers, substituter);
+    const body = bodyCarriesCredential ? rewriteBody(request, credentials, host) : undefined;
+    if (body?.kind === "reject")
+        return body;
+    const used = new Set([...substituter.used, ...(body?.used ?? [])]);
+    const refusal = refuse(substituter, host) ?? hostHeaderRefusal(request.headers, host, used);
+    if (refusal !== null)
+        return refusal;
+    return {
+        kind: "rewrite",
+        url: rewrittenUrl,
+        headers,
+        ...(body === undefined ? {} : { body: body.text }),
+        used: [...used],
+    };
+}
+//# sourceMappingURL=rewrite.js.map

package/dist/broker/rewrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../src/broker/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,KAAK,IAAI,cAAc,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAsD,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAsBtG,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvD,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAE5E,6HAA6H;AAC7H,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,WAA0C,EAAE,IAAY;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO;QACL,IAAI;QACJ,MAAM;QACN,OAAO;QACP,KAAK,CAAC,IAAY,EAAE,MAAM,GAA8B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;YACtE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACtG,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,KAAK,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,MAAM,CAAC,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACnF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,GAAG,qCAAqC,CAAC;AAEzD,uDAAuD;AACvD,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxF,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,IAAI,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/G,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,WAAwB;IACjE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAuB,EACvB,WAA4C;IAE5C,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CACxD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;YACtC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/F,OAAO,IAAI,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC,CAAC,CACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,OAAuB,EAAE,WAAwB;IACvE,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAC9B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC5D,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAID,SAAS,WAAW,CAAC,OAAuB,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC;QACH,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,UAAU,CAAC,WAA+B,EAAE,IAAgB;IACnE,MAAM,IAAI,GAAG,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IACzE,IAAI,IAAI,KAAK,mCAAmC;QAAE,OAAO,MAAM,CAAC;IAChE,IACE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,KAAK,qBAAqB;QAC9B,IAAI,KAAK,wBAAwB,EACjC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,UAAU,CAAC,WAA+B,EAAE,IAAgB;IAC1E,OAAO,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,GAAkD;IAChE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;CACvB,CAAC;AAEF,SAAS,UAAU,CAAC,OAAuB;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC1B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;SAC9E,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,cAAc,GAAyC;IAC3D,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,GAAG;IACX,OAAO,EACL,iKAAiK;CACpK,CAAC;AAEF,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAChF,CAAC;AAED,MAAM,WAAW,GAAoB;IACnC,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,sEAAsE;CAChF,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACpE,yHAAyH;AACzH,MAAM,cAAc,GAAG,eAAe,CAAC;AAEvC;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,IAAY;IACpD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AAC5E,CAAC;AAED,MAAM,aAAa,GAAoB;IACrC,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,GAAG;IACX,OAAO,EACL,gKAAgK;CACnK,CAAC;AAEF,+GAA+G;AAC/G,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,SAAS,GAAG,UAAU,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3C,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAuB,EAAE,IAAY;IAC7D,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAuB,EAAE,IAAY,EAAE,IAAyB;IACzF,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,yBAAyB,IAAI,4GAA4G;KACnJ,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAE1C,SAAS,MAAM,CAAC,WAAwB,EAAE,IAAY;IACpD,MAAM,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,8BAA8B,OAAO,iEAAiE;YAC/G,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,MAAM,CAAC;IACpC,MAAM,OAAO,GACX,YAAY,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,qBAAqB,IAAI,2EAA2E,QAAQ,GAAG;QACjH,CAAC,CAAC,qBAAqB,IAAI,8BAA8B,IAAI,eAAe,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,2DAA2D,QAAQ,GAAG,CAAC;IAC9K,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB;IACvC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACzD,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACjG,CAAC;AAED,sHAAsH;AACtH,SAAS,kBAAkB,CACzB,IAAuB,EACvB,WAA0C,EAC1C,IAAY;IAEZ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,iHAAiH;AACjH,SAAS,WAAW,CAClB,OAAwB,EACxB,WAA0C,EAC1C,IAAY;IAEZ,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,GAAG,sBAAsB;QAAE,OAAO,cAAc,CAAC;IACtF,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9G,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,6DAA6D;AAC7D,SAAS,eAAe,CAAC,MAAW;IAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,2DAA2D,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,WAAW;KAC7G,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAwB,EACxB,WAAiD;IAEjD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1D,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChF,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClF,MAAM,qBAAqB,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC,eAAe,IAAI,CAAC,qBAAqB;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAChE,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO;QACL,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,YAAY;QACjB,OAAO;QACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;KAChB,CAAC;AACJ,CAAC"}

package/dist/broker/rewrite.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rewrite.test.d.ts.map

package/dist/broker/rewrite.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.test.d.ts","sourceRoot":"","sources":["../../src/broker/rewrite.test.ts"],"names":[],"mappings":""}

package/dist/broker/rewrite.test.js

@@ -0,0 +1,171 @@
+import { describe, expect, it } from "vitest";
+import { rewriteRequest } from "./rewrite.js";
+const credentials = [
+    { name: "meta-token", value: "EAAG-secret/value+1", allowedHosts: ["graph.facebook.com"] },
+    { name: "shop", value: 'shpat_"quoted"&x=1', allowedHosts: ["acme.myshopify.com"] },
+    { name: "nowhere", value: "unscoped-secret-1", allowedHosts: [] },
+];
+function request(overrides = {}) {
+    return {
+        url: "https://graph.facebook.com/v21.0/me",
+        headers: { accept: "application/json" },
+        body: null,
+        ...overrides,
+    };
+}
+const text = (value) => new TextEncoder().encode(value);
+describe("rewriteRequest", () => {
+    it("passes a request that carries no placeholder untouched", () => {
+        expect(rewriteRequest(request({ body: text('{"a":1}') }), credentials)).toEqual({ kind: "pass" });
+    });
+    it("swaps a placeholder in a header for the value when the host is allowed", () => {
+        const decision = rewriteRequest(request({ headers: { authorization: "Bearer {{credential:meta-token}}", accept: "*/*" } }), credentials);
+        expect(decision).toEqual({
+            kind: "rewrite",
+            url: "https://graph.facebook.com/v21.0/me",
+            headers: { authorization: "Bearer EAAG-secret/value+1", accept: "*/*" },
+            used: ["meta-token"],
+        });
+    });
+    it("swaps a placeholder in a JSON body, escaped so the body stays valid JSON", () => {
+        const decision = rewriteRequest(request({
+            url: "https://acme.myshopify.com/admin/graphql.json",
+            headers: { "content-type": "application/json; charset=utf-8" },
+            body: text('{"token":"{{credential:shop}}"}'),
+        }), credentials);
+        expect(decision).toMatchObject({ kind: "rewrite", used: ["shop"] });
+        const body = decision.kind === "rewrite" ? (decision.body ?? "") : "";
+        expect(JSON.parse(body)).toEqual({ token: 'shpat_"quoted"&x=1' });
+    });
+    it("swaps a placeholder in a form body, form-encoded", () => {
+        const decision = rewriteRequest(request({
+            url: "https://acme.myshopify.com/oauth",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: text("grant=x&secret=%7B%7Bcredential%3Ashop%7D%7D"),
+        }), credentials);
+        expect(decision).toMatchObject({ kind: "rewrite", used: ["shop"] });
+        const body = decision.kind === "rewrite" ? (decision.body ?? "") : "";
+        expect(new URLSearchParams(body).get("secret")).toBe('shpat_"quoted"&x=1');
+    });
+    it.each([
+        ["a text body over 10 MB", "text/plain", text(`{{credential:shop}}${"x".repeat(10 * 1024 * 1024)}`)],
+        ["a binary body", "application/octet-stream", text("\u0000\u0001{{credential:shop}}")],
+    ])("refuses a placeholder in %s with 413", (_kind, contentType, body) => {
+        const decision = rewriteRequest(request({ url: "https://acme.myshopify.com/upload", headers: { "content-type": contentType }, body }), credentials);
+        expect(decision).toMatchObject({ kind: "reject", status: 413 });
+    });
+    it("refuses to put a credential on plain http, even to an allowed host", () => {
+        const decision = rewriteRequest(request({ url: "http://graph.facebook.com/me", headers: { authorization: "Bearer {{credential:meta-token}}" } }), credentials);
+        expect(decision).toMatchObject({ kind: "reject", status: 403 });
+        expect(decision.kind === "reject" && decision.message).toContain("only sent over https");
+    });
+    it("swaps a placeholder hidden inside Basic auth, re-encoding the pair", () => {
+        const basic = `Basic ${btoa("admin:{{credential:shop}}")}`;
+        const decision = rewriteRequest(request({ url: "https://acme.myshopify.com/admin", headers: { authorization: basic } }), credentials);
+        expect(decision).toMatchObject({
+            kind: "rewrite",
+            headers: { authorization: `Basic ${Buffer.from('admin:shpat_"quoted"&x=1').toString("base64")}` },
+            used: ["shop"],
+        });
+    });
+    it.each([
+        ["literally", "https://acme.myshopify.com/admin?token={{credential:shop}}"],
+        ["percent-encoded", "https://acme.myshopify.com/admin?token=%7B%7Bcredential%3Ashop%7D%7D"],
+        ["percent-encoded in lower case", "https://acme.myshopify.com/admin?token=%7b%7bcredential%3ashop%7d%7d"],
+    ])("swaps a placeholder written %s in the URL for the URL-encoded value", (_form, url) => {
+        const decision = rewriteRequest(request({ url }), credentials);
+        expect(decision).toMatchObject({
+            kind: "rewrite",
+            url: `https://acme.myshopify.com/admin?token=${encodeURIComponent('shpat_"quoted"&x=1')}`,
+            used: ["shop"],
+        });
+    });
+    it("leaves HTTP/2 pseudo-headers as they came, since the proxy refuses a changed :path", () => {
+        const path = "/admin?token={{credential:shop}}";
+        const decision = rewriteRequest(request({ url: `https://acme.myshopify.com${path}`, headers: { ":method": "GET", ":path": path } }), credentials);
+        expect(decision).toMatchObject({
+            kind: "rewrite",
+            url: `https://acme.myshopify.com/admin?token=${encodeURIComponent('shpat_"quoted"&x=1')}`,
+            headers: { ":method": "GET", ":path": path },
+        });
+    });
+    it.each([
+        ["Host", "host"],
+        ["HTTP/2 :authority", ":authority"],
+    ])("refuses a credential when the %s header names a different site than the one checked", (_kind, header) => {
+        const decision = rewriteRequest(request({ headers: { [header]: "attacker.io", authorization: "Bearer {{credential:meta-token}}" } }), credentials);
+        expect(decision).toMatchObject({
+            kind: "reject",
+            status: 403,
+            message: expect.stringContaining("Host header names another website"),
+        });
+    });
+    it("accepts a Host header that names the checked site with a port and in any case", () => {
+        const decision = rewriteRequest(request({ headers: { host: "Graph.Facebook.com:443", authorization: "Bearer {{credential:meta-token}}" } }), credentials);
+        expect(decision).toMatchObject({ kind: "rewrite", used: ["meta-token"] });
+    });
+    it("refuses to send a credential to a host it is not allowed for, and says where it may go", () => {
+        const decision = rewriteRequest(request({ url: "https://attacker.io/collect", headers: { authorization: "Bearer {{credential:shop}}" } }), credentials);
+        expect(decision).toEqual({
+            kind: "reject",
+            status: 403,
+            message: 'Baker credential "shop" is not allowed for host "attacker.io". Allowed: acme.myshopify.com. Ask the user to add this website to the credential in Settings → Credentials.',
+            stale: true,
+        });
+    });
+    it("tells the agent to ask for websites when a credential has none yet", () => {
+        const decision = rewriteRequest(request({ headers: { "x-key": "{{credential:nowhere}}" } }), credentials);
+        expect(decision).toEqual({
+            kind: "reject",
+            status: 403,
+            message: 'Baker credential "nowhere" has no websites it may be sent to yet. Ask the user to choose them in Settings → Credentials.',
+            stale: true,
+        });
+    });
+    it.each([
+        ["not allowed for the host", "{{credential:shop}}"],
+        ["naming no stored credential", "{{credential:typo}}"],
+    ])("passes a body-only placeholder %s through untouched, as text", (_case, placeholder) => {
+        const decision = rewriteRequest(request({
+            url: "https://openrouter.ai/api/v1/chat/completions",
+            headers: { "content-type": "application/json" },
+            body: text(`{"messages":[{"content":"use ${placeholder}"}]}`),
+        }), credentials);
+        expect(decision).toEqual({ kind: "pass" });
+    });
+    it("answers 503 for a placeholder in a header when the credentials could not be fetched", () => {
+        const decision = rewriteRequest(request({ headers: { authorization: "Bearer {{credential:meta-token}}" } }), null);
+        expect(decision).toEqual({
+            kind: "reject",
+            status: 503,
+            message: "Baker credentials are unavailable right now — try again in a minute.",
+        });
+    });
+    it("passes a body-only placeholder when the credentials could not be fetched", () => {
+        const decision = rewriteRequest(request({ headers: { "content-type": "text/plain" }, body: text("{{credential:meta-token}}") }), null);
+        expect(decision).toEqual({ kind: "pass" });
+    });
+    it("answers 404 for a placeholder naming no stored credential", () => {
+        const decision = rewriteRequest(request({ headers: { "x-key": "{{credential:typo}}" } }), credentials);
+        expect(decision).toEqual({
+            kind: "reject",
+            status: 404,
+            message: 'No Baker credential named "typo". Run `baker credentials list` to see the names you can use.',
+            stale: true,
+        });
+    });
+    it("refuses a host whose name another URL parser would read differently", () => {
+        // mockttp re-parses the URL it is handed with url.parse(), which cuts a host at `{`, while the
+        // check reads the whole name: the credential must never go to a host the check did not see.
+        const decision = rewriteRequest(request({
+            url: "https://attacker.io{.acme.myshopify.com/admin",
+            headers: { authorization: "Bearer {{credential:shop}}" },
+        }), credentials);
+        expect(decision).toMatchObject({ kind: "reject", status: 403 });
+    });
+    it("refuses to put a credential into the address of the website itself", () => {
+        const decision = rewriteRequest(request({ url: "https://{{credential:shop}}.myshopify.com/admin" }), credentials);
+        expect(decision).toMatchObject({ kind: "reject", status: 403 });
+    });
+});
+//# sourceMappingURL=rewrite.test.js.map

package/dist/broker/rewrite.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.test.js","sourceRoot":"","sources":["../../src/broker/rewrite.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAwB,cAAc,EAAE,MAAM,cAAc,CAAC;AAEpE,MAAM,WAAW,GAAG;IAClB,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IAC1F,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC,oBAAoB,CAAC,EAAE;IACnF,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,EAAE,EAAE;CAClE,CAAC;AAEF,SAAS,OAAO,CAAC,SAAS,GAA6B,EAAE;IACvD,OAAO;QACL,GAAG,EAAE,qCAAqC;QAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,IAAI,EAAE,IAAI;QACV,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEhE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,EAC1F,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,qCAAqC;YAC1C,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE,MAAM,EAAE,KAAK,EAAE;YACvE,IAAI,EAAE,CAAC,YAAY,CAAC;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC;YACN,GAAG,EAAE,+CAA+C;YACpD,OAAO,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE;YAC9D,IAAI,EAAE,IAAI,CAAC,iCAAiC,CAAC;SAC9C,CAAC,EACF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC;YACN,GAAG,EAAE,kCAAkC;YACvC,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,8CAA8C,CAAC;SAC3D,CAAC,EACF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,wBAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,sBAAsB,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC,eAAe,EAAE,0BAA0B,EAAE,IAAI,CAAC,iCAAiC,CAAC,CAAC;KACvF,CAAC,CAAC,sCAAsC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,mCAAmC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,EACrG,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,8BAA8B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,CAAC,EAChH,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAE3D,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,kCAAkC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,EACvF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE;YACjG,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,WAAW,EAAE,4DAA4D,CAAC;QAC3E,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;QAC3F,CAAC,+BAA+B,EAAE,sEAAsE,CAAC;KAC1G,CAAC,CAAC,qEAAqE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,0CAA0C,kBAAkB,CAAC,oBAAoB,CAAC,EAAE;YACzF,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,IAAI,GAAG,kCAAkC,CAAC;QAEhD,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,6BAA6B,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,EACnG,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,0CAA0C,kBAAkB,CAAC,oBAAoB,CAAC,EAAE;YACzF,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,MAAM,EAAE,MAAM,CAAC;QAChB,CAAC,mBAAmB,EAAE,YAAY,CAAC;KACpC,CAAC,CAAC,qFAAqF,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1G,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,CAAC,EACpG,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC;YAC7B,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,mCAAmC,CAAC;SACtE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,CAAC,EAC3G,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE,EAAE,CAAC,EACzG,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EACL,2KAA2K;YAC7K,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAE1G,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EACL,0HAA0H;YAC5H,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,0BAA0B,EAAE,qBAAqB,CAAC;QACnD,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;KACvD,CAAC,CAAC,8DAA8D,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QACxF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC;YACN,GAAG,EAAE,+CAA+C;YACpD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,gCAAgC,WAAW,MAAM,CAAC;SAC9D,CAAC,EACF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,kCAAkC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAEnH,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAC/F,IAAI,CACL,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAEvG,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACvB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,8FAA8F;YACvG,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,+FAA+F;QAC/F,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,cAAc,CAC7B,OAAO,CAAC;YACN,GAAG,EAAE,+CAA+C;YACpD,OAAO,EAAE,EAAE,aAAa,EAAE,4BAA4B,EAAE;SACzD,CAAC,EACF,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,iDAAiD,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAElH,MAAM,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/broker/socket-service.d.ts

@@ -0,0 +1,18 @@
+import type { CredentialCache } from "./credential-cache.ts";
+export declare const MAX_SCRUB_REQUEST_BYTES: number;
+export type SocketService = {
+    listen(): Promise<void>;
+    close(): Promise<void>;
+};
+export declare function createSocketService(options: {
+    cache: CredentialCache;
+    socketPath: string;
+    ratePerSecond?: number;
+    /** Bytes of text a caller may have scrubbed: slows using /scrub as an oracle for guessing a value. */
+    scrubBytes?: {
+        capacity: number;
+        perSecond: number;
+    };
+    log?: (message: string) => void;
+}): SocketService;
+//# sourceMappingURL=socket-service.d.ts.map

package/dist/broker/socket-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-service.d.ts","sourceRoot":"","sources":["../../src/broker/socket-service.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,eAAO,MAAM,uBAAuB,QAAkB,CAAC;AAmBvD,MAAM,MAAM,aAAa,GAAG;IAAE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AA6BhF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sGAAsG;IACtG,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,GAAG,aAAa,CAyChB"}

package/dist/broker/socket-service.js

@@ -0,0 +1,103 @@
+/**
+ * The broker's local service for the bridge, over a unix socket the agent user
+ * can reach: scrub values out of text, and health. It
+ * never returns a value — `/scrub` only ever turns values into placeholders.
+ *
+ * The agent writes the text it asks to have scrubbed, so a scrub is an answer
+ * to "is any of these my password?". `/scrub` therefore leaves alone a value a
+ * wordlist could reach (`resistsGuessing`); the proxy still scrubs it from
+ * what a website sends back, where the agent does not choose the text.
+ */
+import { chmod, mkdir, rm } from "node:fs/promises";
+import { createServer } from "node:http";
+import { dirname } from "node:path";
+import { z } from "zod";
+import { scrub } from "./credential-text.js";
+import { createTokenBucket } from "./token-bucket.js";
+export const MAX_SCRUB_REQUEST_BYTES = 2 * 1024 * 1024;
+const DEFAULT_SCRUB_BYTES = { capacity: 8 * 1024 * 1024, perSecond: 256 * 1024 };
+const scrubRequestSchema = z.object({ text: z.string() });
+/** Bits a value must carry — its length times its per-character entropy — before `/scrub` may confirm it. */
+const MIN_SCRUB_BITS = 64;
+function resistsGuessing(value) {
+    const counts = new Map();
+    for (const char of value)
+        counts.set(char, (counts.get(char) ?? 0) + 1);
+    let perChar = 0;
+    for (const count of counts.values()) {
+        const p = count / value.length;
+        perChar -= p * Math.log2(p);
+    }
+    return perChar * value.length >= MIN_SCRUB_BITS;
+}
+class BodyTooLarge extends Error {
+}
+async function readBody(req, limit) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+        size += buffer.byteLength;
+        if (size > limit)
+            throw new BodyTooLarge();
+        chunks.push(buffer);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+function parseJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+function send(res, status, body) {
+    res.writeHead(status, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+}
+export function createSocketService(options) {
+    const bucket = createTokenBucket({ ratePerSecond: options.ratePerSecond ?? 50, burst: options.ratePerSecond ?? 50 });
+    const scrubBytes = options.scrubBytes ?? DEFAULT_SCRUB_BYTES;
+    const bytes = createTokenBucket({ ratePerSecond: scrubBytes.perSecond, burst: scrubBytes.capacity });
+    async function handle(req, res) {
+        if (req.method === "GET" && req.url === "/health") {
+            return send(res, 200, { ok: true, credentials: options.cache.size() });
+        }
+        if (req.method !== "POST" || req.url !== "/scrub")
+            return send(res, 404, { error: "not found" });
+        if (!bucket.take())
+            return send(res, 429, { error: "too many scrub requests" });
+        const raw = await readBody(req, MAX_SCRUB_REQUEST_BYTES);
+        if (!bytes.take(Buffer.byteLength(raw)))
+            return send(res, 429, { error: "too much text scrubbed, slow down" });
+        const parsed = scrubRequestSchema.safeParse(parseJson(raw));
+        if (!parsed.success)
+            return send(res, 400, { error: "expected {text}" });
+        const credentials = (await options.cache.scrubbable()).filter((credential) => resistsGuessing(credential.value));
+        return send(res, 200, { text: scrub(parsed.data.text, credentials) });
+    }
+    const server = createServer((req, res) => {
+        handle(req, res).catch((error) => {
+            if (error instanceof BodyTooLarge)
+                return send(res, 413, { error: "text too large to scrub" });
+            options.log?.(`socket request failed: ${error instanceof Error ? error.name : "unknown"}`);
+            send(res, 500, { error: "scrub failed" });
+        });
+    });
+    return {
+        async listen() {
+            await mkdir(dirname(options.socketPath), { recursive: true });
+            await rm(options.socketPath, { force: true });
+            await new Promise((resolve, reject) => {
+                server.once("error", reject);
+                server.listen(options.socketPath, () => resolve());
+            });
+            await chmod(options.socketPath, 0o666);
+        },
+        async close() {
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+//# sourceMappingURL=socket-service.js.map

package/dist/broker/socket-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket-service.js","sourceRoot":"","sources":["../../src/broker/socket-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACvD,MAAM,mBAAmB,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,CAAC;AAEjF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE1D,6GAA6G;AAC7G,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC;AAClD,CAAC;AAID,MAAM,YAAa,SAAQ,KAAK;CAAG;AAEnC,KAAK,UAAU,QAAQ,CAAC,GAAoB,EAAE,KAAa;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK;YAAE,MAAM,IAAI,YAAY,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAOnC;IACC,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IACrH,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;IAErG,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC/G,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACjH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxC,IAAI,KAAK,YAAY,YAAY;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,EAAE,CAAC,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3F,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,CAAC,MAAM;YACV,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC"}