@wardby/cli 0.5.3 → 0.6.0

package/dist/mcp/tools/secret-broker-compat.js

@@ -0,0 +1,23 @@
+/**
+ * A static, best-effort check: a tool granted a brokered secret that still reads secrets with
+ * secrets.get() will fail at run time. Warns; never blocks (the scan can't see dynamic code).
+ */
+export function toolCallsSecretsGet(code) {
+    return /\bsecrets\s*\.\s*get\s*\(/.test(code);
+}
+export function brokerCompatibilityWarnings(tools, brokeredNames) {
+    const warnings = [];
+    for (const tool of tools) {
+        const brokered = tool.allowedSecrets.filter((s) => brokeredNames.has(s));
+        if (!brokered.length || !toolCallsSecretsGet(tool.code))
+            continue;
+        const list = brokered.map((s) => `"${s}"`).join(", ");
+        const example = JSON.stringify(brokered);
+        warnings.push(`Tool "${tool.name}" reads secrets with secrets.get(), but ${list} ${brokered.length > 1 ? "are" : "is"} brokered: that call will fail with secret_brokered. Update the tool to send it with fetch(url, { secrets: ${example} }).`);
+    }
+    return warnings;
+}
+/** An attachment's `allowedSecrets` JSON column as names (anything else is ignored). */
+export function allowedSecretNames(json) {
+    return Array.isArray(json) ? json.filter((s) => typeof s === "string") : [];
+}

package/dist/mcp/tools/secret-elicitation-form.d.ts

@@ -2,15 +2,26 @@
  * The one-time browser form a secret-elicitation URL points to — shared by
  * both hosts: stdio's ephemeral loopback server (secret-elicitation-server.ts)
  * and the HTTP transport's mounted route (wired in streamable-http.ts). No
- * JavaScript: a plain HTML form POST is enough for one password field, so
+ * JavaScript: a plain HTML form POST is enough for one password field (plus
+ * the optional broker fields, shown and hidden by a CSS `:checked` rule), so
  * CSP can forbid scripts outright rather than needing a nonce.
+ *
+ * Two pages share the route, chosen by the signed payload's `kind`: "create"
+ * (enter a value, optionally brokered) and "unbroker" (a person confirms
+ * removing a secret's broker config by typing its name). An unbroker link
+ * never shows or accepts a value.
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { PrismaClient } from "#prisma";
 import type { SecretCipher } from "../../providers/secrets/types.js";
 import { type SecretElicitationPayload } from "./secret-elicitation.js";
+import { type SecretBrokerConfig } from "../../core/secret-broker-config.js";
 /** The HTTP-transport route path this form is mounted at (see streamable-http.ts). */
 export declare const SECRET_ELICITATION_PATH = "/elicit/secret";
+/** The "Brokered (recommended)" checkbox, warning, compatibility note, and broker fields, pre-filled from `prefill`. */
+export declare function brokerFieldset(prefill?: SecretBrokerConfig): string;
+/** The form's broker config: null when the box is unchecked; throws secret_broker_config_invalid when it doesn't validate. */
+export declare function brokerConfigFromForm(body: URLSearchParams): SecretBrokerConfig | null;
 export interface SecretFormDeps {
     verify: (token: string) => Promise<SecretElicitationPayload>;
     secrets: SecretCipher;
@@ -18,5 +29,14 @@ export interface SecretFormDeps {
 }
 /** Handles one GET (render) or POST (submit) for the secret-entry form at the given token. */
 export declare function handleSecretElicitationForm(method: string | undefined, token: string | null, readFormBody: () => Promise<URLSearchParams>, res: ServerResponse, deps: SecretFormDeps): Promise<void>;
-/** Reads a small `application/x-www-form-urlencoded` body (8 KiB cap — a secret value, nothing more). */
+/**
+ * The largest form body accepted: room for the largest valid AWS SigV4 value
+ * (an 8 KiB session token, up to 3x after URL encoding) plus the broker fields.
+ */
+export declare const FORM_BODY_LIMIT: number;
+/**
+ * Reads a small `application/x-www-form-urlencoded` body. Over FORM_BODY_LIMIT it
+ * rejects with `body_too_large` and discards the rest of the upload, so the
+ * handler can still answer 413 on the same connection.
+ */
 export declare function readFormBody(req: IncomingMessage): Promise<URLSearchParams>;

package/dist/mcp/tools/secret-elicitation-form.js

@@ -1,11 +1,107 @@
-import { fulfillSecretElicitation } from "./secret-elicitation.js";
+import { fulfillSecretElicitation, fulfillUnbrokerElicitation, } from "./secret-elicitation.js";
+import { listSecrets } from "../../core/secrets.js";
+import { parseSecretBrokerConfig } from "../../core/secret-broker-config.js";
 import { PAGE_STYLE } from "../shared/page-style.js";
 /** The HTTP-transport route path this form is mounted at (see streamable-http.ts). */
 export const SECRET_ELICITATION_PATH = "/elicit/secret";
 function escape(value) {
     return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 }
-function html(res, status, body) {
+const BROKER_WARNING = "If this is not brokered, any tool attached with this secret can read its value and send it anywhere that tool can fetch — including when a prompt-injected agent tells it to.";
+const BROKER_COMPAT = 'Brokered secrets only work with tools that call <code>fetch(url, { secrets: ["NAME"] })</code>. A tool that reads the value with <code>secrets.get()</code> will fail with <code>secret_brokered</code>.';
+/** Script-free toggle: the fields after the checkbox show only while it is checked. */
+const BROKER_STYLE = `
+.broker-toggle { display: inline-block; margin: 0 0 12px 6px; color: var(--ink); }
+.broker-fields { display: none; }
+#brokered:checked ~ .broker-fields { display: block; }
+.warning { border-left: 3px solid #b45309; padding-left: 8px; color: var(--ink); }
+.broker-fields input, .broker-fields textarea, .broker-fields select, input[name="confirm"] {
+  display: block;
+  width: 100%;
+  margin-top: 8px;
+  padding: 10px 12px;
+  font: inherit;
+  font-size: 14px;
+  color: var(--ink);
+  background: var(--paper);
+  border: 1px solid var(--line);
+  border-radius: 10px;
+}
+code, pre { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 12px; }
+code { overflow-wrap: anywhere; }
+pre { white-space: pre-wrap; overflow-wrap: anywhere; padding: 10px; background: var(--paper); border: 1px solid var(--line); border-radius: 10px; }
+.hint { margin: 4px 0 12px; }
+.broker-summary { margin: 0 0 12px; padding: 10px 10px 10px 28px; background: var(--paper); border: 1px solid var(--line); border-radius: 10px; color: var(--ink); }
+.broker-summary li { margin: 2px 0; }
+/* Show only the selected placement's fields; browsers without :has() show them all. */
+@supports selector(:has(*)) {
+  .placement { display: none; }
+  .broker-fields:has(option[value="header"]:checked) .placement-header,
+  .broker-fields:has(option[value="query"]:checked) .placement-query,
+  .broker-fields:has(option[value="body"]:checked) .placement-body,
+  .broker-fields:has(option[value="aws-sigv4"]:checked) .placement-aws-sigv4 { display: block; }
+}
+`;
+/** The "Brokered (recommended)" checkbox, warning, compatibility note, and broker fields, pre-filled from `prefill`. */
+export function brokerFieldset(prefill) {
+    const p = prefill?.placement;
+    const sel = (kind) => (p?.kind === kind ? " selected" : "");
+    return (`<input type="checkbox" id="brokered" name="brokered" value="1"${prefill ? " checked" : ""}>` +
+        `<label class="broker-toggle" for="brokered">Brokered (recommended)</label>` +
+        `<p class="warning">${escape(BROKER_WARNING)}</p>` +
+        `<p>${BROKER_COMPAT}</p>` +
+        `<div class="broker-fields">` +
+        `<label>Allowed hosts (one per line)<textarea name="hosts" rows="2">${escape(prefill?.hosts.join("\n") ?? "")}</textarea></label>` +
+        `<label>Path prefixes (optional, one per line)<textarea name="pathPrefixes" rows="2">${escape(prefill?.pathPrefixes?.join("\n") ?? "")}</textarea></label>` +
+        `<label>Placement<select name="placement">` +
+        `<option value="header"${sel("header")}>Header</option><option value="query"${sel("query")}>Query parameter</option>` +
+        `<option value="body"${sel("body")}>Body field</option><option value="aws-sigv4"${sel("aws-sigv4")}>AWS SigV4</option></select></label>` +
+        `<div class="placement placement-header">` +
+        `<label>Header name<input name="headerName" value="${escape(p?.kind === "header" ? p.name : "Authorization")}"></label>` +
+        `<label>Header format<input name="headerFormat" value="${escape(p?.kind === "header" ? p.format : "Bearer {value}")}"></label>` +
+        `<p class="hint"><code>{value}</code> is replaced with the secret.</p>` +
+        `</div>` +
+        `<div class="placement placement-query">` +
+        `<label>Query parameter name<input name="queryName" value="${escape(p?.kind === "query" ? p.name : "")}"></label>` +
+        `</div>` +
+        `<div class="placement placement-body">` +
+        `<label>Body field name<input name="bodyField" value="${escape(p?.kind === "body" ? p.field : "")}"></label>` +
+        `<p class="hint">A top-level field of a JSON-object or form-encoded body.</p>` +
+        `</div>` +
+        `<div class="placement placement-aws-sigv4">` +
+        `<label>AWS region<input name="awsRegion" value="${escape(p?.kind === "aws-sigv4" ? p.region : "")}"></label>` +
+        `<label>AWS service<input name="awsService" value="${escape(p?.kind === "aws-sigv4" ? p.service : "")}"></label>` +
+        `<p class="hint">For AWS SigV4 the secret value is JSON (session token optional):</p>` +
+        `<pre>{\n  "accessKeyId": "…",\n  "secretAccessKey": "…",\n  "sessionToken": "…"\n}</pre>` +
+        `</div>` +
+        `</div>`);
+}
+const lines = (v) => (v ?? "")
+    .split(/\r?\n/)
+    .map((s) => s.trim())
+    .filter(Boolean);
+/** The form's broker config: null when the box is unchecked; throws secret_broker_config_invalid when it doesn't validate. */
+export function brokerConfigFromForm(body) {
+    if (body.get("brokered") !== "1")
+        return null;
+    const kind = body.get("placement");
+    const placement = kind === "header"
+        ? { kind, name: body.get("headerName") ?? "", format: body.get("headerFormat") ?? "" }
+        : kind === "query"
+            ? { kind, name: body.get("queryName") ?? "" }
+            : kind === "body"
+                ? { kind, field: body.get("bodyField") ?? "" }
+                : kind === "aws-sigv4"
+                    ? { kind, region: body.get("awsRegion") ?? "", service: body.get("awsService") ?? "" }
+                    : { kind };
+    const prefixes = lines(body.get("pathPrefixes"));
+    return parseSecretBrokerConfig({
+        hosts: lines(body.get("hosts")),
+        ...(prefixes.length > 0 && { pathPrefixes: prefixes }),
+        placement,
+    });
+}
+function html(res, status, body, extraStyle = "") {
     res.setHeader("content-security-policy", "default-src 'none'; script-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'");
     res.setHeader("cache-control", "no-store");
     res.setHeader("x-content-type-options", "nosniff");
@@ -18,7 +114,7 @@ function html(res, status, body) {
     res
         .writeHead(status, { "content-type": "text/html; charset=utf-8" })
         .end(`<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">` +
-        `<title>wardby secret entry</title><style>${PAGE_STYLE}</style><body><div class="card"><div class="kicker">wardby</div>${body}</div></body></html>`);
+        `<title>wardby secret entry</title><style>${PAGE_STYLE}${extraStyle}</style><body><div class="card"><div class="kicker">wardby</div>${body}</div></body></html>`);
 }
 /** Handles one GET (render) or POST (submit) for the secret-entry form at the given token. */
 export async function handleSecretElicitationForm(method, token, readFormBody, res, deps) {
@@ -32,21 +128,36 @@ export async function handleSecretElicitationForm(method, token, readFormBody, r
         html(res, 400, "<h1>Link expired</h1><p>This link is invalid or has expired. Return to your MCP client and try again.</p>");
         return;
     }
+    if ((payload.kind ?? "create") === "unbroker") {
+        await handleUnbroker(method, payload, readFormBody, res, deps);
+        return;
+    }
     if (method === "GET") {
         html(res, 200, `<h1>Enter secret value</h1><p>Name: <strong>${escape(payload.secretName)}</strong></p>` +
             `<form method="post"><label>Secret value` +
             `<input type="password" name="value" autocomplete="off" required autofocus placeholder="Paste the value here"></label>` +
-            `<button type="submit">Save</button></form>`);
+            brokerFieldset(payload.broker) +
+            `<button type="submit">Save</button></form>`, BROKER_STYLE);
         return;
     }
     if (method === "POST") {
-        const body = await readFormBody();
+        const body = await readBodyOr413(readFormBody, res);
+        if (!body)
+            return;
         const value = body.get("value") ?? "";
         if (!value) {
             html(res, 400, "<h1>A value is required.</h1>");
             return;
         }
-        const outcome = await fulfillSecretElicitation(payload, value, deps.secrets, deps.db);
+        let broker;
+        try {
+            broker = brokerConfigFromForm(body);
+        }
+        catch (err) {
+            html(res, 400, `<h1>Could not save</h1><p>${escape(err instanceof Error ? err.message : String(err))}</p>`);
+            return;
+        }
+        const outcome = await fulfillSecretElicitation(payload, value, deps.secrets, deps.db, broker);
         if (outcome.ok)
             html(res, 200, "<h1>Saved</h1><p>You can close this tab and return to your MCP client.</p>");
         else
@@ -55,21 +166,100 @@ export async function handleSecretElicitationForm(method, token, readFormBody, r
     }
     res.writeHead(405).end();
 }
-/** Reads a small `application/x-www-form-urlencoded` body (8 KiB cap — a secret value, nothing more). */
+/** Reads the POST body, or answers 413 (over the cap) and returns undefined. */
+async function readBodyOr413(readFormBody, res) {
+    try {
+        return await readFormBody();
+    }
+    catch (err) {
+        if (!(err instanceof Error && err.message === "body_too_large"))
+            throw err;
+        res.setHeader("connection", "close");
+        html(res, 413, "<h1>Value too large</h1><p>The form was larger than this page accepts.</p>");
+        return undefined;
+    }
+}
+/** A readable, escaped summary of a broker config for the unbroker page. */
+function describeBroker(broker) {
+    if (!broker)
+        return "<p>(not brokered)</p>";
+    const p = broker.placement;
+    const placement = p.kind === "header"
+        ? `header <code>${escape(p.name)}: ${escape(p.format)}</code>`
+        : p.kind === "query"
+            ? `query parameter <code>${escape(p.name)}</code>`
+            : p.kind === "body"
+                ? `body field <code>${escape(p.field)}</code>`
+                : `AWS SigV4 (region <code>${escape(p.region)}</code>, service <code>${escape(p.service)}</code>)`;
+    const list = (items) => items.map((item) => `<code>${escape(item)}</code>`).join(", ");
+    return (`<ul class="broker-summary">` +
+        `<li>Hosts: ${list(broker.hosts)}</li>` +
+        (broker.pathPrefixes?.length ? `<li>Paths: ${list(broker.pathPrefixes)}</li>` : "") +
+        `<li>Sent as: ${placement}</li>` +
+        `</ul>`);
+}
+/** The unbroker link's page: show what is brokered now, and remove it only when the person types the secret's name. */
+async function handleUnbroker(method, payload, readFormBody, res, deps) {
+    if (method === "GET") {
+        const current = (await listSecrets(payload.ownerId, deps.db)).find((s) => s.name === payload.secretName);
+        html(res, 200, `<h1>Remove brokering</h1><p>Name: <strong>${escape(payload.secretName)}</strong></p>` +
+            `<p>Currently brokered as:</p>${describeBroker(current?.broker ?? null)}` +
+            `<p class="warning">${escape(BROKER_WARNING)}</p>` +
+            `<form method="post"><label>Type the secret's name to confirm` +
+            `<input name="confirm" autocomplete="off" required autofocus></label>` +
+            `<button type="submit">Remove brokering</button></form>`, BROKER_STYLE);
+        return;
+    }
+    if (method === "POST") {
+        const body = await readBodyOr413(readFormBody, res);
+        if (!body)
+            return;
+        if (body.get("confirm") !== payload.secretName) {
+            html(res, 400, `<h1>${escape("Type the secret's name to confirm.")}</h1>`);
+            return;
+        }
+        const outcome = await fulfillUnbrokerElicitation(payload, deps.secrets, deps.db);
+        if (outcome.ok) {
+            html(res, 200, "<h1>Brokering removed</h1><p>You can close this tab and return to your MCP client.</p>");
+        }
+        else {
+            html(res, 400, `<h1>Could not remove brokering</h1><p>${escape(outcome.error)}</p>`);
+        }
+        return;
+    }
+    res.writeHead(405).end();
+}
+/**
+ * The largest form body accepted: room for the largest valid AWS SigV4 value
+ * (an 8 KiB session token, up to 3x after URL encoding) plus the broker fields.
+ */
+export const FORM_BODY_LIMIT = 32 * 1024;
+/**
+ * Reads a small `application/x-www-form-urlencoded` body. Over FORM_BODY_LIMIT it
+ * rejects with `body_too_large` and discards the rest of the upload, so the
+ * handler can still answer 413 on the same connection.
+ */
 export function readFormBody(req) {
     return new Promise((resolve, reject) => {
         let size = 0;
+        let tooLarge = false;
         const chunks = [];
         req.on("data", (chunk) => {
+            if (tooLarge)
+                return;
             size += chunk.length;
-            if (size > 8192) {
+            if (size > FORM_BODY_LIMIT) {
+                tooLarge = true;
+                chunks.length = 0;
                 reject(new Error("body_too_large"));
-                req.destroy();
                 return;
             }
             chunks.push(chunk);
         });
-        req.on("end", () => resolve(new URLSearchParams(Buffer.concat(chunks).toString("utf8"))));
+        req.on("end", () => {
+            if (!tooLarge)
+                resolve(new URLSearchParams(Buffer.concat(chunks).toString("utf8")));
+        });
         req.on("error", reject);
     });
 }

package/dist/mcp/tools/secret-elicitation-server.js

@@ -36,7 +36,14 @@ export function createStdioSecretElicitationHost(deps) {
                 res.writeHead(404).end();
                 return;
             }
-            void handleSecretElicitationForm(req.method, url.searchParams.get("t"), () => readFormBody(req), res, deps);
+            // A failure here must never become an unhandled rejection: that would take
+            // down the whole stdio MCP process, not just this request.
+            handleSecretElicitationForm(req.method, url.searchParams.get("t"), () => readFormBody(req), res, deps).catch(() => {
+                if (!res.headersSent)
+                    res.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
+                if (!res.writableEnded)
+                    res.end("Internal error");
+            });
         });
         server = s;
         await new Promise((resolve, reject) => {

package/dist/mcp/tools/secret-elicitation.d.ts

@@ -14,25 +14,60 @@
  * elicitation nobody completes or polls within that window is abandoned).
  * Expiry is swept lazily on every read and write via a `deleteMany` rather
  * than a timer, so an idle process holds no interval.
+ *
+ * Two kinds share the table: "create" (enter a secret's value, optionally
+ * brokered) and "unbroker" (a person confirms removing a secret's broker
+ * config: `set_secret_broker { broker: null }` never removes it directly).
+ * Payloads and outcomes written before `kind` existed have none and count as
+ * "create".
  */
 import type { PrismaClient } from "#prisma";
 import { type SecretMetadata } from "../../core/secrets.js";
+import { type SecretBrokerConfig } from "../../core/secret-broker-config.js";
 import type { SecretCipher } from "../../providers/secrets/types.js";
+export type SecretElicitationKind = "create" | "unbroker";
 export interface SecretElicitationPayload {
     ownerId: string;
     secretName: string;
+    /** Missing on links minted before brokered secrets: those are "create". */
+    kind?: SecretElicitationKind;
+    /** "create" only: the broker config to save with the value (the form pre-fills it). */
+    broker?: SecretBrokerConfig;
+    /**
+     * "unbroker" only: brokerConfigHash of the config the link was minted for. The
+     * removal is refused if the secret's config has changed since (or the link has none).
+     */
+    brokerHash?: string;
 }
 export type SecretElicitationOutcome = {
     ok: true;
+    kind: SecretElicitationKind;
     secret: SecretMetadata;
 } | {
     ok: false;
+    kind: SecretElicitationKind;
     error: string;
 };
-export declare function getSecretElicitationOutcome(ownerId: string, secretName: string, db: PrismaClient): Promise<SecretElicitationOutcome | undefined>;
+export declare function getSecretElicitationOutcome(ownerId: string, secretName: string, db: PrismaClient, kind?: SecretElicitationKind): Promise<SecretElicitationOutcome | undefined>;
 /**
  * Called by the browser form's POST handler. Idempotent — a resubmit for
  * the same (ownerId, secretName) that's already fulfilled returns the
- * recorded outcome rather than writing again.
+ * recorded outcome rather than writing again. A value or broker config that
+ * fails validation is returned but not recorded, so the person can correct it. `broker` (the form's,
+ * pre-filled from the payload) makes the new secret brokered.
+ */
+export declare function fulfillSecretElicitation(payload: SecretElicitationPayload, value: string, cipher: SecretCipher, db: PrismaClient, broker?: SecretBrokerConfig | null): Promise<SecretElicitationOutcome>;
+/**
+ * Called by the unbroker form's POST: removes brokering (audited, via
+ * "browser", the owner as actor). Idempotent like fulfillSecretElicitation.
+ * A link only removes the config it was minted for: if brokering changed
+ * since (or the link carries no brokerHash) it is refused without recording
+ * an outcome, so a fresh link for the current config still works.
+ */
+export declare function fulfillUnbrokerElicitation(payload: SecretElicitationPayload, cipher: SecretCipher, db: PrismaClient): Promise<SecretElicitationOutcome>;
+/**
+ * Forgets a recorded unbroker outcome for this secret: called when brokering
+ * is set again, so a removal confirmed earlier can't answer (or short-circuit)
+ * a later removal request.
  */
-export declare function fulfillSecretElicitation(payload: SecretElicitationPayload, value: string, cipher: SecretCipher, db: PrismaClient): Promise<SecretElicitationOutcome>;
+export declare function clearUnbrokerOutcome(ownerId: string, secretName: string, db: PrismaClient): Promise<void>;

package/dist/mcp/tools/secret-elicitation.js

@@ -1,34 +1,72 @@
-import { createSecret } from "../../core/secrets.js";
+import { createSecret, listSecrets, setSecretBroker } from "../../core/secrets.js";
+import { parseSecretBrokerConfig, SECRET_BROKER_CHANGED, } from "../../core/secret-broker-config.js";
+/**
+ * A link only does what it was minted for: a create link can't confirm an
+ * unbroker, nor the reverse. Refused without recording an outcome.
+ */
+function kindMismatch(payload, expected) {
+    const actual = payload.kind ?? "create";
+    if (actual === expected)
+        return undefined;
+    return {
+        ok: false,
+        kind: expected,
+        error: `elicitation_kind_mismatch: this link is for a "${actual}" request, not "${expected}"`,
+    };
+}
+/** A stored outcome's kind; one written before `kind` existed is a "create". */
+function kindOf(outcome) {
+    return outcome.kind ?? "create";
+}
 const ELICITATION_TTL_MS = 600_000;
 /** Sweeps every expired entry, not just the one being looked up, so a set-and-never-polled-again entry doesn't linger forever. */
 async function pruneExpired(db, now) {
     await db.secretElicitationOutcome.deleteMany({ where: { expiresAt: { lte: now } } });
 }
-export async function getSecretElicitationOutcome(ownerId, secretName, db) {
+export async function getSecretElicitationOutcome(ownerId, secretName, db, kind = "create") {
     const now = new Date();
     await pruneExpired(db, now);
     const row = await db.secretElicitationOutcome.findUnique({ where: { ownerId_secretName: { ownerId, secretName } } });
-    return row?.outcome;
+    if (!row || kindOf(row.outcome) !== kind)
+        return undefined;
+    return row.outcome;
+}
+async function recordOutcome(db, ownerId, secretName, outcome, now) {
+    const expiresAt = new Date(now.getTime() + ELICITATION_TTL_MS);
+    await db.secretElicitationOutcome.upsert({
+        where: { ownerId_secretName: { ownerId, secretName } },
+        create: { ownerId, secretName, outcome, expiresAt },
+        update: { outcome, expiresAt },
+    });
 }
 /**
  * Called by the browser form's POST handler. Idempotent — a resubmit for
  * the same (ownerId, secretName) that's already fulfilled returns the
- * recorded outcome rather than writing again.
+ * recorded outcome rather than writing again. A value or broker config that
+ * fails validation is returned but not recorded, so the person can correct it. `broker` (the form's,
+ * pre-filled from the payload) makes the new secret brokered.
  */
-export async function fulfillSecretElicitation(payload, value, cipher, db) {
+export async function fulfillSecretElicitation(payload, value, cipher, db, broker) {
+    const mismatch = kindMismatch(payload, "create");
+    if (mismatch)
+        return mismatch;
     const now = new Date();
     await pruneExpired(db, now);
     const { ownerId, secretName } = payload;
     const existing = await db.secretElicitationOutcome.findUnique({
         where: { ownerId_secretName: { ownerId, secretName } },
     });
-    if (existing)
+    if (existing && kindOf(existing.outcome) === "create")
         return existing.outcome;
     let outcome;
     try {
-        const secret = await createSecret(secretName, value, ownerId, cipher, db);
+        const secret = await createSecret(secretName, value, ownerId, cipher, db, {
+            broker: broker ?? undefined,
+            via: "browser",
+        });
         outcome = {
             ok: true,
+            kind: "create",
             secret: {
                 id: secret.id,
                 name: secret.name,
@@ -36,17 +74,77 @@ export async function fulfillSecretElicitation(payload, value, cipher, db) {
                 ownerId: secret.ownerId,
                 createdAt: secret.createdAt,
                 updatedAt: secret.updatedAt,
+                // A rotation without a broker keeps the stored config, so report what was saved.
+                broker: secret.broker === null || secret.broker === undefined ? null : parseSecretBrokerConfig(secret.broker),
             },
         };
     }
     catch (err) {
-        outcome = { ok: false, error: err instanceof Error ? err.message : String(err) };
+        outcome = { ok: false, kind: "create", error: err instanceof Error ? err.message : String(err) };
+        // A value or config the person can fix: not recorded, so the same link takes a corrected
+        // submission and create_secret keeps waiting rather than replaying this error.
+        if (isCorrectableInput(outcome.error))
+            return outcome;
     }
-    const expiresAt = new Date(now.getTime() + ELICITATION_TTL_MS);
-    await db.secretElicitationOutcome.upsert({
+    await recordOutcome(db, ownerId, secretName, outcome, now);
+    return outcome;
+}
+const CORRECTABLE_ERRORS = ["secret_broker_value_invalid", "secret_broker_config_invalid", "bridge_input_limit"];
+function isCorrectableInput(message) {
+    return CORRECTABLE_ERRORS.some((code) => message.startsWith(code));
+}
+/**
+ * Called by the unbroker form's POST: removes brokering (audited, via
+ * "browser", the owner as actor). Idempotent like fulfillSecretElicitation.
+ * A link only removes the config it was minted for: if brokering changed
+ * since (or the link carries no brokerHash) it is refused without recording
+ * an outcome, so a fresh link for the current config still works.
+ */
+export async function fulfillUnbrokerElicitation(payload, cipher, db) {
+    const mismatch = kindMismatch(payload, "unbroker");
+    if (mismatch)
+        return mismatch;
+    const changed = { ok: false, kind: "unbroker", error: SECRET_BROKER_CHANGED };
+    if (!payload.brokerHash)
+        return changed;
+    const now = new Date();
+    await pruneExpired(db, now);
+    const { ownerId, secretName } = payload;
+    const existing = await db.secretElicitationOutcome.findUnique({
         where: { ownerId_secretName: { ownerId, secretName } },
-        create: { ownerId, secretName, outcome, expiresAt },
-        update: { outcome, expiresAt },
     });
+    if (existing && kindOf(existing.outcome) === "unbroker")
+        return existing.outcome;
+    let outcome;
+    try {
+        await setSecretBroker(db, cipher, {
+            ownerId,
+            name: secretName,
+            broker: null,
+            actorId: ownerId,
+            via: "browser",
+            expectedBrokerHash: payload.brokerHash,
+        });
+        const secret = (await listSecrets(ownerId, db)).find((s) => s.name === secretName);
+        if (!secret)
+            throw new Error(`secret_not_found: no secret named "${secretName}"`);
+        outcome = { ok: true, kind: "unbroker", secret };
+    }
+    catch (err) {
+        if (err instanceof Error && err.message === SECRET_BROKER_CHANGED)
+            return changed;
+        outcome = { ok: false, kind: "unbroker", error: err instanceof Error ? err.message : String(err) };
+    }
+    await recordOutcome(db, ownerId, secretName, outcome, now);
     return outcome;
 }
+/**
+ * Forgets a recorded unbroker outcome for this secret: called when brokering
+ * is set again, so a removal confirmed earlier can't answer (or short-circuit)
+ * a later removal request.
+ */
+export async function clearUnbrokerOutcome(ownerId, secretName, db) {
+    await db.secretElicitationOutcome.deleteMany({
+        where: { ownerId, secretName, outcome: { path: ["kind"], equals: "unbroker" } },
+    });
+}