@zanii/broker 0.1.0

package/LICENSE

@@ -0,0 +1,159 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or agreed
+      to in writing, Licensor provides the Work (and each Contributor
+      provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES
+      OR CONDITIONS OF ANY KIND, either express or implied, including,
+      without limitation, any warranties or conditions of TITLE,
+      NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Zanii
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,60 @@
+# @zanii/broker
+
+The credential broker that closes Zanii's stated custody hole. Every package's limits
+section ends the same way: *"an agent still holding raw credentials can act off the
+rails."* This replaces detection with one invariant:
+
+> **The agent never holds the credential. The broker does — and it injects it ONLY
+> into calls that produced a receipt first.**
+
+```sh
+npm install @zanii/broker @zanii/core
+```
+
+```ts
+import { createBroker } from '@zanii/broker';
+
+const broker = createBroker({
+  credentials: {
+    openai: { inject: 'bearer', secret: process.env.OPENAI_KEY!, allow: ['https://api.openai.com/v1'] },
+    maps:   { inject: 'query', name: 'key', secret: process.env.MAPS_KEY!, allow: ['https://maps.googleapis.com/'] },
+  },
+  // MUST reject unless the receipt is durably accepted — record + flush + check:
+  record: async (f) => {
+    await agent.record({ target: f.target, payload: f.payload });
+    const results = await agent.flush();
+    if (results.some((r) => !r.ok)) throw new Error('receipt not accepted');
+  },
+  gate: (req) => policy.evaluate(req).decision !== 'deny',   // optional @zanii/policy hook
+});
+
+// the agent asks; it never sees the key:
+const res = await broker.execute({
+  credential: 'openai', method: 'POST',
+  url: 'https://api.openai.com/v1/chat/completions', body: JSON.stringify(payload),
+});
+```
+
+Python: `from zanii.broker import create_broker` — same semantics.
+
+## Fail-closed by construction (none of this is configurable)
+
+1. **Allow-list first** — each credential is bound to explicit https origins + path
+   prefixes. Origins compare **exactly** (`api.openai.com.evil.com` cannot masquerade),
+   path prefixes respect segment boundaries (`/v1` allows `/v1/chat`, not `/v1abc`). A
+   prompt-injected agent cannot exfiltrate the key to an attacker-chosen URL.
+2. **Receipt BEFORE call** — `record` must succeed before the upstream is contacted.
+   Ledger unreachable = no call. Over-recording is safe; under-recording is the hole.
+3. **The secret never enters the receipt** — the payload is hashed from the request as
+   the agent submitted it, *before* injection.
+4. **Responses are scrubbed** — `set-cookie` (configurable) stripped before the agent
+   sees them.
+
+## The limit, stated up front
+
+Isolation is only real when the broker runs in a **separate process/host** from the
+agent (the `@zanii/gateway` deployment shape) — in-process, a compromised agent can
+read the broker's memory. And receipt-or-nothing governs calls made *through* the
+broker: it removes the agent's need to hold credentials; it cannot stop an operator
+who hands the agent raw keys anyway. Adopt the broker AND delete the keys from the
+agent's environment — the second half is yours.

package/dist/index.d.ts

@@ -0,0 +1,59 @@
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+export interface CredentialSpec {
+    /** How the secret is injected into the upstream request. */
+    inject: 'bearer' | 'header' | 'query';
+    /** Header or query-parameter name. Default for `bearer`: `Authorization`. */
+    name?: string;
+    /** The raw secret — held HERE, never by the agent. */
+    secret: string;
+    /**
+     * URLs this credential may be sent to: full origin + optional path prefix, e.g.
+     * `https://api.openai.com/v1`. Origins compare EXACTLY (no suffix tricks —
+     * `https://api.openai.com.evil.com` does not match). Required and non-empty:
+     * an unbounded credential is the vulnerability this package exists to remove.
+     */
+    allow: string[];
+}
+export interface BrokerRequest {
+    /** Which named credential to use. */
+    credential: string;
+    method: string;
+    url: string;
+    headers?: Record<string, string>;
+    body?: string;
+}
+export interface BrokerResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+    /** What was recorded for this call (target + payload) — for the agent's own bookkeeping. */
+    recorded: {
+        target: string;
+        payload: Record<string, unknown>;
+    };
+}
+export interface BrokerOptions {
+    /** The secrets, by name. */
+    credentials: Record<string, CredentialSpec>;
+    /**
+     * Records the receipt and MUST reject/throw unless the receipt is durably accepted
+     * (record + flush + check the submit result — see README). If this throws, the
+     * upstream call DOES NOT HAPPEN. Fail-closed is the invariant, not an option.
+     */
+    record: (fields: {
+        target: string;
+        payload: Record<string, unknown>;
+    }) => Promise<unknown>;
+    /** Optional pre-flight gate (compose `@zanii/policy` here). false = refuse, nothing recorded. */
+    gate?: (req: BrokerRequest) => boolean | Promise<boolean>;
+    fetchImpl?: FetchLike;
+    /** Response headers stripped before the agent sees them. Default: `['set-cookie']`. */
+    stripResponseHeaders?: string[];
+}
+export interface Broker {
+    execute(req: BrokerRequest): Promise<BrokerResponse>;
+    /** The credential names this broker holds (never the secrets). */
+    list(): string[];
+}
+export declare function createBroker(opts: BrokerOptions): Broker;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoCA,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACtC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAChE;AAED,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5C;;;;OAIG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3F,iGAAiG;IACjG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,uFAAuF;IACvF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAgCD,MAAM,WAAW,MAAM;IACrB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrD,kEAAkE;IAClE,IAAI,IAAI,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqExD"}

package/dist/index.js

@@ -0,0 +1,136 @@
+/**
+ * @zanii/broker — the credential broker: receipt-or-nothing credential use.
+ *
+ * Every Zanii package's limits section ends the same way: *"an agent still holding
+ * raw credentials can act off the rails."* This package closes that hole with one
+ * invariant instead of another detector:
+ *
+ * > **The agent never holds the credential. The broker does — and it injects it
+ * > ONLY into calls that produced a receipt first.**
+ *
+ * `execute()` is fail-closed by construction, and that is not configurable:
+ *
+ * 1. **Allow-list first** — each credential is bound to explicit URL origins (+ path
+ *    prefixes). A request to any other host is refused before anything happens, so a
+ *    prompt-injected agent cannot exfiltrate the key to an attacker-chosen URL.
+ * 2. **Receipt BEFORE call** — the injected `record` function must succeed (i.e. the
+ *    receipt is durably accepted) before the upstream is contacted. Ledger down =
+ *    no call. Over-recording (receipted but the call then failed) is safe;
+ *    under-recording is the entire hole — so the order is record → call, always.
+ * 3. **The secret never enters the receipt** — the payload is hashed from the
+ *    request *as the agent submitted it*, before injection; the credential cannot
+ *    appear in any hash preimage, log line, or returned artifact.
+ * 4. **Responses are scrubbed** — `set-cookie` (and any configured headers) are
+ *    stripped before the response reaches the agent.
+ *
+ * ## The limit, stated up front
+ *
+ * Isolation is only real when the broker runs in a **separate process/host** from
+ * the agent (the `@zanii/gateway` deployment shape) — in-process, a compromised
+ * agent can read the broker's memory. And receipt-or-nothing governs calls made
+ * *through the broker*: it removes the need for the agent to hold credentials, it
+ * cannot stop an operator who hands the agent raw keys anyway. Adopt the broker AND
+ * delete the keys from the agent's environment — the second half is yours.
+ */
+import { hashPayload } from '@zanii/core';
+function parseAllow(entries, credName) {
+    if (!entries?.length)
+        throw new Error(`credential '${credName}': allow list is required and non-empty — an unbounded credential is the vulnerability`);
+    return entries.map((e) => {
+        let u;
+        try {
+            u = new URL(e);
+        }
+        catch {
+            throw new Error(`credential '${credName}': allow entry '${e}' is not a valid URL`);
+        }
+        if (u.protocol !== 'https:')
+            throw new Error(`credential '${credName}': allow entry '${e}' must be https`);
+        return { origin: u.origin, pathPrefix: u.pathname };
+    });
+}
+function urlAllowed(url, rules) {
+    // Origin equality — never prefix-matching on the raw string, so
+    // https://api.openai.com.evil.com can NOT masquerade as https://api.openai.com.
+    // Path prefixes respect segment boundaries: /v1 allows /v1 and /v1/chat, not /v1abc.
+    return rules.some((r) => {
+        if (url.origin !== r.origin)
+            return false;
+        const p = r.pathPrefix;
+        return url.pathname === p || url.pathname.startsWith(p.endsWith('/') ? p : p + '/');
+    });
+}
+export function createBroker(opts) {
+    const rules = new Map();
+    for (const [name, spec] of Object.entries(opts.credentials)) {
+        if (!spec.secret)
+            throw new Error(`credential '${name}': secret is required`);
+        rules.set(name, parseAllow(spec.allow, name));
+    }
+    const fetchImpl = opts.fetchImpl ?? ((u, i) => fetch(u, i));
+    const strip = new Set((opts.stripResponseHeaders ?? ['set-cookie']).map((h) => h.toLowerCase()));
+    return {
+        list: () => Object.keys(opts.credentials),
+        async execute(req) {
+            const spec = opts.credentials[req.credential];
+            if (!spec)
+                throw new Error(`unknown credential '${req.credential}'`);
+            if (!req.method)
+                throw new Error('method is required');
+            let url;
+            try {
+                url = new URL(req.url);
+            }
+            catch {
+                throw new Error(`invalid url '${req.url}'`);
+            }
+            if (!urlAllowed(url, rules.get(req.credential))) {
+                throw new Error(`credential '${req.credential}' is not allowed for ${url.origin}${url.pathname} — refused before any receipt or call`);
+            }
+            if (opts.gate && !(await opts.gate(req))) {
+                throw new Error(`gate refused ${req.method} ${url.origin}${url.pathname}`);
+            }
+            // The receipt payload is the request AS THE AGENT SUBMITTED IT — hashed
+            // before injection, so the secret can never enter the preimage.
+            const recorded = {
+                target: `broker.${req.credential}.${req.method.toLowerCase()}`,
+                payload: {
+                    method: req.method,
+                    url: req.url,
+                    body_hash: hashPayload(req.body ?? ''),
+                },
+            };
+            // Receipt-or-nothing: if this throws, the call below never happens.
+            await opts.record(recorded);
+            // Inject only now, after the hash and the successful record.
+            const headers = { ...(req.headers ?? {}) };
+            let finalUrl = url;
+            if (spec.inject === 'bearer') {
+                headers[spec.name ?? 'Authorization'] = `Bearer ${spec.secret}`;
+            }
+            else if (spec.inject === 'header') {
+                if (!spec.name)
+                    throw new Error(`credential '${req.credential}': header injection needs a name`);
+                headers[spec.name] = spec.secret;
+            }
+            else {
+                if (!spec.name)
+                    throw new Error(`credential '${req.credential}': query injection needs a name`);
+                finalUrl = new URL(url.toString());
+                finalUrl.searchParams.set(spec.name, spec.secret);
+            }
+            const res = await fetchImpl(finalUrl.toString(), {
+                method: req.method,
+                headers,
+                ...(req.body !== undefined ? { body: req.body } : {}),
+            });
+            const outHeaders = {};
+            res.headers.forEach((v, k) => {
+                if (!strip.has(k.toLowerCase()))
+                    outHeaders[k] = v;
+            });
+            return { status: res.status, headers: outHeaders, body: await res.text(), recorded };
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA0D1C,SAAS,UAAU,CAAC,OAAiB,EAAE,QAAgB;IACrD,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,wFAAwF,CAAC,CAAC;IACvJ,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QAC3G,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ,EAAE,KAAkB;IAC9C,gEAAgE;IAChE,gFAAgF;IAChF,qFAAqF;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QACvB,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,uBAAuB,CAAC,CAAC;QAC9E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAe,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEjG,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QAEzC,KAAK,CAAC,OAAO,CAAC,GAAkB;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAEvD,IAAI,GAAQ,CAAC;YACb,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,wBAAwB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,uCAAuC,CAAC,CAAC;YACzI,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7E,CAAC;YAED,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,QAAQ,GAAG;gBACf,MAAM,EAAE,UAAU,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;gBAC9D,OAAO,EAAE;oBACP,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;iBACvC;aACF,CAAC;YACF,oEAAoE;YACpE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE5B,6DAA6D;YAC7D,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,IAAI,QAAQ,GAAG,GAAG,CAAC;YACnB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;YAClE,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,kCAAkC,CAAC,CAAC;gBACjG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,iCAAiC,CAAC,CAAC;gBAChG,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACnC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;gBAC/C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO;gBACP,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC,CAAC;YACH,MAAM,UAAU,GAA2B,EAAE,CAAC;YAC9C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;oBAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@zanii/broker",
+  "version": "0.1.0",
+  "description": "The credential broker that closes Zanii's stated custody hole: the agent never holds raw API keys - the broker does, and it injects them ONLY into calls that produced a receipt first. Receipt-or-nothing, fail-closed (ledger unreachable = no call), credentials bound to URL origins so they cannot be exfiltrated to attacker-chosen hosts, secrets never in hash preimages or logged responses.",
+  "license": "Apache-2.0",
+  "homepage": "https://ledger.zanii.agency",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "typescript": "^5.8.2",
+    "vitest": "^3.0.9"
+  },
+  "dependencies": {
+    "@zanii/core": "0.4.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/src/index.ts

@@ -0,0 +1,193 @@
+/**
+ * @zanii/broker — the credential broker: receipt-or-nothing credential use.
+ *
+ * Every Zanii package's limits section ends the same way: *"an agent still holding
+ * raw credentials can act off the rails."* This package closes that hole with one
+ * invariant instead of another detector:
+ *
+ * > **The agent never holds the credential. The broker does — and it injects it
+ * > ONLY into calls that produced a receipt first.**
+ *
+ * `execute()` is fail-closed by construction, and that is not configurable:
+ *
+ * 1. **Allow-list first** — each credential is bound to explicit URL origins (+ path
+ *    prefixes). A request to any other host is refused before anything happens, so a
+ *    prompt-injected agent cannot exfiltrate the key to an attacker-chosen URL.
+ * 2. **Receipt BEFORE call** — the injected `record` function must succeed (i.e. the
+ *    receipt is durably accepted) before the upstream is contacted. Ledger down =
+ *    no call. Over-recording (receipted but the call then failed) is safe;
+ *    under-recording is the entire hole — so the order is record → call, always.
+ * 3. **The secret never enters the receipt** — the payload is hashed from the
+ *    request *as the agent submitted it*, before injection; the credential cannot
+ *    appear in any hash preimage, log line, or returned artifact.
+ * 4. **Responses are scrubbed** — `set-cookie` (and any configured headers) are
+ *    stripped before the response reaches the agent.
+ *
+ * ## The limit, stated up front
+ *
+ * Isolation is only real when the broker runs in a **separate process/host** from
+ * the agent (the `@zanii/gateway` deployment shape) — in-process, a compromised
+ * agent can read the broker's memory. And receipt-or-nothing governs calls made
+ * *through the broker*: it removes the need for the agent to hold credentials, it
+ * cannot stop an operator who hands the agent raw keys anyway. Adopt the broker AND
+ * delete the keys from the agent's environment — the second half is yours.
+ */
+import { hashPayload } from '@zanii/core';
+
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+
+export interface CredentialSpec {
+  /** How the secret is injected into the upstream request. */
+  inject: 'bearer' | 'header' | 'query';
+  /** Header or query-parameter name. Default for `bearer`: `Authorization`. */
+  name?: string;
+  /** The raw secret — held HERE, never by the agent. */
+  secret: string;
+  /**
+   * URLs this credential may be sent to: full origin + optional path prefix, e.g.
+   * `https://api.openai.com/v1`. Origins compare EXACTLY (no suffix tricks —
+   * `https://api.openai.com.evil.com` does not match). Required and non-empty:
+   * an unbounded credential is the vulnerability this package exists to remove.
+   */
+  allow: string[];
+}
+
+export interface BrokerRequest {
+  /** Which named credential to use. */
+  credential: string;
+  method: string;
+  url: string;
+  headers?: Record<string, string>;
+  body?: string;
+}
+
+export interface BrokerResponse {
+  status: number;
+  headers: Record<string, string>;
+  body: string;
+  /** What was recorded for this call (target + payload) — for the agent's own bookkeeping. */
+  recorded: { target: string; payload: Record<string, unknown> };
+}
+
+export interface BrokerOptions {
+  /** The secrets, by name. */
+  credentials: Record<string, CredentialSpec>;
+  /**
+   * Records the receipt and MUST reject/throw unless the receipt is durably accepted
+   * (record + flush + check the submit result — see README). If this throws, the
+   * upstream call DOES NOT HAPPEN. Fail-closed is the invariant, not an option.
+   */
+  record: (fields: { target: string; payload: Record<string, unknown> }) => Promise<unknown>;
+  /** Optional pre-flight gate (compose `@zanii/policy` here). false = refuse, nothing recorded. */
+  gate?: (req: BrokerRequest) => boolean | Promise<boolean>;
+  fetchImpl?: FetchLike;
+  /** Response headers stripped before the agent sees them. Default: `['set-cookie']`. */
+  stripResponseHeaders?: string[];
+}
+
+interface AllowRule {
+  origin: string;
+  pathPrefix: string;
+}
+
+function parseAllow(entries: string[], credName: string): AllowRule[] {
+  if (!entries?.length) throw new Error(`credential '${credName}': allow list is required and non-empty — an unbounded credential is the vulnerability`);
+  return entries.map((e) => {
+    let u: URL;
+    try {
+      u = new URL(e);
+    } catch {
+      throw new Error(`credential '${credName}': allow entry '${e}' is not a valid URL`);
+    }
+    if (u.protocol !== 'https:') throw new Error(`credential '${credName}': allow entry '${e}' must be https`);
+    return { origin: u.origin, pathPrefix: u.pathname };
+  });
+}
+
+function urlAllowed(url: URL, rules: AllowRule[]): boolean {
+  // Origin equality — never prefix-matching on the raw string, so
+  // https://api.openai.com.evil.com can NOT masquerade as https://api.openai.com.
+  // Path prefixes respect segment boundaries: /v1 allows /v1 and /v1/chat, not /v1abc.
+  return rules.some((r) => {
+    if (url.origin !== r.origin) return false;
+    const p = r.pathPrefix;
+    return url.pathname === p || url.pathname.startsWith(p.endsWith('/') ? p : p + '/');
+  });
+}
+
+export interface Broker {
+  execute(req: BrokerRequest): Promise<BrokerResponse>;
+  /** The credential names this broker holds (never the secrets). */
+  list(): string[];
+}
+
+export function createBroker(opts: BrokerOptions): Broker {
+  const rules = new Map<string, AllowRule[]>();
+  for (const [name, spec] of Object.entries(opts.credentials)) {
+    if (!spec.secret) throw new Error(`credential '${name}': secret is required`);
+    rules.set(name, parseAllow(spec.allow, name));
+  }
+  const fetchImpl = opts.fetchImpl ?? ((u: string, i?: RequestInit) => fetch(u, i));
+  const strip = new Set((opts.stripResponseHeaders ?? ['set-cookie']).map((h) => h.toLowerCase()));
+
+  return {
+    list: () => Object.keys(opts.credentials),
+
+    async execute(req: BrokerRequest): Promise<BrokerResponse> {
+      const spec = opts.credentials[req.credential];
+      if (!spec) throw new Error(`unknown credential '${req.credential}'`);
+      if (!req.method) throw new Error('method is required');
+
+      let url: URL;
+      try {
+        url = new URL(req.url);
+      } catch {
+        throw new Error(`invalid url '${req.url}'`);
+      }
+      if (!urlAllowed(url, rules.get(req.credential)!)) {
+        throw new Error(`credential '${req.credential}' is not allowed for ${url.origin}${url.pathname} — refused before any receipt or call`);
+      }
+      if (opts.gate && !(await opts.gate(req))) {
+        throw new Error(`gate refused ${req.method} ${url.origin}${url.pathname}`);
+      }
+
+      // The receipt payload is the request AS THE AGENT SUBMITTED IT — hashed
+      // before injection, so the secret can never enter the preimage.
+      const recorded = {
+        target: `broker.${req.credential}.${req.method.toLowerCase()}`,
+        payload: {
+          method: req.method,
+          url: req.url,
+          body_hash: hashPayload(req.body ?? ''),
+        },
+      };
+      // Receipt-or-nothing: if this throws, the call below never happens.
+      await opts.record(recorded);
+
+      // Inject only now, after the hash and the successful record.
+      const headers: Record<string, string> = { ...(req.headers ?? {}) };
+      let finalUrl = url;
+      if (spec.inject === 'bearer') {
+        headers[spec.name ?? 'Authorization'] = `Bearer ${spec.secret}`;
+      } else if (spec.inject === 'header') {
+        if (!spec.name) throw new Error(`credential '${req.credential}': header injection needs a name`);
+        headers[spec.name] = spec.secret;
+      } else {
+        if (!spec.name) throw new Error(`credential '${req.credential}': query injection needs a name`);
+        finalUrl = new URL(url.toString());
+        finalUrl.searchParams.set(spec.name, spec.secret);
+      }
+
+      const res = await fetchImpl(finalUrl.toString(), {
+        method: req.method,
+        headers,
+        ...(req.body !== undefined ? { body: req.body } : {}),
+      });
+      const outHeaders: Record<string, string> = {};
+      res.headers.forEach((v, k) => {
+        if (!strip.has(k.toLowerCase())) outHeaders[k] = v;
+      });
+      return { status: res.status, headers: outHeaders, body: await res.text(), recorded };
+    },
+  };
+}