@zanii/broker 0.1.0 → 0.1.2

package/README.md

@@ -58,3 +58,7 @@ read the broker's memory. And receipt-or-nothing governs calls made *through* th
 broker: it removes the agent's need to hold credentials; it cannot stop an operator
 who hands the agent raw keys anyway. Adopt the broker AND delete the keys from the
 agent's environment — the second half is yours.
+
+## Changelog
+
+- **0.1.2** — Composable controls: `composeGates`, `spendGate` (call budgets, size caps), `dualControlGate` (M distinct approvers), `loadCredentials` from your secret store, `createExchangeBroker` (short-lived exchanged tokens), loud time-boxed `createBreakGlass`, `createKillSwitch` (hold, release, revoke everywhere), `credentialUsageReport`, and `brokerHandler` so any HTTP client can use the broker as a sidecar.

package/dist/controls.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Controls that compose with `createBroker`: short-lived exchanged tokens, spending and
+ * rate limits, dual control, secrets loaded from your vault, loud break-glass access,
+ * holds, revocation, usage reports, and an HTTP handler so any client can use the broker
+ * without code changes. Every control is a gate or a wrapper: the broker's own
+ * receipt-before-call invariant is unchanged.
+ */
+import { type Broker, type BrokerOptions, type BrokerRequest, type CredentialSpec } from './index.js';
+export type Gate = (req: BrokerRequest) => boolean | Promise<boolean>;
+/** All gates must pass, in order. A throwing gate refuses. */
+export declare function composeGates(...gates: Array<Gate | undefined>): Gate;
+/** Per-credential call budgets in a rolling window, and a request-size cap. */
+export declare function spendGate(limits: Record<string, {
+    maxCalls?: number;
+    windowMs?: number;
+    maxBodyBytes?: number;
+}>, now?: () => number): Gate;
+/** Sensitive calls need M distinct approvers (people or agents) before the credential is used. */
+export declare function dualControlGate(opts: {
+    needsApproval: (req: BrokerRequest) => boolean;
+    approve: (req: BrokerRequest) => Promise<string[]>;
+    minApprovers: number;
+}): Gate;
+/**
+ * Load secrets from your secret store at start-up (Vault, AWS Secrets Manager, Azure Key
+ * Vault, GCP Secret Manager, 1Password): you supply `resolve`, the specs never hold a
+ * secret in config files.
+ */
+export declare function loadCredentials(specs: Record<string, Omit<CredentialSpec, 'secret'> & {
+    secretRef: string;
+}>, resolve: (ref: string) => Promise<string>): Promise<Record<string, CredentialSpec>>;
+/**
+ * A broker whose credential is a short-lived token from a token-exchange endpoint (OAuth
+ * token exchange and the like), cached until shortly before it expires. The long-lived
+ * secret never leaves your exchange.
+ */
+export declare function createExchangeBroker(opts: Omit<BrokerOptions, 'credentials'> & {
+    credential: string;
+    spec: Omit<CredentialSpec, 'secret'>;
+    exchange: (credential: string) => Promise<{
+        token: string;
+        expiresAt: number;
+    }>;
+    now?: () => number;
+}): Broker;
+/**
+ * Break-glass: emergency use of a held credential, time-boxed, recorded and announced.
+ * Wire `gate` into the broker so the credential works only while an emergency is open.
+ */
+export declare function createBreakGlass(opts: {
+    record: BrokerOptions['record'];
+    alert: (e: {
+        credential: string;
+        by: string;
+        reason: string;
+        until: string;
+    }) => void;
+    now?: () => number;
+}): {
+    open(credential: string, by: string, reason: string, ttlMs: number): Promise<void>;
+    close(credential: string): void;
+    gate: Gate;
+};
+/** Hold and revoke credentials at runtime (e.g. on a sentinel alert). Revocation is recorded. */
+export declare function createKillSwitch(record: BrokerOptions['record']): {
+    hold(credential: string, reason: string): void;
+    release(credential: string): void;
+    revokeEverywhere(credentials: string[], reason: string): Promise<void>;
+    reason: (credential: string) => string | null;
+    gate: Gate;
+};
+/** Per credential and method: how many calls went through, from recorded broker payloads. */
+export declare function credentialUsageReport(recorded: Array<{
+    target: string;
+}>): Record<string, Record<string, number>>;
+/**
+ * A fetch-style handler so any HTTP client can go through the broker: send the request to
+ * the handler with `x-zanii-credential` and `x-zanii-url` headers. Run it as a sidecar in a
+ * separate process from the agent; that separation is what makes the isolation real.
+ */
+export declare function brokerHandler(broker: Broker): (request: Request) => Promise<Response>;
+//# sourceMappingURL=controls.d.ts.map

package/dist/controls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controls.d.ts","sourceRoot":"","sources":["../src/controls.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAgB,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpH,MAAM,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtE,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,IAAI,CAYpE;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,IAAI,CAgBrJ;AAED,kGAAkG;AAClG,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,aAAa,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC;IAAC,OAAO,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMxK;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EAC7E,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACxC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAQzC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IACrC,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,MAAM,CAUT;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE;qBAI1J,MAAM,MAAM,MAAM,UAAU,MAAM,SAAS,MAAM;sBAOtD,MAAM;UAGoC,IAAI;EAEnE;AAED,iGAAiG;AACjG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;qBAG3C,MAAM,UAAU,MAAM;wBAGnB,MAAM;kCAGU,MAAM,EAAE,UAAU,MAAM;yBAIvC,MAAM;UACmB,IAAI;EAErD;AAED,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,0CASxE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAiBrF"}

package/dist/controls.js

@@ -0,0 +1,167 @@
+/**
+ * Controls that compose with `createBroker`: short-lived exchanged tokens, spending and
+ * rate limits, dual control, secrets loaded from your vault, loud break-glass access,
+ * holds, revocation, usage reports, and an HTTP handler so any client can use the broker
+ * without code changes. Every control is a gate or a wrapper: the broker's own
+ * receipt-before-call invariant is unchanged.
+ */
+import { createBroker } from './index.js';
+/** All gates must pass, in order. A throwing gate refuses. */
+export function composeGates(...gates) {
+    return async (req) => {
+        for (const g of gates) {
+            if (!g)
+                continue;
+            try {
+                if (!(await g(req)))
+                    return false;
+            }
+            catch {
+                return false;
+            }
+        }
+        return true;
+    };
+}
+/** Per-credential call budgets in a rolling window, and a request-size cap. */
+export function spendGate(limits, now = Date.now) {
+    const calls = new Map();
+    return (req) => {
+        const l = limits[req.credential];
+        if (!l)
+            return true;
+        if (l.maxBodyBytes !== undefined && new TextEncoder().encode(req.body ?? '').length > l.maxBodyBytes)
+            return false;
+        if (l.maxCalls !== undefined) {
+            const w = l.windowMs ?? 60_000;
+            const t = now();
+            const recent = (calls.get(req.credential) ?? []).filter((x) => t - x < w);
+            if (recent.length >= l.maxCalls)
+                return false;
+            recent.push(t);
+            calls.set(req.credential, recent);
+        }
+        return true;
+    };
+}
+/** Sensitive calls need M distinct approvers (people or agents) before the credential is used. */
+export function dualControlGate(opts) {
+    return async (req) => {
+        if (!opts.needsApproval(req))
+            return true;
+        const approvers = new Set(await opts.approve(req));
+        return approvers.size >= opts.minApprovers;
+    };
+}
+/**
+ * Load secrets from your secret store at start-up (Vault, AWS Secrets Manager, Azure Key
+ * Vault, GCP Secret Manager, 1Password): you supply `resolve`, the specs never hold a
+ * secret in config files.
+ */
+export async function loadCredentials(specs, resolve) {
+    const out = {};
+    for (const [name, { secretRef, ...rest }] of Object.entries(specs)) {
+        const secret = await resolve(secretRef);
+        if (!secret)
+            throw new Error(`broker: secret ${secretRef} for '${name}' resolved empty`);
+        out[name] = { ...rest, secret };
+    }
+    return out;
+}
+/**
+ * A broker whose credential is a short-lived token from a token-exchange endpoint (OAuth
+ * token exchange and the like), cached until shortly before it expires. The long-lived
+ * secret never leaves your exchange.
+ */
+export function createExchangeBroker(opts) {
+    const now = opts.now ?? Date.now;
+    let cached = null;
+    return {
+        list: () => [opts.credential],
+        async execute(req) {
+            if (!cached || cached.expiresAt - 30_000 <= now())
+                cached = await opts.exchange(opts.credential);
+            return createBroker({ ...opts, credentials: { [opts.credential]: { ...opts.spec, secret: cached.token } } }).execute(req);
+        },
+    };
+}
+/**
+ * Break-glass: emergency use of a held credential, time-boxed, recorded and announced.
+ * Wire `gate` into the broker so the credential works only while an emergency is open.
+ */
+export function createBreakGlass(opts) {
+    const now = opts.now ?? Date.now;
+    const open = new Map();
+    return {
+        async open(credential, by, reason, ttlMs) {
+            if (!reason.trim())
+                throw new Error('broker: break-glass needs a reason');
+            const until = now() + ttlMs;
+            await opts.record({ target: `broker.${credential}.break-glass`, payload: { by, reason, until: new Date(until).toISOString() } });
+            open.set(credential, until);
+            opts.alert({ credential, by, reason, until: new Date(until).toISOString() });
+        },
+        close(credential) {
+            open.delete(credential);
+        },
+        gate: ((req) => (open.get(req.credential) ?? 0) > now()),
+    };
+}
+/** Hold and revoke credentials at runtime (e.g. on a sentinel alert). Revocation is recorded. */
+export function createKillSwitch(record) {
+    const held = new Map();
+    return {
+        hold(credential, reason) {
+            held.set(credential, reason);
+        },
+        release(credential) {
+            held.delete(credential);
+        },
+        async revokeEverywhere(credentials, reason) {
+            for (const c of credentials)
+                held.set(c, `revoked: ${reason}`);
+            await record({ target: 'broker.revoke-all', payload: { credentials, reason } });
+        },
+        reason: (credential) => held.get(credential) ?? null,
+        gate: ((req) => !held.has(req.credential)),
+    };
+}
+/** Per credential and method: how many calls went through, from recorded broker payloads. */
+export function credentialUsageReport(recorded) {
+    const out = {};
+    for (const r of recorded) {
+        const m = r.target.match(/^broker\.(.+)\.([a-z-]+)$/);
+        if (!m)
+            continue;
+        const c = (out[m[1]] ??= {});
+        c[m[2]] = (c[m[2]] ?? 0) + 1;
+    }
+    return out;
+}
+/**
+ * A fetch-style handler so any HTTP client can go through the broker: send the request to
+ * the handler with `x-zanii-credential` and `x-zanii-url` headers. Run it as a sidecar in a
+ * separate process from the agent; that separation is what makes the isolation real.
+ */
+export function brokerHandler(broker) {
+    return async (request) => {
+        const credential = request.headers.get('x-zanii-credential');
+        const url = request.headers.get('x-zanii-url');
+        if (!credential || !url)
+            return new Response('x-zanii-credential and x-zanii-url are required', { status: 400 });
+        const headers = {};
+        request.headers.forEach((v, k) => {
+            if (!k.startsWith('x-zanii-') && k !== 'host' && k !== 'content-length')
+                headers[k] = v;
+        });
+        try {
+            const body = ['GET', 'HEAD'].includes(request.method) ? undefined : await request.text();
+            const res = await broker.execute({ credential, method: request.method, url, headers, ...(body !== undefined ? { body } : {}) });
+            return new Response(res.body, { status: res.status, headers: res.headers });
+        }
+        catch (err) {
+            return new Response(`refused: ${err.message}`, { status: 403 });
+        }
+    };
+}
+//# sourceMappingURL=controls.js.map

package/dist/controls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controls.js","sourceRoot":"","sources":["../src/controls.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAA4E,MAAM,YAAY,CAAC;AAIpH,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,GAAG,KAA8B;IAC5D,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,MAAuF,EAAE,MAAoB,IAAI,CAAC,GAAG;IAC7I,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACnH,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC;YAC/B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1E,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,IAAkI;IAChK,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA6E,EAC7E,OAAyC;IAEzC,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,SAAS,IAAI,kBAAkB,CAAC,CAAC;QACzF,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,IAAI,MAAM,GAAgD,IAAI,CAAC;IAC/D,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAC7B,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,IAAI,GAAG,EAAE;gBAAE,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACjG,OAAO,YAAY,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5H,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAoJ;IACnL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,EAAU,EAAE,MAAc,EAAE,KAAa;YACtE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YAC1E,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC;YAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,UAAU,UAAU,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YACjI,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,UAAkB;YACtB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,CAAS;KACjE,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,MAA+B;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,OAAO;QACL,IAAI,CAAC,UAAkB,EAAE,MAAc;YACrC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,UAAkB;YACxB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,WAAqB,EAAE,MAAc;YAC1D,KAAK,MAAM,CAAC,IAAI,WAAW;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,MAAM,EAAE,CAAC,CAAC;YAC/D,MAAM,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,EAAE,CAAC,UAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI;QAC5D,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAS;KACnD,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,QAAmC;IACvE,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,QAAQ,CAAC,iDAAiD,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACjH,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC/B,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,gBAAgB;gBAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACzF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAChI,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,YAAa,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -56,4 +56,5 @@ export interface Broker {
     list(): string[];
 }
 export declare function createBroker(opts: BrokerOptions): Broker;
+export * from './controls.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoCA,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACtC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAChE;AAED,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5C;;;;OAIG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3F,iGAAiG;IACjG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,uFAAuF;IACvF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAgCD,MAAM,WAAW,MAAM;IACrB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrD,kEAAkE;IAClE,IAAI,IAAI,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqExD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAoCA,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACtC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;CAChE;AAED,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5C;;;;OAIG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3F,iGAAiG;IACjG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,uFAAuF;IACvF,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAgCD,MAAM,WAAW,MAAM;IACrB,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrD,kEAAkE;IAClE,IAAI,IAAI,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqExD;AACD,cAAc,eAAe,CAAC"}

package/dist/index.js

@@ -133,4 +133,5 @@ export function createBroker(opts) {
         },
     };
 }
+export * from './controls.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA0D1C,SAAS,UAAU,CAAC,OAAiB,EAAE,QAAgB;IACrD,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,wFAAwF,CAAC,CAAC;IACvJ,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QAC3G,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ,EAAE,KAAkB;IAC9C,gEAAgE;IAChE,gFAAgF;IAChF,qFAAqF;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QACvB,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,uBAAuB,CAAC,CAAC;QAC9E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAe,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEjG,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QAEzC,KAAK,CAAC,OAAO,CAAC,GAAkB;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAEvD,IAAI,GAAQ,CAAC;YACb,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,wBAAwB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,uCAAuC,CAAC,CAAC;YACzI,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7E,CAAC;YAED,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,QAAQ,GAAG;gBACf,MAAM,EAAE,UAAU,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;gBAC9D,OAAO,EAAE;oBACP,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;iBACvC;aACF,CAAC;YACF,oEAAoE;YACpE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE5B,6DAA6D;YAC7D,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,IAAI,QAAQ,GAAG,GAAG,CAAC;YACnB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;YAClE,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,kCAAkC,CAAC,CAAC;gBACjG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,iCAAiC,CAAC,CAAC;gBAChG,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACnC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;gBAC/C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO;gBACP,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC,CAAC;YACH,MAAM,UAAU,GAA2B,EAAE,CAAC;YAC9C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;oBAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA0D1C,SAAS,UAAU,CAAC,OAAiB,EAAE,QAAgB;IACrD,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,wFAAwF,CAAC,CAAC;IACvJ,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,QAAQ,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;QAC3G,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,GAAQ,EAAE,KAAkB;IAC9C,gEAAgE;IAChE,gFAAgF;IAChF,qFAAqF;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QACvB,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,uBAAuB,CAAC,CAAC;QAC9E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAe,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEjG,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QAEzC,KAAK,CAAC,OAAO,CAAC,GAAkB;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAEvD,IAAI,GAAQ,CAAC;YACb,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAE,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,wBAAwB,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,uCAAuC,CAAC,CAAC;YACzI,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7E,CAAC;YAED,wEAAwE;YACxE,gEAAgE;YAChE,MAAM,QAAQ,GAAG;gBACf,MAAM,EAAE,UAAU,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE;gBAC9D,OAAO,EAAE;oBACP,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;iBACvC;aACF,CAAC;YACF,oEAAoE;YACpE,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE5B,6DAA6D;YAC7D,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,IAAI,QAAQ,GAAG,GAAG,CAAC;YACnB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;YAClE,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,kCAAkC,CAAC,CAAC;gBACjG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,CAAC,UAAU,iCAAiC,CAAC,CAAC;gBAChG,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACnC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;gBAC/C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO;gBACP,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC,CAAC;YACH,MAAM,UAAU,GAA2B,EAAE,CAAC;YAC9C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBAC3B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;oBAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC;AACD,cAAc,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zanii/broker",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "The credential broker that closes Zanii's stated custody hole: the agent never holds raw API keys - the broker does, and it injects them ONLY into calls that produced a receipt first. Receipt-or-nothing, fail-closed (ledger unreachable = no call), credentials bound to URL origins so they cannot be exfiltrated to attacker-chosen hosts, secrets never in hash preimages or logged responses.",
   "license": "Apache-2.0",
   "homepage": "https://ledger.zanii.agency",
@@ -31,7 +31,7 @@
     "vitest": "^3.0.9"
   },
   "dependencies": {
-    "@zanii/core": "0.4.0"
+    "@zanii/core": "^0.5.4"
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",

package/src/controls.ts

@@ -0,0 +1,170 @@
+/**
+ * Controls that compose with `createBroker`: short-lived exchanged tokens, spending and
+ * rate limits, dual control, secrets loaded from your vault, loud break-glass access,
+ * holds, revocation, usage reports, and an HTTP handler so any client can use the broker
+ * without code changes. Every control is a gate or a wrapper: the broker's own
+ * receipt-before-call invariant is unchanged.
+ */
+import { createBroker, type Broker, type BrokerOptions, type BrokerRequest, type CredentialSpec } from './index.js';
+
+export type Gate = (req: BrokerRequest) => boolean | Promise<boolean>;
+
+/** All gates must pass, in order. A throwing gate refuses. */
+export function composeGates(...gates: Array<Gate | undefined>): Gate {
+  return async (req) => {
+    for (const g of gates) {
+      if (!g) continue;
+      try {
+        if (!(await g(req))) return false;
+      } catch {
+        return false;
+      }
+    }
+    return true;
+  };
+}
+
+/** Per-credential call budgets in a rolling window, and a request-size cap. */
+export function spendGate(limits: Record<string, { maxCalls?: number; windowMs?: number; maxBodyBytes?: number }>, now: () => number = Date.now): Gate {
+  const calls = new Map<string, number[]>();
+  return (req) => {
+    const l = limits[req.credential];
+    if (!l) return true;
+    if (l.maxBodyBytes !== undefined && new TextEncoder().encode(req.body ?? '').length > l.maxBodyBytes) return false;
+    if (l.maxCalls !== undefined) {
+      const w = l.windowMs ?? 60_000;
+      const t = now();
+      const recent = (calls.get(req.credential) ?? []).filter((x) => t - x < w);
+      if (recent.length >= l.maxCalls) return false;
+      recent.push(t);
+      calls.set(req.credential, recent);
+    }
+    return true;
+  };
+}
+
+/** Sensitive calls need M distinct approvers (people or agents) before the credential is used. */
+export function dualControlGate(opts: { needsApproval: (req: BrokerRequest) => boolean; approve: (req: BrokerRequest) => Promise<string[]>; minApprovers: number }): Gate {
+  return async (req) => {
+    if (!opts.needsApproval(req)) return true;
+    const approvers = new Set(await opts.approve(req));
+    return approvers.size >= opts.minApprovers;
+  };
+}
+
+/**
+ * Load secrets from your secret store at start-up (Vault, AWS Secrets Manager, Azure Key
+ * Vault, GCP Secret Manager, 1Password): you supply `resolve`, the specs never hold a
+ * secret in config files.
+ */
+export async function loadCredentials(
+  specs: Record<string, Omit<CredentialSpec, 'secret'> & { secretRef: string }>,
+  resolve: (ref: string) => Promise<string>,
+): Promise<Record<string, CredentialSpec>> {
+  const out: Record<string, CredentialSpec> = {};
+  for (const [name, { secretRef, ...rest }] of Object.entries(specs)) {
+    const secret = await resolve(secretRef);
+    if (!secret) throw new Error(`broker: secret ${secretRef} for '${name}' resolved empty`);
+    out[name] = { ...rest, secret };
+  }
+  return out;
+}
+
+/**
+ * A broker whose credential is a short-lived token from a token-exchange endpoint (OAuth
+ * token exchange and the like), cached until shortly before it expires. The long-lived
+ * secret never leaves your exchange.
+ */
+export function createExchangeBroker(opts: Omit<BrokerOptions, 'credentials'> & {
+  credential: string;
+  spec: Omit<CredentialSpec, 'secret'>;
+  exchange: (credential: string) => Promise<{ token: string; expiresAt: number }>;
+  now?: () => number;
+}): Broker {
+  const now = opts.now ?? Date.now;
+  let cached: { token: string; expiresAt: number } | null = null;
+  return {
+    list: () => [opts.credential],
+    async execute(req) {
+      if (!cached || cached.expiresAt - 30_000 <= now()) cached = await opts.exchange(opts.credential);
+      return createBroker({ ...opts, credentials: { [opts.credential]: { ...opts.spec, secret: cached.token } } }).execute(req);
+    },
+  };
+}
+
+/**
+ * Break-glass: emergency use of a held credential, time-boxed, recorded and announced.
+ * Wire `gate` into the broker so the credential works only while an emergency is open.
+ */
+export function createBreakGlass(opts: { record: BrokerOptions['record']; alert: (e: { credential: string; by: string; reason: string; until: string }) => void; now?: () => number }) {
+  const now = opts.now ?? Date.now;
+  const open = new Map<string, number>();
+  return {
+    async open(credential: string, by: string, reason: string, ttlMs: number) {
+      if (!reason.trim()) throw new Error('broker: break-glass needs a reason');
+      const until = now() + ttlMs;
+      await opts.record({ target: `broker.${credential}.break-glass`, payload: { by, reason, until: new Date(until).toISOString() } });
+      open.set(credential, until);
+      opts.alert({ credential, by, reason, until: new Date(until).toISOString() });
+    },
+    close(credential: string) {
+      open.delete(credential);
+    },
+    gate: ((req) => (open.get(req.credential) ?? 0) > now()) as Gate,
+  };
+}
+
+/** Hold and revoke credentials at runtime (e.g. on a sentinel alert). Revocation is recorded. */
+export function createKillSwitch(record: BrokerOptions['record']) {
+  const held = new Map<string, string>();
+  return {
+    hold(credential: string, reason: string) {
+      held.set(credential, reason);
+    },
+    release(credential: string) {
+      held.delete(credential);
+    },
+    async revokeEverywhere(credentials: string[], reason: string) {
+      for (const c of credentials) held.set(c, `revoked: ${reason}`);
+      await record({ target: 'broker.revoke-all', payload: { credentials, reason } });
+    },
+    reason: (credential: string) => held.get(credential) ?? null,
+    gate: ((req) => !held.has(req.credential)) as Gate,
+  };
+}
+
+/** Per credential and method: how many calls went through, from recorded broker payloads. */
+export function credentialUsageReport(recorded: Array<{ target: string }>) {
+  const out: Record<string, Record<string, number>> = {};
+  for (const r of recorded) {
+    const m = r.target.match(/^broker\.(.+)\.([a-z-]+)$/);
+    if (!m) continue;
+    const c = (out[m[1]!] ??= {});
+    c[m[2]!] = (c[m[2]!] ?? 0) + 1;
+  }
+  return out;
+}
+
+/**
+ * A fetch-style handler so any HTTP client can go through the broker: send the request to
+ * the handler with `x-zanii-credential` and `x-zanii-url` headers. Run it as a sidecar in a
+ * separate process from the agent; that separation is what makes the isolation real.
+ */
+export function brokerHandler(broker: Broker): (request: Request) => Promise<Response> {
+  return async (request) => {
+    const credential = request.headers.get('x-zanii-credential');
+    const url = request.headers.get('x-zanii-url');
+    if (!credential || !url) return new Response('x-zanii-credential and x-zanii-url are required', { status: 400 });
+    const headers: Record<string, string> = {};
+    request.headers.forEach((v, k) => {
+      if (!k.startsWith('x-zanii-') && k !== 'host' && k !== 'content-length') headers[k] = v;
+    });
+    try {
+      const body = ['GET', 'HEAD'].includes(request.method) ? undefined : await request.text();
+      const res = await broker.execute({ credential, method: request.method, url, headers, ...(body !== undefined ? { body } : {}) });
+      return new Response(res.body, { status: res.status, headers: res.headers });
+    } catch (err) {
+      return new Response(`refused: ${(err as Error).message}`, { status: 403 });
+    }
+  };
+}

package/src/index.ts

@@ -191,3 +191,4 @@ export function createBroker(opts: BrokerOptions): Broker {
     },
   };
 }
+export * from './controls.js';