aquaman-proxy 0.14.0 → 0.15.0

package/dist/core/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,aAAa,EACb,KAAK,uBAAuB,EAC5B,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,UAAU,EACV,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,cAAc,EACd,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,KAAK,kBAAkB,EACvB,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,KAAK,aAAa,EAClB,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,MAAM,EACN,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,cAAc,YAAY,CAAC;AAG3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,aAAa,EACb,KAAK,uBAAuB,EAC5B,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,UAAU,EACV,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,cAAc,EACd,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,KAAK,kBAAkB,EACvB,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,KAAK,aAAa,EAClB,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,MAAM,EACN,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,kBAAkB,CAAC"}

package/dist/core/index.js

@@ -16,5 +16,5 @@ export { AuditLogger, createAuditLogger, redactSensitiveParams } from './audit/i
 // Secret-pattern redactor (v0.12.0+)
 export { BUILTIN_PATTERNS, redact, redactDeep, containsSecret, buildValuePatterns } from './redactor/index.js';
 // Utils
-export { computeHash, computeChainedHash, generateId, generateNonce, generateSigningKeyPair, sign, verify, encryptWithPassword, decryptWithPassword, generateSelfSignedCert, getConfigDir, getConfigPath, expandPath, getDefaultConfig, loadConfig, ensureConfigDir, saveConfig, applyEnvOverrides, generateLoopbackToken, DEFAULT_LOOPBACK_PORT, DEFAULT_CACHE_TTL_SECONDS, CACHED_BY_DEFAULT_BACKENDS, resolveCacheTtl } from './utils/index.js';
+export { computeHash, computeChainedHash, generateId, generateNonce, generateSigningKeyPair, sign, verify, encryptWithPassword, decryptWithPassword, generateSelfSignedCert, getConfigDir, getConfigPath, expandPath, getDefaultConfig, loadConfig, ensureConfigDir, saveConfig, applyEnvOverrides, generateLoopbackToken, isAquamanPlaceholder, LOOPBACK_TOKEN_PREFIX, DEFAULT_LOOPBACK_PORT, DEFAULT_CACHE_TTL_SECONDS, CACHED_BY_DEFAULT_BACKENDS, resolveCacheTtl } from './utils/index.js';
 //# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,QAAQ;AACR,cAAc,YAAY,CAAC;AAE3B,cAAc;AACd,OAAO,EAIL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,aAAa,EAEb,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EAEnB,UAAU,EACV,gBAAgB,EAEhB,cAAc,EACd,oBAAoB,EAEpB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,wBAAwB,CAAC;AAEhC,QAAQ;AACR,OAAO,EAEL,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAE1B,qCAAqC;AACrC,OAAO,EAEL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAE7B,QAAQ;AACR,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,MAAM,EACN,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EAGtB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,QAAQ;AACR,cAAc,YAAY,CAAC;AAE3B,cAAc;AACd,OAAO,EAIL,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,aAAa,EAEb,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EAEnB,UAAU,EACV,gBAAgB,EAEhB,cAAc,EACd,oBAAoB,EAEpB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,wBAAwB,CAAC;AAEhC,QAAQ;AACR,OAAO,EAEL,WAAW,EACX,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAE1B,qCAAqC;AACrC,OAAO,EAEL,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAE7B,QAAQ;AACR,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,MAAM,EACN,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EAGtB,YAAY,EACZ,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,kBAAkB,CAAC"}

package/dist/core/types.d.ts

@@ -107,6 +107,19 @@ export interface HermesConfig {
     configMethod: 'env' | 'dotenv';
     binaryPath?: string;
 }
+/**
+ * Credential broker (`POST /broker/resolve`), served by `aquaman daemon` only
+ * (v0.15.0+). The broker hands credential VALUES to same-user callers, so it
+ * serves only refs declared for materialization: the env refs in
+ * projects.yaml, plus `allowedRefs` here (e.g. Hermes secret-source bindings).
+ * OpenClaw-hosted proxies never serve it.
+ */
+export interface BrokerConfig {
+    /** Serve the broker from `aquaman daemon`. Default true. */
+    enabled: boolean;
+    /** Extra `aquaman://service/key` refs callers may materialize. Manage with `aquaman broker allow|revoke`. */
+    allowedRefs?: string[];
+}
 export interface WrapperConfig {
     credentials: CredentialsConfig;
     audit: AuditConfig;
@@ -114,6 +127,7 @@ export interface WrapperConfig {
     openclaw: OpenClawConfig;
     loopback?: LoopbackConfig;
     hermes?: HermesConfig;
+    broker?: BrokerConfig;
     policy?: Record<string, {
         defaultAction: 'allow' | 'deny';
         rules: Array<{

package/dist/core/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,WAAW,GAAG,aAAa,GAAG,mBAAmB,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,gBAAgB,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,gBAAgB,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC;IAC7G,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,KAAK,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CACxI;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,gBAAgB,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,IAAI,EAAE,WAAW,GAAG,aAAa,GAAG,mBAAmB,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,gBAAgB,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,gBAAgB,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC;IAC7G,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,KAAK,GAAG,QAAQ,GAAG,UAAU,CAAC;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,6GAA6G;IAC7G,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CACxI;AAED,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,gBAAgB,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC"}

package/dist/core/utils/config.d.ts

@@ -32,7 +32,16 @@ export declare function resolveCacheTtl(config: WrapperConfig): number;
  * agent host as the provider api_key; the proxy strips it and injects the real
  * credential. Prefixed so it's recognizable in `~/.hermes/.env` and logs.
  */
+/** Every generated loopback token starts with this, so it is recognizable. */
+export declare const LOOPBACK_TOKEN_PREFIX = "aqm_lb_";
 export declare function generateLoopbackToken(): string;
+/**
+ * True for a value aquaman itself wrote into a host's config as a stand-in
+ * for a credential: the static placeholder, an `aquaman://` reference, or a
+ * loopback token. None of them work against the vendor API, so tools that
+ * hunt for plaintext credentials must not report them as findings.
+ */
+export declare function isAquamanPlaceholder(value: unknown): boolean;
 export declare function getConfigDir(): string;
 export declare function getConfigPath(): string;
 export declare function expandPath(p: string): string;

package/dist/core/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/core/utils/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,gEAAgE;AAChE,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,CACzD,CAAC;AAEtC;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAQ7D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ5C;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CA2BhD;AAED,wBAAgB,UAAU,IAAI,aAAa,CAmB1C;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAyEtE;AAwCD,wBAAgB,eAAe,IAAI,IAAI,CAKtC;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAUtD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/core/utils/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,gEAAgE;AAChE,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,SAAS,CAAC,CACzD,CAAC;AAEtC;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAQ7D;AAED;;;;GAIG;AACH,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAE/C,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO5D;AAED,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ5C;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CA+BhD;AAED,wBAAgB,UAAU,IAAI,aAAa,CAmB1C;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAgFtE;AA2CD,wBAAgB,eAAe,IAAI,IAAI,CAKtC;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAUtD"}

package/dist/core/utils/config.js

@@ -46,8 +46,23 @@ export function resolveCacheTtl(config) {
  * agent host as the provider api_key; the proxy strips it and injects the real
  * credential. Prefixed so it's recognizable in `~/.hermes/.env` and logs.
  */
+/** Every generated loopback token starts with this, so it is recognizable. */
+export const LOOPBACK_TOKEN_PREFIX = 'aqm_lb_';
 export function generateLoopbackToken() {
-    return 'aqm_lb_' + crypto.randomBytes(24).toString('hex');
+    return LOOPBACK_TOKEN_PREFIX + crypto.randomBytes(24).toString('hex');
+}
+/**
+ * True for a value aquaman itself wrote into a host's config as a stand-in
+ * for a credential: the static placeholder, an `aquaman://` reference, or a
+ * loopback token. None of them work against the vendor API, so tools that
+ * hunt for plaintext credentials must not report them as findings.
+ */
+export function isAquamanPlaceholder(value) {
+    if (typeof value !== 'string')
+        return false;
+    return (value === 'aquaman-proxy-managed' ||
+        value.startsWith('aquaman://') ||
+        value.startsWith(LOOPBACK_TOKEN_PREFIX));
 }
 export function getConfigDir() {
     return process.env['AQUAMAN_CONFIG_DIR'] || DEFAULT_CONFIG_DIR;
@@ -89,6 +104,10 @@ export function getDefaultConfig() {
         },
         hermes: {
             configMethod: 'dotenv'
+        },
+        broker: {
+            enabled: true,
+            allowedRefs: []
         }
     };
 }
@@ -171,6 +190,12 @@ export function applyEnvOverrides(config) {
         config.loopback = config.loopback ?? { enabled: false, port: DEFAULT_LOOPBACK_PORT, host: '127.0.0.1' };
         config.loopback.token = env['AQUAMAN_LOOPBACK_TOKEN'];
     }
+    // Credential broker switch (v0.15.0+). Only 'false' disables; the broker is
+    // still limited to declared refs when on.
+    if (env['AQUAMAN_BROKER_ENABLED']) {
+        config.broker = config.broker ?? { enabled: true, allowedRefs: [] };
+        config.broker.enabled = env['AQUAMAN_BROKER_ENABLED'] !== 'false';
+    }
     return config;
 }
 function mergeConfig(base, override) {
@@ -203,6 +228,9 @@ function mergeConfig(base, override) {
         hermes: override.hermes !== undefined
             ? { ...base.hermes, ...override.hermes }
             : base.hermes,
+        broker: override.broker !== undefined
+            ? { ...base.broker, ...override.broker }
+            : base.broker,
         policy: override.policy !== undefined ? { ...base.policy, ...override.policy } : base.policy
     };
 }

package/dist/core/utils/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/core/utils/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAGtE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC;IACpD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,kBAAkB,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,WAAW,EAAE;YACX,OAAO,EAAE,UAAU;YACnB,eAAe,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;YACtE,cAAc,EAAE,QAAQ;SACzB;QACD,KAAK,EAAE;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC;SAC3C;QACD,QAAQ,EAAE;YACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC;SACvD;QACD,QAAQ,EAAE;YACR,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,KAAK;SACpB;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,WAAW;SAClB;QACD,MAAM,EAAE;YACN,YAAY,EAAE,QAAQ;SACvB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,aAAa,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAA2B,CAAC;YAChE,MAAM,GAAG,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,uCAAuC,UAAU,kBAAkB,CAAC,CAAC;YACnF,MAAM,GAAG,aAAa,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAExB,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,iBAAiB,CAA4C,CAAC;QAC5E,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,MAAM,CAAC,WAAW,CAAC,OAAO,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,WAAW,CAAC,eAAe,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,WAAW,CAAC,kBAAkB,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,CAAC;IACjE,CAAC;IAED,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,WAAW,CAAC,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,WAAW,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,eAAe,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,mCAAmC,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,WAAW,CAAC,uBAAuB,GAAG,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,WAAW,CAAC,qBAAqB,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACpF,CAAC;IAED,yEAAyE;IACzE,IAAI,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,CAAC,eAAe,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,IAAI,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxG,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC,KAAK,MAAM,CAAC;IACvE,CAAC;IACD,IAAI,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;YAC9C,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACxG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxG,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAClB,IAAmB,EACnB,QAAgC;IAEhC,yEAAyE;IACzE,IAAI,QAAQ,CAAC,WAAW,IAAI,oBAAoB,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,oIAAoI,CAAC,CAAC;QACnJ,MAAM,EAAE,kBAAkB,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC;QACrE,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IAED,OAAO;QACL,WAAW,EAAE;YACX,GAAG,IAAI,CAAC,WAAW;YACnB,GAAG,QAAQ,CAAC,WAAW;SACxB;QACD,KAAK,EAAE;YACL,GAAG,IAAI,CAAC,KAAK;YACb,GAAG,QAAQ,CAAC,KAAK;SAClB;QACD,QAAQ,EAAE;YACR,GAAG,IAAI,CAAC,QAAQ;YAChB,GAAG,QAAQ,CAAC,QAAQ;SACrB;QACD,QAAQ,EAAE;YACR,GAAG,IAAI,CAAC,QAAQ;YAChB,GAAG,QAAQ,CAAC,QAAQ;SACrB;QACD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAA+B;YACzE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAA6B;YACnE,CAAC,CAAC,IAAI,CAAC,MAAM;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;KAC7F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAqB;IAC9C,eAAe,EAAE,CAAC;IAClB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,sFAAsF;IACtF,iFAAiF;IACjF,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IAC5E,MAAM,SAAS,GAAkB,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IAC5E,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7F,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/core/utils/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAGtE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,gEAAgE;AAChE,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAEtC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC;IACpD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;QACpE,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;GAIG;AACH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C,MAAM,UAAU,qBAAqB;IACnC,OAAO,qBAAqB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CACL,KAAK,KAAK,uBAAuB;QACjC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9B,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,kBAAkB,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,WAAW,EAAE;YACX,OAAO,EAAE,UAAU;YACnB,eAAe,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;YACtE,cAAc,EAAE,QAAQ;SACzB;QACD,KAAK,EAAE;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC;SAC3C;QACD,QAAQ,EAAE;YACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,eAAe,CAAC;SACvD;QACD,QAAQ,EAAE;YACR,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,KAAK;SACpB;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,WAAW;SAClB;QACD,MAAM,EAAE;YACN,YAAY,EAAE,QAAQ;SACvB;QACD,MAAM,EAAE;YACN,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,EAAE;SAChB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,GAAG,aAAa,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAA2B,CAAC;YAChE,MAAM,GAAG,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,uCAAuC,UAAU,kBAAkB,CAAC,CAAC;YACnF,MAAM,GAAG,aAAa,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAExB,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,iBAAiB,CAA4C,CAAC;QAC5E,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,MAAM,CAAC,WAAW,CAAC,OAAO,GAAG,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,WAAW,CAAC,eAAe,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7G,CAAC;IAED,IAAI,GAAG,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,WAAW,CAAC,kBAAkB,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,CAAC;IACjE,CAAC;IAED,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,WAAW,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,WAAW,CAAC,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,WAAW,CAAC,cAAc,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,WAAW,CAAC,eAAe,GAAG,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,GAAG,CAAC,mCAAmC,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,WAAW,CAAC,uBAAuB,GAAG,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,WAAW,CAAC,qBAAqB,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACpF,CAAC;IAED,yEAAyE;IACzE,IAAI,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,WAAW,CAAC,eAAe,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,IAAI,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxG,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC,KAAK,MAAM,CAAC;IACvE,CAAC;IACD,IAAI,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;YAC9C,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACxG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxG,MAAM,CAAC,QAAQ,CAAC,KAAK,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACxD,CAAC;IAED,4EAA4E;IAC5E,0CAA0C;IAC1C,IAAI,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,wBAAwB,CAAC,KAAK,OAAO,CAAC;IACpE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAClB,IAAmB,EACnB,QAAgC;IAEhC,yEAAyE;IACzE,IAAI,QAAQ,CAAC,WAAW,IAAI,oBAAoB,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,oIAAoI,CAAC,CAAC;QACnJ,MAAM,EAAE,kBAAkB,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC;QACrE,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACrD,CAAC;IAED,OAAO;QACL,WAAW,EAAE;YACX,GAAG,IAAI,CAAC,WAAW;YACnB,GAAG,QAAQ,CAAC,WAAW;SACxB;QACD,KAAK,EAAE;YACL,GAAG,IAAI,CAAC,KAAK;YACb,GAAG,QAAQ,CAAC,KAAK;SAClB;QACD,QAAQ,EAAE;YACR,GAAG,IAAI,CAAC,QAAQ;YAChB,GAAG,QAAQ,CAAC,QAAQ;SACrB;QACD,QAAQ,EAAE;YACR,GAAG,IAAI,CAAC,QAAQ;YAChB,GAAG,QAAQ,CAAC,QAAQ;SACrB;QACD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAA+B;YACzE,CAAC,CAAC,IAAI,CAAC,QAAQ;QACjB,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAA6B;YACnE,CAAC,CAAC,IAAI,CAAC,MAAM;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAA6B;YACnE,CAAC,CAAC,IAAI,CAAC,MAAM;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;KAC7F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAqB;IAC9C,eAAe,EAAE,CAAC;IAClB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,sFAAsF;IACtF,iFAAiF;IACjF,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IAC5E,MAAM,SAAS,GAAkB,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;IAC5E,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7F,CAAC"}

package/dist/core/utils/index.d.ts

@@ -2,5 +2,5 @@
  * Utility functions for aquaman
  */
 export { computeHash, computeChainedHash, generateId, generateNonce, generateSigningKeyPair, sign, verify, encryptWithPassword, decryptWithPassword, generateSelfSignedCert, type SigningKeyPair, type SelfSignedCert } from './hash.js';
-export { getConfigDir, getConfigPath, expandPath, getDefaultConfig, loadConfig, ensureConfigDir, saveConfig, applyEnvOverrides, generateLoopbackToken, DEFAULT_LOOPBACK_PORT, DEFAULT_CACHE_TTL_SECONDS, CACHED_BY_DEFAULT_BACKENDS, resolveCacheTtl } from './config.js';
+export { getConfigDir, getConfigPath, expandPath, getDefaultConfig, loadConfig, ensureConfigDir, saveConfig, applyEnvOverrides, generateLoopbackToken, isAquamanPlaceholder, LOOPBACK_TOKEN_PREFIX, DEFAULT_LOOPBACK_PORT, DEFAULT_CACHE_TTL_SECONDS, CACHED_BY_DEFAULT_BACKENDS, resolveCacheTtl } from './config.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,MAAM,EACN,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,MAAM,EACN,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,aAAa,CAAC"}

package/dist/core/utils/index.js

@@ -2,5 +2,5 @@
  * Utility functions for aquaman
  */
 export { computeHash, computeChainedHash, generateId, generateNonce, generateSigningKeyPair, sign, verify, encryptWithPassword, decryptWithPassword, generateSelfSignedCert } from './hash.js';
-export { getConfigDir, getConfigPath, expandPath, getDefaultConfig, loadConfig, ensureConfigDir, saveConfig, applyEnvOverrides, generateLoopbackToken, DEFAULT_LOOPBACK_PORT, DEFAULT_CACHE_TTL_SECONDS, CACHED_BY_DEFAULT_BACKENDS, resolveCacheTtl } from './config.js';
+export { getConfigDir, getConfigPath, expandPath, getDefaultConfig, loadConfig, ensureConfigDir, saveConfig, applyEnvOverrides, generateLoopbackToken, isAquamanPlaceholder, LOOPBACK_TOKEN_PREFIX, DEFAULT_LOOPBACK_PORT, DEFAULT_CACHE_TTL_SECONDS, CACHED_BY_DEFAULT_BACKENDS, resolveCacheTtl } from './config.js';
 //# sourceMappingURL=index.js.map

package/dist/core/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,MAAM,EACN,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EAGvB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/utils/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,sBAAsB,EACtB,IAAI,EACJ,MAAM,EACN,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EAGvB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,aAAa,CAAC"}

package/dist/daemon.d.ts

@@ -5,6 +5,28 @@
 import { type CredentialStore } from './core/index.js';
 import { ServiceRegistry, type ServiceDefinition } from './service-registry.js';
 import { type PolicyConfig } from './request-policy.js';
+import type { BrokerScope } from './broker-scope.js';
+/**
+ * A url-path service carries its credential in a path segment instead of a
+ * header (Telegram: `/bot<TOKEN>/sendMessage`). A client pointed at us sends
+ * that segment filled with whatever it has — a placeholder, or on the loopback
+ * listener the aquaman token, because the segment is the only auth slot the
+ * shape has.
+ */
+export interface UrlPathCredentialSlot {
+    /** Index of the credential segment within the service-relative path. */
+    index: number;
+    /** What the client put there. Never forwarded upstream. */
+    presented: string;
+}
+/**
+ * Locate the credential segment in a service-relative path.
+ *
+ * Returns null when the client sent no such segment, which is the shape the
+ * plugin's fetch interceptor produces (`/telegram/sendMessage`). Callers then
+ * insert the credential at index 0, the pre-v0.15.0 behaviour.
+ */
+export declare function findUrlPathCredentialSlot(segments: string[], authPathTemplate: string): UrlPathCredentialSlot | null;
 export interface CredentialProxyOptions {
     socketPath: string;
     store: CredentialStore;
@@ -25,6 +47,13 @@ export interface CredentialProxyOptions {
         token: string;
         host?: string;
     };
+    /**
+     * Credential broker (`POST /broker/resolve`) scope. When omitted the broker
+     * is OFF: the endpoint refuses every request without touching the vault.
+     * Only `aquaman daemon` passes a scope; OpenClaw-hosted proxies never do.
+     * See broker-scope.ts for the rules.
+     */
+    broker?: BrokerScope;
 }
 export interface RequestInfo {
     id: string;
@@ -58,6 +87,13 @@ export declare class CredentialProxy {
      * explicit `x-aquaman-token`. Comparison is constant-time.
      */
     private isLoopbackTokenValid;
+    /**
+     * A url-path service sends no auth header at all, so the loopback token can
+     * only arrive in the credential segment. OpenClaw's Telegram channel, for
+     * instance, is pointed at us with `channels.telegram.apiRoot` and a
+     * placeholder bot token; the placeholder it sends is the loopback token.
+     */
+    private urlPathTokenCandidate;
     private handleRequest;
     private proxyRequest;
     private emitRequest;

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,OAAO,EAAE,KAAK,eAAe,EAAc,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAyB,KAAK,iBAAiB,EAAiB,MAAM,uBAAuB,CAAC;AAEtH,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AA0BrE,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;IACxC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,aAAa;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,UAAU,CAAkB;gBAExB,OAAO,EAAE,sBAAsB;IAMrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE5B;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;YAwBd,aAAa;YA+Jb,YAAY;IAoI1B,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;;;;;;;;;OAkBG;YACW,mBAAmB;IA4H3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA6B3B,SAAS,IAAI,OAAO;IAIpB,aAAa,IAAI,MAAM;IAIvB;;;;OAIG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAQnC,kBAAkB,IAAI,eAAe;IAIrC,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;CAGnD;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAEtF;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,OAAO,EAAE,KAAK,eAAe,EAAc,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAyB,KAAK,iBAAiB,EAAiB,MAAM,uBAAuB,CAAC;AAEtH,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKrD;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;CACnB;AASD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAAE,EAClB,gBAAgB,EAAE,MAAM,GACvB,qBAAqB,GAAG,IAAI,CAiB9B;AAuBD,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI,CAAC;IACxC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,aAAa;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,cAAc,CAA4B;IAClD,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,UAAU,CAAkB;gBAExB,OAAO,EAAE,sBAAsB;IAMrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE5B;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IA2B5B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;YAaf,aAAa;YAiMb,YAAY;IAqI1B,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;;;;;;;;;OAkBG;YACW,mBAAmB;IA4J3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA6B3B,SAAS,IAAI,OAAO;IAIpB,aAAa,IAAI,MAAM;IAIvB;;;;OAIG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAQnC,kBAAkB,IAAI,eAAe;IAIrC,iBAAiB,IAAI,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;CAGnD;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAEtF;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/daemon.js

@@ -14,6 +14,40 @@ import { createOAuthTokenCache } from './oauth-token-cache.js';
 import { matchPolicy } from './request-policy.js';
 // Service name validation: lowercase alphanum, dots, hyphens, underscores
 const SAFE_SERVICE_NAME = /^[a-z0-9][a-z0-9._-]*$/;
+/**
+ * Only the first two segments are considered. Telegram builds exactly
+ * `/bot<TOKEN>/<method>` and `/file/bot<TOKEN>/<file_path>`, so a deeper scan
+ * would only add ways for a method or file name to be mistaken for the slot.
+ */
+const URL_PATH_SLOT_SCAN_DEPTH = 2;
+/**
+ * Locate the credential segment in a service-relative path.
+ *
+ * Returns null when the client sent no such segment, which is the shape the
+ * plugin's fetch interceptor produces (`/telegram/sendMessage`). Callers then
+ * insert the credential at index 0, the pre-v0.15.0 behaviour.
+ */
+export function findUrlPathCredentialSlot(segments, authPathTemplate) {
+    const templateSegments = authPathTemplate.split('/').filter(s => s);
+    if (templateSegments.length !== 1)
+        return null;
+    const [prefix, suffix] = templateSegments[0].split('{token}');
+    if (suffix === undefined)
+        return null;
+    const depth = Math.min(segments.length, URL_PATH_SLOT_SCAN_DEPTH);
+    for (let index = 0; index < depth; index++) {
+        const segment = segments[index];
+        if (segment.length <= prefix.length + suffix.length)
+            continue;
+        if (!segment.startsWith(prefix) || !segment.endsWith(suffix))
+            continue;
+        return {
+            index,
+            presented: segment.slice(prefix.length, segment.length - suffix.length)
+        };
+    }
+    return null;
+}
 /**
  * Constant-time string comparison that doesn't leak length via an early
  * return. timingSafeEqual requires equal-length buffers, so unequal lengths
@@ -151,8 +185,30 @@ export class CredentialProxy {
         if (authz) {
             candidates.push(authz.replace(/^Bearer\s+/i, ''));
         }
+        const pathBorne = this.urlPathTokenCandidate(req.url || '/');
+        if (pathBorne)
+            candidates.push(pathBorne);
         return candidates.some(c => timingSafeStrEqual(c, expected));
     }
+    /**
+     * A url-path service sends no auth header at all, so the loopback token can
+     * only arrive in the credential segment. OpenClaw's Telegram channel, for
+     * instance, is pointed at us with `channels.telegram.apiRoot` and a
+     * placeholder bot token; the placeholder it sends is the loopback token.
+     */
+    urlPathTokenCandidate(url) {
+        const segments = url.split('/').filter(p => p);
+        const service = segments[0];
+        if (!service || !SAFE_SERVICE_NAME.test(service))
+            return undefined;
+        if (!this.options.allowedServices.includes(service))
+            return undefined;
+        const serviceDef = this.serviceRegistry.get(service);
+        if (!serviceDef || serviceDef.authMode !== 'url-path' || !serviceDef.authPathTemplate) {
+            return undefined;
+        }
+        return findUrlPathCredentialSlot(segments.slice(1), serviceDef.authPathTemplate)?.presented;
+    }
     async handleRequest(req, res, fromLoopback = false) {
         const requestId = generateId();
         const url = req.url || '/';
@@ -164,7 +220,7 @@ export class CredentialProxy {
             res.statusCode = 401;
             res.end(JSON.stringify({
                 error: 'Loopback request rejected: missing or invalid aquaman loopback token',
-                fix: 'Set the placeholder api_key in ~/.hermes/.env to the token from: aquaman hermes status'
+                fix: 'The host must present the loopback token as its placeholder credential. Hermes: aquaman hermes status. OpenClaw: aquaman openclaw status'
             }));
             return;
         }
@@ -187,13 +243,14 @@ export class CredentialProxy {
             res.end(JSON.stringify(obj));
             return;
         }
-        // Broker endpoint — resolves a vault-stored credential and returns it
-        // with a short-lived expiry hint. Used by aquaman-coder hooks (v0.12.0+)
-        // to materialize credentials on-demand for one tool call, then discard.
+        // Broker endpoint: resolves a vault-stored credential and returns its
+        // VALUE, with a short-lived expiry hint. Used by aquaman-coder (v0.12.0+)
+        // and the Hermes secret source (v0.14.0+) to materialize declared refs.
         // The expires_at field is a hint for the consumer, not a server-side
-        // expiration (the value isn't cached daemon-side beyond the call).
+        // expiration. Scoped since v0.15.0: off unless the proxy was built with a
+        // BrokerScope, and limited to declared refs when on (broker-scope.ts).
         if ((url === '/broker/resolve' || url === '/broker/resolve/') && req.method === 'POST') {
-            await this.handleBrokerResolve(req, res, requestId);
+            await this.handleBrokerResolve(req, res, requestId, fromLoopback);
             return;
         }
         // Parse service from path: /anthropic/v1/messages -> anthropic
@@ -228,12 +285,23 @@ export class CredentialProxy {
             authPrefix: serviceDef.authPrefix,
             credentialKey: serviceDef.credentialKey
         };
-        const remainingPath = '/' + pathParts.slice(1).join('/');
+        // Split the credential segment out of a url-path request before anything
+        // else reads the path, so policy rules match the method (`/sendMessage`,
+        // not `/bot<TOKEN>/sendMessage`) and nothing observable records the token
+        // the client presented.
+        const serviceSegments = pathParts.slice(1);
+        const credentialSlot = authMode === 'url-path' && serviceDef.authPathTemplate
+            ? findUrlPathCredentialSlot(serviceSegments, serviceDef.authPathTemplate)
+            : null;
+        const canonicalSegments = credentialSlot
+            ? serviceSegments.filter((_, i) => i !== credentialSlot.index)
+            : serviceSegments;
+        const remainingPath = '/' + canonicalSegments.join('/');
         const requestInfo = {
             id: requestId,
             service,
             method: req.method || 'GET',
-            path: url,
+            path: credentialSlot ? `/${service}${remainingPath}` : url,
             timestamp: new Date(),
             authenticated: false
         };
@@ -247,7 +315,7 @@ export class CredentialProxy {
                 res.setHeader('Content-Type', 'application/json');
                 res.statusCode = 403;
                 res.end(JSON.stringify({
-                    error: `Request denied by policy: ${req.method || 'GET'} ${url}`,
+                    error: `Request denied by policy: ${req.method || 'GET'} ${requestInfo.path}`,
                     fix: `Check policy rules for "${service}" in ~/.aquaman/config.yaml`
                 }));
                 return;
@@ -272,9 +340,31 @@ export class CredentialProxy {
             // Build upstream URL based on auth mode
             let upstreamPath;
             if (authMode === 'url-path' && serviceDef.authPathTemplate) {
-                // Inject token into URL path: /bot{token}/getUpdates
-                const tokenPath = serviceDef.authPathTemplate.replace('{token}', credential);
-                upstreamPath = tokenPath + remainingPath;
+                // Put the real token back in the position the client used it: index 0
+                // for `/bot<TOKEN>/sendMessage`, index 1 for the file-download shape
+                // `/file/bot<TOKEN>/<file_path>`. A client that sent no segment at all
+                // gets the credential prefixed, as before.
+                // A credential that contains a slash would silently become extra path
+                // segments and send the request somewhere the service definition never
+                // named. No url-path token has one; refuse rather than guess.
+                if (credential.includes('/')) {
+                    requestInfo.error = 'Invalid credential: url-path token contains a slash';
+                    requestInfo.statusCode = 500;
+                    this.emitRequest(requestInfo);
+                    res.setHeader('Content-Type', 'application/json');
+                    res.statusCode = 500;
+                    res.end(JSON.stringify({
+                        error: `Stored credential ${service}/${config.credentialKey} is not a valid ${service} token`,
+                        fix: `Re-add it: aquaman credentials add ${service} ${config.credentialKey}`
+                    }));
+                    return;
+                }
+                const template = serviceDef.authPathTemplate;
+                const injected = (template.startsWith('/') ? template.slice(1) : template)
+                    .replace('{token}', credential);
+                const segments = [...canonicalSegments];
+                segments.splice(credentialSlot?.index ?? 0, 0, injected);
+                upstreamPath = '/' + segments.join('/');
             }
             else {
                 upstreamPath = remainingPath;
@@ -384,8 +474,9 @@ export class CredentialProxy {
                 }
                 resolve();
             });
-            // Add timeout to prevent indefinite hangs
-            const timeout = this.options.requestTimeout ?? 30000;
+            // Add timeout to prevent indefinite hangs. Long-polling services declare
+            // a floor so a shorter global setting can't cut their polls short.
+            const timeout = Math.max(this.options.requestTimeout ?? 30000, serviceDef.minRequestTimeout ?? 0);
             proxyReq.setTimeout(timeout, () => {
                 proxyReq.destroy();
                 requestInfo.error = 'Gateway timeout';
@@ -425,7 +516,7 @@ export class CredentialProxy {
      * v0.12.0+ — used by the aquaman-coder hook adapters to materialize
      * credentials per tool call without writing .env files to disk.
      */
-    async handleBrokerResolve(req, res, requestId) {
+    async handleBrokerResolve(req, res, requestId, fromLoopback) {
         res.setHeader('Content-Type', 'application/json');
         // Read request body
         let bodyBuf = '';
@@ -481,6 +572,34 @@ export class CredentialProxy {
             }
             ttlSeconds = Math.floor(ttlInput);
         }
+        // Scope check BEFORE the vault lookup: a refusal must not depend on (or
+        // reveal) what the vault holds. 404 rather than 403 so that clients which
+        // treat 401/403 as "bad token" (the Hermes source aborts all refs on
+        // those) handle a refusal per ref, like a missing credential.
+        const scope = this.options.broker;
+        const decision = scope
+            ? scope.check(service, key, fromLoopback ? 'loopback' : 'uds')
+            : {
+                allowed: false,
+                code: 'broker_disabled',
+                reason: 'The credential broker is disabled on this proxy',
+                fix: 'OpenClaw-hosted proxies never hand out credential values. For coding agents or the Hermes secret source, run: aquaman daemon',
+            };
+        if (!decision.allowed) {
+            res.statusCode = 404;
+            res.end(JSON.stringify({ error: decision.reason, fix: decision.fix, code: decision.code }));
+            this.emitRequest({
+                id: requestId,
+                service,
+                method: 'BROKER',
+                path: '/broker/resolve',
+                timestamp: new Date(),
+                authenticated: false,
+                statusCode: 404,
+                error: `${decision.code}: ${service}/${key}`,
+            });
+            return;
+        }
         // Fetch from vault
         let value;
         try {
@@ -519,6 +638,8 @@ export class CredentialProxy {
                 timestamp: new Date(),
                 authenticated: false,
                 statusCode: 404,
+                // Without an error the audit logger records this as a successful use.
+                error: `credential_not_found: ${service}/${key}`,
             });
             return;
         }