@elaraai/e3-rack 0.0.0-bootstrap.0 → 1.0.94

package/dist/src/tls/tls.js

@@ -0,0 +1,200 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+import { X509Certificate, generateKeyPairSync, randomBytes, sign } from 'node:crypto';
+import { Agent, request } from 'node:https';
+import { isIP } from 'node:net';
+import { Readable } from 'node:stream';
+import { connect } from 'node:tls';
+function length(n) {
+    if (n < 0x80)
+        return Buffer.from([n]);
+    const bytes = [];
+    for (let rest = n; rest > 0; rest = Math.floor(rest / 256))
+        bytes.unshift(rest & 0xff);
+    return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+const der = (tag, ...contents) => {
+    const body = Buffer.concat(contents);
+    return Buffer.concat([Buffer.from([tag]), length(body.length), body]);
+};
+const sequence = (...contents) => der(0x30, ...contents);
+const oid = (dotted) => {
+    const [first, second, ...rest] = dotted.split('.').map(Number);
+    const out = [40 * first + second];
+    for (const arc of rest) {
+        const groups = [arc & 0x7f];
+        for (let high = Math.floor(arc / 128); high > 0; high = Math.floor(high / 128))
+            groups.unshift(0x80 | (high & 0x7f));
+        out.push(...groups);
+    }
+    return der(0x06, Buffer.from(out));
+};
+const positiveInteger = (bytes) => {
+    let value = bytes;
+    while (value.length > 1 && value[0] === 0 && (value[1] & 0x80) === 0)
+        value = value.subarray(1);
+    return der(0x02, (value[0] & 0x80) === 0 ? value : Buffer.concat([Buffer.from([0]), value]));
+};
+const time = (date) => {
+    const iso = date.toISOString();
+    const rest = `${iso.slice(5, 7)}${iso.slice(8, 10)}${iso.slice(11, 13)}${iso.slice(14, 16)}${iso.slice(17, 19)}Z`;
+    const year = date.getUTCFullYear();
+    // RFC 5280 §4.1.2.5: UTCTime through 2049, GeneralizedTime from 2050.
+    return year < 2050 ? der(0x17, Buffer.from(`${String(year).slice(2)}${rest}`)) : der(0x18, Buffer.from(`${year}${rest}`));
+};
+const pem = (label, bytes) => `-----BEGIN ${label}-----\n${bytes.toString('base64').match(/.{1,64}/g).join('\n')}\n-----END ${label}-----\n`;
+/**
+ * Creates a hub's self-signed ECDSA P-256 certificate, valid from an hour ago
+ * (a rack's clock may lag) for ten years, naming `e3-rack-hub` only.
+ * @param now - The issue time
+ * @returns The certificate and its private key
+ * @example
+ * const { certificatePem, privateKeyPem } = createHubCertificate();
+ */
+export function createHubCertificate(now = new Date()) {
+    const { privateKey, publicKey } = generateKeyPairSync('ec', { namedCurve: 'P-256' });
+    const ecdsaWithSha256 = sequence(oid('1.2.840.10045.4.3.2'));
+    const name = sequence(der(0x31, sequence(oid('2.5.4.3'), der(0x0c, Buffer.from('e3 rack hub')))));
+    const serial = randomBytes(16);
+    serial[0] &= 0x7f;
+    const extensions = sequence(sequence(oid('2.5.29.19'), der(0x01, Buffer.from([0xff])), der(0x04, sequence())), // basicConstraints, critical: not a CA
+    sequence(oid('2.5.29.17'), der(0x04, sequence(der(0x82, Buffer.from('e3-rack-hub'))))));
+    const tbs = sequence(der(0xa0, positiveInteger(Buffer.from([2]))), positiveInteger(serial), ecdsaWithSha256, name, sequence(time(new Date(now.getTime() - 3_600_000)), time(new Date(now.getTime() + 3650 * 86_400_000))), name, publicKey.export({ type: 'spki', format: 'der' }), der(0xa3, extensions));
+    const certificate = sequence(tbs, ecdsaWithSha256, der(0x03, Buffer.from([0]), sign('sha256', tbs, privateKey)));
+    return { certificatePem: pem('CERTIFICATE', certificate), privateKeyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString() };
+}
+/**
+ * The SHA-256 fingerprint a rack pins: uppercase hex pairs joined by colons,
+ * as `openssl x509 -fingerprint -sha256` prints it.
+ * @param certificatePem - A PEM certificate
+ * @returns Its fingerprint
+ * @example
+ * console.log(certificateSha256(certificatePem)); // 'AB:CD:…'
+ */
+export function certificateSha256(certificatePem) {
+    return new X509Certificate(certificatePem).fingerprint256;
+}
+/**
+ * Reads a pinned fingerprint as an operator writes it: 64 hex digits, with or
+ * without colons, in either case.
+ * @param text - The fingerprint
+ * @returns It in {@link certificateSha256}'s form
+ * @throws {Error} When it is not a SHA-256 fingerprint
+ * @example
+ * parseCertificateSha256('abcd…'); // 'AB:CD:…'
+ */
+export function parseCertificateSha256(text) {
+    const hex = text.trim().replaceAll(':', '').toUpperCase();
+    if (!/^[0-9A-F]{64}$/.test(hex))
+        throw new Error('A certificate SHA-256 fingerprint is 64 hex digits, colons optional');
+    return hex.match(/../g).join(':');
+}
+/** Reads the certificate a TLS server presents, sending no application data. */
+function presentedCertificate(host, port, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const socket = connect({ host, port, rejectUnauthorized: false, ...(isIP(host) === 0 ? { servername: host } : {}) }, () => {
+            const raw = socket.getPeerCertificate(true).raw;
+            socket.destroy();
+            if (raw === undefined)
+                reject(new Error(`${host}:${port} presented no certificate`));
+            else
+                resolve(pem('CERTIFICATE', raw));
+        });
+        socket.setTimeout(timeoutMs, () => socket.destroy(new Error(`TLS handshake with ${host}:${port} timed out`)));
+        socket.once('error', reject);
+    });
+}
+/**
+ * Makes an HTTPS agent that trusts exactly the certificate whose SHA-256 is
+ * pinned. A first handshake, which sends nothing, reads the certificate the
+ * origin presents; it is refused unless its fingerprint is the pin. Every
+ * request then verifies the server against that certificate alone, and its
+ * fingerprint again, so a different certificate is refused before any
+ * request or credential is written.
+ * @param origin - An https:// origin
+ * @param certificateSha256 - The pinned fingerprint
+ * @param timeoutMs - The first handshake's deadline
+ * @returns The agent
+ * @throws {Error} When the origin is not HTTPS or presents another certificate
+ * @example
+ * const agent = await pinnedHttpsAgent('https://10.0.0.2:7331', pin);
+ */
+export async function pinnedHttpsAgent(origin, certificateSha256, timeoutMs = 10_000) {
+    const url = new URL(origin);
+    if (url.protocol !== 'https:')
+        throw new Error(`A pinned certificate needs an https:// origin, not ${url.protocol}`);
+    const pin = parseCertificateSha256(certificateSha256);
+    const host = url.hostname.replace(/^\[(.*)\]$/, '$1');
+    const presented = await presentedCertificate(host, Number(url.port || 443), timeoutMs);
+    const found = new X509Certificate(presented).fingerprint256;
+    if (found !== pin)
+        throw new Error(`${url.host} presented certificate SHA-256 ${found}, not the pinned ${pin}`);
+    return new Agent({ ca: presented, keepAlive: true, checkServerIdentity: (_host, certificate) => certificate.fingerprint256 === pin ? undefined : Object.assign(new Error(`${url.host} presented certificate SHA-256 ${certificate.fingerprint256}, not the pinned ${pin}`), { code: 'ERR_RACK_CERTIFICATE_PIN' }) });
+}
+/** OpenSSL's refusals of a server certificate that is not the pinned one, and the pin's own. */
+const CERTIFICATE_REFUSALS = new Set(['ERR_RACK_CERTIFICATE_PIN', 'DEPTH_ZERO_SELF_SIGNED_CERT', 'SELF_SIGNED_CERT_IN_CHAIN',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE', 'UNABLE_TO_GET_ISSUER_CERT', 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', 'CERT_SIGNATURE_FAILURE']);
+/**
+ * A fetch that reaches HTTPS origins only through {@link pinnedHttpsAgent},
+ * one agent per origin; any other scheme is refused.
+ * @param certificateSha256 - The pinned fingerprint
+ * @returns A fetch-compatible function
+ * @throws {Error} When the fingerprint is malformed
+ * @example
+ * const response = await pinnedFetch(pin)('https://10.0.0.2:7331/api/rack/heartbeat', { method: 'POST', body });
+ */
+export function pinnedFetch(certificateSha256) {
+    const pin = parseCertificateSha256(certificateSha256);
+    const agents = new Map();
+    const agentFor = (url) => {
+        let agent = agents.get(url.origin);
+        if (agent === undefined) {
+            agent = pinnedHttpsAgent(url.origin, pin);
+            agents.set(url.origin, agent);
+            agent.catch(() => { agents.delete(url.origin); });
+        }
+        return agent;
+    };
+    return async (input, init = {}) => {
+        const url = new URL(input instanceof Request ? input.url : input.toString());
+        if (url.protocol !== 'https:')
+            throw new TypeError(`A pinned certificate needs an https:// URL, not ${url.protocol}`);
+        const agent = await agentFor(url);
+        const method = init.method ?? 'GET';
+        return new Promise((resolve, reject) => {
+            const req = request(url, { method, agent, headers: Object.fromEntries(new Headers(init.headers)), signal: init.signal ?? undefined }, (res) => {
+                const headers = new Headers();
+                for (const [name, value] of Object.entries(res.headers))
+                    if (value !== undefined)
+                        headers.set(name, Array.isArray(value) ? value.join(', ') : value);
+                const status = res.statusCode ?? 502;
+                const empty = method === 'HEAD' || status === 204 || status === 304;
+                if (empty)
+                    res.resume();
+                resolve(new Response(empty ? null : Readable.toWeb(res), { status, statusText: res.statusMessage, headers }));
+            });
+            // A certificate that does not chain to the pinned one is refused by
+            // the handshake itself, before the fingerprint is compared: either way
+            // it is not the pinned certificate.
+            req.once('error', (error) => reject(error.code !== undefined && CERTIFICATE_REFUSALS.has(error.code)
+                ? new Error(`${url.host} presented a certificate other than the pinned SHA-256 ${pin}`, { cause: error })
+                : error));
+            const body = init.body;
+            if (body === undefined || body === null)
+                req.end();
+            else if (typeof body === 'string' || body instanceof Uint8Array)
+                req.end(body);
+            else if (body instanceof ArrayBuffer)
+                req.end(Buffer.from(body));
+            else if (body instanceof ReadableStream)
+                Readable.fromWeb(body).once('error', (err) => req.destroy(err)).pipe(req);
+            else {
+                req.destroy();
+                reject(new TypeError('A pinned fetch sends a string, bytes or a stream'));
+            }
+        });
+    };
+}
+//# sourceMappingURL=tls.js.map

package/dist/src/tls/tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.js","sourceRoot":"","sources":["../../../src/tls/tls.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAgBnC,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AACD,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAG,QAAkB,EAAU,EAAE;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,GAAG,QAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;AACnE,MAAM,GAAG,GAAG,CAAC,MAAc,EAAU,EAAE;IACrC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,KAAM,GAAG,MAAO,CAAC,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QAC5B,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACrH,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAU,EAAE;IAChD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC,CAAC;AACF,MAAM,IAAI,GAAG,CAAC,IAAU,EAAU,EAAE;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC;IAClH,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACnC,sEAAsE;IACtE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5H,CAAC,CAAC;AACF,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAa,EAAE,EAAE,CAAC,cAAc,KAAK,UAAU,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC;AAE9J;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;IACnD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,eAAe,GAAG,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,CAAC,CAAE,IAAI,IAAI,CAAC;IACnB,MAAM,UAAU,GAAG,QAAQ,CACzB,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,uCAAuC;IAC1H,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CACvF,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,CAClB,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,IAAI,EAC5F,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAC5G,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CACzE,CAAC;IACF,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACjH,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC5I,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,cAAsB;IACtD,OAAO,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACxH,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,IAAY,EAAE,IAAY,EAAE,SAAiB;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE;YACxH,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;YAChD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,2BAA2B,CAAC,CAAC,CAAC;;gBAChF,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,sBAAsB,IAAI,IAAI,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,iBAAyB,EAAE,SAAS,GAAG,MAAM;IAClG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrH,MAAM,GAAG,GAAG,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;IAC5D,IAAI,KAAK,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,kCAAkC,KAAK,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAChH,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,CAC7F,WAAW,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,kCAAkC,WAAW,CAAC,cAAc,oBAAoB,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,EAAE,CAAC,CAAC;AACzN,CAAC;AAED,gGAAgG;AAChG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B;IAC1H,iCAAiC,EAAE,2BAA2B,EAAE,mCAAmC,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAElI;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,iBAAyB;IACnD,MAAM,GAAG,GAAG,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,MAAM,QAAQ,GAAG,CAAC,GAAQ,EAAkB,EAAE;QAC5C,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,SAAS,CAAC,mDAAmD,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACpC,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC5I,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,IAAI,KAAK,KAAK,SAAS;wBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrJ,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;gBACpE,IAAI,KAAK;oBAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBACxB,OAAO,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAA+B,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9I,CAAC,CAAC,CAAC;YACH,oEAAoE;YACpE,uEAAuE;YACvE,oCAAoC;YACpC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBACzH,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,0DAA0D,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBACzG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC;iBAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,YAAY,UAAU;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;iBAC1E,IAAI,IAAI,YAAY,WAAW;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC5D,IAAI,IAAI,YAAY,cAAc;gBAAE,QAAQ,CAAC,OAAO,CAAC,IAAgD,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;iBAC1J,CAAC;gBAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC,CAAC;YAAC,CAAC;QACpG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/tls/tls.spec.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+export {};
+//# sourceMappingURL=tls.spec.d.ts.map

package/dist/src/tls/tls.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.spec.d.ts","sourceRoot":"","sources":["../../../src/tls/tls.spec.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/src/tls/tls.spec.js

@@ -0,0 +1,101 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+import { afterEach, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { X509Certificate, createPrivateKey } from 'node:crypto';
+import { once } from 'node:events';
+import { createServer } from 'node:https';
+import { certificateSha256, createHubCertificate, parseCertificateSha256, pinnedFetch, pinnedHttpsAgent } from './tls.js';
+const cleanup = [];
+afterEach(async () => { for (const close of cleanup.splice(0).reverse())
+    await close(); });
+async function serve(certificate = createHubCertificate(), port = 0) {
+    const requests = [];
+    const server = createServer({ cert: certificate.certificatePem, key: certificate.privateKeyPem }, (req, res) => {
+        const chunks = [];
+        req.on('data', (chunk) => chunks.push(chunk));
+        req.on('end', () => {
+            requests.push(`${req.method} ${req.url} ${Buffer.concat(chunks).toString()}`);
+            if (req.url === '/empty') {
+                res.writeHead(204);
+                res.end();
+                return;
+            }
+            res.writeHead(200, { 'content-type': 'text/plain', 'x-echo': req.headers['x-echo'] ?? '' });
+            res.end(`${req.method} ${Buffer.concat(chunks).toString()}`);
+        });
+    });
+    server.listen(port, '127.0.0.1');
+    await once(server, 'listening');
+    const close = async () => { if (!server.listening)
+        return; server.closeAllConnections(); server.close(); await once(server, 'close'); };
+    cleanup.push(close);
+    const address = server.address();
+    assert(address && typeof address !== 'string');
+    return { origin: `https://127.0.0.1:${address.port}`, port: address.port, pin: certificateSha256(certificate.certificatePem), requests, close };
+}
+it('creates a self-signed P-256 certificate naming e3-rack-hub, valid from an hour ago for ten years', () => {
+    const now = new Date('2030-01-01T00:00:00Z');
+    const { certificatePem, privateKeyPem } = createHubCertificate(now);
+    const certificate = new X509Certificate(certificatePem);
+    assert.equal(certificate.subject, 'CN=e3 rack hub');
+    assert.equal(certificate.issuer, certificate.subject);
+    assert.equal(certificate.subjectAltName, 'DNS:e3-rack-hub');
+    assert.equal(certificate.ca, false);
+    assert.equal(certificate.publicKey.asymmetricKeyDetails?.namedCurve, 'prime256v1');
+    assert(certificate.checkPrivateKey(createPrivateKey(privateKeyPem)));
+    assert(certificate.verify(certificate.publicKey));
+    assert.equal(new Date(certificate.validFrom).getTime(), now.getTime() - 3_600_000);
+    assert.equal(new Date(certificate.validTo).getTime(), now.getTime() + 3650 * 86_400_000);
+    assert.notEqual(certificateSha256(createHubCertificate(now).certificatePem), certificateSha256(certificatePem));
+});
+it('writes a validity past 2049 as GeneralizedTime', () => {
+    const certificate = new X509Certificate(createHubCertificate(new Date('2045-06-01T00:00:00Z')).certificatePem);
+    assert.equal(new Date(certificate.validTo).getUTCFullYear(), 2055);
+});
+it('reads a fingerprint with or without colons, in either case, and refuses anything else', () => {
+    const pin = certificateSha256(createHubCertificate().certificatePem);
+    assert.match(pin, /^([0-9A-F]{2}:){31}[0-9A-F]{2}$/);
+    assert.equal(parseCertificateSha256(pin.toLowerCase()), pin);
+    assert.equal(parseCertificateSha256(` ${pin.replaceAll(':', '')} `), pin);
+    for (const bad of ['', pin.slice(3), `${pin}:00`, pin.replace(/^../, 'ZZ')])
+        assert.throws(() => parseCertificateSha256(bad), /64 hex digits/);
+});
+it('fetches through the pinned certificate, with headers, bodies and empty responses', async () => {
+    const hub = await serve();
+    const fetch = pinnedFetch(hub.pin);
+    const posted = await fetch(`${hub.origin}/echo`, { method: 'POST', headers: { 'x-echo': 'yes' }, body: new TextEncoder().encode('payload') });
+    assert.equal(posted.status, 200);
+    assert.equal(posted.headers.get('x-echo'), 'yes');
+    assert.equal(await posted.text(), 'POST payload');
+    const streamed = await fetch(`${hub.origin}/stream`, { method: 'PUT', body: new Blob(['streamed']).stream(), duplex: 'half' });
+    assert.equal(await streamed.text(), 'PUT streamed');
+    const empty = await fetch(`${hub.origin}/empty`);
+    assert.equal(empty.status, 204);
+    assert.equal(await empty.text(), '');
+});
+it('refuses another certificate before any request reaches it, and refuses plain HTTP', async () => {
+    const hub = await serve();
+    const other = certificateSha256(createHubCertificate().certificatePem);
+    await assert.rejects(pinnedFetch(other)(`${hub.origin}/secret`, { method: 'POST', body: 'token' }), /not the pinned/);
+    await assert.rejects(pinnedHttpsAgent(hub.origin, other), /not the pinned/);
+    assert.deepEqual(hub.requests, [], 'nothing was sent to the wrong certificate');
+    await assert.rejects(pinnedFetch(hub.pin)('http://127.0.0.1:1/x'), /https:\/\//);
+    await assert.rejects(pinnedHttpsAgent('http://127.0.0.1:1', hub.pin), /https:\/\//);
+    // An unpinned client refuses the self-signed certificate outright.
+    await assert.rejects(globalThis.fetch(`${hub.origin}/secret`));
+    assert.deepEqual(hub.requests, []);
+});
+it('refuses an origin it trusted once that origin presents another certificate', async () => {
+    const first = await serve();
+    const fetch = pinnedFetch(first.pin);
+    // A connection kept alive would outlive the server; the next request must handshake again.
+    assert.equal((await fetch(`${first.origin}/a`, { headers: { connection: 'close' } })).status, 200);
+    await first.close();
+    const replaced = await serve(createHubCertificate(), first.port);
+    await assert.rejects(fetch(`${replaced.origin}/b`, { method: 'POST', body: 'token' }), /other than the pinned SHA-256/);
+    assert.deepEqual(replaced.requests, [], 'the agent the first certificate made refuses the second');
+});
+//# sourceMappingURL=tls.spec.js.map

package/dist/src/tls/tls.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.spec.js","sourceRoot":"","sources":["../../../src/tls/tls.spec.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,EAAE,YAAY,EAAe,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE1H,MAAM,OAAO,GAA+B,EAAE,CAAC;AAC/C,SAAS,CAAC,KAAK,IAAI,EAAE,GAAG,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3F,KAAK,UAAU,KAAK,CAAC,WAAW,GAAG,oBAAoB,EAAE,EAAE,IAAI,GAAG,CAAC;IACjE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAW,YAAY,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,cAAc,EAAE,GAAG,EAAE,WAAW,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACrH,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9E,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YACpE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5F,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAAC,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACxI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IAAC,MAAM,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC;IACjF,OAAO,EAAE,MAAM,EAAE,qBAAqB,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,iBAAiB,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAClJ,CAAC;AAED,EAAE,CAAC,kGAAkG,EAAE,GAAG,EAAE;IAC1G,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC7C,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,oBAAoB,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;IACnF,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC;IACnF,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC;IACzF,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC;AAClH,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;IACxD,MAAM,WAAW,GAAG,IAAI,eAAe,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC/G,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;IAC/F,MAAM,GAAG,GAAG,iBAAiB,CAAC,oBAAoB,EAAE,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;AACjJ,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9I,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAiB,CAAC,CAAC;IAC9I,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;IACjG,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,oBAAoB,EAAE,CAAC,cAAc,CAAC,CAAC;IACvE,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACtH,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC5E,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,2CAA2C,CAAC,CAAC;IAChF,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,sBAAsB,CAAC,EAAE,YAAY,CAAC,CAAC;IACjF,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;IACpF,mEAAmE;IACnE,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,KAAK,GAAG,MAAM,KAAK,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,2FAA2F;IAC3F,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACxH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,yDAAyD,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC"}

package/dist/src/version.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+/** The lockstep release whose repository formats this session reads. */
+export declare const E3_RACK_VERSION: string;
+/** The hub/session protocol this release implements; negotiated exactly. */
+export declare const HUB_PROTOCOL = 2;
+//# sourceMappingURL=version.d.ts.map

package/dist/src/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wEAAwE;AACxE,eAAO,MAAM,eAAe,EAAE,MAAmB,CAAC;AAClD,4EAA4E;AAC5E,eAAO,MAAM,YAAY,IAAI,CAAC"}

package/dist/src/version.js

@@ -0,0 +1,10 @@
+/**
+ * Copyright (c) 2025 Elara AI Pty Ltd
+ * Licensed under BSL 1.1. See LICENSE for details.
+ */
+import { E3_RELEASE } from '@elaraai/e3-types';
+/** The lockstep release whose repository formats this session reads. */
+export const E3_RACK_VERSION = E3_RELEASE;
+/** The hub/session protocol this release implements; negotiated exactly. */
+export const HUB_PROTOCOL = 2;
+//# sourceMappingURL=version.js.map

package/dist/src/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/version.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAW,UAAU,CAAC;AAClD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC"}

package/package.json

@@ -1,15 +1,75 @@
 {
   "name": "@elaraai/e3-rack",
-  "version": "0.0.0-bootstrap.0",
-  "description": "Rack protocol, local hub and task delegation for e3 — this version only reserves the name; install the release matching your e3",
+  "version": "1.0.94",
+  "type": "module",
+  "description": "Rack protocol, local hub and task delegation for e3",
+  "main": "dist/src/index.js",
+  "types": "dist/src/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    },
+    "./protocol": {
+      "types": "./dist/src/protocol/index.d.ts",
+      "default": "./dist/src/protocol/index.js"
+    },
+    "./server": {
+      "types": "./dist/src/server/index.d.ts",
+      "default": "./dist/src/server/index.js"
+    },
+    "./testing": {
+      "types": "./dist/src/testing/index.d.ts",
+      "default": "./dist/src/testing/index.js"
+    },
+    "./hub-main": {
+      "types": "./dist/src/hub/main.d.ts",
+      "default": "./dist/src/hub/main.js"
+    }
+  },
+  "files": [
+    "dist/src",
+    "!dist/src/**/*.spec.*",
+    "README.md",
+    "LICENSE.md"
+  ],
+  "keywords": [
+    "east",
+    "e3",
+    "rack"
+  ],
   "license": "BUSL-1.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/elaraai/east-workspace.git",
     "directory": "libs/e3/packages/e3-rack"
   },
-  "files": [
-    "README.md",
-    "LICENSE.md"
-  ]
-}
+  "engines": {
+    "node": ">=22.2.0"
+  },
+  "dependencies": {
+    "@hono/node-server": "^1.13.0",
+    "hono": "^4.6.0",
+    "@elaraai/e3": "1.0.94",
+    "@elaraai/e3-types": "1.0.94",
+    "@elaraai/e3-core": "1.0.94"
+  },
+  "peerDependencies": {
+    "@elaraai/east": "1.0.94"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.47.0",
+    "@typescript-eslint/parser": "^8.47.0",
+    "eslint": "^9.0.0",
+    "eslint-plugin-headers": "^1.3.3",
+    "typescript": "^5.6.0",
+    "@elaraai/east-node-cli": "1.0.94"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "npm run build && node --enable-source-maps --test-reporter=spec --test-timeout=480000 --test 'dist/src/**/*.spec.js'",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix"
+  }
+}