@intentic/base 1.310.0 → 1.312.0

package/README.md

@@ -1,73 +1,39 @@
-# @intentic/base
+# base
 
-The runtime primitives every tier shares: the `when` condition language, disposal, the async schedulers, the
-outside-text neutralizer, the fuzzy path scorer, and the SQLite driver seam.
-
-Almost nothing in here knows what this product is. That is the point: each module replaced a decision
-that had been made independently, and differently, in the daemon and in the web app, where the copies could
-only ever drift apart. `outside-text` is the one deliberate exception — it IS product vocabulary (the
-untrusted-content envelope), and it sits here precisely because three separate writers (the daemon's seams,
-webq's saved pages, fileq's sidecars) must speak it byte-identically. There is no barrel export: a consumer
-imports the module it needs (`@intentic/base/when`), because these modules have nothing to do with each other
-and a package that offers them as one thing invites being treated as a junk drawer.
-
-## Responsibilities
-
-- **`when`**: parse and evaluate a condition written as a string, against a bag of named values the caller
-  supplies. This is what lets a condition live in a JSON manifest an extension ships, and be evaluated the same
-  way on both sides of the wire. Deliberately not a general expression language: no arithmetic, no calls, no
-  reaching past the context object, because these strings arrive from installed extensions.
-- **`lifecycle`**: teardown as structure rather than as a list somebody maintains. A store is registered into
-  where things are created and disposed once; it keeps going past a member that throws and reports the failures
-  together, so one bad stop cannot strand the ports and child processes queued behind it.
-- **`outside-text`**: the untrusted-content envelope (`wrapOutsideContent`) and the marker neutralizer
-  (`neutralizeOutsideText`) that makes it trustworthy: envelope forgeries, harness control tags and model
-  reserved tokens are folded (homoglyphs, zero-width characters) and replaced before content is sealed or
-  written to disk. Shared because the daemon's seams, webq's saved pages and fileq's derived sidecars must all
-  neutralize identically — a drifted copy is a working forgery.
-- **`fuzzy`**: the fzf-style path scorer and the ranking order built on it. Both ends of quick-open answer with
-  it — the sandbox's iq `files` engine and the app's own search box — and they used to answer with two copies of
-  it, kept identical by hand, where the same keystrokes could have put a different file first on either side.
-- **`sqlite`**: the narrow seam a `node:sqlite` store is written against — the five-method driver interface, the
-  BEGIN/COMMIT/ROLLBACK transaction the driver has no helper for, and the schema-version guard that treats a
-  mismatch as cache loss. iq's index and iq's session recall are written against this one, not against two.
-- **`async`**: the four shapes of "don't do that again yet", named so the choice between them is visible:
-  `Delayer` restarts its clock on every call, `Coalescer` opens a window on the first call and lets later ones
-  join it, `SingleFlight` shares one run per key among concurrent callers, and `retry` is the loop with the
-  delay in it. Under them sit the three primitives every reconnect loop and readiness wait was hand-rolling
-  beside its own `setTimeout`-in-a-promise: `sleep` (interruptible, because a pause a teardown cannot cut
-  short is a teardown that waits for it), `pollUntil`, and `createBackoff`. `mapPool` is the odd one out and
-  the opposite question — not "wait longer" but "start more at once, up to a limit": the bounded fan-out a
-  caller reaches for after writing the same `for (… ) await` loop that turns twenty writes into twenty round
-  trips.
-
-## Delayer or Coalescer
-
-The two debouncers differ by one character when they are written by hand (`timer = setTimeout(…)` versus
-`timer ??= setTimeout(…)`) and by everything in behaviour. Choosing wrong is not a style mistake: a source that
-never goes quiet starves a `Delayer` forever.
+Runtime primitives that every tier, from the daemon to the browser, must run identically: when-expressions, disposal, async schedulers, untrusted-content tags, size and token formatting, and fuzzy path scoring.
 
 ```mermaid
 flowchart LR
-    subgraph D["Delayer — clock restarts"]
-        d1["call"] --> d2["call"] --> d3["call"] --> d4["quiet for N ms"] --> d5["run once"]
-    end
-    subgraph C["Coalescer — window from the first"]
-        c1["first call<br/>opens the window"] --> c2["calls join it"] --> c3["N ms after the FIRST"] --> c4["flush the batch"]
-    end
+    manifest["Extension manifests<br/>when strings"] --> base(["base"])
+    base -->|"when · fuzzy"| web["Web app<br/>and extension host"]
+    base -->|"outside-text · plain-text · lifecycle"| daemon["Sandbox daemon<br/>fileq · webq"]
+    base -->|"fuzzy · sqlite"| iq["iq engine"]
+    base -->|"async · errors · format"| rest["Every tier<br/>devices, deploy, extensions"]
 ```
 
-A search box wants the Delayer: the user stops typing, and stopping is the signal. A file watcher under a
-working agent wants the Coalescer: the agent never stops, and a batch that only arrives once it does arrives
-when nobody needs it any more.
+- One implementation per rule that more than one tier applies: two copies of a condition, a size label or a
+  quick-open ranking disagree on screen. Anything only one surface renders belongs next to that surface.
+- Subpath exports only, with no index, so a browser bundle pulls nothing it does not use. `outside-text` uses Web
+  Crypto and `sqlite` imports only types from `node:sqlite`, so neither ties a caller to Node.
+- `when.ts` is a closed grammar with no arithmetic, calls or property access, because its strings arrive from
+  installed extensions.
+- `outside-text.ts` wraps chat, pages and tool results in `<untrusted-content>` tags whose close carries a fresh id,
+  so content cannot forge its own end. It marks taint and does not defend against a hostile model.
+- `lifecycle.ts` is teardown as a store: whatever needs undoing registers when it is created, a member that throws
+  does not stop the rest, and failures surface together. Every scheduler in `async.ts` is disposable.
+- `errors.ts` lets a catch name the failure it expects: `isMissing` is ENOENT or ENOTDIR only, and
+  `undefinedIfMissing` answers undefined for "not there" while EACCES, EIO and a bug's TypeError still arrive.
 
 ## Key files
 
-- [src/when.ts](src/when.ts): the grammar, the parser, and what a condition means against a context.
-- [src/lifecycle.ts](src/lifecycle.ts): `DisposableStore` and the two things built on it.
-- [src/async.ts](src/async.ts): the schedulers, each with the case that made it a separate name.
-- [src/fuzzy.ts](src/fuzzy.ts): the path scorer, with its substring/subsequence split and why the substring
-  branch is deliberately uncapped.
-- [src/when.test.ts](src/when.test.ts), the evaluation rules that are decisions rather than syntax: an absent
-  key is false, ordering refuses anything but numbers, comparison crosses the type boundary by string form.
-- [src/async.test.ts](src/async.test.ts): the Delayer/Coalescer distinction pinned as behaviour.
+- [src/when.ts](src/when.ts) — `parseWhen` and `evaluateWhen`, the condition language manifests carry.
+- [src/async.ts](src/async.ts) — `Delayer`, `Coalescer`, `SingleFlight`, `keyedLock`, `retry`, `pollUntil`, `createBackoff`.
+- [src/lifecycle.ts](src/lifecycle.ts) — `IDisposable`, `DisposableStore` and `MutableDisposable`.
+- [src/outside-text.ts](src/outside-text.ts) — `wrapOutsideContent`, the envelope for outside text.
+- [src/fuzzy.ts](src/fuzzy.ts) — `fuzzyScore`, `rankByFuzzy` and the per-keystroke `fuzzyRanker` both quick-open ends share.
+
+## Commands
+
+```sh
+pnpm --filter @intentic/base test
+```

package/dist/acme.d.ts

@@ -0,0 +1,18 @@
+import { type KeyObject } from "node:crypto";
+export declare const LETS_ENCRYPT_DIRECTORY = "https://acme-v02.api.letsencrypt.org/directory";
+export interface AcmeOptions {
+    readonly directoryUrl: string;
+    readonly accountKey: KeyObject;
+    readonly certificateKey: KeyObject;
+    readonly hostnames: readonly string[];
+    readonly publishChallenge: (recordName: string, value: string) => Promise<void>;
+    readonly removeChallenge: (recordName: string) => Promise<void>;
+    readonly resolveTxt?: (recordName: string) => Promise<string[]>;
+    readonly fetchImpl?: typeof fetch;
+    readonly wait?: (ms: number) => Promise<void>;
+    readonly now?: () => number;
+}
+export declare const obtainCertificate: (options: AcmeOptions) => Promise<{
+    certificate: string;
+}>;
+//# sourceMappingURL=acme.d.ts.map

package/dist/acme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acme.d.ts","sourceRoot":"","sources":["../src/acme.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,SAAS,EAAQ,MAAM,aAAa,CAAC;AAuB/D,eAAO,MAAM,sBAAsB,mDAAmD,CAAC;AAQvF,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAE/B,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,QAAQ,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAwBD,eAAO,MAAM,iBAAiB,YAAmB,WAAW,KAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAyK7F,CAAC"}

package/dist/acme.js

@@ -0,0 +1,167 @@
+import { createHash, sign } from "node:crypto";
+import { setTimeout as sleep } from "node:timers/promises";
+import { pollUntil } from "./async.js";
+import { resolveTxtAuthoritatively } from "./authoritative-dns.js";
+import { base64Url, buildCsr } from "./csr.js";
+const VALIDATION_TIMEOUT_MS = 120_000;
+const POLL_INTERVAL_MS = 3_000;
+const PUBLICATION_TIMEOUT_MS = 90_000;
+const PUBLICATION_INTERVAL_MS = 2_000;
+const TRANSPORT_ATTEMPTS = 3;
+const TRANSPORT_RETRY_MS = 2_000;
+export const LETS_ENCRYPT_DIRECTORY = "https://acme-v02.api.letsencrypt.org/directory";
+const jsonOf = async (response) => {
+    const text = await response.text();
+    if (text === "") {
+        return {};
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return {};
+    }
+};
+const problemOf = async (response) => {
+    const body = await jsonOf(response);
+    const detail = typeof body["detail"] === "string" ? body["detail"] : undefined;
+    const type = typeof body["type"] === "string" ? body["type"] : undefined;
+    return detail ?? type ?? `HTTP ${response.status}`;
+};
+export const obtainCertificate = async (options) => {
+    const resolveTxt = options.resolveTxt ?? resolveTxtAuthoritatively;
+    const wait = options.wait ?? ((ms) => sleep(ms));
+    const now = options.now ?? (() => Date.now());
+    const transport = options.fetchImpl ?? fetch;
+    const doFetch = async (input, init) => {
+        for (let attempt = 1;; attempt += 1) {
+            try {
+                return await transport(input, init);
+            }
+            catch (error) {
+                if (attempt >= TRANSPORT_ATTEMPTS) {
+                    throw error;
+                }
+                await wait(TRANSPORT_RETRY_MS);
+            }
+        }
+    };
+    const { crv, kty, x, y } = options.accountKey.export({ format: "jwk" });
+    if (kty !== "EC" || crv !== "P-256" || x === undefined || y === undefined) {
+        throw new Error("the ACME account key must be a P-256 key");
+    }
+    const publicJwk = { crv, kty, x, y };
+    const thumbprint = base64Url(new Uint8Array(createHash("sha256").update(JSON.stringify(publicJwk)).digest()));
+    const directory = (await jsonOf(await doFetch(options.directoryUrl)));
+    if (directory.newNonce === undefined || directory.newAccount === undefined || directory.newOrder === undefined) {
+        throw new Error(`${options.directoryUrl} is not an ACME directory`);
+    }
+    let nonce = (await doFetch(directory.newNonce, { method: "HEAD" })).headers.get("replay-nonce") ?? "";
+    let kid;
+    const signedPost = async (url, payload) => {
+        const encode = (text) => Buffer.from(text, "utf8").toString("base64url");
+        const header = encode(JSON.stringify({ alg: "ES256", nonce, url, ...(kid === undefined ? { jwk: publicJwk } : { kid }) }));
+        const body = payload === undefined ? "" : encode(JSON.stringify(payload));
+        const signature = sign("sha256", Buffer.from(`${header}.${body}`, "ascii"), { key: options.accountKey, dsaEncoding: "ieee-p1363" });
+        const jws = { protected: header, payload: body, signature: signature.toString("base64url") };
+        const response = await doFetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/jose+json" },
+            body: JSON.stringify(jws),
+        });
+        nonce = response.headers.get("replay-nonce") ?? nonce;
+        if (response.status === 400 && (await response.clone().text()).includes("badNonce")) {
+            return signedPost(url, payload);
+        }
+        return response;
+    };
+    const account = await signedPost(directory.newAccount, { termsOfServiceAgreed: true });
+    if (!account.ok) {
+        throw new Error(`ACME account registration failed: ${await problemOf(account)}`);
+    }
+    kid = account.headers.get("location") ?? undefined;
+    if (kid === undefined) {
+        throw new Error("ACME account registration returned no account URL");
+    }
+    const orderResponse = await signedPost(directory.newOrder, {
+        identifiers: options.hostnames.map((value) => ({ type: "dns", value })),
+    });
+    if (!orderResponse.ok) {
+        throw new Error(`ACME order failed: ${await problemOf(orderResponse)}`);
+    }
+    const orderUrl = orderResponse.headers.get("location") ?? "";
+    const order = await jsonOf(orderResponse);
+    const authorizations = Array.isArray(order["authorizations"]) ? order["authorizations"] : [];
+    const finalizeUrl = typeof order["finalize"] === "string" ? order["finalize"] : undefined;
+    if (finalizeUrl === undefined) {
+        throw new Error("ACME order carried no finalize URL");
+    }
+    const published = [];
+    try {
+        for (const authzUrl of authorizations) {
+            const authz = await jsonOf(await signedPost(authzUrl, undefined));
+            const identifier = authz["identifier"]?.value ?? "";
+            const challenges = Array.isArray(authz["challenges"]) ? authz["challenges"] : [];
+            const dns01 = challenges.find((challenge) => challenge["type"] === "dns-01");
+            if (dns01 === undefined || typeof dns01["token"] !== "string" || typeof dns01["url"] !== "string") {
+                throw new Error(`the CA offered no dns-01 challenge for ${identifier}`);
+            }
+            const keyAuthorization = `${dns01["token"]}.${thumbprint}`;
+            const recordName = `_acme-challenge.${identifier}`;
+            const digest = base64Url(new Uint8Array(createHash("sha256").update(keyAuthorization).digest()));
+            await options.publishChallenge(recordName, digest);
+            published.push(recordName);
+            await awaitOrThrow(async () => (await resolveTxt(recordName)).includes(digest), {
+                wait,
+                now,
+                what: `publication of ${recordName}`,
+                timeoutMs: PUBLICATION_TIMEOUT_MS,
+                intervalMs: PUBLICATION_INTERVAL_MS,
+            });
+            const accepted = await signedPost(dns01["url"], {});
+            if (!accepted.ok) {
+                throw new Error(`the CA refused the dns-01 challenge for ${identifier}: ${await problemOf(accepted)}`);
+            }
+            await awaitOrThrow(async () => {
+                const state = await jsonOf(await signedPost(authzUrl, undefined));
+                if (state["status"] === "invalid") {
+                    const reason = state["challenges"]?.find((c) => c.error)?.error?.detail;
+                    throw new Error(`the CA could not validate ${identifier}${reason === undefined ? "" : `: ${reason}`}`);
+                }
+                return state["status"] === "valid";
+            }, { wait, now, what: `validation of ${identifier}`, timeoutMs: VALIDATION_TIMEOUT_MS, intervalMs: POLL_INTERVAL_MS });
+        }
+        const finalized = await signedPost(finalizeUrl, { csr: base64Url(buildCsr(options.certificateKey, options.hostnames)) });
+        if (!finalized.ok) {
+            throw new Error(`ACME finalize failed: ${await problemOf(finalized)}`);
+        }
+        let certificateUrl = typeof (await jsonOf(finalized.clone()))["certificate"] === "string" ? String((await jsonOf(finalized))["certificate"]) : undefined;
+        if (certificateUrl === undefined) {
+            await awaitOrThrow(async () => {
+                const state = await jsonOf(await signedPost(orderUrl, undefined));
+                if (state["status"] === "invalid") {
+                    throw new Error("the CA marked the order invalid after finalize");
+                }
+                certificateUrl = typeof state["certificate"] === "string" ? state["certificate"] : undefined;
+                return certificateUrl !== undefined;
+            }, { wait, now, what: "certificate issuance", timeoutMs: VALIDATION_TIMEOUT_MS, intervalMs: POLL_INTERVAL_MS });
+        }
+        const download = await signedPost(certificateUrl, undefined);
+        if (!download.ok) {
+            throw new Error(`ACME certificate download failed: ${await problemOf(download)}`);
+        }
+        return { certificate: await download.text() };
+    }
+    finally {
+        for (const recordName of published) {
+            await options.removeChallenge(recordName).catch(() => {
+            });
+        }
+    }
+};
+const awaitOrThrow = async (predicate, context) => {
+    if (!(await pollUntil(predicate, context))) {
+        throw new Error(`timed out waiting for ${context.what}`);
+    }
+};
+//# sourceMappingURL=acme.js.map

package/dist/acme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acme.js","sourceRoot":"","sources":["../src/acme.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAkB,IAAI,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAO/C,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAG/B,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAGtC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAGjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,gDAAgD,CAAC;AA2BvF,MAAM,MAAM,GAAG,KAAK,EAAE,QAAkB,EAAoC,EAAE;IAC1E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,SAAS,GAAG,KAAK,EAAE,QAAkB,EAAmB,EAAE;IAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,OAAO,MAAM,IAAI,IAAI,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,OAAoB,EAAoC,EAAE;IAC9F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAG7C,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAE,IAAkB,EAAqB,EAAE;QAC3E,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBAED,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,OAAO,IAAI,kBAAkB,EAAE,CAAC;oBAChC,MAAM,KAAK,CAAC;gBAChB,CAAC;gBAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC;IAGD,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE9G,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAyB,CAAC;IAC9F,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,YAAY,2BAA2B,CAAC,CAAC;IACxE,CAAC;IAGD,IAAI,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAEtG,IAAI,GAAuB,CAAC;IAI5B,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAE,OAAgB,EAAqB,EAAE;QAC1E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3H,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QACpI,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,uBAAuB,EAAE;YACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SAC5B,CAAC,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;QAEtD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClF,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC,CAAC;IAGF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;IACnD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE;QACvD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,gBAAgB,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3G,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC1D,CAAC;IAGD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YAEpC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAClE,MAAM,UAAU,GAAI,KAAK,CAAC,YAAY,CAAoC,EAAE,KAAK,IAAI,EAAE,CAAC;YACxF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,YAAY,CAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC;YAC7E,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAChG,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,mBAAmB,UAAU,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAEjG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAI3B,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;gBAC5E,IAAI;gBACJ,GAAG;gBACH,IAAI,EAAE,kBAAkB,UAAU,EAAE;gBACpC,SAAS,EAAE,sBAAsB;gBACjC,UAAU,EAAE,uBAAuB;aACtC,CAAC,CAAC;YAGH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,KAAK,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,MAAM,YAAY,CACd,KAAK,IAAI,EAAE;gBACP,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;oBAChC,MAAM,MAAM,GAAI,KAAK,CAAC,YAAY,CAAmD,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC;oBAC3H,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC3G,CAAC;gBACD,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;YACvC,CAAC,EACD,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,UAAU,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACrH,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,cAAc,GACd,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,YAAY,CACd,KAAK,IAAI,EAAE;gBACP,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACtE,CAAC;gBACD,cAAc,GAAG,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7F,OAAO,cAAc,KAAK,SAAS,CAAC;YACxC,CAAC,EACD,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,qBAAqB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAC9G,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAe,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IAClD,CAAC;YAAS,CAAC;QAEP,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;YAEjC,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAErD,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,YAAY,GAAG,KAAK,EACtB,SAAiC,EACjC,OAAwH,EAC3G,EAAE;IACf,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;AACL,CAAC,CAAC"}

package/dist/authoritative-dns.d.ts

@@ -0,0 +1,2 @@
+export declare const resolveTxtAuthoritatively: (recordName: string) => Promise<string[]>;
+//# sourceMappingURL=authoritative-dns.d.ts.map

package/dist/authoritative-dns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoritative-dns.d.ts","sourceRoot":"","sources":["../src/authoritative-dns.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,yBAAyB,eAAsB,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAoBpF,CAAC"}

package/dist/authoritative-dns.js

@@ -0,0 +1,37 @@
+import { Resolver } from "node:dns/promises";
+const QUERY_TIMEOUT_MS = 3_000;
+const resolverFor = (servers) => {
+    const resolver = new Resolver({ timeout: QUERY_TIMEOUT_MS, tries: 1 });
+    if (servers !== undefined) {
+        resolver.setServers([...servers]);
+    }
+    return resolver;
+};
+const nameserversFor = async (recordName) => {
+    const resolver = resolverFor();
+    const labels = recordName.split(".");
+    for (let index = 0; index < labels.length - 1; index += 1) {
+        const nameservers = await resolver.resolveNs(labels.slice(index).join(".")).catch(() => []);
+        if (nameservers.length > 0) {
+            return nameservers;
+        }
+    }
+    return [];
+};
+export const resolveTxtAuthoritatively = async (recordName) => {
+    const nameservers = await nameserversFor(recordName);
+    const perNameserver = await Promise.all(nameservers.map(async (nameserver) => {
+        const addresses = await resolverFor()
+            .resolve4(nameserver)
+            .catch(() => []);
+        if (addresses.length === 0) {
+            return [];
+        }
+        const records = await resolverFor(addresses)
+            .resolveTxt(recordName)
+            .catch(() => []);
+        return records.map((chunks) => chunks.join(""));
+    }));
+    return perNameserver.reduce((shared, values) => shared.filter((value) => values.includes(value)), perNameserver[0] ?? []);
+};
+//# sourceMappingURL=authoritative-dns.js.map

package/dist/authoritative-dns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoritative-dns.js","sourceRoot":"","sources":["../src/authoritative-dns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAM7C,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,WAAW,GAAG,CAAC,OAA2B,EAAY,EAAE;IAC1D,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAC;AAIF,MAAM,cAAc,GAAG,KAAK,EAAE,UAAkB,EAAqB,EAAE;IACnE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAErC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAGxD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC;QACvB,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,UAAkB,EAAqB,EAAE;IACrF,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,MAAM,WAAW,EAAE;aAChC,QAAQ,CAAC,UAAU,CAAC;aAEpB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC;aACvC,UAAU,CAAC,UAAU,CAAC;aAEtB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAErB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CACL,CAAC;IACF,OAAO,aAAa,CAAC,MAAM,CAAW,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACxI,CAAC,CAAC"}

package/dist/csr.d.ts

@@ -0,0 +1,4 @@
+import { type KeyObject } from "node:crypto";
+export declare const buildCsr: (privateKey: KeyObject, hostnames: readonly string[]) => Uint8Array;
+export declare const base64Url: (bytes: Uint8Array) => string;
+//# sourceMappingURL=csr.d.ts.map

package/dist/csr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csr.d.ts","sourceRoot":"","sources":["../src/csr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,SAAS,EAAQ,MAAM,aAAa,CAAC;AA2DpE,eAAO,MAAM,QAAQ,eAAgB,SAAS,aAAa,SAAS,MAAM,EAAE,KAAG,UAiB9E,CAAC;AAGF,eAAO,MAAM,SAAS,UAAW,UAAU,KAAG,MAAkD,CAAC"}

package/dist/csr.js

@@ -0,0 +1,48 @@
+import { createPublicKey, sign } from "node:crypto";
+const concat = (...parts) => {
+    const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+};
+const lengthBytes = (size) => {
+    if (size < 0x80) {
+        return Uint8Array.from([size]);
+    }
+    const bytes = [];
+    for (let remaining = size; remaining > 0; remaining = Math.floor(remaining / 256)) {
+        bytes.unshift(remaining % 256);
+    }
+    return Uint8Array.from([0x80 | bytes.length, ...bytes]);
+};
+const der = (tag, content) => concat(Uint8Array.from([tag]), lengthBytes(content.length), content);
+const SEQUENCE = 0x30;
+const SET = 0x31;
+const OCTET_STRING = 0x04;
+const BIT_STRING = 0x03;
+const CONTEXT_0 = 0xa0;
+const DNS_NAME = 0x82;
+const VERSION_0 = Uint8Array.from([0x02, 0x01, 0x00]);
+const OID_EXTENSION_REQUEST = Uint8Array.from([0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x0e]);
+const OID_SUBJECT_ALT_NAME = Uint8Array.from([0x06, 0x03, 0x55, 0x1d, 0x11]);
+const OID_ECDSA_WITH_SHA256 = Uint8Array.from([0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02]);
+const sanAttributes = (hostnames) => {
+    const generalNames = der(SEQUENCE, concat(...hostnames.map((host) => der(DNS_NAME, new TextEncoder().encode(host)))));
+    const extension = der(SEQUENCE, concat(OID_SUBJECT_ALT_NAME, der(OCTET_STRING, generalNames)));
+    const attribute = der(SEQUENCE, concat(OID_EXTENSION_REQUEST, der(SET, der(SEQUENCE, extension))));
+    return der(CONTEXT_0, attribute);
+};
+export const buildCsr = (privateKey, hostnames) => {
+    if (hostnames.length === 0) {
+        throw new Error("a certificate request needs at least one hostname");
+    }
+    const spki = new Uint8Array(createPublicKey(privateKey).export({ type: "spki", format: "der" }));
+    const requestInfo = der(SEQUENCE, concat(VERSION_0, der(SEQUENCE, new Uint8Array()), spki, sanAttributes(hostnames)));
+    const signature = new Uint8Array(sign("sha256", requestInfo, privateKey));
+    return der(SEQUENCE, concat(requestInfo, der(SEQUENCE, OID_ECDSA_WITH_SHA256), der(BIT_STRING, concat(Uint8Array.from([0x00]), signature))));
+};
+export const base64Url = (bytes) => Buffer.from(bytes).toString("base64url");
+//# sourceMappingURL=csr.js.map

package/dist/csr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csr.js","sourceRoot":"","sources":["../src/csr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,IAAI,EAAE,MAAM,aAAa,CAAC;AAQpE,MAAM,MAAM,GAAG,CAAC,GAAG,KAA4B,EAAc,EAAE;IAC3D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAc,EAAE;IAC7C,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,SAAS,GAAG,IAAI,EAAE,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,OAAmB,EAAc,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnI,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,GAAG,GAAG,IAAI,CAAC;AACjB,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC;AAGtB,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAGtD,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAClH,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7E,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAI5G,MAAM,aAAa,GAAG,CAAC,SAA4B,EAAc,EAAE;IAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,OAAO,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,UAAqB,EAAE,SAA4B,EAAc,EAAE;IACxF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEjG,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtH,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CACN,QAAQ,EACR,MAAM,CACF,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAEpC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAC9D,CACJ,CAAC;AACN,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC"}

package/dist/errors.d.ts

@@ -1,2 +1,5 @@
 export declare const errorMessage: (error: unknown) => string;
+export declare const errnoCode: (error: unknown) => string | undefined;
+export declare const isMissing: (error: unknown) => boolean;
+export declare const undefinedIfMissing: (error: unknown) => undefined;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAkE,CAAC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAkE,CAAC;AAGjH,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,MAAM,GAAG,SAGnD,CAAC;AAGF,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,OAG1C,CAAC;AAGF,eAAO,MAAM,kBAAkB,UAAW,OAAO,KAAG,SAKnD,CAAC"}

package/dist/errors.js

@@ -1,2 +1,16 @@
 export const errorMessage = (error) => (error instanceof Error ? error.message : String(error));
+export const errnoCode = (error) => {
+    const code = typeof error === `object` && error !== null ? error.code : undefined;
+    return typeof code === `string` ? code : undefined;
+};
+export const isMissing = (error) => {
+    const code = errnoCode(error);
+    return code === `ENOENT` || code === `ENOTDIR`;
+};
+export const undefinedIfMissing = (error) => {
+    if (isMissing(error)) {
+        return undefined;
+    }
+    throw error;
+};
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAGjH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAsB,EAAE;IAC5D,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAW,EAAE;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC;AACnD,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAa,EAAE;IAC5D,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,CAAC;AAChB,CAAC,CAAC"}

package/dist/fuzzy.d.ts

@@ -1,6 +1,8 @@
 export declare const fuzzyScore: (needle: string, path: string) => number | undefined;
-export declare const rankByFuzzy: (needle: string, paths: Iterable<string>) => {
+export type Ranked = {
     readonly path: string;
     readonly score: number;
 }[];
+export declare const rankByFuzzy: (needle: string, paths: Iterable<string>) => Ranked;
+export declare const fuzzyRanker: () => ((needle: string, paths: readonly string[]) => Ranked);
 //# sourceMappingURL=fuzzy.d.ts.map

package/dist/fuzzy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fuzzy.d.ts","sourceRoot":"","sources":["../src/fuzzy.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,UAAU,WAAY,MAAM,QAAQ,MAAM,KAAG,MAAM,GAAG,SAalE,CAAC;AAMF,eAAO,MAAM,WAAW,WAAY,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,KAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAStH,CAAC"}
+{"version":3,"file":"fuzzy.d.ts","sourceRoot":"","sources":["../src/fuzzy.ts"],"names":[],"mappings":"AAkCA,eAAO,MAAM,UAAU,WAAY,MAAM,QAAQ,MAAM,KAAG,MAAM,GAAG,SAalE,CAAC;AAGF,MAAM,MAAM,MAAM,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC;AAMzE,eAAO,MAAM,WAAW,WAAY,MAAM,SAAS,QAAQ,CAAC,MAAM,CAAC,KAAG,MASrE,CAAC;AAMF,eAAO,MAAM,WAAW,QAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAWnF,CAAC"}

package/dist/fuzzy.js

@@ -40,4 +40,15 @@ export const rankByFuzzy = (needle, paths) => {
     }
     return scored.toSorted((a, b) => b.score - a.score || (a.path < b.path ? -1 : 1));
 };
+export const fuzzyRanker = () => {
+    let last;
+    return (needle, paths) => {
+        const narrowed = last !== undefined && last.paths === paths && last.needle !== "" && needle.toLowerCase().startsWith(last.needle.toLowerCase())
+            ? last.ranked.map((entry) => entry.path)
+            : paths;
+        const ranked = rankByFuzzy(needle, narrowed);
+        last = { paths, needle, ranked };
+        return ranked;
+    };
+};
 //# sourceMappingURL=fuzzy.js.map

package/dist/fuzzy.js.map

@@ -1 +1 @@
-{"version":3,"file":"fuzzy.js","sourceRoot":"","sources":["../src/fuzzy.ts"],"names":[],"mappings":"AAIA,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAG/C,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,EAAU,EAAU,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;AAI9I,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAY,EAAsB,EAAE;IAC5F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAE,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAE,IAAI,GAAG,CAAC,CAAC;QAChJ,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,WAAW,GAAG,KAAK,CAAC;QACpB,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,IAAY,EAAsB,EAAE;IAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACZ,OAAO,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAEzC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAChI,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,KAAuB,EAAuD,EAAE;IACxH,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC,CAAC"}
+{"version":3,"file":"fuzzy.js","sourceRoot":"","sources":["../src/fuzzy.ts"],"names":[],"mappings":"AAIA,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAG/C,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,EAAU,EAAU,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;AAI9I,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,IAAY,EAAsB,EAAE;IAC5F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAE,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,QAAQ,GACV,KAAK,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAE,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAE,IAAI,GAAG,CAAC,CAAC;QACnI,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,WAAW,GAAG,KAAK,CAAC;QACpB,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,IAAY,EAAsB,EAAE;IAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACZ,OAAO,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAEzC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAChI,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,KAAuB,EAAU,EAAE;IAC3E,MAAM,MAAM,GAAsC,EAAE,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,WAAW,GAAG,GAA2D,EAAE;IACpF,IAAI,IAAyG,CAAC;IAC9G,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,QAAQ,GACV,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC1H,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC;QAChB,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC;IAClB,CAAC,CAAC;AACN,CAAC,CAAC"}

package/dist/sqlite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../src/sqlite.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;AACvE,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAE9C,MAAM,WAAW,QAAQ;IACrB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC;IAClD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,GAAG,SAAS,CAAC;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACjD,WAAW,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,CAAC;CACjB;AAMD,eAAO,MAAM,MAAM,OAAQ,YAAY,KAAG,QAiBxC,CAAC;AAMH,eAAO,MAAM,kBAAkB,OAAQ,QAAQ,WAAW,MAAM,SAAS,MAAM,KAAG,IAUjF,CAAC"}
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../src/sqlite.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;AACvE,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAE9C,MAAM,WAAW,QAAQ;IACrB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC;IAClD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,GAAG,SAAS,CAAC;IAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;IACjD,WAAW,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAClC,KAAK,IAAI,IAAI,CAAC;CACjB;AAMD,eAAO,MAAM,MAAM,OAAQ,YAAY,KAAG,QAoBxC,CAAC;AAMH,eAAO,MAAM,kBAAkB,OAAQ,QAAQ,WAAW,MAAM,SAAS,MAAM,KAAG,IAUjF,CAAC"}

package/dist/sqlite.js

@@ -11,7 +11,9 @@ export const wrapDb = (db) => ({
             db.exec("COMMIT");
         }
         catch (error) {
-            db.exec("ROLLBACK");
+            if (db.isTransaction) {
+                db.exec("ROLLBACK");
+            }
             throw error;
         }
     },

package/dist/sqlite.js.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../src/sqlite.ts"],"names":[],"mappings":"AAmBA,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,EAAgB,EAAY,EAAE,CAAC,CAAC;IACnD,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAU;IAChE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAoB;IAC1E,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE;QACpB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE;QAChB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACD,EAAE,EAAE,CAAC;YACL,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IACD,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EAAY,EAAE,OAAe,EAAE,KAAa,EAAQ,EAAE;IACrF,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,qDAAqD,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACvF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,EAAE,CAAC,GAAG,CAAC,4DAA4D,EAAE,OAAO,CAAC,CAAC;QAC9E,OAAO;IACX,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACpB,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,MAAM,CAAC,KAAK,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../src/sqlite.ts"],"names":[],"mappings":"AAmBA,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,EAAgB,EAAY,EAAE,CAAC,CAAC;IACnD,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAU;IAChE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAoB;IAC1E,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE;QACpB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE;QAChB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjB,IAAI,CAAC;YACD,EAAE,EAAE,CAAC;YACL,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEb,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC;gBACnB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,CAAC;YACD,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IACD,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EAAY,EAAE,OAAe,EAAE,KAAa,EAAQ,EAAE;IACrF,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,qDAAqD,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACvF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,EAAE,CAAC,GAAG,CAAC,4DAA4D,EAAE,OAAO,CAAC,CAAC;QAC9E,OAAO;IACX,CAAC;IACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACpB,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,MAAM,CAAC,KAAK,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;AACL,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/base",
-  "version": "1.310.0",
+  "version": "1.312.0",
   "description": "Runtime primitives every tier shares, when-expressions, disposal, and the async schedulers",
   "license": "MIT",
   "type": "module",
@@ -50,6 +50,17 @@
         "default": "./dist/outside-text.js"
       }
     },
+    "./acme": {
+      "types": "./dist/acme.d.ts",
+      "import": {
+        "@intentic/src": "./src/acme.ts",
+        "default": "./dist/acme.js"
+      },
+      "require": {
+        "@intentic/src": "./src/acme.ts",
+        "default": "./dist/acme.js"
+      }
+    },
     "./async": {
       "types": "./dist/async.d.ts",
       "import": {
@@ -123,10 +134,10 @@
   "devDependencies": {
     "@intentic/testing": "0.0.0",
     "@intentic/tsconfig": "0.0.0",
-    "@types/bun": "1.4.0",
-    "@types/node": "24.13.2",
+    "@types/bun": "1.4.2",
+    "@types/node": "24.13.6",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
-    "fast-check": "4.9.0"
+    "fast-check": "4.10.2"
   },
   "scripts": {
     "build": "tsgo",