@intentic/base 1.311.0 → 1.312.0

package/dist/acme.d.ts

@@ -0,0 +1,18 @@
+import { type KeyObject } from "node:crypto";
+export declare const LETS_ENCRYPT_DIRECTORY = "https://acme-v02.api.letsencrypt.org/directory";
+export interface AcmeOptions {
+    readonly directoryUrl: string;
+    readonly accountKey: KeyObject;
+    readonly certificateKey: KeyObject;
+    readonly hostnames: readonly string[];
+    readonly publishChallenge: (recordName: string, value: string) => Promise<void>;
+    readonly removeChallenge: (recordName: string) => Promise<void>;
+    readonly resolveTxt?: (recordName: string) => Promise<string[]>;
+    readonly fetchImpl?: typeof fetch;
+    readonly wait?: (ms: number) => Promise<void>;
+    readonly now?: () => number;
+}
+export declare const obtainCertificate: (options: AcmeOptions) => Promise<{
+    certificate: string;
+}>;
+//# sourceMappingURL=acme.d.ts.map

package/dist/acme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acme.d.ts","sourceRoot":"","sources":["../src/acme.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,SAAS,EAAQ,MAAM,aAAa,CAAC;AAuB/D,eAAO,MAAM,sBAAsB,mDAAmD,CAAC;AAQvF,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAE/B,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAEtC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChF,QAAQ,CAAC,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAwBD,eAAO,MAAM,iBAAiB,YAAmB,WAAW,KAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAyK7F,CAAC"}

package/dist/acme.js

@@ -0,0 +1,167 @@
+import { createHash, sign } from "node:crypto";
+import { setTimeout as sleep } from "node:timers/promises";
+import { pollUntil } from "./async.js";
+import { resolveTxtAuthoritatively } from "./authoritative-dns.js";
+import { base64Url, buildCsr } from "./csr.js";
+const VALIDATION_TIMEOUT_MS = 120_000;
+const POLL_INTERVAL_MS = 3_000;
+const PUBLICATION_TIMEOUT_MS = 90_000;
+const PUBLICATION_INTERVAL_MS = 2_000;
+const TRANSPORT_ATTEMPTS = 3;
+const TRANSPORT_RETRY_MS = 2_000;
+export const LETS_ENCRYPT_DIRECTORY = "https://acme-v02.api.letsencrypt.org/directory";
+const jsonOf = async (response) => {
+    const text = await response.text();
+    if (text === "") {
+        return {};
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return {};
+    }
+};
+const problemOf = async (response) => {
+    const body = await jsonOf(response);
+    const detail = typeof body["detail"] === "string" ? body["detail"] : undefined;
+    const type = typeof body["type"] === "string" ? body["type"] : undefined;
+    return detail ?? type ?? `HTTP ${response.status}`;
+};
+export const obtainCertificate = async (options) => {
+    const resolveTxt = options.resolveTxt ?? resolveTxtAuthoritatively;
+    const wait = options.wait ?? ((ms) => sleep(ms));
+    const now = options.now ?? (() => Date.now());
+    const transport = options.fetchImpl ?? fetch;
+    const doFetch = async (input, init) => {
+        for (let attempt = 1;; attempt += 1) {
+            try {
+                return await transport(input, init);
+            }
+            catch (error) {
+                if (attempt >= TRANSPORT_ATTEMPTS) {
+                    throw error;
+                }
+                await wait(TRANSPORT_RETRY_MS);
+            }
+        }
+    };
+    const { crv, kty, x, y } = options.accountKey.export({ format: "jwk" });
+    if (kty !== "EC" || crv !== "P-256" || x === undefined || y === undefined) {
+        throw new Error("the ACME account key must be a P-256 key");
+    }
+    const publicJwk = { crv, kty, x, y };
+    const thumbprint = base64Url(new Uint8Array(createHash("sha256").update(JSON.stringify(publicJwk)).digest()));
+    const directory = (await jsonOf(await doFetch(options.directoryUrl)));
+    if (directory.newNonce === undefined || directory.newAccount === undefined || directory.newOrder === undefined) {
+        throw new Error(`${options.directoryUrl} is not an ACME directory`);
+    }
+    let nonce = (await doFetch(directory.newNonce, { method: "HEAD" })).headers.get("replay-nonce") ?? "";
+    let kid;
+    const signedPost = async (url, payload) => {
+        const encode = (text) => Buffer.from(text, "utf8").toString("base64url");
+        const header = encode(JSON.stringify({ alg: "ES256", nonce, url, ...(kid === undefined ? { jwk: publicJwk } : { kid }) }));
+        const body = payload === undefined ? "" : encode(JSON.stringify(payload));
+        const signature = sign("sha256", Buffer.from(`${header}.${body}`, "ascii"), { key: options.accountKey, dsaEncoding: "ieee-p1363" });
+        const jws = { protected: header, payload: body, signature: signature.toString("base64url") };
+        const response = await doFetch(url, {
+            method: "POST",
+            headers: { "content-type": "application/jose+json" },
+            body: JSON.stringify(jws),
+        });
+        nonce = response.headers.get("replay-nonce") ?? nonce;
+        if (response.status === 400 && (await response.clone().text()).includes("badNonce")) {
+            return signedPost(url, payload);
+        }
+        return response;
+    };
+    const account = await signedPost(directory.newAccount, { termsOfServiceAgreed: true });
+    if (!account.ok) {
+        throw new Error(`ACME account registration failed: ${await problemOf(account)}`);
+    }
+    kid = account.headers.get("location") ?? undefined;
+    if (kid === undefined) {
+        throw new Error("ACME account registration returned no account URL");
+    }
+    const orderResponse = await signedPost(directory.newOrder, {
+        identifiers: options.hostnames.map((value) => ({ type: "dns", value })),
+    });
+    if (!orderResponse.ok) {
+        throw new Error(`ACME order failed: ${await problemOf(orderResponse)}`);
+    }
+    const orderUrl = orderResponse.headers.get("location") ?? "";
+    const order = await jsonOf(orderResponse);
+    const authorizations = Array.isArray(order["authorizations"]) ? order["authorizations"] : [];
+    const finalizeUrl = typeof order["finalize"] === "string" ? order["finalize"] : undefined;
+    if (finalizeUrl === undefined) {
+        throw new Error("ACME order carried no finalize URL");
+    }
+    const published = [];
+    try {
+        for (const authzUrl of authorizations) {
+            const authz = await jsonOf(await signedPost(authzUrl, undefined));
+            const identifier = authz["identifier"]?.value ?? "";
+            const challenges = Array.isArray(authz["challenges"]) ? authz["challenges"] : [];
+            const dns01 = challenges.find((challenge) => challenge["type"] === "dns-01");
+            if (dns01 === undefined || typeof dns01["token"] !== "string" || typeof dns01["url"] !== "string") {
+                throw new Error(`the CA offered no dns-01 challenge for ${identifier}`);
+            }
+            const keyAuthorization = `${dns01["token"]}.${thumbprint}`;
+            const recordName = `_acme-challenge.${identifier}`;
+            const digest = base64Url(new Uint8Array(createHash("sha256").update(keyAuthorization).digest()));
+            await options.publishChallenge(recordName, digest);
+            published.push(recordName);
+            await awaitOrThrow(async () => (await resolveTxt(recordName)).includes(digest), {
+                wait,
+                now,
+                what: `publication of ${recordName}`,
+                timeoutMs: PUBLICATION_TIMEOUT_MS,
+                intervalMs: PUBLICATION_INTERVAL_MS,
+            });
+            const accepted = await signedPost(dns01["url"], {});
+            if (!accepted.ok) {
+                throw new Error(`the CA refused the dns-01 challenge for ${identifier}: ${await problemOf(accepted)}`);
+            }
+            await awaitOrThrow(async () => {
+                const state = await jsonOf(await signedPost(authzUrl, undefined));
+                if (state["status"] === "invalid") {
+                    const reason = state["challenges"]?.find((c) => c.error)?.error?.detail;
+                    throw new Error(`the CA could not validate ${identifier}${reason === undefined ? "" : `: ${reason}`}`);
+                }
+                return state["status"] === "valid";
+            }, { wait, now, what: `validation of ${identifier}`, timeoutMs: VALIDATION_TIMEOUT_MS, intervalMs: POLL_INTERVAL_MS });
+        }
+        const finalized = await signedPost(finalizeUrl, { csr: base64Url(buildCsr(options.certificateKey, options.hostnames)) });
+        if (!finalized.ok) {
+            throw new Error(`ACME finalize failed: ${await problemOf(finalized)}`);
+        }
+        let certificateUrl = typeof (await jsonOf(finalized.clone()))["certificate"] === "string" ? String((await jsonOf(finalized))["certificate"]) : undefined;
+        if (certificateUrl === undefined) {
+            await awaitOrThrow(async () => {
+                const state = await jsonOf(await signedPost(orderUrl, undefined));
+                if (state["status"] === "invalid") {
+                    throw new Error("the CA marked the order invalid after finalize");
+                }
+                certificateUrl = typeof state["certificate"] === "string" ? state["certificate"] : undefined;
+                return certificateUrl !== undefined;
+            }, { wait, now, what: "certificate issuance", timeoutMs: VALIDATION_TIMEOUT_MS, intervalMs: POLL_INTERVAL_MS });
+        }
+        const download = await signedPost(certificateUrl, undefined);
+        if (!download.ok) {
+            throw new Error(`ACME certificate download failed: ${await problemOf(download)}`);
+        }
+        return { certificate: await download.text() };
+    }
+    finally {
+        for (const recordName of published) {
+            await options.removeChallenge(recordName).catch(() => {
+            });
+        }
+    }
+};
+const awaitOrThrow = async (predicate, context) => {
+    if (!(await pollUntil(predicate, context))) {
+        throw new Error(`timed out waiting for ${context.what}`);
+    }
+};
+//# sourceMappingURL=acme.js.map

package/dist/acme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acme.js","sourceRoot":"","sources":["../src/acme.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAkB,IAAI,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAO/C,MAAM,qBAAqB,GAAG,OAAO,CAAC;AACtC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAG/B,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AAGtC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAGjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,gDAAgD,CAAC;AA2BvF,MAAM,MAAM,GAAG,KAAK,EAAE,QAAkB,EAAoC,EAAE;IAC1E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,SAAS,GAAG,KAAK,EAAE,QAAkB,EAAmB,EAAE;IAC5D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,OAAO,MAAM,IAAI,IAAI,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,OAAoB,EAAoC,EAAE;IAC9F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;IACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAG7C,MAAM,OAAO,GAAG,KAAK,EAAE,KAAa,EAAE,IAAkB,EAAqB,EAAE;QAC3E,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC;gBAED,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,OAAO,IAAI,kBAAkB,EAAE,CAAC;oBAChC,MAAM,KAAK,CAAC;gBAChB,CAAC;gBAED,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChE,CAAC;IAGD,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE9G,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAyB,CAAC;IAC9F,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,YAAY,2BAA2B,CAAC,CAAC;IACxE,CAAC;IAGD,IAAI,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAEtG,IAAI,GAAuB,CAAC;IAI5B,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAE,OAAgB,EAAqB,EAAE;QAC1E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3H,MAAM,IAAI,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;QACpI,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,uBAAuB,EAAE;YACpD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SAC5B,CAAC,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC;QAEtD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClF,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,QAAQ,CAAC;IACpB,CAAC,CAAC;IAGF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;IACnD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE;QACvD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;KAC1E,CAAC,CAAC;IACH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,gBAAgB,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3G,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC1D,CAAC;IAGD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YAEpC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAClE,MAAM,UAAU,GAAI,KAAK,CAAC,YAAY,CAAoC,EAAE,KAAK,IAAI,EAAE,CAAC;YACxF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAE,KAAK,CAAC,YAAY,CAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC;YAC7E,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAChG,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,EAAE,CAAC,CAAC;YAC5E,CAAC;YAED,MAAM,gBAAgB,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3D,MAAM,UAAU,GAAG,mBAAmB,UAAU,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAEjG,MAAM,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACnD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAI3B,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;gBAC5E,IAAI;gBACJ,GAAG;gBACH,IAAI,EAAE,kBAAkB,UAAU,EAAE;gBACpC,SAAS,EAAE,sBAAsB;gBACjC,UAAU,EAAE,uBAAuB;aACtC,CAAC,CAAC;YAGH,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,KAAK,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3G,CAAC;YAED,MAAM,YAAY,CACd,KAAK,IAAI,EAAE;gBACP,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;oBAChC,MAAM,MAAM,GAAI,KAAK,CAAC,YAAY,CAAmD,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC;oBAC3H,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC3G,CAAC;gBACD,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;YACvC,CAAC,EACD,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,UAAU,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CACrH,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,cAAc,GACd,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxI,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,YAAY,CACd,KAAK,IAAI,EAAE;gBACP,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACtE,CAAC;gBACD,cAAc,GAAG,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC7F,OAAO,cAAc,KAAK,SAAS,CAAC;YACxC,CAAC,EACD,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,qBAAqB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAC9G,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,cAAe,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IAClD,CAAC;YAAS,CAAC;QAEP,KAAK,MAAM,UAAU,IAAI,SAAS,EAAE,CAAC;YAEjC,MAAM,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAErD,CAAC,CAAC,CAAC;QACP,CAAC;IACL,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,YAAY,GAAG,KAAK,EACtB,SAAiC,EACjC,OAAwH,EAC3G,EAAE;IACf,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;AACL,CAAC,CAAC"}

package/dist/authoritative-dns.d.ts

@@ -0,0 +1,2 @@
+export declare const resolveTxtAuthoritatively: (recordName: string) => Promise<string[]>;
+//# sourceMappingURL=authoritative-dns.d.ts.map

package/dist/authoritative-dns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoritative-dns.d.ts","sourceRoot":"","sources":["../src/authoritative-dns.ts"],"names":[],"mappings":"AAmCA,eAAO,MAAM,yBAAyB,eAAsB,MAAM,KAAG,OAAO,CAAC,MAAM,EAAE,CAoBpF,CAAC"}

package/dist/authoritative-dns.js

@@ -0,0 +1,37 @@
+import { Resolver } from "node:dns/promises";
+const QUERY_TIMEOUT_MS = 3_000;
+const resolverFor = (servers) => {
+    const resolver = new Resolver({ timeout: QUERY_TIMEOUT_MS, tries: 1 });
+    if (servers !== undefined) {
+        resolver.setServers([...servers]);
+    }
+    return resolver;
+};
+const nameserversFor = async (recordName) => {
+    const resolver = resolverFor();
+    const labels = recordName.split(".");
+    for (let index = 0; index < labels.length - 1; index += 1) {
+        const nameservers = await resolver.resolveNs(labels.slice(index).join(".")).catch(() => []);
+        if (nameservers.length > 0) {
+            return nameservers;
+        }
+    }
+    return [];
+};
+export const resolveTxtAuthoritatively = async (recordName) => {
+    const nameservers = await nameserversFor(recordName);
+    const perNameserver = await Promise.all(nameservers.map(async (nameserver) => {
+        const addresses = await resolverFor()
+            .resolve4(nameserver)
+            .catch(() => []);
+        if (addresses.length === 0) {
+            return [];
+        }
+        const records = await resolverFor(addresses)
+            .resolveTxt(recordName)
+            .catch(() => []);
+        return records.map((chunks) => chunks.join(""));
+    }));
+    return perNameserver.reduce((shared, values) => shared.filter((value) => values.includes(value)), perNameserver[0] ?? []);
+};
+//# sourceMappingURL=authoritative-dns.js.map

package/dist/authoritative-dns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoritative-dns.js","sourceRoot":"","sources":["../src/authoritative-dns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAM7C,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,MAAM,WAAW,GAAG,CAAC,OAA2B,EAAY,EAAE;IAC1D,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAC;AAIF,MAAM,cAAc,GAAG,KAAK,EAAE,UAAkB,EAAqB,EAAE;IACnE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAErC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAGxD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5F,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC;QACvB,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,EAAE,UAAkB,EAAqB,EAAE;IACrF,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,MAAM,WAAW,EAAE;aAChC,QAAQ,CAAC,UAAU,CAAC;aAEpB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC;aACvC,UAAU,CAAC,UAAU,CAAC;aAEtB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAErB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CACL,CAAC;IACF,OAAO,aAAa,CAAC,MAAM,CAAW,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACxI,CAAC,CAAC"}

package/dist/csr.d.ts

@@ -0,0 +1,4 @@
+import { type KeyObject } from "node:crypto";
+export declare const buildCsr: (privateKey: KeyObject, hostnames: readonly string[]) => Uint8Array;
+export declare const base64Url: (bytes: Uint8Array) => string;
+//# sourceMappingURL=csr.d.ts.map

package/dist/csr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csr.d.ts","sourceRoot":"","sources":["../src/csr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,SAAS,EAAQ,MAAM,aAAa,CAAC;AA2DpE,eAAO,MAAM,QAAQ,eAAgB,SAAS,aAAa,SAAS,MAAM,EAAE,KAAG,UAiB9E,CAAC;AAGF,eAAO,MAAM,SAAS,UAAW,UAAU,KAAG,MAAkD,CAAC"}

package/dist/csr.js

@@ -0,0 +1,48 @@
+import { createPublicKey, sign } from "node:crypto";
+const concat = (...parts) => {
+    const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+};
+const lengthBytes = (size) => {
+    if (size < 0x80) {
+        return Uint8Array.from([size]);
+    }
+    const bytes = [];
+    for (let remaining = size; remaining > 0; remaining = Math.floor(remaining / 256)) {
+        bytes.unshift(remaining % 256);
+    }
+    return Uint8Array.from([0x80 | bytes.length, ...bytes]);
+};
+const der = (tag, content) => concat(Uint8Array.from([tag]), lengthBytes(content.length), content);
+const SEQUENCE = 0x30;
+const SET = 0x31;
+const OCTET_STRING = 0x04;
+const BIT_STRING = 0x03;
+const CONTEXT_0 = 0xa0;
+const DNS_NAME = 0x82;
+const VERSION_0 = Uint8Array.from([0x02, 0x01, 0x00]);
+const OID_EXTENSION_REQUEST = Uint8Array.from([0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x0e]);
+const OID_SUBJECT_ALT_NAME = Uint8Array.from([0x06, 0x03, 0x55, 0x1d, 0x11]);
+const OID_ECDSA_WITH_SHA256 = Uint8Array.from([0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02]);
+const sanAttributes = (hostnames) => {
+    const generalNames = der(SEQUENCE, concat(...hostnames.map((host) => der(DNS_NAME, new TextEncoder().encode(host)))));
+    const extension = der(SEQUENCE, concat(OID_SUBJECT_ALT_NAME, der(OCTET_STRING, generalNames)));
+    const attribute = der(SEQUENCE, concat(OID_EXTENSION_REQUEST, der(SET, der(SEQUENCE, extension))));
+    return der(CONTEXT_0, attribute);
+};
+export const buildCsr = (privateKey, hostnames) => {
+    if (hostnames.length === 0) {
+        throw new Error("a certificate request needs at least one hostname");
+    }
+    const spki = new Uint8Array(createPublicKey(privateKey).export({ type: "spki", format: "der" }));
+    const requestInfo = der(SEQUENCE, concat(VERSION_0, der(SEQUENCE, new Uint8Array()), spki, sanAttributes(hostnames)));
+    const signature = new Uint8Array(sign("sha256", requestInfo, privateKey));
+    return der(SEQUENCE, concat(requestInfo, der(SEQUENCE, OID_ECDSA_WITH_SHA256), der(BIT_STRING, concat(Uint8Array.from([0x00]), signature))));
+};
+export const base64Url = (bytes) => Buffer.from(bytes).toString("base64url");
+//# sourceMappingURL=csr.js.map

package/dist/csr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csr.js","sourceRoot":"","sources":["../src/csr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,IAAI,EAAE,MAAM,aAAa,CAAC;AAQpE,MAAM,MAAM,GAAG,CAAC,GAAG,KAA4B,EAAc,EAAE;IAC3D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAc,EAAE;IAC7C,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QACd,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,SAAS,GAAG,IAAI,EAAE,SAAS,GAAG,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AAC5D,CAAC,CAAC;AAEF,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,OAAmB,EAAc,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AAEnI,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,GAAG,GAAG,IAAI,CAAC;AACjB,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC;AAGtB,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAGtD,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAClH,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7E,MAAM,qBAAqB,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAI5G,MAAM,aAAa,GAAG,CAAC,SAA4B,EAAc,EAAE;IAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,OAAO,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,UAAqB,EAAE,SAA4B,EAAc,EAAE;IACxF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEjG,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtH,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CACN,QAAQ,EACR,MAAM,CACF,WAAW,EACX,GAAG,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAEpC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAC9D,CACJ,CAAC;AACN,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/base",
-  "version": "1.311.0",
+  "version": "1.312.0",
   "description": "Runtime primitives every tier shares, when-expressions, disposal, and the async schedulers",
   "license": "MIT",
   "type": "module",
@@ -50,6 +50,17 @@
         "default": "./dist/outside-text.js"
       }
     },
+    "./acme": {
+      "types": "./dist/acme.d.ts",
+      "import": {
+        "@intentic/src": "./src/acme.ts",
+        "default": "./dist/acme.js"
+      },
+      "require": {
+        "@intentic/src": "./src/acme.ts",
+        "default": "./dist/acme.js"
+      }
+    },
     "./async": {
       "types": "./dist/async.d.ts",
       "import": {
@@ -123,10 +134,10 @@
   "devDependencies": {
     "@intentic/testing": "0.0.0",
     "@intentic/tsconfig": "0.0.0",
-    "@types/bun": "1.4.0",
-    "@types/node": "24.13.2",
+    "@types/bun": "1.4.2",
+    "@types/node": "24.13.6",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
-    "fast-check": "4.9.0"
+    "fast-check": "4.10.2"
   },
   "scripts": {
     "build": "tsgo",